- Devel - libvirt List Archives

[PATCH v2 0/2] Introduce hardware UUID (hwuuid) element
by Mark Cave-Ayland 04 Aug '25

04 Aug '25

Following on from the discussions at [1] and more recently [2], this series introduces a new hardware UUID (hwuuid) element that allows an external UUID to be provided to the guest, as opposed to the libvirt domain UUID. The use case for this feature is to allow a domain to cloned and then restarted without changing its guest-visible UUID e.g. via dmidecode. Patch 1 introduces the new hardware UUID (hwuuid) element along with an implementation for the QEMU driver, whilst patch 2 adds additional tests to ensure the hwuuid functionality is working as expected. Note that from reading the source it doesn't appear as if all virtualisation platforms will support this feature: I've included the relevant changes for the QEMU driver since that is what we use here at Nutanix. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HGFT… v2: - Rebase onto master - Rework if() logic in virSysinfoSystemParseXML() in patch 1 as suggested by Daniel - Add R-B tag from Daniel to patch 2 Mark Cave-Ayland (2): conf: introduce hardware UUID (hwuuid) element qemuxmlconftest: add tests for new hardware UUID (hwuuid) element docs/formatdomain.rst | 7 +++ src/conf/domain_conf.c | 43 ++++++++++++++++--- src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 6 ++- ...hwuuid-smbios-uuid-match.x86_64-latest.err | 1 + .../hwuuid-smbios-uuid-match.xml | 36 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 35 +++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.xml | 41 ++++++++++++++++++ tests/qemuxmlconfdata/hwuuid.xml | 30 +++++++++++++ tests/qemuxmlconftest.c | 3 ++ 11 files changed, 202 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.xml -- 2.43.0

2 5

Release of libvirt-11.6.0
by Jiri Denemark 01 Aug '25

01 Aug '25

The 11.6.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag This new flag for virConnectBaselineHypervisorCPU can be used for computing a baseline CPU on any host. Without the VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. * Allow control over QEMU TLS priority strings The qemu.conf file now has multiple settings allowing control over the QEMU TLS priority strings, for the different subsystems in QEMU that can support TLS. This can be used to workaround a current bug in GNUTLS that is liable to cause crashes of the source QEMU when performing long running live migration operations with TLS enabled. * Add support for disabling deprecated CPU model features by default for s390 domains Starting an s390 domain with host-model will now default to setting the ``deprecated_features`` attribute to ``off``, ensuring the domain starts with a migration-compatible CPU model to newer systems. This behavior can be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. * bhyve: Add TCP console support TCP serial devices can now be configured with ``<serial type='tcp'>``:: <serial type='tcp'> <source mode='bind' host='127.0.0.1' service='12345'/> <target type='serial' port='0'/> </serial> Additionally, number of supported consoles increased to 4. * qemu: Add support for RBD namespaces Allow specifying the 'namespace' within a RBD image pool. * Improvements * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V The previous default of ``lsilogic`` is unsupported by modern operating systems. ``virtio-scsi`` is a more suitable default for ARM and RISC-V ``virt`` machine types. * Clarify documentation of virConnectBaselineHypervisorCPU The documentation makes it clear virConnectBaselineHypervisorCPU is supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. * Allow specifying zero discard granularity for block devices This can be used to tell some guest operating systems (notably Windows) to not trim the disk. * bhyve: Add timeout handling for bhyveload It is now possible to run ``bhyveload`` with the ``timeout`` tool, which can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. Timeout values are set using the ``bhyveload_timeout`` and ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. * nss: Improve debugging Debugging messages from NSS modules can be now enabled by setting the ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special meaning to its value. * rpc: Removed requirement for TLS certificates to support 'key encipherment' With TLS 1.3, key encipherment is not required even for RSA keys. Other key types didn't even support it so they were wrongly refused even in cases when they would work with libvirt. The TLS certificate validation now no longer requires 'key encipherment' to be enabled. * Bug fixes * bhyve: Fix resetting of the autostart flag of the domain on destroy. * The nwfilter driver no longer recreates the base iptable/ip6tables chains The nwfilter driver had a impl mistake causing it to recreate the base chains for iptables/ip6tables every time a VM was started. This allowed a small window where traffic might not be fully filtered. It now handles iptables/ip6tables the same way as ebtables, creating the base chains only if they did not already exist. * Fix systemd unit ordering for auto-shutdown of domains via the daemon The ordering of systemd units created by libvirt for individual machines needed to be adapted when the shutdown of VMs on host shutdown is done via the virt daemon itself (rather than ``libvirt-guests.service``) to ensure that the VMs are not terminated before the virt daemon can deal with them. Enjoy. Jirka

1 0

[PATCH] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 01 Aug '25

01 Aug '25

Add the ability to enable/disable exposing the EDID information to the guest. This allows migration from legacy machine types that have EDID disabled to a newer machine type without any change becoming visible to the guest. The edid attribute can specified in the domain XML as below: <video> <model type='virtio' edid='off'/> </video> If the edid attribute is unspecified, it is not generated so that the virtualisation platform will continue to use its default. The edid attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> --- docs/formatdomain.rst | 8 ++++++++ src/conf/domain_conf.c | 5 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++++++++ src/conf/schemas/domaincommon.rng | 5 +++++ src/qemu/qemu_command.c | 7 +++++++ 6 files changed, 37 insertions(+) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 976746e292..7fe8b03a56 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -7103,6 +7103,14 @@ A video device. sub-element is valid for model types "vga", "qxl", "bochs", "gop", and "virtio". + :since:`Since 11.7.0` (QEMU driver only), the ``model`` element may have an + optional ``edid`` attribute that can be set to "on" or "off". If the ``edid`` + attribute is not specified then the device will use its default value. + Otherwise setting ``edid`` to "on" will expose the device EDID blob to the + guest, whilst setting it to "off" will hide the device EDID blob from the + guest. The ``edid`` attribute is only valid for model types "vga", "bochs", + and "virtio". + ``acceleration`` Configure if video acceleration should be enabled. diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 59958c2f08..10cc6d7432 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13535,6 +13535,9 @@ virDomainVideoModelDefParseXML(virDomainVideoDef *def, if (virXMLPropTristateSwitch(node, "blob", VIR_XML_PROP_NONE, &def->blob) < 0) return -1; + if (virXMLPropTristateSwitch(node, "edid", VIR_XML_PROP_NONE, &def->edid) < 0) + return -1; + return 0; } @@ -26629,6 +26632,8 @@ virDomainVideoDefFormat(virBuffer *buf, virBufferAddLit(buf, " primary='yes'"); if (def->blob != VIR_TRISTATE_SWITCH_ABSENT) virBufferAsprintf(buf, " blob='%s'", virTristateSwitchTypeToString(def->blob)); + if (def->edid != VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(buf, " edid='%s'", virTristateSwitchTypeToString(def->edid)); if (def->accel || def->res) { virBufferAddLit(buf, ">\n"); virBufferAdjustIndent(buf, 2); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 596d138973..425ccfa97c 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1895,6 +1895,7 @@ struct _virDomainVideoDef { virDomainDeviceInfo info; virDomainVirtioOptions *virtio; virDomainVideoBackendType backend; + virTristateSwitch edid; }; /* graphics console modes */ diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 40edecef83..60a2e46b7e 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -231,6 +231,17 @@ virDomainVideoDefValidate(const virDomainVideoDef *video, } } + if ((video->type != VIR_DOMAIN_VIDEO_TYPE_BOCHS) && + (video->type != VIR_DOMAIN_VIDEO_TYPE_VGA) && + (video->type != VIR_DOMAIN_VIDEO_TYPE_VIRTIO)) { + if (video->edid != VIR_TRISTATE_SWITCH_ABSENT) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("video type '%1$s' does not support edid"), + virDomainVideoTypeToString(video->type)); + return -1; + } + } + return 0; } diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index a714c3fcc5..d84f20637c 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -4807,6 +4807,11 @@ <ref name="virOnOff"/> </attribute> </optional> + <optional> + <attribute name="edid"> + <ref name="virOnOff"/> + </attribute> + </optional> <optional> <element name="acceleration"> <optional> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 457dee7029..db00f9b173 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4739,6 +4739,13 @@ qemuBuildDeviceVideoCmd(virCommand *cmd, return -1; } + if ((video->type == VIR_DOMAIN_VIDEO_TYPE_BOCHS) || + (video->type == VIR_DOMAIN_VIDEO_TYPE_VGA) || + (video->type == VIR_DOMAIN_VIDEO_TYPE_VIRTIO)) { + if (virJSONValueObjectAdd(&props, "T:edid", video->edid, NULL) < 0) + return -1; + } + if (video->res) { if (virJSONValueObjectAdd(&props, "p:xres", video->res->x, -- 2.43.0

3 6

[PATCH] NEWS: Mention RBD namespaces, and auto-shutdown/key encipherment fixes
by Peter Krempa 31 Jul '25

31 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 5a320b7f33..6db9c998d9 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -51,6 +51,10 @@ v11.6.0 (unreleased) Additionally, number of supported consoles increased to 4. + * qemu: Add support for RBD namespaces + + Allow specifying the 'namespace' within a RBD image pool. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V @@ -83,6 +87,13 @@ v11.6.0 (unreleased) ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special meaning to its value. + * rpc: Removed requirement for TLS certificates to support 'key encipherment' + + With TLS 1.3, key encipherment is not required even for RSA keys. Other key + types didn't even support it so they were wrongly refused even in cases when + they would work with libvirt. The TLS certificate validation now no longer + requires 'key encipherment' to be enabled. + * **Bug fixes** * bhyve: Fix resetting of the autostart flag of the domain on destroy. @@ -96,6 +107,14 @@ v11.6.0 (unreleased) ebtables, creating the base chains only if they did not already exist. + * Fix systemd unit ordering for auto-shutdown of domains via the daemon + + The ordering of systemd units created by libvirt for individual machines + needed to be adapted when the shutdown of VMs on host shutdown is done + via the virt daemon itself (rather than ``libvirt-guests.service``) to + ensure that the VMs are not terminated before the virt daemon can deal with + them. + v11.5.0 (2025-07-01) ==================== -- 2.50.1

2 1

Question about SEV* guests and automatic firmware selection
by Jim Fehlig 31 Jul '25

31 Jul '25

Hi All, While investigating an internal bug report, we noticed that a minimal firmware auto-selection configuration along with SEV* fails to find a match. E.g. the following config <domain type="kvm"> <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <boot dev="hd"/> </os> <launchSecurity type="sev"> <policy>0x07</policy> </launchSecurity> ... </domain> Fails with "Unable to find 'efi' firmware that is compatible with the current configuration". A firmware that should match has the following json description { "description": "UEFI firmware for x86_64, with AMD SEV", "interface-types": [ "uefi" ], "mapping": { "device": "flash", "mode": "stateless", "executable": { "filename": "/usr/share/qemu/ovmf-x86_64-sev.bin", "format": "raw" } }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "acpi-s4", "amd-sev", "amd-sev-es", "amd-sev-snp", "verbose-dynamic" ], "tags": [ ] } Auto-selection works fine if I specify a 'stateless' firmware, e.g. amend the above config with <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <loader stateless="yes"/> <boot dev="hd"/> </os> Being unfamiliar with the firmware auto-selection code, I tried the below naive hack, which only led to test failures and the subsequent runtime error "unable to find any master var store for loader: /usr/share/qemu/ovmf-x86_64-sev.bin". Should auto-selection work with the minimal config, or is it expected that user also specify a stateless firmware? Regards, Jim diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 2d0ec0b4fa..660b74141a 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1293,15 +1293,17 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } - if (loader && loader->stateless == VIR_TRISTATE_BOOL_YES) { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { - VIR_DEBUG("Discarding loader without stateless flash"); - return false; - } - } else { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { - VIR_DEBUG("Discarding loader without split flash"); - return false; + if (loader) { + if (loader->stateless == VIR_TRISTATE_BOOL_YES) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { + VIR_DEBUG("Discarding loader without stateless flash"); + return false; + } + } else if (loader->stateless == VIR_TRISTATE_BOOL_NO) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + VIR_DEBUG("Discarding loader without split flash"); + return false; + } } }

3 6

[PATCH] news: document fixed nwfilter driver base chain creation
by Daniel P. Berrangé 30 Jul '25

30 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e5e8626729..c7bfac1db4 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -48,6 +48,14 @@ v11.6.0 (unreleased) * **Bug fixes** + * The nwfilter driver no longer recreates the base iptable/ip6tables chains + + The nwfilter driver had a impl mistake causing it to recreate the + base chains for iptables/ip6tables every time a VM was started. + This allowed a small window where traffic might not be fully + filtered. It now handles iptables/ip6tables the same way as + ebtables, creating the base chains only if they did not already + exist. v11.5.0 (2025-07-01) ==================== -- 2.50.1

2 1

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 30 Jul '25

30 Jul '25

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7f08e45537..d6919bdf4c 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -59,6 +59,12 @@ v11.6.0 (unreleased) This can be used to tell some guest operating systems (notably Windows) to not trim the disk. + * nss: Improve debugging + + Debugging printings from NSS modules can be now enabled by setting the + ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special + meaning to its value. + * **Bug fixes** -- 2.49.1

2 1

[PATCH] NEWS: document bhyve changes for the release
by Roman Bogorodskiy 30 Jul '25

30 Jul '25

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225..447259d66e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -40,6 +40,17 @@ v11.6.0 (unreleased) be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. + * bhyve: Add TCP console support + + TCP serial devices can now be configured with ``<serial type='tcp'>``:: + + <serial type='tcp'> + <source mode='bind' host='127.0.0.1' service='12345'/> + <target type='serial' port='0'/> + </serial> + + Additionally, number of supported consoles increased to 4. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V @@ -54,8 +65,16 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * bhyve: Add timeout handling for bhyveload + + It is now possible to run ``bhyveload`` with the ``timeout`` tool, which + can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. + Timeout values are set using the ``bhyveload_timeout`` and + ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. + * **Bug fixes** + * bhyve: Fix resetting of the autostart flag of the domain on destroy. v11.5.0 (2025-07-01) ==================== -- 2.49.0

2 2

Plans for 11.6.0 release (freeze on 2025-07-28)
by Jiri Denemark 30 Jul '25

30 Jul '25

We are getting close to 11.6.0 release of libvirt. To aim for the release on Friday 01 Aug I suggest entering the freeze on Monday 28 Jul and tagging RC2 on Wednesday 30 Jul. I hope this works for everyone. Jirka

1 1

[PATCH 0/2] qemu: Match firmware with fully resolved and canonicalized paths
by James Le Cuirot 29 Jul '25

29 Jul '25

From: James Le Cuirot <jlecuirot(a)microsoft.com> Distros may provide compatibility symlinks after moving firmware files around, but they won't work for existing VMs when doing a straight string comparison. virFileComparePaths has been used to do this, but it was previously only resolving the last path component, despite what the description says. James Le Cuirot (2): util: Fully resolve paths with virFileComparePaths qemu: Match firmware with fully resolved and canonicalized paths src/qemu/qemu_firmware.c | 11 ++++++----- src/util/virfile.c | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.49.0

4 6

[PATCH 0/2] Revert recent patches causing test dependance on host state
by Peter Krempa 29 Jul '25

29 Jul '25

Revert the patches as we're in code freeze. Peter Krempa (2): Revert "qemuxmlconfdata: Regenerate outputs after last commit" Revert "qemu: Match firmware with fully resolved and canonicalized paths" src/qemu/qemu_firmware.c | 11 +++++------ ...anual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++------- ...i-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++------- ...ual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- ...l-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- 10 files changed, 22 insertions(+), 39 deletions(-) -- 2.50.0

2 3

[PATCH pushed] qemuxmlconfdata: Regenerate outputs after last commit
by Peter Krempa 29 Jul '25

29 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Commit 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 modified how the EFI paths are detected but didn't update the outputs. Fixes: 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed as build fix. ...manual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...-manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++++++--- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...anual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...al-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...e-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- 9 files changed, 33 insertions(+), 17 deletions(-) diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args index 83b1ce46ab..7bf2aeb570 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/AAVMF/AAVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml index 2e5c4fe584..0ee421fe6f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader> + <nvram template='/usr/share/edk2/aarch64/vars-template-pflash.raw' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml index b452ebaca2..4bfc7cdd0c 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args index 2113a46e80..d1b0377986 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml index 83623f1de2..490e298f7f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml index cbadd0f0c8..beb146d35a 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> - <nvram template='/path/to/OVMF_VARS.fd' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram template='/path/to/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml index 44d200134b..41e5742c21 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> -- 2.50.0

1 0

[PATCH] include: fix version for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST
by Daniel P. Berrangé 28 Jul '25

28 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- include/libvirt/libvirt-host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-host.h b/include/libvirt/libvirt-host.h index 19043235b2..8922d00e0c 100644 --- a/include/libvirt/libvirt-host.h +++ b/include/libvirt/libvirt-host.h @@ -975,7 +975,7 @@ typedef enum { /* filter out non-migratable features (Since: 1.2.14) */ VIR_CONNECT_BASELINE_CPU_MIGRATABLE = (1 << 1), /* when computing a baseline from several CPUs, do not make the result - * dependent on the current host (Since: 11.5.0) */ + * dependent on the current host (Since: 11.6.0) */ VIR_CONNECT_BASELINE_CPU_IGNORE_HOST = (1 << 2), } virConnectBaselineCPUFlags; -- 2.50.1

2 1

[PATCH] NEWS: Mention zero discard_granularity option
by Martin Kletzander 28 Jul '25

28 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225a6..7f08e455377b 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -54,6 +54,11 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * Allow specifying zero discard granularity for block devices + + This can be used to tell some guest operating systems (notably Windows) to + not trim the disk. + * **Bug fixes** -- 2.50.1

2 1

[PATCH] include: s/RECREATION/RECREATED/ in domain event names
by Daniel P. Berrangé 28 Jul '25

28 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> New event reasons were added in commit 1af740c5012bb45dfe96c77bcd6b20c28b6bb45d Author: Zhenzhong Duan <zhenzhong.duan(a)intel.com> Date: Thu Jul 10 03:21:21 2025 -0400 qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation but the naming did not match existing reason names, so adapt to match. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- examples/c/misc/event-test.c | 8 ++++---- include/libvirt/libvirt-domain.h | 4 ++-- src/qemu/qemu_process.c | 4 ++-- tools/virsh-domain-event.c | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/examples/c/misc/event-test.c b/examples/c/misc/event-test.c index bafa929c47..347ec44682 100644 --- a/examples/c/misc/event-test.c +++ b/examples/c/misc/event-test.c @@ -143,8 +143,8 @@ eventDetailToString(int event, case VIR_DOMAIN_EVENT_STARTED_WAKEUP: return "Event wakeup"; - case VIR_DOMAIN_EVENT_STARTED_RECREATION: - return "Recreation"; + case VIR_DOMAIN_EVENT_STARTED_RECREATED: + return "Recreated"; case VIR_DOMAIN_EVENT_STARTED_LAST: break; @@ -230,8 +230,8 @@ eventDetailToString(int event, case VIR_DOMAIN_EVENT_STOPPED_FROM_SNAPSHOT: return "Snapshot"; - case VIR_DOMAIN_EVENT_STOPPED_RECREATION: - return "Recreation"; + case VIR_DOMAIN_EVENT_STOPPED_RECREATED: + return "Recreated"; case VIR_DOMAIN_EVENT_STOPPED_LAST: break; diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index fad58cf409..1811c55005 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5051,7 +5051,7 @@ typedef enum { VIR_DOMAIN_EVENT_STARTED_RESTORED = 2, /* Restored from a state file (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STARTED_FROM_SNAPSHOT = 3, /* Restored from snapshot (Since: 0.8.0) */ VIR_DOMAIN_EVENT_STARTED_WAKEUP = 4, /* Started due to wakeup event (Since: 0.9.11) */ - VIR_DOMAIN_EVENT_STARTED_RECREATION = 5, /* Secure guest recreation (Since: 10.1.0) */ + VIR_DOMAIN_EVENT_STARTED_RECREATED = 5, /* Secure guest recreation (Since: 10.1.0) */ # ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_EVENT_STARTED_LAST /* (Since: 0.9.10) */ @@ -5116,7 +5116,7 @@ typedef enum { VIR_DOMAIN_EVENT_STOPPED_SAVED = 4, /* Saved to a state file (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STOPPED_FAILED = 5, /* Host emulator/mgmt failed (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STOPPED_FROM_SNAPSHOT = 6, /* offline snapshot loaded (Since: 0.8.0) */ - VIR_DOMAIN_EVENT_STOPPED_RECREATION = 7, /* Secure guest recreation (Since: 10.1.0) */ + VIR_DOMAIN_EVENT_STOPPED_RECREATED = 7, /* Secure guest recreation (Since: 10.1.0) */ # ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_EVENT_STOPPED_LAST /* (Since: 0.9.10) */ diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 8f3d357b9f..6b7b971f27 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -476,7 +476,7 @@ qemuProcessFakeRebootViaRecreate(virDomainObj *vm, bool locked) event = virDomainEventLifecycleNewFromObj(vm, VIR_DOMAIN_EVENT_STOPPED, - VIR_DOMAIN_EVENT_STOPPED_RECREATION); + VIR_DOMAIN_EVENT_STOPPED_RECREATED); virObjectEventStateQueue(driver->domainEventState, event); /* skip remove inactive domain from active list */ @@ -501,7 +501,7 @@ qemuProcessFakeRebootViaRecreate(virDomainObj *vm, bool locked) virDomainAuditStart(vm, "booted", true); event = virDomainEventLifecycleNewFromObj(vm, VIR_DOMAIN_EVENT_STARTED, - VIR_DOMAIN_EVENT_STARTED_RECREATION); + VIR_DOMAIN_EVENT_STARTED_RECREATED); virObjectEventStateQueue(driver->domainEventState, event); qemuDomainSaveStatus(vm); diff --git a/tools/virsh-domain-event.c b/tools/virsh-domain-event.c index 21dbf6e1d2..a47fdfc7fd 100644 --- a/tools/virsh-domain-event.c +++ b/tools/virsh-domain-event.c @@ -72,7 +72,7 @@ VIR_ENUM_IMPL(virshDomainEventStarted, N_("Restored"), N_("Snapshot"), N_("Event wakeup"), - N_("Recreation")); + N_("Recreated")); VIR_ENUM_DECL(virshDomainEventSuspended); VIR_ENUM_IMPL(virshDomainEventSuspended, @@ -106,7 +106,7 @@ VIR_ENUM_IMPL(virshDomainEventStopped, N_("Saved"), N_("Failed"), N_("Snapshot"), - N_("Recreation")); + N_("Recreated")); VIR_ENUM_DECL(virshDomainEventShutdown); VIR_ENUM_IMPL(virshDomainEventShutdown, -- 2.50.1

2 1

Entering freeze for libvirt-11.6.0
by Jiri Denemark 28 Jul '25

28 Jul '25

I have just tagged v11.6.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

2 1

[RFC 0/4] Implement automatic attachment of the vhostuser port
by yong.huang＠smartx.com 28 Jul '25

28 Jul '25

From: Hyman Huang <yong.huang(a)smartx.com> This series offer an automated method to configure a vhostuser interface in server mode, simplifying integration with DPDK-enabled Open vSwitch bridges. To ensure simplicity and forward compatibility, we introduce openvswitch backend support for vhostuser interfaces in XML configuration, with an optional 'autoiface' attribute. Here is an example of the config for a vhostuser interface that attached to bridge automatically: <interface type='vhostuser'> <mac address='52:54:00:3b:83:1b'/> <source type='unix' path='/tmp/vhost2.sock' mode='server'/> <virtualport type='openvswitch'> <parameters interfaceid='9317d6b7-5fae-4464-a7e9-87d90eff2204'/> </virtualport> <backend type='openvswitch' autoiface='yes'> <parameters bridge='ovsbr-ddpbxnhaq'/> </backend> <model type='virtio'/> <driver queues='5'/> </interface> The backend element specifies the backend implementation of the vhostuser interface type. The type attribute is required and currently supports supports openvswitch and passt. If type is openvswitch, the autoiface attribute may be specified (yes or no), if autoiface is yes, the parameters element bridge attribute is mandatory. Libvirt will derive the interface name by extracting the substring after the '/' character in the vhostuser server path, and attach it to the bridge specified by the bridge attribute. Please review. Thanks. Yong Hyman Huang (4): qemu_passt: Make logFile backend-specific conf: Introduce autoiface attribute for vhostuser interface util: Add iface argument to virNetDevOpenvswitchAddPort qemu: Implement automatic attachment of the vhostuser port docs/formatdomain.rst | 37 ++++++++- src/conf/domain_conf.c | 75 +++++++++++++++++-- src/conf/domain_conf.h | 13 +++- src/conf/domain_postparse.c | 46 ++++++++++++ src/conf/domain_validate.c | 24 ++++++ src/conf/schemas/domaincommon.rng | 20 +++++ src/lxc/lxc_process.c | 3 +- src/qemu/qemu_command.c | 3 + src/qemu/qemu_hotplug.c | 4 + src/qemu/qemu_interface.c | 46 ++++++++++++ src/qemu/qemu_interface.h | 3 + src/qemu/qemu_passt.c | 4 +- src/qemu/qemu_process.c | 4 + src/util/virnetdevopenvswitch.c | 36 ++++++++- src/util/virnetdevopenvswitch.h | 10 ++- src/util/virnetdevtap.c | 3 +- .../net-vhostuser.x86_64-latest.xml | 10 +++ tests/qemuxmlconfdata/net-vhostuser.xml | 10 +++ 18 files changed, 336 insertions(+), 15 deletions(-) -- 2.27.0

2 6

[PATCH v6 0/3] Fix virtio console port assignment issue
by Aaron M. Brown 26 Jul '25

26 Jul '25

Changelog: --- v6: - Fixed issue with console auto port index starting from 1 instead of 0 --- v5: - Added xml tests to tests/qemuxmlconfdata - Fixed virito -> virtio typo in commit message --- v4: - Update commit messages --- v3: - Added Reviewed-By - Included CI Results Link --- v2: - Split patch into two commits - Added fixes tag --- This libvirt patch series does the following: 1. fixes an issue with virtio console device port auto assignment on virtio-serial buses 2. updates console port reservation comment and changes the allowZero variable to allowPortZero for clarity 3. Adds tests for virtio console on the vioserial bus Currently in libvirt, a virtio console device cannot be auto assigned a port number greater than zero on a virtio-serial bus. This leads to port collision errors when adding more than 1 virtio console device on a single virtio-serial bus. After applying this patch, one can add multiple console ports under a single virtio-serial bus. Here is a link to CI results for this series: https://gitlab.com/aaronbmalik/libvirt/-/pipelines/1942021076 Aaron M. Brown (3): tests: Add console-virtio-vioserial tests domain_addr: Fix virtio console port autoassign on virtio-serial bus domain_addr: update virtconsole port reservation comment and allowZero var src/conf/domain_addr.c | 50 ++++++++++----- ...rial-autoassign-address.x86_64-latest.args | 44 +++++++++++++ ...erial-autoassign-address.x86_64-latest.xml | 63 +++++++++++++++++++ ...nsole-virtio-serial-autoassign-address.xml | 48 ++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 192 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.xml -- 2.39.5 (Apple Git-154)

3 8

[PATCH v5 0/5] Disable Deprecated Features by Default on s390 CPU Models
by Collin Walling 25 Jul '25

25 Jul '25

Changelog v5 - dropped the "none" test in qemuxmlactivetest (see commit for details) - reordered patches to introduce some tests first, then add qemu.conf changes v4 - added qemu.conf option to dictate the default behavior for the deprecated_features attribute (Boris) - added qemuxmlactivetests (Boris) - snuck in missing documentation for deprecated_features in formatdomain.rst v3 - added qemu caps check to avoid breaking s390 guests trying to default deprecated_features='off' on QEMU versions that do not support reporting these features v2 - changed behavior from disabling features on the host model to instead flagging the guest CPU to disable deprecated features - removed disabling deprecated features on host model in virQEMUCapsInitCPUModelS390 - added flagging deprecated_feats in qemuProcessUpdateGuestCPU - added tests for deprecated_features='on' - split virQEMUCapsUpdateCPUDeprecatedFeatures update and qemuProcessUpdateGuestCPU changes The intention of reporting deprecated features and modifying the guest CPU model was to alleviate the user from the burden of preparing a guest with the necessary amendments to assure migration to newer hardware. While that goal was met by way of the "deprecated_features='on|off'" attribute, it still adds an extra step that the user must be aware to prepare a guest for migration and the errors that stem from an unsuccessful migration (due to feature incompatibility) is not always clear how to resolve. These patches make s390 CPU *host models* migration ready from the get-go by introducing a qemu.conf option for disabling deprecated features by default. They may still be disabled for other model types via the respective attribute, or reenabled if desired. The configured behavior may be overridden by explicitly providing the attribute within the guest XML. Boris Fiuczynski (2): tests: new qemuxmlactive tests for s390x qemu: add default_cpu_deprecated_features configuration option Collin Walling (3): docs: domain: document deprecated_features attribute qemu: caps: add virCPUFeaturePolicy param to virQEMUCapsUpdateCPUDeprecatedFeatures qemu: process: refactor deprecated features code docs/formatdomain.rst | 8 ++++ src/qemu/libvirtd_qemu.aug | 3 ++ src/qemu/qemu.conf.in | 14 ++++++ src/qemu/qemu_capabilities.c | 6 +-- src/qemu/qemu_capabilities.h | 3 +- src/qemu/qemu_conf.c | 33 +++++++++++++ src/qemu/qemu_conf.h | 12 +++++ src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_process.c | 46 +++++++++++++++---- src/qemu/test_libvirtd_qemu.aug.in | 1 + ...cated-features-off-active.s390x-latest.xml | 25 ++++++++++ ...ted-features-off-inactive.s390x-latest.xml | 25 ++++++++++ ...ecated-features-on-active.s390x-latest.xml | 25 ++++++++++ ...ated-features-on-inactive.s390x-latest.xml | 25 ++++++++++ tests/qemuxmlactivetest.c | 10 +++- ...deprecated-features-none.s390x-latest.args | 32 +++++++++++++ ...-deprecated-features-none.s390x-latest.xml | 25 ++++++++++ .../cpu-model-deprecated-features-none.xml | 15 ++++++ ...l-deprecated-features-on.s390x-latest.args | 32 +++++++++++++ ...el-deprecated-features-on.s390x-latest.xml | 25 ++++++++++ .../cpu-model-deprecated-features-on.xml | 15 ++++++ ...default-video-type-s390x.s390x-latest.args | 2 +- ...vfio-zpci-ccw-memballoon.s390x-latest.args | 2 +- .../launch-security-s390-pv.s390x-latest.args | 2 +- ...t-cpu-kvm-ccw-virtio-4.2.s390x-latest.args | 2 +- .../s390-defaultconsole.s390x-latest.args | 2 +- .../s390-panic.s390x-latest.args | 2 +- tests/qemuxmlconftest.c | 2 + 28 files changed, 375 insertions(+), 22 deletions(-) create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-off-active.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-off-inactive.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-on-active.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-on-inactive.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.xml -- 2.49.0

5 18

[PATCH] NEWS: mention disabling deprecated features by default on s390 CPU models
by Collin Walling 25 Jul '25

25 Jul '25

Signed-off-by: Collin Walling <walling(a)linux.ibm.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e5e8626729..6cc8f23225 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -32,6 +32,14 @@ v11.6.0 (unreleased) that is liable to cause crashes of the source QEMU when performing long running live migration operations with TLS enabled. + * Add support for disabling deprecated CPU model features by default for s390 domains + + Starting an s390 domain with host-model will now default to setting the + ``deprecated_features`` attribute to ``off``, ensuring the domain starts + with a migration-compatible CPU model to newer systems. This behavior can + be modified by setting the ``default_cpu_deprecated_features`` option in + the qemu.conf file. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.49.0

2 1

Re: Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by Peter Krempa 25 Jul '25

25 Jul '25

On Wed, Jul 23, 2025 at 04:57:57 +0000, P, Rajasekar via Users wrote: > Hello libvirt community, > > I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). > > **Environment:** > - libvirt version: 10.5.0 Note that this was released almost a year ago. > - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 > - Disk image format: qcow2 > - Host OS: RHEL 9.5 > > **Steps to reproduce:** > 1. Create an external snapshot: > virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic > 2. Delete the snapshot: > virsh snapshot-delete <vm> --snapshotname snap1 > > **Observed behavior:** > - Changes from the overlay (snapshot) file are merged into the base image. > - The snapshot metadata is removed from libvirt. > - The snapshot file remains on disk (appears orphaned). You mean that the original overlay images remained on disk? e.g. /path/to/originalimage.snap1 ? > **Questions:** > - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. Yes it is intended, because deleting a snapshot is effectively meaning "I don't want to return to this point any more" so the extra overlay makes no sense. > - Should the snapshot file be deleted automatically, or is manual cleanup required? If you mean the overlay, then yes it should have been deleted. > - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? The semantics of external and internal snapshots are supposed to be indentical. I don't think we document to a deep extent the actual behaviour WRT to the disk files.

1 0

شهادة الأبوة في المغرب
by walid falcon 24 Jul '25

24 Jul '25

كل ما تحتاج معرفته حول شهادة الأبوة بالمغرب يمكنك تحميل الطلب من خلال الرابط المباشر https://www.targir.com/2025/04/blog-post_14.html معلومات شاملة لاستخراج شهادة الأبوة والإجراءات القانونية المرتبطة بها ما هي شهادة الأبوة في المغرب؟ شهادة الأبوة وثيقة قانونية تصدر بناءً على حكم قضائي، وتُثبت العلاقة البنوية بين الطفل ووالده البيولوجي، في حال عدم وجود عقد زواج رسمي أو تسجيل سابق. تُعَد هذه الشهادة جزءًا من الإجراءات القضائية التي تدخل ضمن قضايا الحالة المدنية. الحالات التي تستوجب استخراج شهادة الأبوة 1. الأطفال غير المسجلين في الحالة المدنية عندما يولد طفل خارج إطار الزواج أو لم يُسجَّل بصفة قانونية في دفتر الحالة المدنية، يحتاج الأب إلى رفع دعوى للحصول على شهادة الأبوة. 2. إثبات النسب في غياب عقد زواج في حالات عدم توفر وثيقة الزواج بين الأبوين، يُلجأ إلى المحكمة لتقديم التصريح بالأبوة. إجراءات الحصول على شهادة الأبوة أولا: رفع دعوى أمام المحكمة يتوجب على الأب أو ولي أمر الطفل تقديم طلب إلى المحكمة الابتدائية التي يقع فيها مقر سكن الطفل أو الأب، وذلك من أجل إصدار حكم قضائي بإثبات الأبوة. ثانياً: الوثائق المطلوبة نسخة من بطاقة التعريف الوطنية عقد الازدياد الخاص بالطفل (إن وُجد) شهادة طبية للولادة شهادة السكنى وثائق أو إثباتات تدعم علاقة الأب بالطفل نموذج شهادة الأبوة pdf تتيح بعض المواقع الإلكترونية تحميل نموذج شهادة الأبوة PDF قابل للطباعة، غير أن إصدارها الرسمي لا يتم إلا بعد حكم قضائي، ويتم توجيهها لمصلحة الحالة المدنية لتسجيل الطفل. الأسئلة الشائعة حول شهادة الأبوة هل يمكن تقديم طلب شهادة الأبوة إلكترونياً؟ لا، المسطرة تظل قضائية وتتطلب الحضور أمام المحكمة. ما هي مدة الحصول على شهادة الأبوة؟ قد تختلف المدة حسب عدد الجلسات، ولكن عادة ما تستغرق بين شهر إلى ثلاثة أشهر، حسب تعقيد الملف. صلة بين شهادة الأبوة وبعض التصاريح القانونية الأخرى تم الربط ضمن هذا الدليل بين شهادة الأبوة وبعض المفاهيم القانونية الأخرى التي يبحث عنها الكثير، مثل: 1. التصريح الأمني وتصريح السفر غالباً ما يُطلب في بعض الحالات القانونية توفير تصريح أمني عند استخراج أوراق ثبوتية، كما هو الحال في: الأوراق المطلوبة لاستخراج تصريح السفر من منطقة التجنيد تصريح أمني مستعجل التصريح الأمني الإلكتروني 2. استبدال التصريح برخصة قيادة في حالات مثل شروط إصدار رخصة قيادة بعد التصريح أو تجديد التصريح إلى رخصة، من المهم التأكد من إثبات الهوية القانونية، وهو ما يجعل شهادة الأبوة ضرورية في بعض الحالات القانونية الخاصة. شهادة الأبوة الغاية من هذه الوثيقة هي إثبات علاقة الأبوة بالابن سواء كان راشدا أم قاصرا وغالبا ما تطلب في بعض المساطر الإدارية. صاحب الطلب المغربي المقيم بالخارج الوثائق المطلوبة بالنسبة للراشد : · بطاقة التسجيل ؛ · الدفتر العائلي بالنسبة للقاصر : · بطاقة تسجيل الأب ؛ · الدفتر العائلي . المصلحة المكلفة باستلام الوثائق المطلوبة المصالح القنصلية التابعة لمحل إقامة صاحب الطلب المصلحة المكلفة بتقديم الخدمة المصالح القنصلية التابعة لمحل إقامة صاحب الطلب في حالة تعذر الحصول على الخدمة مؤسسة الوسيط لأجل الاتصال وزارة الشؤون الخارجية والتعاون مصدر المعلومات (الإدارة المعنية) وزارة الشؤون الخارجية والتعاون_أرشيف يمكنك تحميل الطلب من خلال الرابط المباشر نموذج شهادة الأبوة بالمغرب محكمة الأسرة بـ: [اسم المدينة] رقم الملف: [يُترك للمحكمة] رقم القضية: [يُترك للمحكمة] بيان تصريح بالأبوة أنا الموقع أسفله: الاسم الكامل: [الاسم الكامل للأب] رقم بطاقة التعريف الوطنية: [رقم CIN] تاريخ ومكان الازدياد: [تاريخ ومكان ولادة الأب] العنوان الكامل: [عنوان الإقامة] المهنة: [المهنة الحالية] أُصرّح بموجب هذا، وبكامل قواي العقلية والقانونية، بما يلي: أن الطفل (ة) المسمى (ة): [اسم الطفل/ة] المولود (ة) بتاريخ: [تاريخ الولادة] بـ: [مكان الولادة] هو(هي) ابني/ابنتي البيولوجي(ة)، وقد وُلد(ت) نتيجة علاقة أبوية قائمة بيني وبين السيدة: [اسم الأم]، المولودة بتاريخ: [تاريخ ميلاد الأم]، والحاملة لرقم بطاقة التعريف الوطنية: [رقم CIN الأم]. وأتحمل كامل المسؤولية القانونية والأبوية تجاه هذا الطفل/ة، وأطلب من المحكمة الموقرة إصدار حكم قضائي يثبت نسب الطفل لي، وتمكينه من التسجيل في الحالة المدنية. الإمضاء الإسم الكامل: _____________________ التوقيع: ___________________________ التاريخ: ____ / ____ / ________ ملاحظات : يُرفق هذا النموذج بالوثائق الداعمة كـ: نسخة البطاقة الوطنية، شهادة السكنى، شهادة الولادة، وغيرها. يُودَع لدى كتابة ضبط المحكمة الابتدائية (قسم قضاء الأسرة) التي يقع ضمن اختصاصها محل ولادة الطفل أو محل سكن الأب.

1 0

[PATCH v1] virBitmapNextClearBit: Correct virBitmapNextClearBit function header comment
by Aaron M. Brown 23 Jul '25

23 Jul '25

This patch corrects the header comment for virBitmapNextClearBIt. Currently, the header comment reads: `@pos can be -1 to search for the first set bit.` However, this statement is false. We can prove this by referencing the virbitmaptest functions, i.e virbitmaptest.c:223, in which i = 0 if (virBitmapNextClearBIt(bitmap, -1) != 0) return -1 Because this is a zero set, this case would fail if the header statement was true as is. Signed-off-by: Aaron M. Brown <aaronmbr(a)linux.ibm.com> --- src/util/virbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virbitmap.c b/src/util/virbitmap.c index 8a3f33c806..1a3e75671c 100644 --- a/src/util/virbitmap.c +++ b/src/util/virbitmap.c @@ -948,7 +948,7 @@ virBitmapLastSetBit(virBitmap *bitmap) * @pos: the position after which to search for a clear bit * * Search for the first clear bit after position @pos in bitmap @bitmap. - * @pos can be -1 to search for the first set bit. Position starts + * @pos can be -1 to search for the first clear bit. Position starts * at 0. * * Returns the position of the found bit, or -1 if no bit found. -- 2.39.5 (Apple Git-154)

3 2

[PATCH 0/2] virnetdevvportprofile: Misc cleanups
by Michal Privoznik 23 Jul '25

23 Jul '25

*** BLURB HERE *** Michal Prívozník (2): virnetdevvportprofile: Drop explicit enum virNetDevVPortProfile declaration virnetdevvportprofile: Turn 'virtPortType' of virNetDevVPortProfile into proper enum type src/conf/netdev_vport_profile_conf.c | 11 +++++------ src/hypervisor/virhostdev.c | 1 + src/qemu/qemu_migration_cookie.c | 2 ++ src/util/virnetdevvportprofile.c | 19 ++++++++++++++++--- src/util/virnetdevvportprofile.h | 4 ++-- 5 files changed, 26 insertions(+), 11 deletions(-) -- 2.49.1

2 3

[PATCH 0/5] secdriver: Misc cleanups
by Michal Privoznik 23 Jul '25

23 Jul '25

*** BLURB HERE *** Michal Prívozník (5): security: Drop some G_GNUC_UNUSED attributes security_selinux: Drop needless checks for seclabel->model == "selinux" security_dac: Drop needless checks for seclabel->model == "dac" security_apparmor: Drop needless checks for seclabel->model == "apparmor" security_dac: Drop needles typecast in virSecurityDACGenLabel() src/security/security_apparmor.c | 18 +--------- src/security/security_dac.c | 14 ++------ src/security/security_selinux.c | 59 +++----------------------------- 3 files changed, 8 insertions(+), 83 deletions(-) -- 2.49.1

2 6

[PATCH v2 0/4] Some parsing functions refactor
by Kirill Shchetiniuk 23 Jul '25

23 Jul '25

This patch series is supposed to refactor the existing logic of some parsing functions, changing the previous approach of getting the string fisrt and then parsing the string itself. Now the parsing logic is implemented by using the appropriate virXMLProp* functions. Changelog fromm v1: 1. 'ret' temp value is now 'rc' 2. code style fixes 3. 'id' param is now parsed as not mandatory Kirill Shchetiniuk (4): conf: virNetDevVPortProfileParse refactor util: virSecretLookupParseSecret refactor conf: virDomainChrDefParseTargetXML refactor qemu: qemuDomainObjPrivateXMLParseVcpu refactor src/conf/domain_conf.c | 16 +--- src/conf/netdev_vport_profile_conf.c | 112 +++++++++++---------------- src/qemu/qemu_domain.c | 16 +--- src/util/virsecret.c | 19 ++--- 4 files changed, 55 insertions(+), 108 deletions(-) -- 2.49.0

2 7

libvirt-gitlab-executor - maintainer?
by Kristina Hanicova 23 Jul '25

23 Jul '25

Hello Libvirt friends, Is anyone interested in maintaining this orphaned repository: https://gitlab.com/libvirt/libvirt-gitlab-executor ? It is used in Cryptsetup CI and we would like to upstream some changes. If no one is interested, I am willing to take on the role of the maintainer myself:) Regards, Kristina Hanicova

4 4

[PATCH 0/4] qemu: add support for RBD namespace
by Peter Krempa 23 Jul '25

23 Jul '25

After recent inquiry on libvirt-users I've necromanced this already very old series that I still had laying around. This series: - turns virStorageSource's 'protocol' to real enum - removes virStorageSource's 'volume' - wires in the RBD support Han Han (1): qemu: Add support for RBD namespace. Peter Krempa (3): conf: Turn 'protocol' field of virStorageSource into proper enum type virStorageFileBackendGlusterInit: Refactor cleanup virStorageSource: Eliminate 'volume' field docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 36 ++------- src/conf/domain_validate.c | 2 +- src/conf/storage_source_conf.c | 79 ++++++++++++++++++- src/conf/storage_source_conf.h | 10 ++- src/libvirt_private.syms | 1 + src/libxl/libxl_conf.c | 4 +- src/libxl/xen_xl.c | 4 +- src/qemu/qemu_block.c | 41 ++++++---- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- .../storage_file_backend_gluster.c | 63 ++++++++------- src/storage_file/storage_source.c | 2 - .../storage_source_backingstore.c | 56 ++++--------- .../disk-network-rbd.x86_64-latest.args | 4 +- .../disk-network-rbd.x86_64-latest.xml | 4 +- tests/qemuxmlconfdata/disk-network-rbd.xml | 4 +- 17 files changed, 185 insertions(+), 137 deletions(-) -- 2.49.0

2 6

Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by P, Rajasekar 23 Jul '25

23 Jul '25

Hello libvirt community, I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). **Environment:** - libvirt version: 10.5.0 - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 - Disk image format: qcow2 - Host OS: RHEL 9.5 **Steps to reproduce:** 1. Create an external snapshot: virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic 2. Delete the snapshot: virsh snapshot-delete <vm> --snapshotname snap1 **Observed behavior:** - Changes from the overlay (snapshot) file are merged into the base image. - The snapshot metadata is removed from libvirt. - The snapshot file remains on disk (appears orphaned). **Questions:** - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. - Should the snapshot file be deleted automatically, or is manual cleanup required? - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? Thank you for your help and clarification! Best regards, Raj.

1 0

[RFC PATCH 0/8] Add support for Grace ACPI Extended GPU Memory (EGM) devices
by Ian May 22 Jul '25

22 Jul '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. RFC Status ========== This patch series is submitted as an RFC to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This 8-patch series adds a new device type 'acpi-egm-memory' with the following structure: 1. Schema definition - Add XML schema definition for the new ACPI EGM memory device 2. XML parsing - Implement XML parsing and internal data structures 3. Capability detection - Add QEMU capability detection for EGM support 4. Validation - Add validation logic for EGM device configuration 5. Command generation - Implement QEMU command line generation 6. Resource management - Setup required cgroup and namespace configurations 7. Documentation - Add comprehensive documentation 8. Testing - Add qemuxmlconftest for ACPI EGM memory device XML Configuration ================= Example usage in domain XML: <devices> <hostdev mode="subsystem" type="pci" managed="yes"> <alias name="ua-hostdev0"/> <source> <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </source> </hostdev> <acpiEgmMemory> <alias name="egm0"/> <pciDev>ua-hostdev0</pciDev> <numaNode>0</numaNode> </acpiEgmMemory> </devices> This configuration results in appropriate QEMU command line options: -object memory-backend-file,id=m0,mem-path=/dev/egm0,size=32G,share=on,prealloc=on -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 Implementation Notes ==================== The device validation includes checking that referenced PCI devices exist, NUMA nodes are valid, and device paths are accessible with proper permissions. Memory backing is configured automatically to use the EGM device path, and cgroups/namespaces are set up to allow safe access. Testing ======= I've tested XML parsing, validation, and qemu command line generation. The qemuxmlconftest passes for XML handling, though the command generation test currently fails since QEMU doesn't have acpi-egm-memory support yet, but the generated args look correct for when it does. Requirements ============ This feature requires: - NVIDIA ARM64 Grace platform with EGM support - Host kernel with EGM driver support [1] - QEMU with ACPI EGM device support [2] [1] https://github.com/ianm-nv/NV-Kernels/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (8): conf: Add schema definition for ACPI EGM memory device conf: Add definitions and XML parsing for ACPI EGM memory device qemu: Add capability detection for ACPI EGM memory device qemu: Add validation for ACPI EGM memory device configuration qemu: Add command line generation for ACPI EGM memory device qemu: Add cgroup and namespace setup for ACPI EGM memory device docs: Document ACPI EGM memory device tests: Add qemuxmlconftest for ACPI EGM memory device docs/formatdomain.rst | 80 ++++++++++++++ src/ch/ch_domain.c | 1 + src/conf/domain_conf.c | 102 ++++++++++++++++++ src/conf/domain_conf.h | 11 ++ src/conf/domain_postparse.c | 8 ++ src/conf/domain_validate.c | 23 ++++ src/conf/schemas/domaincommon.rng | 19 ++++ src/conf/virconftypes.h | 2 + src/libxl/libxl_driver.c | 6 ++ src/lxc/lxc_driver.c | 6 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 21 ++++ src/qemu/qemu_command.c | 37 +++++++ src/qemu/qemu_domain.c | 2 + src/qemu/qemu_domain_address.c | 2 + src/qemu/qemu_driver.c | 3 + src/qemu/qemu_hotplug.c | 5 + src/qemu/qemu_namespace.c | 21 ++++ src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_validate.c | 99 +++++++++++++++++ src/test/test_driver.c | 4 + tests/meson.build | 1 + .../caps_10.0.0_aarch64.xml | 1 + tests/qemuegmmock.c | 67 ++++++++++++ .../acpi-egm-memory.aarch64-latest.args | 1 + .../acpi-egm-memory.aarch64-latest.xml | 56 ++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 27 +++++ tests/qemuxmlconftest.c | 5 +- 29 files changed, 613 insertions(+), 1 deletion(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

1 8

[PATCH] news: document new crypto TLS priority string settings
by Daniel P. Berrangé 22 Jul '25

22 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c7885f01a0..e5e8626729 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -24,6 +24,14 @@ v11.6.0 (unreleased) flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. + * Allow control over QEMU TLS priority strings + + The qemu.conf file now has multiple settings allowing control over the + QEMU TLS priority strings, for the different subsystems in QEMU that + can support TLS. This can be used to workaround a current bug in GNUTLS + that is liable to cause crashes of the source QEMU when performing long + running live migration operations with TLS enabled. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.50.1

2 1

[PATCH 00/19] security_selinux: Refactor temporary variable cleanup
by Peter Krempa 22 Jul '25

22 Jul '25

Some cleanups resutling from analyzing some selinux code. Peter Krempa (19): security/security_driver.c/h: Fix function header formatting virSecuritySELinuxTransactionRun: Refactor cleanup virSecuritySELinuxMCSFind: Refactor variable clearing virSecuritySELinuxRestoreFileLabel: Refactor cleanup virSecuritySELinux(Set|Restore)TPMFileLabel: Automatically free 'cancel_path' virSecuritySELinuxRestoreFileLabels: Refactor variable freeing virSecuritySELinux(Set|Restore)HostdevCapsLabel: Refactor cleanup virSecuritySELinux(Set|Restore)ChardevLabel: Refactor cleanup virSecuritySELinuxSet(Daemon)SocketLabel: Refactor cleanup virSecuritySELinuxSetTapFDLabel: Refactor cleanup security_selinux: Declare internal autoptr cleanup helper for 'context_t' virSecuritySELinuxContextAddRange: Refactor cleanup of 'context_t' virSecuritySELinuxGenNewContext: Refactor cleanup virSecuritySELinuxReserveLabel: Refactor cleanup virSecuritySELinuxGetProcessLabel: Automatically free 'ctx' temp variable virSecuritySELinuxSetFilecon: Automatically free 'econ' temp variable virSecuritySELinuxRestoreInputLabel: Return values directly virSecuritySELinuxGenImageLabel: Refactor cleanup virSecuritySELinuxGetSecurityMountOptions: refactor printing src/security/security_driver.c | 5 +- src/security/security_driver.h | 5 +- src/security/security_selinux.c | 347 +++++++++++++------------------- 3 files changed, 149 insertions(+), 208 deletions(-) -- 2.50.0

2 20

[PATCH v2 0/1] nwfilter: Check before removing and reinserting iptable base chains
by Dion Bosschieter 22 Jul '25

22 Jul '25

Thanks for the feedback. I've applied the iptables -L with a callback handler. The callback handler then decides whether or not to create the base chains. I changed the commit message from "nwfilter: Avoid firewall hole during VM startup by checking rule presence" to "nwfilter: Check before removing and reinserting iptable base chains". I also edited nwfilterxml2firewalltest, so it pretends that currently there are no chains and I changed the expected order of the commonRules. Dion Bosschieter (1): nwfilter: Check before removing and reinserting iptable base chains src/nwfilter/nwfilter_ebiptables_driver.c | 203 +++++++++++++--------- tests/nwfilterxml2firewalltest.c | 58 +++++-- 2 files changed, 163 insertions(+), 98 deletions(-) -- 2.43.0

2 2

[PATCH] qemu: driver: Reformat function headers for block job APIs
by Peter Krempa 22 Jul '25

22 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7c203e32fe..a0f770b053 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14552,8 +14552,11 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, } static int -qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, - unsigned long bandwidth, unsigned int flags) +qemuDomainBlockRebase(virDomainPtr dom, + const char *path, + const char *base, + unsigned long bandwidth, + unsigned int flags) { virDomainObj *vm; int ret = -1; @@ -14625,8 +14628,11 @@ qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, static int -qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, - virTypedParameterPtr params, int nparams, +qemuDomainBlockCopy(virDomainPtr dom, + const char *disk, + const char *destxml, + virTypedParameterPtr params, + int nparams, unsigned int flags) { virQEMUDriver *driver = dom->conn->privateData; @@ -14703,7 +14709,9 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, static int -qemuDomainBlockPull(virDomainPtr dom, const char *path, unsigned long bandwidth, +qemuDomainBlockPull(virDomainPtr dom, + const char *path, + unsigned long bandwidth, unsigned int flags) { virDomainObj *vm; -- 2.50.0

2 1

[PATCH v2 0/1] network: introduce Packet Filter firewall backend
by Roman Bogorodskiy 22 Jul '25

22 Jul '25

Changes since v1: - Left only firewall backend changes - Build network_pf.c only on FreeBSD - pfAddIPSpecificFirewallRules: error message for lack of IPv6 support I have also added a basic docs/drvnetwork.rst, but I think it would make more sense to include it in the follow up series with the bridge driver changes as with this patch alone pf backend cannot be used just yet. Roman Bogorodskiy (1): network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 1 + src/network/bridge_driver_conf.c | 4 + src/network/bridge_driver_linux.c | 2 + src/network/meson.build | 4 + src/network/network_pf.c | 326 ++++++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 9 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 2

[PATCH] bhyve: implement timeout for bhyveload
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

The bhyveload(8) command does not have a native non-interactive mode. It means that in case of errors, e.g. invalid boot media, it just drops into a loader prompt and waits for user input. This behaviour makes it tricky for users to understand what's going on. To address that, run it with the timeout(1) tool which sends SIGTERM after a certain timeout, and then optionally sends SIGKILL if the command keeps hanging. These timeout values could be configured in the bhyve.conf. Setting timeout to 0 mean that bhyveload(8) will be executed directly, without timeout(1). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve.conf | 9 +++++++ src/bhyve/bhyve_command.c | 25 ++++++++++++++++--- src/bhyve/bhyve_conf.c | 12 +++++++++ src/bhyve/bhyve_utils.h | 3 +++ src/bhyve/libvirtd_bhyve.aug | 4 ++- src/bhyve/test_libvirtd_bhyve.aug.in | 2 ++ .../bhyvexml2argv-bhyveload-timeout.args | 10 ++++++++ .../bhyvexml2argv-bhyveload-timeout.ldargs | 7 ++++++ .../bhyvexml2argv-bhyveload-timeout.xml | 23 +++++++++++++++++ tests/bhyvexml2argvtest.c | 6 +++++ 10 files changed, 96 insertions(+), 5 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml diff --git a/src/bhyve/bhyve.conf b/src/bhyve/bhyve.conf index 2a8baacff3..dc8d3d8fd8 100644 --- a/src/bhyve/bhyve.conf +++ b/src/bhyve/bhyve.conf @@ -5,3 +5,12 @@ # Path to a directory with firmware files. By default it's pointing # to the directory that sysutils/bhyve-firmware installs files into. #firmware_dir = "/usr/local/share/uefi-firmware" + +# Set timeout for the bhyveload(8) command. This might be necessary +# because in case of errors bhyveload(8) drops to an interactive +# loader and hangs indefinitely. These timeout values are passed +# to the timeout(1) command. Please refer to its manual page for more +# details. When timeout is 0, bhyveload is executed directly. +# Units are seconds. +#bhyveload_timeout = 300 +#bhyveload_timeout_kill = 15 diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 5757a41e7e..ab6d6e92e4 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -921,11 +921,28 @@ virAppendBootloaderArgs(virCommand *cmd, virDomainDef *def) } static virCommand * -virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, virDomainDiskDef *disk) +virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, + struct _bhyveConn *driver, + virDomainDiskDef *disk) { virCommand *cmd; - - cmd = virCommandNew("bhyveload"); + g_autoptr(virBhyveDriverConfig) cfg = virBhyveDriverGetConfig(driver); + + if (cfg->bhyveloadTimeout > 0) { + /* TODO: update bhyve_process.c to interpret timeout(1) exit + * codes 124-127 to produce more meaningful error messages */ + cmd = virCommandNew("timeout"); + virCommandAddArg(cmd, "--foreground"); + virCommandAddArg(cmd, "--verbose"); + if (cfg->bhyveloadTimeoutKill > 0) { + virCommandAddArg(cmd, "-k"); + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeoutKill); + } + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeout); + virCommandAddArg(cmd, "bhyveload"); + } else { + cmd = virCommandNew("bhyveload"); + } if (def->os.bootloaderArgs == NULL) { VIR_DEBUG("bhyveload with default arguments"); @@ -1212,7 +1229,7 @@ virBhyveProcessBuildLoadCmd(struct _bhyveConn *driver, virDomainDef *def, if (disk == NULL) return NULL; - return virBhyveProcessBuildBhyveloadCmd(def, disk); + return virBhyveProcessBuildBhyveloadCmd(def, driver, disk); } else if (strstr(def->os.bootloader, "grub-bhyve") != NULL) { return virBhyveProcessBuildGrubbhyveCmd(def, driver, devmap_file, devicesmap_out); diff --git a/src/bhyve/bhyve_conf.c b/src/bhyve/bhyve_conf.c index f18b24f91d..182e00ee1d 100644 --- a/src/bhyve/bhyve_conf.c +++ b/src/bhyve/bhyve_conf.c @@ -2,6 +2,7 @@ * bhyve_conf.c: bhyve config file * * Copyright (C) 2017 Roman Bogorodskiy + * Copyright (C) 2025 The FreeBSD Foundation * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -60,6 +61,9 @@ virBhyveDriverConfigNew(void) cfg->libDir = g_strdup_printf("%s/lib/libvirt/bhyve", LOCALSTATEDIR); cfg->nvramDir = g_strdup_printf("%s/nvram", cfg->libDir); + cfg->bhyveloadTimeout = 300; + cfg->bhyveloadTimeoutKill = 15; + return cfg; } @@ -81,6 +85,14 @@ virBhyveLoadDriverConfig(struct _virBhyveDriverConfig *cfg, &cfg->firmwareDir) < 0) return -1; + if (virConfGetValueInt(conf, "bhyveload_timeout", + &cfg->bhyveloadTimeout) < 0) + return -1; + + if (virConfGetValueInt(conf, "bhyveload_timeout_kill", + &cfg->bhyveloadTimeoutKill) < 0) + return -1; + return 0; } diff --git a/src/bhyve/bhyve_utils.h b/src/bhyve/bhyve_utils.h index 9c9ea0a01a..8ed1fa5509 100644 --- a/src/bhyve/bhyve_utils.h +++ b/src/bhyve/bhyve_utils.h @@ -41,6 +41,9 @@ struct _virBhyveDriverConfig { char *firmwareDir; char *libDir; char *nvramDir; + + int bhyveloadTimeout; + int bhyveloadTimeoutKill; }; G_DEFINE_AUTOPTR_CLEANUP_FUNC(virBhyveDriverConfig, virObjectUnref); diff --git a/src/bhyve/libvirtd_bhyve.aug b/src/bhyve/libvirtd_bhyve.aug index b6bee261a6..0fd74d4bb3 100644 --- a/src/bhyve/libvirtd_bhyve.aug +++ b/src/bhyve/libvirtd_bhyve.aug @@ -23,9 +23,11 @@ module Libvirtd_bhyve = let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ] let log_entry = str_entry "firmware_dir" + let bhyveload_timeout = int_entry "bhyveload_timeout" + let bhyveload_timeout_kill = int_entry "bhyveload_timeout_kill" (* Each entry in the config is one of the following three ... *) - let entry = log_entry + let entry = log_entry | bhyveload_timeout | bhyveload_timeout_kill let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/bhyve/test_libvirtd_bhyve.aug.in b/src/bhyve/test_libvirtd_bhyve.aug.in index ec932b4b11..391648e71f 100644 --- a/src/bhyve/test_libvirtd_bhyve.aug.in +++ b/src/bhyve/test_libvirtd_bhyve.aug.in @@ -3,3 +3,5 @@ module Test_libvirtd_bhyve = test Libvirtd_bhyve.lns get conf = { "firmware_dir" = "/usr/local/share/uefi-firmware" } +{ "bhyveload_timeout" = "300" } +{ "bhyveload_timeout_kill" = "15" } diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args new file mode 100644 index 0000000000..153a1d5035 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci-hd,/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs new file mode 100644 index 0000000000..264ae48441 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs @@ -0,0 +1,7 @@ +timeout \ +--foreground \ +--verbose \ +-k 20s 300s bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml new file mode 100644 index 0000000000..0b8066733d --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml @@ -0,0 +1,23 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 2838b20c29..cc6b17233d 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -165,6 +165,8 @@ mymain(void) driver.config->firmwareDir = fakefirmwaredir; driver.config->nvramDir = fakenvramdir; + driver.config->bhyveloadTimeout = 0; + driver.config->bhyveloadTimeoutKill = 0; # define DO_TEST_FULL(name, flags) \ do { \ @@ -305,6 +307,10 @@ mymain(void) driver.bhyvecaps &= ~BHYVE_CAP_VNC_PASSWORD; DO_TEST_FAILURE("vnc-password"); + driver.config->bhyveloadTimeout = 300; + driver.config->bhyveloadTimeoutKill = 20; + DO_TEST("bhyveload-timeout"); + virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); virPortAllocatorRangeFree(driver.remotePorts); -- 2.49.0

2 1

[PATCH] bhyve: don't reset domain autostart flag on destroy
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

Currently, virBhyveProcessStop() uses the virDomainDeleteConfig() helper to clean up domain status. It passes BHYVE_STATE_DIR as a configuration dir and NULL as autostart dir, so the helper does its job, even though it has a different purpose. However, the issue is that it also resets the autostart (and autostartOnce) property. This results in a situation that when a persistent domain with autostart enabled gets destroyed, its autostart state is reported as disabled, which is not correct. To fix that, implement the bhyveProcessRemoveDomainStatus() which removes the status file without side effects on the virDomainObj object. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_process.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 5e77a9c4d6..79be6f7aba 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -427,6 +427,17 @@ virBhyveProcessStart(bhyveConn *driver, return virBhyveProcessStartImpl(driver, vm, reason); } +static void +bhyveProcessRemoveDomainStatus(const char *statusDir, + const char *name) +{ + g_autofree char *file = virDomainConfigFile(statusDir, name); + + if (unlink(file) < 0 && errno != ENOENT && errno != ENOTDIR) + VIR_WARN("Failed to remove domain XML for %s: %s", + name, g_strerror(errno)); +} + int virBhyveProcessStop(struct _bhyveConn *driver, virDomainObj *vm, @@ -483,7 +494,7 @@ virBhyveProcessStop(struct _bhyveConn *driver, cleanup: virPidFileDelete(BHYVE_STATE_DIR, vm->def->name); - virDomainDeleteConfig(BHYVE_STATE_DIR, NULL, vm); + bhyveProcessRemoveDomainStatus(BHYVE_STATE_DIR, vm->def->name); return ret; } -- 2.49.0

2 1

[PATCH 0/2] meson: Report library versions in the summary
by Michal Privoznik 18 Jul '25

18 Jul '25

Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1934463449 and if you shod individual builds you can see these in action. Michal Prívozník (2): meson: Convert attr_dep to dependency() meson: Report library versions in the summary meson.build | 77 ++++++++++++++++++++++++++--------------------------- 1 file changed, 38 insertions(+), 39 deletions(-) -- 2.49.1

2 3

[PATCH] qemu_tpm: Do not use persistent definition during pre-start checks
by Martin Kletzander 18 Jul '25

18 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Commit 3451987fca7c used the persistent TPM Definition in both calls to qemuTPMVirCommandSwtpmAddTPMState() but in one of the two cases it might've been NULL and what's more, it is not the right definition which should've been used. Change that to @tpm which is the current definition. The other call does not have access to the current definition and is only called during updating the profile. But for the sake of fewer future mistakes, keep the other one as is because there is no issue with calling it that way and adding logic that just skips the extra check on NULL could mistake someone in the future. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 5cb678df0eee..4c9445d72c39 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -852,7 +852,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArgFormat(cmd, "type=unixio,path=%s,mode=0600", tpm->data.emulator.source->data.nix.path); - qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, persistentTPMDef, cfg); + qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, tpm, cfg); virCommandAddArg(cmd, "--log"); if (tpm->data.emulator.debug != 0) -- 2.50.1

2 1

[PATCH 0/6] nss: Rework debugging
by Michal Privoznik 18 Jul '25

18 Jul '25

I've been debugging a problem with NSS plugin recently [1] and the fact that I had to recompile libvirt just to enable debugging printings for the NSS plugin turned out very inconvenient. Make the debug printings env var dependant and add a few more printings. 1: https://bugzilla.redhat.com/show_bug.cgi?id=2364285 Michal Prívozník (6): nss: Promote debug message to proper error when time() fails nss: Move logging into a separate file and turn it temporarily on nss: Make logging conditional on an envvar nss: Include filename in debug printings nss: Print module name nss: Debug print JSON files as they are parsed build-aux/syntax-check.mk | 2 +- docs/nss.rst | 13 ++++++ tools/nss/libvirt_nss.c | 8 +++- tools/nss/libvirt_nss.h | 30 +----------- tools/nss/libvirt_nss_leases.c | 12 +++-- tools/nss/libvirt_nss_log.c | 85 ++++++++++++++++++++++++++++++++++ tools/nss/libvirt_nss_log.h | 41 ++++++++++++++++ tools/nss/meson.build | 1 + 8 files changed, 158 insertions(+), 34 deletions(-) create mode 100644 tools/nss/libvirt_nss_log.c create mode 100644 tools/nss/libvirt_nss_log.h -- 2.49.0

3 10

[PATCH 0/3] qemu_tpm: Do not pollute logs with unnecessary warning
by Martin Kletzander 18 Jul '25

18 Jul '25

https://issues.redhat.com/browse/RHEL-80155 Martin Kletzander (3): qemu_tpm: Rename qemuTPMHasSharedStorage -> qemuTPMDomainHasSharedStorage qemu_tpm: Extract per-TPM functionality from qemuTPMDomainHasSharedStorage qemu_tpm: Only warn about missing locking feature on shared filesystems src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_tpm.c | 75 +++++++++++++++++++++++---------------- src/qemu/qemu_tpm.h | 4 +-- 3 files changed, 47 insertions(+), 34 deletions(-) -- 2.50.1

4 8

[PATCH 0/3] qemu: workaround for GNUTLS bug hitting live migration
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

This is a workaround for existing running QEMU processes which are susceptible to a GNUTLS crasher bug with non-multifd live migration: https://gitlab.com/qemu-project/qemu/-/issues/1937 which in turn is caused by a gnutls regression https://gitlab.com/gnutls/gnutls/-/issues/1717 Even if gnutls is fixed, running QEMU processes are still at risk until restarted, and that can't be done without live migrating workloads off, which triggers the bug we're trying to avoid. The only way to avoid this for running QEMU processes is to change the crypto priority string. On Fedora / RHEL distros we can do this on the target QEMU using /etc/crypto-policies configs, but many other distros have now adopted this - hint: this is a very useful thing to adopt. This series gives a more targetted workaround that is compatible with all distros and can be configured on either the source or dst hosts and whose impact is limited just to live migration. Daniel P. Berrangé (3): qemu: fix order of VNC TLS config entries qemu: sanitize blank lines in config file qemu: add ability to set TLS priority string with QEMU src/conf/storage_source_conf.c | 2 + src/conf/storage_source_conf.h | 1 + src/qemu/libvirtd_qemu.aug | 8 +- src/qemu/qemu.conf.in | 99 +++++++++++++++++-- src/qemu/qemu_backup.c | 5 +- src/qemu/qemu_blockjob.c | 1 + src/qemu/qemu_command.c | 15 ++- src/qemu/qemu_command.h | 1 + src/qemu/qemu_conf.c | 22 +++++ src/qemu/qemu_conf.h | 6 ++ src/qemu/qemu_domain.c | 3 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_hotplug.c | 4 +- src/qemu/qemu_hotplug.h | 1 + src/qemu/qemu_migration_params.c | 1 + src/qemu/test_libvirtd_qemu.aug.in | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 2 +- ...graphics-vnc-tls-secret.x86_64-latest.args | 2 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 6 ++ 20 files changed, 170 insertions(+), 20 deletions(-) -- 2.50.1

2 6

Re: download.libvirt.org HTTPS certificate expired causing download failures
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

On Fri, Jul 18, 2025 at 10:36:53AM +0000, Song, Jiaying (CN) wrote: > Hello libvirt team, > > I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. > > This causes download failures in automated builds and package fetching processes. For example, wget reports: > > wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz > ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': > Issued certificate has expired. > > Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? > > Thank you very much for your help! FYI, we connected on IRC and I got this sorted out. It was a result of us having to move to a new physical server on short notice a few weeks ago, combined with an OS upgrade from RHEL 7 to 9. We copied the certs, but failed to setup acme-tiny again on the new machine to renew them. In 3 months time we'll find out if I got the acme-tiny config correct, so if anyone notices problems at that time let me know.... With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH 0/7] tls: Improve validation of certificates if multiple certs are concatenated in one file
by Peter Krempa 18 Jul '25

18 Jul '25

Our code handled properly only multiple CA certs in one file. This patch extends the validation also to multiple client/server certs in one file. Peter Krempa (7): rpc: virnettlscontext: Fix formatting of function definitions virNetTLSContextNewPath: Refactor temporary variable usage virNetTLSCertCheckPair: Fix function definition formatting rpc: virnettlscert: Rename virNetTLSCertLoadCAListFromFile to virNetTLSCertLoadListFromFile virPKIValidateIdentity: Validate all concatenated certificates virNetTLSCertSanityCheck: Validate all concatenated certs Remove unused 'virNetTLSCertLoadFromFile' src/rpc/virnettlscert.c | 94 ++++++++++++-------------------------- src/rpc/virnettlscert.h | 6 ++- src/rpc/virnettlscontext.c | 89 +++++++++++++++++------------------- tools/virt-pki-validate.c | 20 ++++++-- 4 files changed, 90 insertions(+), 119 deletions(-) -- 2.50.0

2 16

download.libvirt.org HTTPS certificate expired causing download failures
by Song, Jiaying (CN) 18 Jul '25

18 Jul '25

Hello libvirt team, I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. This causes download failures in automated builds and package fetching processes. For example, wget reports: wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': Issued certificate has expired. Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? Thank you very much for your help! Best regards, Jiaying.

1 0

[PATCH 0/6] Make virConnectBaselineHypervisorCPU a bit more sane
by Jiri Denemark 18 Jul '25

18 Jul '25

See 2/6 for description of the issue this series is trying to deal with. Jiri Denemark (6): cpu: Show input CPU model names in debug log Clarify documentation of virConnectBaselineHypervisorCPU Change documentation style of virConnectBaselineCPUFlags Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag qemu: Implement VIR_CONNECT_BASELINE_CPU_IGNORE_HOST virsh: Add support for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag docs/manpages/virsh.rst | 20 +++++++++++++++----- include/libvirt/libvirt-host.h | 9 +++++++-- src/cpu/cpu.c | 2 +- src/libvirt-host.c | 30 +++++++++++++++++++++--------- src/qemu/qemu_driver.c | 30 +++++++++++++++++++++--------- tools/virsh-host.c | 8 ++++++++ 6 files changed, 73 insertions(+), 26 deletions(-) -- 2.50.0

3 9

[PATCH] src: fix typo in fixup_name()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Similar branches in the if-else structure look like bad copy-paste. Fix the typo. Fixes: a559ffec44 (src: rewrite ACL rule checker in Python) Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- scripts/check-aclrules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-aclrules.py b/scripts/check-aclrules.py index ed6805058b..13aed99243 100755 --- a/scripts/check-aclrules.py +++ b/scripts/check-aclrules.py @@ -88,7 +88,7 @@ def fixup_name(name): elif name.endswith("Mac"): name = name[:-3] + "MAC" elif name.endswith("Cpu"): - name = name[:-3] + "MAC" + name = name[:-3] + "CPU" elif name.endswith("Os"): name = name[:-2] + "OS" elif name.endswith("Nmi"): -- 2.39.2

2 1

[PATCH v2 0/5] bhyve: TCP console support
by Roman Bogorodskiy 17 Jul '25

17 Jul '25

Changes since v1: I misunderstood semantics of the 'mode' attribute of the <source> element, and used 'connect' while I should have used 'bind', because bhyve listens on the TCP socket and client connects to using using netcat (or any other similar tool). Now it's using the 'bind' value. Other changes: added validation to bhyve_domain.c, and unified error messages used in bhyve_command.c and bhyve_domain.c Roman Bogorodskiy (5): bhyve: support serial type 'tcp' bhyve: increase number of supported consoles to 4 docs: drvbhyve: document TCP console support bhyve: validate serial devices validation bhyve: sync error messages docs/drvbhyve.rst | 19 ++++++ src/bhyve/bhyve_capabilities.c | 3 +- src/bhyve/bhyve_command.c | 42 +++++++++----- src/bhyve/bhyve_domain.c | 27 +++++++++ .../bhyvexml2argv-4-consoles.args | 15 +++++ .../bhyvexml2argv-4-consoles.ldargs | 4 ++ .../bhyvexml2argv-4-consoles.xml | 35 +++++++++++ .../bhyvexml2argv-serial-invalid-port.args | 12 ++++ .../bhyvexml2argv-serial-invalid-port.ldargs | 4 ++ .../bhyvexml2argv-serial-invalid-port.xml | 28 +++++++++ .../bhyvexml2argv-serial-tcp.args | 12 ++++ .../bhyvexml2argv-serial-tcp.ldargs | 4 ++ .../bhyvexml2argv-serial-tcp.xml | 27 +++++++++ tests/bhyvexml2argvtest.c | 3 + .../bhyvexml2xmlout-4-consoles.xml | 58 +++++++++++++++++++ .../bhyvexml2xmlout-serial-tcp.xml | 46 +++++++++++++++ tests/bhyvexml2xmltest.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + 20 files changed, 328 insertions(+), 16 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-4-consoles.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-serial-tcp.xml -- 2.49.0

2 8

[PATCH] virshFindDisk: fix NULL-dereference of xmlCopyNode() result
by Anastasia Belova 17 Jul '25

17 Jul '25

xmlCopyNode() may return NULL. Add a check and log an error in this case. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 22766a1a53 ("virshFindDisk: Sanitize use of 'tmp' variable") Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> --- tools/virsh-domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 7253596f4a..8752294784 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12875,6 +12875,10 @@ virshFindDisk(const char *doc, STREQ_NULLABLE(sourceDir, path) || STREQ_NULLABLE(sourceName, path)) { xmlNodePtr ret = xmlCopyNode(nodes[i], 1); + if (!ret) { + vshError(NULL, "%s", _("Failed to copy node")); + return NULL; + } /* drop backing store since they are not needed here */ virshDiskDropBackingStore(ret); return ret; -- 2.43.0

3 2

[PATCH] network: fix memory leak in networkAddFirewallRules()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Add g_clear_pointer() to networkAddFirewallRules() after using virSetError() to free errInitV4 and errInitV6 to avoid memory leaks. Fixes: ef760a4133 (Revert "network: support setting firewalld zone for bridge device of open networks") Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- src/network/bridge_driver_linux.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 86f6a5915f..93d4d2c8ee 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -413,6 +413,7 @@ networkAddFirewallRules(virNetworkDef *def, (virNetworkDefGetIPByIndex(def, AF_INET, 0) || virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { virSetError(errInitV4); + g_clear_pointer(&errInitV4, virFreeError); return -1; } @@ -421,6 +422,7 @@ networkAddFirewallRules(virNetworkDef *def, virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || def->ipv6nogw)) { virSetError(errInitV6); + g_clear_pointer(&errInitV6, virFreeError); return -1; } -- 2.39.2

2 1

[PATCH 0/2] Introduce hardware UUID (hwuuid) element
by Mark Cave-Ayland 17 Jul '25

17 Jul '25

Following on from the discussions at [1] and more recently [2], this series introduces a new hardware UUID (hwuuid) element that allows an external UUID to be provided to the guest, as opposed to the libvirt domain UUID. The use case for this feature is to allow a domain to cloned and then restarted without changing its guest-visible UUID e.g. via dmidecode. Patch 1 introduces the new hardware UUID (hwuuid) element along with an implementation for the QEMU driver, whilst patch 2 adds additional tests to ensure the hwuuid functionality is working as expected. Note that from reading the source it doesn't appear as if all virtualisation platforms will support this feature: I've included the relevant changes for the QEMU driver since that is what we use here at Nutanix. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HGFT… Mark Cave-Ayland (2): conf: introduce hardware UUID (hwuuid) element qemuxmlconftest: add tests for new hardware UUID (hwuuid) element docs/formatdomain.rst | 7 ++++ src/conf/domain_conf.c | 38 +++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 6 ++- ...hwuuid-smbios-uuid-match.x86_64-latest.err | 1 + .../hwuuid-smbios-uuid-match.xml | 36 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 35 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/hwuuid.xml | 30 ++++++++++++++ tests/qemuxmlconftest.c | 3 ++ 11 files changed, 199 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.xml -- 2.43.0

2 4

[RFC PATCH 0/6] Fix building of sparc/sparc32plus test cases
by Alex Bennée 17 Jul '25

17 Jul '25

We didn't have any reliable way to build sparc test cases. I have found someone who ships a compiler but the binaries still don't run due to the need for CASA. I'm posting mainly for those who actually care who might want to fix up the remaining cases. Alex. Alex Bennée (6): tests/tcg: special case sparc test cases tests/tcg: special case sparc32plus test cases configure: update sparc and sparc32plus target compiler detection tests/docker: add sparc-leon-cross container image configure: enable the container fallbacks for sparc/sparc32plus docs/about: deprecate add sparc/sparc32plus-*-user docs/about/deprecated.rst | 8 ++++ configure | 11 ++++- .../dockerfiles/sparc-leon-cross.docker | 40 +++++++++++++++++ tests/tcg/Makefile.target | 9 ++-- tests/tcg/sparc/Makefile.target | 45 +++++++++++++++++++ tests/tcg/sparc32plus | 1 + 6 files changed, 108 insertions(+), 6 deletions(-) create mode 100644 tests/docker/dockerfiles/sparc-leon-cross.docker create mode 100644 tests/tcg/sparc/Makefile.target create mode 120000 tests/tcg/sparc32plus -- 2.47.2

3 9

[PATCH] Allow specifying zero discard granularity for block devices
by Martin Kletzander 17 Jul '25

17 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> That allows for disabling discard in a way that some guest OSes (e.g. Windows) understand and do not try to trim the disk. Resolves: https://issues.redhat.com/browse/RHEL-72006 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Out of all the approaches for allowing previously default value 100% of them are ugly. This one is maybe slightly more error-prone. src/conf/domain_conf.c | 12 ++++++++---- src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 2 +- src/qemu/qemu_command.c | 7 ++++++- tests/qemuxmlconftest.c | 1 + 5 files changed, 17 insertions(+), 6 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index bfc62b62705f..ba0d4a7b128c 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -8554,6 +8554,8 @@ virDomainDiskDefParseXML(virDomainXMLOption *xmlopt, } if ((blockioNode = virXPathNode("./blockio", ctxt))) { + int tmp = 0; + if (virXMLPropUInt(blockioNode, "logical_block_size", 10, VIR_XML_PROP_NONE, &def->blockio.logical_block_size) < 0) return NULL; @@ -8562,9 +8564,11 @@ virDomainDiskDefParseXML(virDomainXMLOption *xmlopt, &def->blockio.physical_block_size) < 0) return NULL; - if (virXMLPropUInt(blockioNode, "discard_granularity", 10, VIR_XML_PROP_NONE, - &def->blockio.discard_granularity) < 0) + if ((tmp = virXMLPropUInt(blockioNode, "discard_granularity", 10, VIR_XML_PROP_NONE, + &def->blockio.discard_granularity)) < 0) return NULL; + if (tmp > 0) + def->blockio.discard_granularity_specified = true; } if ((driverNode = virXPathNode("./driver", ctxt))) { @@ -23102,7 +23106,7 @@ virDomainDiskBlockIoDefFormat(virBuffer *buf, { if (def->blockio.logical_block_size > 0 || def->blockio.physical_block_size > 0 || - def->blockio.discard_granularity > 0) { + def->blockio.discard_granularity_specified) { virBufferAddLit(buf, "<blockio"); if (def->blockio.logical_block_size > 0) { virBufferAsprintf(buf, @@ -23114,7 +23118,7 @@ virDomainDiskBlockIoDefFormat(virBuffer *buf, " physical_block_size='%u'", def->blockio.physical_block_size); } - if (def->blockio.discard_granularity > 0) { + if (def->blockio.discard_granularity_specified) { virBufferAsprintf(buf, " discard_granularity='%u'", def->blockio.discard_granularity); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 6997cf7c09be..6008ec66d3fe 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -560,6 +560,7 @@ struct _virDomainDiskDef { unsigned int logical_block_size; unsigned int physical_block_size; unsigned int discard_granularity; + bool discard_granularity_specified; } blockio; virDomainBlockIoTuneInfo blkdeviotune; diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index b28af7fa5618..8f7259a0e1ed 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -462,7 +462,7 @@ virDomainDiskVhostUserValidate(const virDomainDiskDef *disk) if (disk->blockio.logical_block_size > 0 || disk->blockio.physical_block_size > 0 || - disk->blockio.discard_granularity > 0) { + disk->blockio.discard_granularity_specified) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("blockio is not supported with vhostuser disk")); return -1; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7658cc4d395a..fc6ce4dd9143 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1899,7 +1899,6 @@ qemuBuildDiskDeviceProps(const virDomainDef *def, "S:loadparm", bootLoadparm, "p:logical_block_size", logical_block_size, "p:physical_block_size", physical_block_size, - "p:discard_granularity", discard_granularity, "A:wwn", &wwn, "p:rotation_rate", disk->rotation_rate, "S:vendor", disk->vendor, @@ -1917,6 +1916,12 @@ qemuBuildDiskDeviceProps(const virDomainDef *def, NULL) < 0) return NULL; + if (disk->blockio.discard_granularity_specified && + virJSONValueObjectAdd(&props, + "u:discard_granularity", discard_granularity, + NULL) < 0) + return NULL; + return g_steal_pointer(&props); } diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 9fba98429019..ae8efd58f8ac 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1694,6 +1694,7 @@ mymain(void) DO_TEST_CAPS_LATEST("disk-ide-wwn"); DO_TEST_CAPS_LATEST("disk-geometry"); DO_TEST_CAPS_LATEST("disk-blockio"); + DO_TEST_CAPS_LATEST("disk-blockio-no-discard"); driver.config->storageUseNbdkit = 1; DO_TEST_CAPS_LATEST_NBDKIT("disk-cdrom-network-nbdkit", QEMU_NBDKIT_CAPS_PLUGIN_CURL); -- 2.50.1

3 3

[libvirt PATCH 0/2] tests: nssdata: add empty status file
by Ján Tomko 17 Jul '25

17 Jul '25

A blurb is a short promotional piece accompanying a piece of creative work. It may be written by the author or publisher or quote praise from others. Blurbs were originally printed on the back or rear dust jacket of a book. With the development of the mass-market paperback, they were placed on both covers by most publishers. Now they are also found on web portals and news websites. A blurb may introduce a newspaper or a book. -- https://en.wikipedia.org/wiki/Blurb Ján Tomko (2): DO NOT PUSH Revert "nss: Skip empty files and avoid use of uninitialized value" tests: nssdata: add empty status file tests/nssdata/virbr2.status | 0 tools/nss/libvirt_nss_leases.c | 9 ++------- tools/nss/libvirt_nss_macs.c | 9 ++------- 3 files changed, 4 insertions(+), 14 deletions(-) create mode 100644 tests/nssdata/virbr2.status -- 2.50.1

2 3

[PATCH 0/2] qemu: Random fixes
by Michal Privoznik 17 Jul '25

17 Jul '25

I've been migrating some machines recently and on dst didn't have VSOCK enabled in the kernel which led to 1/2. Then I've also noticed weird looking error messaged around TPM which led to 2/2. Michal Prívozník (2): qemu: Report system error on failed open() qemu_tpm: Don't report uninitialized variable in error message src/qemu/qemu_domain.c | 8 ++++---- src/qemu/qemu_process.c | 4 ++-- src/qemu/qemu_tpm.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) -- 2.49.1

2 3

[PATCH 0/1] qemu qapi: SIGSEGV small fix
by Nikolai Barybin 16 Jul '25

16 Jul '25

Hello everyone! When implementing some custom qemu capability I cought this bug when some string with '*' pattern is not contained in schema, and virQEMUQAPISchemaTraverseObject passes NULL ptr to virJSONValueObjectHasKey. Nikolai Barybin (1): qemu: qapi: fix potential SIGSEGV in virQEMUQAPISchemaTraverseObject() src/qemu/qemu_qapi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.43.5

2 4

[libvirt PATCH] conf: schemas: add sysinfocommon.rng into list of installed schemas
by Pavel Hrdina 15 Jul '25

15 Jul '25

From: Pavel Hrdina <phrdina(a)redhat.com> Fixes: 918594b419ea3944220fcbab6cf4f1ce7d81e609 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/conf/schemas/meson.build | 1 + 1 file changed, 1 insertion(+) diff --git a/src/conf/schemas/meson.build b/src/conf/schemas/meson.build index b293373085..7ec625b8db 100644 --- a/src/conf/schemas/meson.build +++ b/src/conf/schemas/meson.build @@ -25,6 +25,7 @@ schema_files = [ 'storagepoolcaps.rng', 'storagepool.rng', 'storagevol.rng', + 'sysinfocommon.rng', ] install_data(schema_files, install_dir: pkgdatadir / 'schemas') -- 2.50.1

2 2

[PATCH 0/5] Some parsing functions refactor
by Kirill Shchetiniuk 15 Jul '25

15 Jul '25

This patch series is supposed to refactor the existing logic of some parsing functions, changing the previous approach of getting the string fisrt and then parsing the string itself. Now the parsing logic is implemented by using the appropriate virXMLProp* functions. In some places the error reporter was changed along with the reported error message and this change was also reflected in exsiting test cases. Kirill Shchetiniuk (5): conf: virNetDevVPortProfileParse refactor conf: virDomainHostdevSubsysMediatedDevDefParseXML refactor util: virSecretLookupParseSecret refactor conf: virDomainChrDefParseTargetXML refactor qemu: qemuDomainObjPrivateXMLParseVcpu refactor src/conf/domain_conf.c | 28 +--- src/conf/netdev_vport_profile_conf.c | 120 +++++++----------- src/qemu/qemu_domain.c | 16 +-- src/util/virsecret.c | 19 +-- ...mdev-src-address-invalid.x86_64-latest.err | 2 +- 5 files changed, 60 insertions(+), 125 deletions(-) -- 2.49.0

2 10

[PATCH 0/3] bhyve: TCP console support
by Roman Bogorodskiy 14 Jul '25

14 Jul '25

Roman Bogorodskiy (3): bhyve: support serial type 'tcp' bhyve: increase number of supported consoles to 4 docs: drvbhyve: document TCP console support docs/drvbhyve.rst | 19 ++++++ src/bhyve/bhyve_capabilities.c | 3 +- src/bhyve/bhyve_command.c | 42 +++++++++----- .../bhyvexml2argv-4-consoles.args | 15 +++++ .../bhyvexml2argv-4-consoles.ldargs | 4 ++ .../bhyvexml2argv-4-consoles.xml | 35 +++++++++++ .../bhyvexml2argv-serial-invalid-port.args | 12 ++++ .../bhyvexml2argv-serial-invalid-port.ldargs | 4 ++ .../bhyvexml2argv-serial-invalid-port.xml | 28 +++++++++ .../bhyvexml2argv-serial-tcp.args | 12 ++++ .../bhyvexml2argv-serial-tcp.ldargs | 4 ++ .../bhyvexml2argv-serial-tcp.xml | 27 +++++++++ tests/bhyvexml2argvtest.c | 3 + .../bhyvexml2xmlout-4-consoles.xml | 58 +++++++++++++++++++ .../bhyvexml2xmlout-serial-tcp.xml | 46 +++++++++++++++ tests/bhyvexml2xmltest.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + 19 files changed, 301 insertions(+), 16 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-4-consoles.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-serial-tcp.xml -- 2.49.0

2 6

[PATCH 0/3] sysinfotest: rename output XMLs with .xml suffix and introduce schema testing
by Peter Krempa 14 Jul '25

14 Jul '25

As noticed in: https://gitlab.com/libvirt/libvirt-go-xml-module/-/issues/10#note_2608097257 This series: - renames the output files with .xml suffix - refactors the schema for the domain <sysinfo> to be reusable - introduces schema to validate the host sysinfo document and tests the output files in virschematest Peter Krempa (3): sysinfotest: Use '.xml' suffix for output files conf: schemas: Split out common parts of 'sysinfo' schema schema: Schema validate host '<sysinfo>' XML test documents src/conf/schemas/domaincommon.rng | 126 +---------- src/conf/schemas/sysinfo.rng | 34 +++ src/conf/schemas/sysinfocommon.rng | 204 ++++++++++++++++++ ...nfo.expect => aarch64-gigabytesysinfo.xml} | 0 ...o.expect => aarch64-hpe-apollosysinfo.xml} | 0 ...nfo.expect => aarch64-moonshotsysinfo.xml} | 0 ...rch64sysinfo.expect => aarch64sysinfo.xml} | 0 ...rpi2sysinfo.expect => arm-rpi2sysinfo.xml} | 0 .../{armsysinfo.expect => armsysinfo.xml} | 0 .../{ppcsysinfo.expect => ppcsysinfo.xml} | 0 ...reqsysinfo.expect => s390-freqsysinfo.xml} | 0 .../{s390sysinfo.expect => s390sysinfo.xml} | 0 .../{x86sysinfo.expect => x86sysinfo.xml} | 0 tests/sysinfotest.c | 2 +- tests/virschematest.c | 5 + 15 files changed, 251 insertions(+), 120 deletions(-) create mode 100644 src/conf/schemas/sysinfo.rng create mode 100644 src/conf/schemas/sysinfocommon.rng rename tests/sysinfodata/{aarch64-gigabytesysinfo.expect => aarch64-gigabytesysinfo.xml} (100%) rename tests/sysinfodata/{aarch64-hpe-apollosysinfo.expect => aarch64-hpe-apollosysinfo.xml} (100%) rename tests/sysinfodata/{aarch64-moonshotsysinfo.expect => aarch64-moonshotsysinfo.xml} (100%) rename tests/sysinfodata/{aarch64sysinfo.expect => aarch64sysinfo.xml} (100%) rename tests/sysinfodata/{arm-rpi2sysinfo.expect => arm-rpi2sysinfo.xml} (100%) rename tests/sysinfodata/{armsysinfo.expect => armsysinfo.xml} (100%) rename tests/sysinfodata/{ppcsysinfo.expect => ppcsysinfo.xml} (100%) rename tests/sysinfodata/{s390-freqsysinfo.expect => s390-freqsysinfo.xml} (100%) rename tests/sysinfodata/{s390sysinfo.expect => s390sysinfo.xml} (100%) rename tests/sysinfodata/{x86sysinfo.expect => x86sysinfo.xml} (100%) -- 2.50.0

2 4

Support cloning of VMs - part 2
by Mark Cave-Ayland 11 Jul '25

11 Jul '25

Hi all, I'm currently looking at how libvirt can be used to clone a saved VM, and have been focusing on the previous thread on this topic at https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2…. My understanding from reading the thread is that the best way to approach this is 1) add uuid properties to the relevant objects/devices in QEMU where the UUID is user-visible, and 2) update libvirt to handle these properties via XML. Does this sound correct, or is there any more recent thinking about the best approach to take? ATB, Mark.

3 8

[PATCH] build: prohibit realpath() by syntax-check
by Michal Privoznik 11 Jul '25

11 Jul '25

From: Michal Privoznik <mprivozn(a)redhat.com> We have virFileCanonicalizePath() which calls realpath() but also is present in our mocks (in contrast to realpath()). Introduce a syntax-check rule to enforce use of our wrapper. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- build-aux/syntax-check.mk | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/build-aux/syntax-check.mk b/build-aux/syntax-check.mk index 1303a0ce7e..27eabe6565 100644 --- a/build-aux/syntax-check.mk +++ b/build-aux/syntax-check.mk @@ -247,6 +247,12 @@ sc_prohibit_canonicalize_file_name: halt='use virFileCanonicalizePath() instead of canonicalize_file_name()' \ $(_sc_search_regexp) +sc_prohibit_realpath: + @prohibit='\<realpath\(' \ + exclude='exempt from syntax-check' \ + halt='use virFileCanonicalizePath() instead of realpath()' \ + $(_sc_search_regexp) + # qsort from glibc has unstable sort ordering for "equal" members sc_prohibit_qsort: @prohibit='\<(qsort|qsort_r) *\(' \ @@ -1420,6 +1426,9 @@ exclude_file_name_regexp--sc_prohibit_nonreentrant = \ exclude_file_name_regexp--sc_prohibit_canonicalize_file_name = \ ^(build-aux/syntax-check\.mk|tests/virfilemock\.c)$$ +exclude_file_name_regexp--sc_prohibit_realpath = \ + ^(build-aux/syntax-check\.mk|src/cpu_map/sync_qemu_features_i386\.py|tests/virfilemock\.c)$$ + exclude_file_name_regexp--sc_prohibit_raw_allocation = \ ^(docs/advanced-tests\.rst|src/util/viralloc\.[ch]|examples/.*|tests/(securityselinuxhelper|(vircgroup|nss)mock|commandhelper)\.c|tools/wireshark/src/packet-libvirt\.c|tools/nss/libvirt_nss(_leases|_macs)?\.[ch])$$ -- 2.49.0

2 1

[libvirt PATCH] docs: hacking: Define policy forbidding use of AI code generators
by Pavel Hrdina 11 Jul '25

11 Jul '25

This policy is a copy of what QEMU project is using [1] as there is no reason to use different policy, only modification is changing the project name and link to DCO. [1] <https://www.qemu.org/docs/master/devel/code-provenance.html#use-of-ai-conte…> Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- docs/hacking.rst | 52 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/docs/hacking.rst b/docs/hacking.rst index 825b8b83d2..5f0f867b9f 100644 --- a/docs/hacking.rst +++ b/docs/hacking.rst @@ -90,6 +90,58 @@ formal ID documents, but should not be anonymous, nor misrepresent who you are. The presence of this line attests that the contributor has read the above linked DCO and agrees with its statements. +Use of AI content generators +============================ + +TL;DR: + + **Current libvirt project policy is to DECLINE any contributions which are + believed to include or derive from AI generated content. This includes + ChatGPT, Claude, Copilot, Llama and similar tools.** + +The increasing prevalence of AI-assisted software development results in a +number of difficult legal questions and risks for software projects, including +libvirt. Of particular concern is content generated by `Large Language Models +<https://en.wikipedia.org/wiki/Large_language_model>`__ (LLMs). + +The libvirt community requires that contributors certify their patch submissions +are made in accordance with the rules of the `Developer Certificate of +Origin`_. + +To satisfy the DCO, the patch contributor has to fully understand the +copyright and license status of content they are contributing to libvirt. With +AI content generators, the copyright and license status of the output is +ill-defined with no generally accepted, settled legal foundation. + +Where the training material is known, it is common for it to include large +volumes of material under restrictive licensing/copyright terms. Even where +the training material is all known to be under open source licenses, it is +likely to be under a variety of terms, not all of which will be compatible +with libvirt's licensing requirements. + +How contributors could comply with DCO terms (b) or (c) for the output of AI +content generators commonly available today is unclear. The libvirt project is +not willing or able to accept the legal risks of non-compliance. + +The libvirt project thus requires that contributors refrain from using AI +content generators on patches intended to be submitted to the project, and +will decline any contribution if use of AI is either known or suspected. + +This policy does not apply to other uses of AI, such as researching APIs or +algorithms, static analysis, or debugging, provided their output is not to be +included in contributions. + +Examples of tools impacted by this policy includes GitHub's CoPilot, OpenAI's +ChatGPT, Anthropic's Claude, and Meta's Code Llama, and code/content +generation agents which are built on top of such tools. + +This policy may evolve as AI tools mature and the legal situation is +clarified. In the meanwhile, requests for exceptions to this policy will be +evaluated by the libvirt project on a case by case basis. To be granted an +exception, a contributor will need to demonstrate clarity of the license and +copyright status for the tool's output in relation to its training model and +code, to the satisfaction of the project maintainers. + Further reading =============== -- 2.49.0

3 3

[PATCH] NEWS: Mention switch to virtio-scsi on ARM
by Jim Fehlig 10 Jul '25

10 Jul '25

From: Jim Fehlig <jfehlig(a)suse.com> Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d8bd2559f4..59494cb380 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,12 @@ v11.6.0 (unreleased) * **Improvements** + * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM + + The previous default of ``lsilogic`` is unsupported by modern operating + systems. ``virtio-scsi`` is a more suitable default for ARM ``virt`` + machine types. + * **Bug fixes** -- 2.43.0

2 2

How to process after sending a patch assisted with AI
by Enrique Llorente Pastora 10 Jul '25

10 Jul '25

Hi, How should I process after sending a patch that has code generated by AI [1] ? Is creating a new AI free version with some explanation enough to prevent the submission from being suspicious ? Possible example for explanation would be "I am using how qemu:commandline is implemented as inspiration for the feature and not AI was used to generate code or tests as opposed to v3". BR. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/ZNR… -- Quique Llorente CNV networking Senior Software Engineer Red Hat EMEA ellorent(a)redhat.com @RedHat Red Hat Red Hat

1 0

[PATCH v3] qemu: passt: add support for custom command line arguments
by Enrique Llorente 10 Jul '25

10 Jul '25

This adds support for custom command line arguments for the passt backend, similar to qemu:commandline. The feature allows passing additional arguments to the passt process for development and testing purposes. The implementation: - Adds a passt XML namespace for custom arguments - Properly taints the domain when custom args are used - Includes comprehensive test coverage - Adds documentation for the new feature Usage example: <interface type='user'> <backend type='passt' xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> <passt:commandline> <passt:arg value='--debug'/> <passt:arg value='--verbose'/> </passt:commandline> </backend> </interface> Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- v3: - Fix all test problems - Refactor domain_conf.c to use libvirt xml constructs to have proper indent - Rework documentation and make it more concise - Add domainpassttest.c to check that arguments are passed to passt docs/formatdomain.rst | 38 ++++ src/conf/domain_conf.c | 61 ++++++- src/conf/domain_conf.h | 6 + src/conf/schemas/domaincommon.rng | 15 ++ src/qemu/qemu_passt.c | 9 + tests/meson.build | 1 + tests/qemupassttest.c | 162 ++++++++++++++++++ ...-user-passt-custom-args.x86_64-latest.args | 35 ++++ ...t-user-passt-custom-args.x86_64-latest.xml | 67 ++++++++ .../net-user-passt-custom-args.xml | 64 +++++++ tests/qemuxmlconftest.c | 1 + 11 files changed, 458 insertions(+), 1 deletion(-) create mode 100644 tests/qemupassttest.c create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 9a2f065590..4c01a07135 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -5464,6 +5464,44 @@ ports **with the exception of some subset**. </devices> ... +Custom passt commandline arguments +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. warning:: + + **This is an unsupported feature for development and testing only.** + Using it will taint the domain. Users are strongly advised to use the + proper libvirt XML elements for configuring passt instead. + + +:since:`Since 11.7.0` For development and testing purposes, it is +sometimes useful to be able to pass additional command-line arguments +directly to the passt process. This can be accomplished using a +special passt namespace in the domain XML that is similar to the qemu +commandline namespace: + +:: + + ... + <devices> + ... + <interface type='user'> + <backend type='passt'> + <passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + </passt:commandline> + </backend> + </interface> + </devices> + ... + +Any arguments provided using this method will be appended to the passt +command line, and will therefore override any default options set by +libvirt in the case of conflicts. **This can lead to unexpected behavior +and libvirt cannot guarantee functionality when its default configuration +is overridden.** + Generic ethernet connection ^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1e24e41a48..9721763622 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2918,6 +2918,10 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->backend.tap); g_free(def->backend.vhost); g_free(def->backend.logFile); + if (def->backend.passtCommandline) { + g_strfreev(def->backend.passtCommandline->args); + g_free(def->backend.passtCommandline); + } virDomainNetTeamingInfoFree(def->teaming); g_free(def->virtPortProfile); g_free(def->script); @@ -9772,6 +9776,7 @@ virDomainNetBackendParseXML(xmlNodePtr node, { g_autofree char *tap = virXMLPropString(node, "tap"); g_autofree char *vhost = virXMLPropString(node, "vhost"); + xmlNodePtr cur; /* In the case of NET_TYPE_USER, backend type can be unspecified * (i.e. VIR_DOMAIN_NET_BACKEND_DEFAULT) and that means 'use @@ -9808,6 +9813,38 @@ virDomainNetBackendParseXML(xmlNodePtr node, def->backend.vhost = virFileSanitizePath(vhost); } + /* Parse passt namespace commandline */ + cur = node->children; + while (cur != NULL) { + if (cur->type == XML_ELEMENT_NODE) { + if (cur->ns && + STREQ((const char *)cur->ns->href, "http://libvirt.org/schemas/domain/passt/1.0") && + STREQ((const char *)cur->name, "commandline")) { + xmlNodePtr arg_node = cur->children; + g_autoptr(GPtrArray) args = g_ptr_array_new(); + + while (arg_node != NULL) { + if (arg_node->type == XML_ELEMENT_NODE && + arg_node->ns && + STREQ((const char *)arg_node->ns->href, "http://libvirt.org/schemas/domain/passt/1.0") && + STREQ((const char *)arg_node->name, "arg")) { + g_autofree char *value = virXMLPropString(arg_node, "value"); + if (value) + g_ptr_array_add(args, g_strdup(value)); + } + arg_node = arg_node->next; + } + + if (args->len > 0) { + def->backend.passtCommandline = g_new0(virDomainNetBackendPasstCommandline, 1); + g_ptr_array_add(args, NULL); /* NULL-terminate */ + def->backend.passtCommandline->args = (char **)g_ptr_array_steal(args, NULL); + } + } + } + cur = cur->next; + } + return 0; } @@ -20802,6 +20839,7 @@ virDomainNetBackendIsEqual(virDomainNetBackend *src, STRNEQ_NULLABLE(src->logFile, dst->logFile)) { return false; } + return true; } @@ -24921,11 +24959,29 @@ virDomainNetTeamingInfoFormat(virDomainNetTeamingInfo *teaming, } +static void +virDomainNetBackendPasstCommandLineFormat(virBuffer *buf, + virDomainNetBackend *backend) +{ + g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER; + g_auto(virBuffer) childBuf = VIR_BUFFER_INIT_CHILD(buf); + GStrv n; + + if (backend->passtCommandline && backend->passtCommandline->args) { + for (n = backend->passtCommandline->args; n && *n; n++) + virBufferEscapeString(&childBuf, "<passt:arg value='%s'/>\n", *n); + virBufferAddLit(&attrBuf, " xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'"); + virXMLFormatElement(buf, "passt:commandline", &attrBuf, &childBuf); + } + +} + static void virDomainNetBackendFormat(virBuffer *buf, virDomainNetBackend *backend) { g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER; + g_auto(virBuffer) childBuf = VIR_BUFFER_INIT_CHILD(buf); if (backend->type) { virBufferAsprintf(&attrBuf, " type='%s'", @@ -24934,7 +24990,10 @@ virDomainNetBackendFormat(virBuffer *buf, virBufferEscapeString(&attrBuf, " tap='%s'", backend->tap); virBufferEscapeString(&attrBuf, " vhost='%s'", backend->vhost); virBufferEscapeString(&attrBuf, " logFile='%s'", backend->logFile); - virXMLFormatElement(buf, "backend", &attrBuf, NULL); + + virDomainNetBackendPasstCommandLineFormat(&childBuf, backend); + + virXMLFormatElement(buf, "backend", &attrBuf, &childBuf); } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 6997cf7c09..1f51bad546 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1070,12 +1070,18 @@ struct _virDomainActualNetDef { unsigned int class_id; /* class ID for bandwidth 'floor' */ }; +typedef struct _virDomainNetBackendPasstCommandline virDomainNetBackendPasstCommandline; +struct _virDomainNetBackendPasstCommandline { + char **args; /* NULL-terminated array of arguments */ +}; + struct _virDomainNetBackend { virDomainNetBackendType type; char *tap; char *vhost; /* The following are currently only valid/used when backend type='passt' */ char *logFile; /* path to logfile used by passt process */ + virDomainNetBackendPasstCommandline *passtCommandline; /* for passt overrides */ }; struct _virDomainNetPortForwardRange { diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index 183dd5db5e..e176073c6a 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -3908,6 +3908,9 @@ </optional> <optional> <element name="backend"> + <optional> + <ref name="passtcmdline"/> + </optional> <optional> <attribute name="type"> <choice> @@ -8877,6 +8880,18 @@ </attribute> </define> + <define name="passtcmdline"> + <element name="commandline" ns="http://libvirt.org/schemas/domain/passt/1.0"> + <interleave> + <zeroOrMore> + <element name="arg"> + <attribute name="value"/> + </element> + </zeroOrMore> + </interleave> + </element> + </define> + <define name="coalesce"> <element name="coalesce"> <interleave> diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c index fcc34de384..0163553cee 100644 --- a/src/qemu/qemu_passt.c +++ b/src/qemu/qemu_passt.c @@ -317,6 +317,15 @@ qemuPasstStart(virDomainObj *vm, virCommandAddArg(cmd, virBufferCurrentContent(&buf)); } + /* Add custom passt arguments from namespace */ + if (net->backend.passtCommandline && net->backend.passtCommandline->args) { + for (i = 0; net->backend.passtCommandline->args[i]; i++) { + virCommandAddArg(cmd, net->backend.passtCommandline->args[i]); + } + + /* Taint the domain when using custom passt arguments */ + qemuDomainObjTaint(driver, vm, VIR_DOMAIN_TAINT_CUSTOM_ARGV, NULL); + } if (qemuExtDeviceLogCommand(driver, vm, cmd, "passt") < 0) return -1; diff --git a/tests/meson.build b/tests/meson.build index 0d76d37959..fe9013b600 100644 --- a/tests/meson.build +++ b/tests/meson.build @@ -269,6 +269,7 @@ tests += [ { 'name': 'networkxml2xmlupdatetest' }, { 'name': 'nodedevxml2xmltest' }, { 'name': 'nwfilterxml2xmltest' }, + { 'name': 'qemupassttest' }, { 'name': 'seclabeltest' }, { 'name': 'secretxml2xmltest' }, { 'name': 'sockettest' }, diff --git a/tests/qemupassttest.c b/tests/qemupassttest.c new file mode 100644 index 0000000000..84f4c1510a --- /dev/null +++ b/tests/qemupassttest.c @@ -0,0 +1,162 @@ +/* + * Copyright (C) 2024 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "testutils.h" +#include "conf/domain_conf.h" +#include "viralloc.h" +#include "virstring.h" +#include "virlog.h" + +#define VIR_FROM_THIS VIR_FROM_QEMU + +VIR_LOG_INIT("tests.qemupassttest"); + +struct testPasstData { + const char *name; + const char *xmlfile; + const char * const *expectedArgs; + size_t nExpectedArgs; + bool expectCustomArgs; +}; + +static virDomainDef * +testParseDomainXML(const char *xmlfile) +{ + g_autofree char *xmlpath = NULL; + g_autofree char *xmldata = NULL; + virDomainDef *def = NULL; + g_autoptr(virDomainXMLOption) xmlopt = NULL; + + xmlpath = g_strdup_printf("%s/qemuxmlconfdata/%s", abs_srcdir, xmlfile); + + if (virTestLoadFile(xmlpath, &xmldata) < 0) + return NULL; + + if (!(xmlopt = virDomainXMLOptionNew(NULL, NULL, NULL, NULL, NULL, NULL))) + return NULL; + + def = virDomainDefParseString(xmldata, xmlopt, NULL, + VIR_DOMAIN_DEF_PARSE_INACTIVE); + + return def; +} + +static int +testPasstParseCustomArgs(const void *opaque) +{ + const struct testPasstData *data = opaque; + g_autoptr(virDomainDef) def = NULL; + virDomainNetDef *net = NULL; + size_t i; + + if (!(def = testParseDomainXML(data->xmlfile))) { + VIR_TEST_DEBUG("Failed to parse domain XML"); + return -1; + } + + /* Find the interface with passt backend */ + for (i = 0; i < def->nnets; i++) { + if (def->nets[i]->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { + net = def->nets[i]; + break; + } + } + + if (!net) { + VIR_TEST_DEBUG("No passt interface found in domain XML"); + return -1; + } + + /* Check if we have custom arguments */ + if (data->expectCustomArgs) { + char **args; + + if (!net->backend.passtCommandline || !net->backend.passtCommandline->args) { + VIR_TEST_DEBUG("Expected custom args but none found"); + return -1; + } + + args = net->backend.passtCommandline->args; + + if (g_strv_length(args) != data->nExpectedArgs) { + VIR_TEST_DEBUG("Expected %zu arguments but found %u", + data->nExpectedArgs, g_strv_length(args)); + return -1; + } + + /* Verify all expected arguments are present */ + for (i = 0; i < data->nExpectedArgs; i++) { + if (!g_strv_contains((const char * const *)args, data->expectedArgs[i])) { + VIR_TEST_DEBUG("Missing expected argument: %s", data->expectedArgs[i]); + return -1; + } + } + } else { + /* Should not have custom arguments */ + if (net->backend.passtCommandline && + net->backend.passtCommandline->args && + *net->backend.passtCommandline->args) { + VIR_TEST_DEBUG("Found custom args but none expected"); + return -1; + } + } + + return 0; +} + +static int +mymain(void) +{ + int ret = 0; + + static const char * const customArgsExpected[] = { + "--debug", + "--verbose", + "--socket=/tmp/foo.socket" + }; + + struct testPasstData customArgsData = { + .name = "custom-args", + .xmlfile = "net-user-passt-custom-args.xml", + .expectedArgs = customArgsExpected, + .nExpectedArgs = G_N_ELEMENTS(customArgsExpected), + .expectCustomArgs = true, + }; + + struct testPasstData noCustomArgsData = { + .name = "no-custom-args", + .xmlfile = "net-user-passt.xml", + .expectedArgs = NULL, + .nExpectedArgs = 0, + .expectCustomArgs = false, + }; + + if (virTestRun("passt XML parsing with custom args", + testPasstParseCustomArgs, &customArgsData) < 0) + ret = -1; + + if (virTestRun("passt XML parsing without custom args", + testPasstParseCustomArgs, &noCustomArgsData) < 0) + ret = -1; + + return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; +} + +VIR_TEST_MAIN(mymain) diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args new file mode 100644 index 0000000000..48d2596594 --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-netdev '{"type":"stream","addr":{"type":"unix","path":"/var/run/libvirt/qemu/passt/-1-QEMUGuest1-net0.socket"},"server":false,"reconnect-ms":5000,"id":"hostnet0"}' \ +-device '{"driver":"rtl8139","netdev":"hostnet0","id":"net0","mac":"00:11:22:33:44:55","bus":"pci.0","addr":"0x2"}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml new file mode 100644 index 0000000000..6718893a52 --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml @@ -0,0 +1,67 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='none'/> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <interface type='user'> + <mac address='00:11:22:33:44:55'/> + <source dev='eth42'/> + <ip address='172.17.2.0' family='ipv4' prefix='24'/> + <ip address='2001:db8:ac10:fd01::feed' family='ipv6'/> + <portForward proto='tcp' address='2001:db8:ac10:fd01::1:10'> + <range start='22' to='2022'/> + <range start='1000' end='1050'/> + <range start='1020' exclude='yes'/> + <range start='1030' end='1040' exclude='yes'/> + </portForward> + <portForward proto='udp' address='1.2.3.4' dev='eth0'> + <range start='5000' end='5020' to='6000'/> + <range start='5010' end='5015' exclude='yes'/> + </portForward> + <portForward proto='tcp'> + <range start='80'/> + </portForward> + <portForward proto='tcp'> + <range start='443' to='344'/> + </portForward> + <model type='rtl8139'/> + <backend type='passt' logFile='/var/log/loglaw.blog'> + <passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + <passt:arg value='--socket=/tmp/foo.socket'/> + </passt:commandline> + </backend> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </interface> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.xml b/tests/qemuxmlconfdata/net-user-passt-custom-args.xml new file mode 100644 index 0000000000..a2a0f4c245 --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.xml @@ -0,0 +1,64 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='none'/> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <interface type='user'> + <mac address='00:11:22:33:44:55'/> + <source dev='eth42'/> + <ip address='172.17.2.0' family='ipv4' prefix='24'/> + <ip address='2001:db8:ac10:fd01::feed' family='ipv6'/> + <portForward proto='tcp' address='2001:db8:ac10:fd01::1:10'> + <range start='22' to='2022'/> + <range start='1000' end='1050'/> + <range start='1020' exclude='yes'/> + <range start='1030' end='1040' exclude='yes'/> + </portForward> + <portForward proto='udp' address='1.2.3.4' dev='eth0'> + <range start='5000' end='5020' to='6000'/> + <range start='5010' end='5015' exclude='yes'/> + </portForward> + <portForward proto='tcp'> + <range start='80'/> + </portForward> + <portForward proto='tcp'> + <range start='443' to='344'/> + </portForward> + <model type='rtl8139'/> + <backend type='passt' logFile='/var/log/loglaw.blog'> + <passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + <passt:arg value='--socket=/tmp/foo.socket'/> + </passt:commandline> + </backend> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </interface> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 9fba984290..839ae49ed4 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1805,6 +1805,7 @@ mymain(void) DO_TEST_CAPS_LATEST("net-user-addr"); DO_TEST_CAPS_LATEST("net-user-passt"); DO_TEST_CAPS_VER("net-user-passt", "7.2.0"); + DO_TEST_CAPS_LATEST("net-user-passt-custom-args"); DO_TEST_CAPS_LATEST_PARSE_ERROR("net-user-slirp-portforward"); DO_TEST_CAPS_LATEST("net-vhostuser-passt"); DO_TEST_CAPS_LATEST_PARSE_ERROR("net-vhostuser-passt-no-shmem"); -- 2.50.0

3 2

[PATCH 0/2] Fix problems with local pkg-config files.
by Daniel P. Berrangé 10 Jul '25

10 Jul '25

Daniel P. Berrangé (2): src: add missing libvirt-admin.pc.in for local usage src: fix package name in local pkg-config files src/libvirt-admin.pc.in | 19 +++++++++++++++++++ src/libvirt-lxc.pc.in | 2 +- src/libvirt-qemu.pc.in | 2 +- src/meson.build | 1 + 4 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 src/libvirt-admin.pc.in -- 2.49.0

2 3

[PATCH] virdevmapper: Always use device name for finding targets
by Bhavin 10 Jul '25

10 Jul '25

From: Bhavin Gandhi <bhavin192(a)geeksocket.in> DM_TABLE_DEPS expects a device name in dm_ioctl.name. In one of the cases, full path of the device was getting returned causing the ioctl call to fail with `ENXIO (No such device or address)`. Also rename the function and variable names to better reflect that we are dealing with DM device names and not paths. This got introduced in 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e Resolves: https://gitlab.com/libvirt/libvirt/-/issues/790 Signed-off-by: Bhavin Gandhi <bhavin192(a)geeksocket.in> --- src/util/virdevmapper.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c index d0eae671ab..42c86d89cf 100644 --- a/src/util/virdevmapper.c +++ b/src/util/virdevmapper.c @@ -164,7 +164,7 @@ virDMOpen(void) static char * -virDMSanitizepath(const char *path) +virDMGetDeviceName(const char *path) { g_autofree char *dmDirPath = NULL; struct dirent *ent = NULL; @@ -205,7 +205,7 @@ virDMSanitizepath(const char *path) if (stat(tmp, &sb[1]) == 0 && sb[0].st_rdev == sb[1].st_rdev) { - return g_steal_pointer(&tmp); + return g_strdup(ent->d_name); } } @@ -219,7 +219,7 @@ virDevMapperGetTargetsImpl(int controlFD, GSList **devPaths, unsigned int ttl) { - g_autofree char *sanitizedPath = NULL; + g_autofree char *deviceName = NULL; g_autofree char *buf = NULL; struct dm_ioctl dm = { 0 }; struct dm_target_deps *deps = NULL; @@ -233,10 +233,10 @@ virDevMapperGetTargetsImpl(int controlFD, if (!virIsDevMapperDevice(path)) return 0; - if (!(sanitizedPath = virDMSanitizepath(path))) + if (!(deviceName = virDMGetDeviceName(path))) return 0; - if (virStrcpy(dm.name, sanitizedPath, DM_NAME_LEN) < 0) { + if (virStrcpy(dm.name, deviceName, DM_NAME_LEN) < 0) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("Resolved device mapper name too long")); return -1; -- 2.49.0

3 2

[PATCH v2] qemu: passt: add support for custom command line arguments
by Enrique Llorente 10 Jul '25

10 Jul '25

This adds support for custom command line arguments for the passt backend, similar to qemu:commandline. The feature allows passing additional arguments to the passt process for development and testing purposes. The implementation: - Adds a passt XML namespace for custom arguments - Properly taints the domain when custom args are used - Includes comprehensive test coverage - Adds documentation for the new feature Usage example: <interface type='user'> <backend type='passt' xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> <passt:commandline> <passt:arg value='--debug'/> <passt:arg value='--verbose'/> </passt:commandline> </backend> </interface> Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- docs/formatdomain.rst | 40 +++++++++ src/conf/domain_conf.c | 84 ++++++++++++++++++- src/conf/domain_conf.h | 6 ++ src/qemu/qemu_passt.c | 9 ++ ...-user-passt-custom-args.x86_64-latest.args | 39 +++++++++ ...t-user-passt-custom-args.x86_64-latest.xml | 57 +++++++++++++ .../net-user-passt-custom-args.xml | 52 ++++++++++++ tests/qemuxmlconftest.c | 1 + 8 files changed, 287 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/net-user-passt-custom-args.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 9a2f065590..59899aaa4a 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -5464,6 +5464,46 @@ ports **with the exception of some subset**. </devices> ... +Custom passt commandline arguments +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +:since:`Since 11.7.0` For development and testing purposes, it is +sometimes useful to be able to pass additional command-line arguments +directly to the passt process. This can be accomplished using a +special passt namespace in the domain XML that is similar to the qemu +commandline namespace: + +:: + + ... + <devices> + ... + <interface type='user'> + <backend type='passt' xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:commandline> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + </passt:commandline> + </backend> + </interface> + </devices> + ... + +Any arguments provided using this method will be appended to the passt +command line, and will therefore override any default options set by +libvirt in the case of conflicts. + +**This feature is intended for development and testing only.** +Arguments are used as specified in the XML, and no validation beyond +basic libvirt XML schema validation is performed. It is expected that +this feature will primarily be used for testing new passt options, so +that they can be evaluated for inclusion in libvirt's schema in a +future release. It should not be used as a substitute for configuring +passt with the proper libvirt XML elements and attributes. **When a +domain uses this feature, it will be marked as "tainted" in the logs and +the ``virsh dominfo`` output will include "custom-argv" in the list +of reasons.** + Generic ethernet connection ^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1e24e41a48..9d39bb39bd 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2918,6 +2918,10 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->backend.tap); g_free(def->backend.vhost); g_free(def->backend.logFile); + if (def->backend.passtCommandline) { + g_strfreev(def->backend.passtCommandline->args); + g_free(def->backend.passtCommandline); + } virDomainNetTeamingInfoFree(def->teaming); g_free(def->virtPortProfile); g_free(def->script); @@ -9772,6 +9776,7 @@ virDomainNetBackendParseXML(xmlNodePtr node, { g_autofree char *tap = virXMLPropString(node, "tap"); g_autofree char *vhost = virXMLPropString(node, "vhost"); + xmlNodePtr cur; /* In the case of NET_TYPE_USER, backend type can be unspecified * (i.e. VIR_DOMAIN_NET_BACKEND_DEFAULT) and that means 'use @@ -9808,6 +9813,40 @@ virDomainNetBackendParseXML(xmlNodePtr node, def->backend.vhost = virFileSanitizePath(vhost); } + /* Parse passt namespace commandline */ + cur = node->children; + while (cur != NULL) { + if (cur->type == XML_ELEMENT_NODE) { + if (cur->ns && + STREQ((const char *)cur->ns->href, "http://libvirt.org/schemas/domain/passt/1.0") && + STREQ((const char *)cur->name, "commandline")) { + xmlNodePtr arg_node = cur->children; + GPtrArray *args = g_ptr_array_new(); + + while (arg_node != NULL) { + if (arg_node->type == XML_ELEMENT_NODE && + arg_node->ns && + STREQ((const char *)arg_node->ns->href, "http://libvirt.org/schemas/domain/passt/1.0") && + STREQ((const char *)arg_node->name, "arg")) { + g_autofree char *value = virXMLPropString(arg_node, "value"); + if (value) + g_ptr_array_add(args, g_strdup(value)); + } + arg_node = arg_node->next; + } + + if (args->len > 0) { + def->backend.passtCommandline = g_new0(virDomainNetBackendPasstCommandline, 1); + g_ptr_array_add(args, NULL); /* NULL-terminate */ + def->backend.passtCommandline->args = (char **)g_ptr_array_free(args, FALSE); + } else { + g_ptr_array_unref(args); + } + } + } + cur = cur->next; + } + return 0; } @@ -20802,6 +20841,33 @@ virDomainNetBackendIsEqual(virDomainNetBackend *src, STRNEQ_NULLABLE(src->logFile, dst->logFile)) { return false; } + + /* Compare passt commandline */ + if ((src->passtCommandline && dst->passtCommandline) || + (!src->passtCommandline && !dst->passtCommandline)) { + if (src->passtCommandline && dst->passtCommandline) { + /* Compare argument arrays */ + char **srcArgs = src->passtCommandline->args; + char **dstArgs = dst->passtCommandline->args; + + if (!srcArgs && !dstArgs) { + /* Both are NULL, continue */ + } else if (!srcArgs || !dstArgs) { + return false; /* One is NULL, other is not */ + } else { + /* Compare each argument */ + int i = 0; + while (srcArgs[i] || dstArgs[i]) { + if (!srcArgs[i] || !dstArgs[i] || STRNEQ(srcArgs[i], dstArgs[i])) + return false; + i++; + } + } + } + } else { + return false; + } + return true; } @@ -24926,6 +24992,7 @@ virDomainNetBackendFormat(virBuffer *buf, virDomainNetBackend *backend) { g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER; + g_auto(virBuffer) childBuf = VIR_BUFFER_INITIALIZER; if (backend->type) { virBufferAsprintf(&attrBuf, " type='%s'", @@ -24934,7 +25001,22 @@ virDomainNetBackendFormat(virBuffer *buf, virBufferEscapeString(&attrBuf, " tap='%s'", backend->tap); virBufferEscapeString(&attrBuf, " vhost='%s'", backend->vhost); virBufferEscapeString(&attrBuf, " logFile='%s'", backend->logFile); - virXMLFormatElement(buf, "backend", &attrBuf, NULL); + + /* Format passt commandline with namespace */ + if (backend->passtCommandline && backend->passtCommandline->args) { + virBufferAddLit(&childBuf, "<passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'>\n"); + virBufferAdjustIndent(&childBuf, 2); + + for (int i = 0; backend->passtCommandline->args[i]; i++) { + virBufferAsprintf(&childBuf, "<passt:arg value='%s'/>\n", + backend->passtCommandline->args[i]); + } + + virBufferAdjustIndent(&childBuf, -2); + virBufferAddLit(&childBuf, "</passt:commandline>\n"); + } + + virXMLFormatElement(buf, "backend", &attrBuf, &childBuf); } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 6997cf7c09..1f51bad546 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1070,12 +1070,18 @@ struct _virDomainActualNetDef { unsigned int class_id; /* class ID for bandwidth 'floor' */ }; +typedef struct _virDomainNetBackendPasstCommandline virDomainNetBackendPasstCommandline; +struct _virDomainNetBackendPasstCommandline { + char **args; /* NULL-terminated array of arguments */ +}; + struct _virDomainNetBackend { virDomainNetBackendType type; char *tap; char *vhost; /* The following are currently only valid/used when backend type='passt' */ char *logFile; /* path to logfile used by passt process */ + virDomainNetBackendPasstCommandline *passtCommandline; /* for passt overrides */ }; struct _virDomainNetPortForwardRange { diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c index fcc34de384..e64ccfa5aa 100644 --- a/src/qemu/qemu_passt.c +++ b/src/qemu/qemu_passt.c @@ -317,6 +317,15 @@ qemuPasstStart(virDomainObj *vm, virCommandAddArg(cmd, virBufferCurrentContent(&buf)); } + /* Add custom passt arguments from namespace */ + if (net->backend.passtCommandline && net->backend.passtCommandline->args) { + for (i = 0; net->backend.passtCommandline->args[i]; i++) { + virCommandAddArg(cmd, net->backend.passtCommandline->args[i]); + } + + /* Taint the domain when using custom passt arguments */ + qemuDomainObjTaint(driver, vm, VIR_DOMAIN_TAINT_CUSTOM_ARGV, NULL); + } if (qemuExtDeviceLogCommand(driver, vm, cmd, "passt") < 0) return -1; diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args new file mode 100644 index 0000000000..1715d4253c --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.args @@ -0,0 +1,39 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-i386 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu32 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"drive-ide0-0-0","id":"ide0-0-0","bootindex":1}' \ +-netdev '{"type":"stream","addr":{"type":"unix","path":"/var/run/libvirt/qemu/passt/-1-QEMUGuest1-net0.socket"},"server":false,"reconnect-ms":5000,"id":"hostnet0"}' \ +-device '{"driver":"rtl8139","netdev":"hostnet0","id":"net0","mac":"52:54:00:12:34:56","bus":"pci.0","addr":"0x3"}' \ +-vnc 127.0.0.1:0 \ +-device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \ +-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml new file mode 100644 index 0000000000..310ff6c39e --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.x86_64-latest.xml @@ -0,0 +1,57 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu32</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i386</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <interface type='user'> + <mac address='52:54:00:12:34:56'/> + <model type='rtl8139'/> + <backend type='passt' logFile='/tmp/passt.log'> + <passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + <passt:arg value='--no-dhcp'/> + </passt:commandline> + </backend> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <video> + <model type='cirrus' vram='16384' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </memballoon> + <audio id='1' type='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/net-user-passt-custom-args.xml b/tests/qemuxmlconfdata/net-user-passt-custom-args.xml new file mode 100644 index 0000000000..15eca80b5e --- /dev/null +++ b/tests/qemuxmlconfdata/net-user-passt-custom-args.xml @@ -0,0 +1,52 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i386</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <interface type='user'> + <mac address='52:54:00:12:34:56'/> + <backend type='passt' logFile='/tmp/passt.log'> + <passt:commandline xmlns:passt='http://libvirt.org/schemas/domain/passt/1.0'> + <passt:arg value='--debug'/> + <passt:arg value='--verbose'/> + <passt:arg value='--no-dhcp'/> + </passt:commandline> + </backend> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + <video> + <model type='cirrus' vram='16384' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </memballoon> + </devices> +</domain> \ No newline at end of file diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 9fba984290..839ae49ed4 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1805,6 +1805,7 @@ mymain(void) DO_TEST_CAPS_LATEST("net-user-addr"); DO_TEST_CAPS_LATEST("net-user-passt"); DO_TEST_CAPS_VER("net-user-passt", "7.2.0"); + DO_TEST_CAPS_LATEST("net-user-passt-custom-args"); DO_TEST_CAPS_LATEST_PARSE_ERROR("net-user-slirp-portforward"); DO_TEST_CAPS_LATEST("net-vhostuser-passt"); DO_TEST_CAPS_LATEST_PARSE_ERROR("net-vhostuser-passt-no-shmem"); -- 2.50.0

3 7

[PATCH v3 00/21] LIBVIRT: X86: TDX support
by Zhenzhong Duan 10 Jul '25

10 Jul '25

Hi, This series brings libvirt the x86 TDX support. * What's TDX? TDX stands for Trust Domain Extensions which isolates VMs from the virtual-machine manager (VMM)/hypervisor and any other software on the platform. This patchset extends libvirt to support TDX, with which one can start a TDX guest from high level rather than running qemu directly. * Misc As QEMU use a software emulated way to reset guest which isn't supported by TDX guest for security reason. We simulate reboot for TDX guest by kill and create a new one in FakeReboot framework. Complete code can be found at [1]. * Test Tested with upstream qemu v10.0.0-1724-gf9a3def17b shutdown/reboot/reset with virsh shutdown/reboot trigger in guest shutdown with on_poweroff=destroy/restart reboot with on_reboot=destroy/restart * Patch organization - patch 1-4: Some preparing work - patch 5-6: Support query of TDX capabilities - patch 7-13: Add TDX type to launchsecurity framework - patch 14-19: Add reboot/reset support to TDX guest - patch 20: Add conf test dump/cases for '+inteltdx' variant - patch 21: Add docs TODO: - add reconnect logic in virsh command [1] https://github.com/intel/libvirt-tdx/commits/tdx_for_upstream_v3 Thanks Zhenzhong Changelog: v3: - fix a hiden failure in qemuBuildTDXQGSCommandLine() (Peter Krempa) - avoid the use of the ternary operator (Peter Krempa) - add capability test dump before capability introduced (Peter Krempa) - change tests version number from 11.0.0 to 10.1.0 (Peter Krempa) v2: - add capability and xmlconf test (Peter Krempa) v1: - s/virQEMUCapsKVMSupportsSecureGuestINTEL/virQEMUCapsKVMSupportsSecureGuestTDX (Daniel) - make policy element optional and expose to QEMU directly (Daniel) - s/qemuProcessSecFakeReboot/qemuProcessFakeRebootViaRecreate (Daniel) - simplify QGS element schema by supporting only UNIX socket (Daniel) - add new events VIR_DOMAIN_EVENT_[STOPPED|STARTED] for control plane (Daniel) - s/quoteGenerationService/quoteGenerationSocket as QEMU - add virsh reset support rfcv4: - add a check to tools/virt-host-validate-qemu.c (Daniel) - remove check of q35 (Daniel) - model 'SocktetAddress' QAPI in xml schema (Daniel) - s/Quote-Generation-Service/quoteGenerationService/ (Daniel) - define bits in tdx->policy and add validating logic (Daniel) - presume QEMU choose split kernel irqchip for TDX guest by default (Daniel) - utilize existing FakeReboot framework to do reboot for TDX guest (Daniel) - drop patch11 'conf: Add support to keep same domid for hard reboot' (Daniel) - add test in tests/ to validate parsing and formatting logic (Daniel) - add doc in docs/formatdomain.rst (Daniel) - add R-B rfcv3: - Change to generate qemu cmdline with -bios - drop firmware auto match as -bios is used - add a hard reboot method to reboot TDX guest rfcv3: https://www.mail-archive.com/devel@lists.libvirt.org/msg00385.html rfcv2: - give up using qmp cmd and check TDX directly on host for TDX capabilities. - use launchsecurity framework to support TDX - use <os>.<loader> for general loader - add auto firmware match feature for TDX A example TDVF fimware description file 70-edk2-x86_64-tdx.json: { "description": "UEFI firmware for x86_64, supporting Intel TDX", "interface-types": [ "uefi" ], "mapping": { "device": "generic", "filename": "/usr/share/OVMF/OVMF_CODE-tdx.fd" }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "intel-tdx", "verbose-dynamic" ], "tags": [ ] } rfcv2: https://www.mail-archive.com/libvir-list@redhat.com/msg219378.html Zhenzhong Duan (21): tools: Secure guest check for Intel in virt-host-validate qemu: Check if INTEL Trust Domain Extention support is enabled qemucapabilitiesdata: Document '+inteltdx' variant qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant qemu: Add TDX capability conf: Expose TDX feature in domain capabilities conf: Add tdx as launch security type conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig qemu: Add command line and validation for TDX type conf: Expose TDX type in domain launch security capability qemu: Force special parameters enabled for TDX guest conf: Add Intel TDX Quote Generation Service(QGS) support qemu: Add command line for TDX Quote Generation Service(QGS) qemu: Add FakeReboot support for TDX guest qemu: Support reboot command in guest qemu: Avoid duplicate FakeReboot for secure guest qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation qemu: Bypass sending VIR_DOMAIN_EVENT_RESUMED event when TD VM reboot qemu: Support domain reset command for TDX guest qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data docs: domain: Add documentation for Intel TDX guest docs/formatdomain.rst | 63 + docs/formatdomaincaps.rst | 1 + examples/c/misc/event-test.c | 6 + include/libvirt/libvirt-domain.h | 2 + src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 82 + src/conf/domain_conf.h | 21 + src/conf/domain_validate.c | 11 + src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 41 + src/conf/virconftypes.h | 2 + src/qemu/qemu_capabilities.c | 38 +- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 1 + src/qemu/qemu_command.c | 43 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 11 +- src/qemu/qemu_firmware.c | 1 + src/qemu/qemu_monitor.c | 34 +- src/qemu/qemu_monitor.h | 2 +- src/qemu/qemu_monitor_json.c | 6 +- src/qemu/qemu_namespace.c | 1 + src/qemu/qemu_process.c | 104 +- src/qemu/qemu_process.h | 2 + src/qemu/qemu_validate.c | 45 + src/security/security_dac.c | 2 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 783 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1830 + .../qemu_10.1.0.x86_64+inteltdx.xml | 783 + tests/domaincapsmock.c | 3 +- tests/qemucapabilitiesdata/README.rst | 5 + .../caps_10.1.0_x86_64+inteltdx.replies | 44552 ++++++++++++++++ .../caps_10.1.0_x86_64+inteltdx.xml | 3585 ++ .../caps.x86_64+inteltdx.xml | 29 + ...h-security-tdx.x86_64-latest+inteltdx.args | 44 + ...ch-security-tdx.x86_64-latest+inteltdx.xml | 74 + tests/qemuxmlconfdata/launch-security-tdx.xml | 27 + tests/qemuxmlconftest.c | 3 + tools/virsh-domain-event.c | 6 +- tools/virt-host-validate-common.c | 31 +- tools/virt-host-validate-common.h | 1 + 42 files changed, 52273 insertions(+), 15 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-tcg.x86_64+inteltdx.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml create mode 100644 tests/qemucaps2xmloutdata/caps.x86_64+inteltdx.xml create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.x86_64-latest+inteltdx.args create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.x86_64-latest+inteltdx.xml create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.xml -- 2.34.1

5 60

[PATCH] nwfilter: Avoid firewall hole during VM startup by checking rule presence
by Dion Bosschieter 08 Jul '25

08 Jul '25

Upon VM bootstrapping (start,restore,incoming migration) iptablesCreateBaseChainsFW is called and unconditionally deletes and reinserts top-level firewall chain jumps (e.g. INPUT, FORWARD rules). This briefly opens a hole in the firewall, allowing packets through until the insertions complete. This commit ensures that the base chains are only created once per layer (IPV4/IPV6) and checks whether the expected rules already exist using `iptables -C`. If they do, no delete/insert operations are performed. This eliminates the short window where packets could bypass filters during VM lifecycle operations. Signed-off-by: Dion Bosschieter <dionbosschieter(a)gmail.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 79 ++++++++++++++--------- 1 file changed, 47 insertions(+), 32 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 067df6e612..42a0133159 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -131,6 +131,14 @@ static char chainprefixes_host_temp[3] = { 0 }; +typedef struct { + const char *chain; + const char *position; + const char *targetChain; +} iptablesBaseChainFW; + +static bool baseChainFWDefined[VIR_FIREWALL_LAYER_LAST] = { false }; + static int printVar(virNWFilterVarCombIter *vars, char *buf, int bufsize, @@ -403,38 +411,45 @@ static void iptablesCreateBaseChainsFW(virFirewall *fw, virFirewallLayer layer) { - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-N", VIRT_IN_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-N", VIRT_OUT_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-N", VIRT_IN_POST_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-N", HOST_IN_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-D", "FORWARD", "-j", VIRT_IN_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-D", "FORWARD", "-j", VIRT_OUT_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-D", "FORWARD", "-j", VIRT_IN_POST_CHAIN, NULL); - virFirewallAddCmdFull(fw, layer, - true, NULL, NULL, - "-D", "INPUT", "-j", HOST_IN_CHAIN, NULL); - virFirewallAddCmd(fw, layer, - "-I", "FORWARD", "1", "-j", VIRT_IN_CHAIN, NULL); - virFirewallAddCmd(fw, layer, - "-I", "FORWARD", "2", "-j", VIRT_OUT_CHAIN, NULL); - virFirewallAddCmd(fw, layer, - "-I", "FORWARD", "3", "-j", VIRT_IN_POST_CHAIN, NULL); - virFirewallAddCmd(fw, layer, - "-I", "INPUT", "1", "-j", HOST_IN_CHAIN, NULL); + iptablesBaseChainFW fw_chains[] = { + {"FORWARD", "1", VIRT_IN_CHAIN}, + {"FORWARD", "2", VIRT_OUT_CHAIN}, + {"FORWARD", "3", VIRT_IN_POST_CHAIN}, + {"INPUT", "1", HOST_IN_CHAIN}, + }; + size_t i; + + // iptablesCreateBaseChainsFW already ran once for this layer, + // we don't have to recreate the base chains on every firewall update + if (baseChainFWDefined[layer]) + return; + + // set defined state so we skip the following logic next run + baseChainFWDefined[layer] = true; + + virFirewallStartTransaction(fw, 0); + + for (i = 0; i < G_N_ELEMENTS(fw_chains); i++) + virFirewallAddCmd(fw, layer, + "-C", fw_chains[i].chain, + "-j", fw_chains[i].targetChain, NULL); + + if (virFirewallApply(fw) == 0) + // rules already in place + return; + + for (i = 0; i < G_N_ELEMENTS(fw_chains); i++) { + virFirewallAddCmdFull(fw, layer, + true, NULL, NULL, + "-N", fw_chains[i].targetChain, NULL); + virFirewallAddCmdFull(fw, layer, + true, NULL, NULL, + "-D", fw_chains[i].chain, "-j", + fw_chains[i].targetChain, NULL); + virFirewallAddCmd(fw, layer, + "-I", fw_chains[i].chain, fw_chains[i].position, + "-j", fw_chains[i].targetChain, NULL); + } } -- 2.39.3 (Apple Git-146)

2 3

[PATCH 0/4] Allow xml-configured coredump format on VM crash
by Nikolai Barybin 08 Jul '25

08 Jul '25

When libvirt processes VM crash event it always dumps core in raw format. This series makes it possible to configure dump format via domain xml. This would be especcialy helpful for Windows guests, because it requires a lot effort to convert raw dump into wingdb. Nikolai Barybin (4): conf: schemas: add coredump_format element to events section src: conf: add parsing/formatting for 'coredump_format' value qemu: use configurable dump format in doCoreDumpToAutoDumpPath() docs: formatdomain: document 'coredump_format' element docs/formatdomain.rst | 9 +++++ src/conf/domain_conf.c | 64 +++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 19 +++++++++ src/libvirt_private.syms | 2 + src/qemu/qemu_driver.c | 2 +- 6 files changed, 97 insertions(+), 1 deletion(-) -- 2.43.5

3 8

[PATCH] qemu: Switch to virtio-scsi on ARM
by Jim Fehlig 08 Jul '25

08 Jul '25

From: Jim Fehlig <jfehlig(a)suse.com> Similar to x86, the default SCSI controller model for ARM is lsilogic. But unlike x86, the ARM virt machine type prefers virtio devices. Switch the default controller model for ARM from lsilogic to virtio-scsi. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- IMO, the lsilogic SCSI controller is a poor default for the ARM virt machine type. One could argue modern operating systems are more likely to contain a functional virtio-scsi driver than an LSI one. However, I do understand this change could break existing ARM VM configurations containing a SCSI controller without a model specification. One could also argue the pain inflicted is tolerable :-). The test churn is interesting. I haven't yet investigated if there's an underlying bug, or if it's a consequence of libvirt's processing of controllers. Much appreciated if anyone has an explanation handy :-). src/qemu/qemu_domain.c | 3 ++- ...ault-models.aarch64-latest.abi-update.args | 13 +++++------ ...fault-models.aarch64-latest.abi-update.xml | 22 ++++++++----------- ...64-virt-default-models.aarch64-latest.args | 13 +++++------ ...h64-virt-default-models.aarch64-latest.xml | 22 ++++++++----------- 5 files changed, 32 insertions(+), 41 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 0d2548d8d4..499db0ad78 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4252,7 +4252,8 @@ qemuDomainGetSCSIControllerModel(const virDomainDef *def, if (qemuDomainIsPSeries(def)) return VIR_DOMAIN_CONTROLLER_MODEL_SCSI_IBMVSCSI; - if (ARCH_IS_S390(def->os.arch) || qemuDomainIsLoongArchVirt(def)) + if (ARCH_IS_ARM(def->os.arch) || ARCH_IS_S390(def->os.arch) || + qemuDomainIsLoongArchVirt(def)) return VIR_DOMAIN_CONTROLLER_MODEL_SCSI_VIRTIO_SCSI; if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SCSI_LSI)) return VIR_DOMAIN_CONTROLLER_MODEL_SCSI_LSILOGIC; diff --git a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.args b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.args index 96fb251d80..ff86567c59 100644 --- a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.args +++ b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.args @@ -29,20 +29,19 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -device '{"driver":"pcie-root-port","port":8,"chassis":1,"id":"pci.1","bus":"pcie.0","multifunction":true,"addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":9,"chassis":2,"id":"pci.2","bus":"pcie.0","addr":"0x1.0x1"}' \ -device '{"driver":"pcie-root-port","port":10,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x1.0x2"}' \ --device '{"driver":"pcie-pci-bridge","id":"pci.4","bus":"pci.1","addr":"0x0"}' \ --device '{"driver":"pcie-root-port","port":11,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x1.0x3"}' \ --device '{"driver":"pcie-root-port","port":12,"chassis":6,"id":"pci.6","bus":"pcie.0","addr":"0x1.0x4"}' \ --device '{"driver":"qemu-xhci","id":"usb","bus":"pci.3","addr":"0x0"}' \ --device '{"driver":"lsi","id":"scsi0","bus":"pci.4","addr":"0x1"}' \ +-device '{"driver":"pcie-root-port","port":11,"chassis":4,"id":"pci.4","bus":"pcie.0","addr":"0x1.0x3"}' \ +-device '{"driver":"pcie-root-port","port":12,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x1.0x4"}' \ +-device '{"driver":"qemu-xhci","id":"usb","bus":"pci.2","addr":"0x0"}' \ +-device '{"driver":"virtio-scsi-pci","id":"scsi0","bus":"pci.3","addr":"0x0"}' \ -netdev '{"type":"user","id":"hostnet0"}' \ --device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:09:a4:37","bus":"pci.2","addr":"0x0"}' \ +-device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:09:a4:37","bus":"pci.1","addr":"0x0"}' \ -chardev pty,id=charserial0 \ -serial chardev:charserial0 \ -chardev socket,id=chrtpm,path=/dev/test \ -tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \ -device '{"driver":"tpm-tis-device","tpmdev":"tpm-tpm0","id":"tpm0"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ --device '{"driver":"virtio-gpu-pci","id":"video0","max_outputs":1,"bus":"pci.5","addr":"0x0"}' \ +-device '{"driver":"virtio-gpu-pci","id":"video0","max_outputs":1,"bus":"pci.4","addr":"0x0"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ -device '{"driver":"pvpanic-pci","bus":"pcie.0","addr":"0x2"}' \ -msg timestamp=on diff --git a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.xml b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.xml index f27e7e1522..5abf55cf36 100644 --- a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.xml +++ b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.abi-update.xml @@ -21,11 +21,11 @@ <devices> <emulator>/usr/bin/qemu-system-aarch64</emulator> <controller type='usb' index='0' model='qemu-xhci'> + <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> + </controller> + <controller type='scsi' index='0' model='virtio-scsi'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> - <controller type='scsi' index='0' model='lsilogic'> - <address type='pci' domain='0x0000' bus='0x04' slot='0x01' function='0x0'/> - </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> @@ -42,24 +42,20 @@ <target chassis='3' port='0xa'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> - <controller type='pci' index='4' model='pcie-to-pci-bridge'> - <model name='pcie-pci-bridge'/> - <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> - </controller> - <controller type='pci' index='5' model='pcie-root-port'> + <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> - <target chassis='5' port='0xb'/> + <target chassis='4' port='0xb'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/> </controller> - <controller type='pci' index='6' model='pcie-root-port'> + <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> - <target chassis='6' port='0xc'/> + <target chassis='5' port='0xc'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/> </controller> <interface type='user'> <mac address='52:54:00:09:a4:37'/> <model type='virtio'/> - <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> + <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='system-serial' port='0'> @@ -75,7 +71,7 @@ <audio id='1' type='none'/> <video> <model type='virtio' heads='1' primary='yes'/> - <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> + <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </video> <memballoon model='none'/> <panic model='pvpanic'> diff --git a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.args b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.args index 96fb251d80..ff86567c59 100644 --- a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.args +++ b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.args @@ -29,20 +29,19 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -device '{"driver":"pcie-root-port","port":8,"chassis":1,"id":"pci.1","bus":"pcie.0","multifunction":true,"addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":9,"chassis":2,"id":"pci.2","bus":"pcie.0","addr":"0x1.0x1"}' \ -device '{"driver":"pcie-root-port","port":10,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x1.0x2"}' \ --device '{"driver":"pcie-pci-bridge","id":"pci.4","bus":"pci.1","addr":"0x0"}' \ --device '{"driver":"pcie-root-port","port":11,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x1.0x3"}' \ --device '{"driver":"pcie-root-port","port":12,"chassis":6,"id":"pci.6","bus":"pcie.0","addr":"0x1.0x4"}' \ --device '{"driver":"qemu-xhci","id":"usb","bus":"pci.3","addr":"0x0"}' \ --device '{"driver":"lsi","id":"scsi0","bus":"pci.4","addr":"0x1"}' \ +-device '{"driver":"pcie-root-port","port":11,"chassis":4,"id":"pci.4","bus":"pcie.0","addr":"0x1.0x3"}' \ +-device '{"driver":"pcie-root-port","port":12,"chassis":5,"id":"pci.5","bus":"pcie.0","addr":"0x1.0x4"}' \ +-device '{"driver":"qemu-xhci","id":"usb","bus":"pci.2","addr":"0x0"}' \ +-device '{"driver":"virtio-scsi-pci","id":"scsi0","bus":"pci.3","addr":"0x0"}' \ -netdev '{"type":"user","id":"hostnet0"}' \ --device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:09:a4:37","bus":"pci.2","addr":"0x0"}' \ +-device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:09:a4:37","bus":"pci.1","addr":"0x0"}' \ -chardev pty,id=charserial0 \ -serial chardev:charserial0 \ -chardev socket,id=chrtpm,path=/dev/test \ -tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \ -device '{"driver":"tpm-tis-device","tpmdev":"tpm-tpm0","id":"tpm0"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ --device '{"driver":"virtio-gpu-pci","id":"video0","max_outputs":1,"bus":"pci.5","addr":"0x0"}' \ +-device '{"driver":"virtio-gpu-pci","id":"video0","max_outputs":1,"bus":"pci.4","addr":"0x0"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ -device '{"driver":"pvpanic-pci","bus":"pcie.0","addr":"0x2"}' \ -msg timestamp=on diff --git a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.xml b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.xml index f27e7e1522..5abf55cf36 100644 --- a/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/aarch64-virt-default-models.aarch64-latest.xml @@ -21,11 +21,11 @@ <devices> <emulator>/usr/bin/qemu-system-aarch64</emulator> <controller type='usb' index='0' model='qemu-xhci'> + <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> + </controller> + <controller type='scsi' index='0' model='virtio-scsi'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> - <controller type='scsi' index='0' model='lsilogic'> - <address type='pci' domain='0x0000' bus='0x04' slot='0x01' function='0x0'/> - </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> @@ -42,24 +42,20 @@ <target chassis='3' port='0xa'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> - <controller type='pci' index='4' model='pcie-to-pci-bridge'> - <model name='pcie-pci-bridge'/> - <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> - </controller> - <controller type='pci' index='5' model='pcie-root-port'> + <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> - <target chassis='5' port='0xb'/> + <target chassis='4' port='0xb'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/> </controller> - <controller type='pci' index='6' model='pcie-root-port'> + <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> - <target chassis='6' port='0xc'/> + <target chassis='5' port='0xc'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/> </controller> <interface type='user'> <mac address='52:54:00:09:a4:37'/> <model type='virtio'/> - <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> + <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='system-serial' port='0'> @@ -75,7 +71,7 @@ <audio id='1' type='none'/> <video> <model type='virtio' heads='1' primary='yes'/> - <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> + <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </video> <memballoon model='none'/> <panic model='pvpanic'> -- 2.43.0

3 7

Re: [PATCH V2 1/5] qom: qom-tree-get
by Markus Armbruster 08 Jul '25

08 Jul '25

Steve Sistare <steven.sistare(a)oracle.com> writes: > Define the qom-tree-get QAPI command, which fetches an entire tree of > properties and values with a single QAPI call. This is much faster > than using qom-list plus qom-get for every node and property of the > tree. See qom.json for details. > > Signed-off-by: Steve Sistare <steven.sistare(a)oracle.com> > --- > qapi/qom.json | 56 ++++++++++++++++++++++++++++++++++++++++++ > qom/qom-qmp-cmds.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 128 insertions(+) > > diff --git a/qapi/qom.json b/qapi/qom.json > index 28ce24c..94662ad 100644 > --- a/qapi/qom.json > +++ b/qapi/qom.json > @@ -46,6 +46,38 @@ > '*default-value': 'any' } } > > ## > +# @ObjectPropertyValue: > +# > +# @name: the name of the property > +# > +# @type: the type of the property, as described in @ObjectPropertyInfo That description is crap. In part because what it tries to describe is crap. Neither is this patch's problem. > +# > +# @value: the value of the property. Omitted if cannot be read. Suggest "Absent when the property cannot be read." > +# > +# Since 10.1 > +## > +{ 'struct': 'ObjectPropertyValue', > + 'data': { 'name': 'str', > + 'type': 'str', > + '*value': 'any' } } ObjectPropertyValue suggests this describes a property's value. It does not. It includes the name, i.e. it describes the *property*. So does ObjectPropertyInfo. The two overlap: both habe name and type. Only ObjectPropertyValue has the current value. Only ObjectPropertyInfo has the default value and description (I suspect the latter is useless in practice). ObjectPropertyInfo is used with qom-list and qom-list-properties. qom-list takes a QOM path, like your qom-tree-get and qom-list-getv. I'd expect your commands to supersede qom-list in practice. qom-list-properties is unlike your qom-tree-get and qom-list-getv: it takes a type name. It's unreliable for non-abstract types: it can miss dynamically created properties. Let's ignore all this for now. > + > +## > +# @ObjectNode: > +# > +# @name: the name of the node > +# > +# @children: child nodes > +# > +# @properties: properties of the node > +# > +# Since 10.1 > +## > +{ 'struct': 'ObjectNode', > + 'data': { 'name': 'str', > + 'children': [ 'ObjectNode' ], > + 'properties': [ 'ObjectPropertyValue' ] }} > + > +## > # @qom-list: > # > # This command will list any properties of a object given a path in > @@ -126,6 +158,30 @@ > 'allow-preconfig': true } > > ## > +# @qom-tree-get: > +# > +# This command returns a tree of objects and their properties, > +# rooted at the specified path. > +# > +# @path: The absolute or partial path within the object model, as > +# described in @qom-get > +# > +# Errors: > +# - If path is not valid or is ambiguous, returns an error. By convention, we use "If <condition>, <error>, where <error> is a member of QapiErrorClass. What are the possible error classes? As far as I can tell: - If path is ambiguous, GenericError - If path cannot be resolved, DeviceNotFound However, use of error classes other than GenericError is strongly discouraged (see error_set() in qapi/error.h). Is the ability to distinguish between these two errors useful? Existing related commands such as qom-get also use DeviceNotFound. Entirely undocumented, exact error conditions unclear. Awesome. Libvirt seems to rely on this undocumented behavior: I can see code checking for DeviceNotFound. Hyrum's law strikes. qom-get fails with DeviceNotFound in both of the above cases. It fails with GenericError when @property doesn't exist or cannot be read. Your qom-tree-get fails differently. Awesome again. Choices: 1. Leave errors undocumented and inconsistent. 2. Document errors for all related commands. Make the new ones as consistent as we can. > +# - If a property cannot be read, the value field is omitted in > +# the corresponding @ObjectPropertyValue. This is not an error, and therefore doesn't belong here. ObjectPropertyValue's documentation also mentions it. Good enough? > +# > +# Returns: A tree of @ObjectNode. Each node contains its name, list > +# of properties, and list of child nodes. Hmm. A struct Object has no name. Only properties have a name. An ObjectNode has a name, and an ObjectPropertyValue has a name. I may get back to this in a later message. > +# > +# Since 10.1 > +## > +{ 'command': 'qom-tree-get', > + 'data': { 'path': 'str' }, > + 'returns': 'ObjectNode', > + 'allow-preconfig': true } > + > +## > # @qom-set: > # > # This command will set a property from a object model path. > diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c > index 293755f..b876681 100644 > --- a/qom/qom-qmp-cmds.c > +++ b/qom/qom-qmp-cmds.c > @@ -69,6 +69,78 @@ ObjectPropertyInfoList *qmp_qom_list(const char *path, Error **errp) > return props; > } > > +static void qom_list_add_property_value(Object *obj, ObjectProperty *prop, > + ObjectPropertyValueList **props) > +{ > + ObjectPropertyValue *item = g_new0(ObjectPropertyValue, 1); > + Error *err = NULL; > + > + QAPI_LIST_PREPEND(*props, item); List elements are in reverse iteration order. Not wrong. I would've reached for QAPI_LIST_APPEND(), though. Wait! Existing command code uses QAPI_LIST_PREPEND(). Nevermind, carry on! > + > + item->name = g_strdup(prop->name); > + item->type = g_strdup(prop->type); > + item->value = object_property_get_qobject(obj, prop->name, &err); > + > + if (!item->value) { > + /* > + * For bulk get, the error message is dropped, but the value field > + * is omitted so the caller knows this property could not be read. > + */ > + error_free(err); Simpler: pass NULL to object_property_get_qobject(). > + } > +} > + > +static ObjectNode *qom_tree_get(const char *path, Error **errp) > +{ > + Object *obj; > + ObjectProperty *prop; > + ObjectNode *result, *child; > + ObjectPropertyIterator iter; > + > + obj = qom_resolve_path(path, errp); > + if (obj == NULL) { > + return NULL; > + } > + > + result = g_new0(ObjectNode, 1); > + > + object_property_iter_init(&iter, obj); > + while ((prop = object_property_iter_next(&iter))) { > + if (strstart(prop->type, "child<", NULL)) { > + g_autofree char *child_path = g_strdup_printf("%s/%s", > + path, prop->name); > + child = qom_tree_get(child_path, errp); > + if (!child) { > + qapi_free_ObjectNode(result); > + return NULL; > + } > + child->name = g_strdup(prop->name); WAT? > + QAPI_LIST_PREPEND(result->children, child); > + } else { > + qom_list_add_property_value(obj, prop, &result->properties); > + } > + } > + Oh, result->name remains unset, and the caller is expected to fill it in. Two callers, "WAT" above, and ... > + return result; > +} > + > +ObjectNode *qmp_qom_tree_get(const char *path, Error **errp) > +{ > + ObjectNode *result = qom_tree_get(path, errp); > + > + if (result) { > + /* Strip the path prefix if any */ > + const char *basename = strrchr(path, '/'); > + > + if (!basename || !basename[1]) { > + result->name = g_strdup(path); > + } else { > + result->name = g_strdup(basename + 1); > + } > + } ... this one. Not a fan. But it works. > + return result; > +} > + > void qmp_qom_set(const char *path, const char *property, QObject *value, > Error **errp) > {

2 3

Re: [PATCH V2 4/5] qom: qom-list-getv
by Markus Armbruster 08 Jul '25

08 Jul '25

Steve Sistare <steven.sistare(a)oracle.com> writes: > Define the qom-list-getv command, which fetches all the properties and > values for a list of paths. This is faster than qom-tree-get when > fetching a subset of the QOM tree. See qom.json for details. > > Signed-off-by: Steve Sistare <steven.sistare(a)oracle.com> > --- > qapi/qom.json | 34 ++++++++++++++++++++++++++++++++++ > qom/qom-qmp-cmds.c | 40 ++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 74 insertions(+) > > diff --git a/qapi/qom.json b/qapi/qom.json > index 94662ad..dc710d6 100644 > --- a/qapi/qom.json > +++ b/qapi/qom.json > @@ -62,6 +62,16 @@ > '*value': 'any' } } > > ## > +# @ObjectPropertiesValues: > +# > +# @properties: a list of properties. > +# > +# Since 10.1 > +## > +{ 'struct': 'ObjectPropertiesValues', > + 'data': { 'properties': [ 'ObjectPropertyValue' ] }} > + > +## > # @ObjectNode: > # > # @name: the name of the node > @@ -158,6 +168,30 @@ > 'allow-preconfig': true } > > ## > +# @qom-list-getv: > +# > +# This command returns a list of properties and their values for > +# each object path in the input list. Imperative mood, please: "Return a list of ..." > +# > +# @paths: The absolute or partial path for each object, as described > +# in @qom-get > +# > +# Errors: > +# - If any path is not valid or is ambiguous, returns an error. > +# - If a property cannot be read, the value field is omitted in > +# the corresponding @ObjectPropertyValue. My comment on qom-tree-get's Errors: section applies. > +# > +# Returns: A list of @ObjectPropertiesValues. Each element contains > +# the properties of the corresponding element in @paths. Again, ObjectPropertiesValues is an unfortunate name. > +# > +# Since 10.1 > +## > +{ 'command': 'qom-list-getv', > + 'data': { 'paths': [ 'str' ] }, > + 'returns': [ 'ObjectPropertiesValues' ], > + 'allow-preconfig': true } > + > +## > # @qom-tree-get: > # > # This command returns a tree of objects and their properties, I find this command *much* simpler than qom-tree-get. qom-list-getv treats all properties the same. References, whether they are children and links, are the same: a QOM path. qom-tree-get separates properties into children and non-children. Children become nested ObjectNodes, links remain QOM paths. > diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c > index b876681..1f05956 100644 > --- a/qom/qom-qmp-cmds.c > +++ b/qom/qom-qmp-cmds.c > @@ -90,6 +90,46 @@ static void qom_list_add_property_value(Object *obj, ObjectProperty *prop, > } > } > > +static ObjectPropertyValueList *qom_get_property_value_list(const char *path, > + Error **errp) > +{ > + Object *obj; > + ObjectProperty *prop; > + ObjectPropertyIterator iter; > + ObjectPropertyValueList *props = NULL; > + > + obj = qom_resolve_path(path, errp); > + if (obj == NULL) { > + return NULL; > + } > + > + object_property_iter_init(&iter, obj); > + while ((prop = object_property_iter_next(&iter))) { > + qom_list_add_property_value(obj, prop, &props); > + } > + > + return props; > +} > + > +ObjectPropertiesValuesList *qmp_qom_list_getv(strList *paths, Error **errp) > +{ > + ObjectPropertiesValuesList *head = NULL, **tail = &head; > + > + for ( ; paths ; paths = paths->next) { I'd prefer a separate variable: for (tail = paths; tail; tail = tail->next) { > + ObjectPropertiesValues *item = g_new0(ObjectPropertiesValues, 1); > + > + QAPI_LIST_APPEND(tail, item); > + > + item->properties = qom_get_property_value_list(paths->value, errp); > + if (!item->properties) { > + qapi_free_ObjectPropertiesValuesList(head); > + return NULL; > + } > + } > + > + return head; > +} > + > static ObjectNode *qom_tree_get(const char *path, Error **errp) > { > Object *obj; The implementation is simpler than qom-tree's, too.

2 2

Re: [PATCH V2 0/5] fast qom tree get
by Markus Armbruster 07 Jul '25

07 Jul '25

Steve Sistare <steven.sistare(a)oracle.com> writes: > Using qom-list and qom-get to get all the nodes and property values in a > QOM tree can take multiple seconds because it requires 1000's of individual > QOM requests. Some managers fetch the entire tree or a large subset > of it when starting a new VM, and this cost is a substantial fraction of > start up time. > > To reduce this cost, consider QAPI calls that fetch more information in > each call: > * qom-list-get: given a path, return a list of properties and values. > * qom-list-getv: given a list of paths, return a list of properties and > values for each path. > * qom-tree-get: given a path, return all descendant nodes rooted at that > path, with properties and values for each. > > In all cases, a returned property is represented by ObjectPropertyValue, > with fields name, type, and value. If an error occurs when reading a value > the value field is omitted. Thus an error for one property will not cause a > bulk fetch operation to fail. > > To evaluate each method, I modified scripts/qmp/qom-tree to use the method, > verified all methods produce the same output, and timed each using: > > qemu-system-x86_64 -display none \ > -chardev socket,id=monitor0,path=/tmp/vm1.sock,server=on,wait=off \ > -mon monitor0,mode=control & > > time qom-tree -s /tmp/vm1.sock > /dev/null > > I only measured once per method, but the variation is low after a warm up run. > The 'real - user - sys' column is a proxy for QEMU CPU time. > > method real(s) user(s) sys(s) (real - user - sys)(s) > qom-list / qom-get 2.048 0.932 0.057 1.059 > qom-list-get 0.402 0.230 0.029 0.143 > qom-list-getv 0.200 0.132 0.015 0.053 > qom-tree-get 0.143 0.123 0.012 0.008 > > qom-tree-get is the clear winner, reducing elapsed time by a factor of 14X, > and reducing QEMU CPU time by 132X. > > qom-list-getv is slower when fetching the entire tree, but can beat > qom-tree-get when only a subset of the tree needs to be fetched (not shown). > qom-list-get is shown for comparison only, and is not included in this series. How badly do you need the additional performance qom-tree-get can give you in certain cases? I'm asking because I find qom-list-getv *much* simpler.

2 1

[PATCH 00/10] virDomainDriverAutoShutdown: Fix 3 bugs related to auto shutdown of VMs
by Peter Krempa 07 Jul '25

07 Jul '25

Following bugs are addressed: - ordering of systemd units, which cause the VMs to be killed prior to auto-shutdown finishing - transient VMs are attempted to be managesaved - restore of state is applied to VMs which the auto shutdown code didn't act on otherwise Peter Krempa (10): virSystemdCreateMachine: Document @maxthreds cgroup: Unexport 'virDomainCgroupInitCgroup' qemu: conf: Store 'autoShutdown' config in virDomainDriverAutoShutdownConfig hypervisor: domain: Extract logic for auto shutdown to virDomainDriverAutoShutdownActive virSystemdCreateMachine: Add flag to invert machined unit dependencies cgroup: Plumb the 'daemonDomainShutdown' parameter of 'virSystemdCreateMachine' to drivers qemu: Fix auto-shutdown of qemu VMs by the qemu driver hypervisor: Split out individual steps out of virDomainDriverAutoShutdown virDomainDriverAutoShutdownDoSave: Don't attempt to save transient VMs virDomainDriverAutoShutdown: Refactor selection logic for VMs src/ch/ch_process.c | 2 + src/hypervisor/domain_cgroup.c | 6 +- src/hypervisor/domain_cgroup.h | 11 +- src/hypervisor/domain_driver.c | 390 +++++++++++++++++++-------------- src/hypervisor/domain_driver.h | 1 + src/libvirt_private.syms | 2 +- src/lxc/lxc_cgroup.c | 1 + src/qemu/qemu.conf.in | 15 +- src/qemu/qemu_cgroup.c | 7 + src/qemu/qemu_conf.c | 30 +-- src/qemu/qemu_conf.h | 7 +- src/qemu/qemu_driver.c | 12 +- src/util/vircgroup.c | 7 +- src/util/vircgroup.h | 1 + src/util/virsystemd.c | 28 ++- src/util/virsystemd.h | 3 +- tests/virsystemdtest.c | 15 +- 17 files changed, 322 insertions(+), 216 deletions(-) -- 2.49.0

2 22

[PATCH 0/7] qemu-10.1 test data and dropped machine type cleanups
by Peter Krempa 07 Jul '25

07 Jul '25

Peter Krempa (7): qemuxmlconftest: x86_64: Drop explicit use of '2.10' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.12' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.5' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.9' machine type qemuxmlconftest: x86_64: Bump 'firmware*' test cases to 'pc-i440fx-10.0' qemuxmlconftest: x86_64: Bump 'firmware*' test cases to 'pc-q35-10.0' qemucapabilitiestest: Add dump for the qemu-10.1 development cycle on x86_64 .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1722 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1827 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1722 + .../caps_10.1.0_x86_64.replies | 46736 ++++++++++++++++ .../caps_10.1.0_x86_64.xml | 4574 ++ ...host-model-fallback-tcg.x86_64-latest.args | 2 +- ...st-model-nofallback-tcg.x86_64-latest.args | 2 +- .../cpu-host-model-tcg.x86_64-latest.args | 2 +- .../firmware-auto-bios-not-stateless.xml | 2 +- .../firmware-auto-bios-nvram.xml | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios-stateless.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-auto-bios.xml | 2 +- ...ware-auto-efi-enrolled-keys-no-secboot.xml | 2 +- ...-auto-efi-enrolled-keys.x86_64-latest.args | 2 +- ...e-auto-efi-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-auto-efi-enrolled-keys.xml | 2 +- ...loader-qcow2-nvram-path.x86_64-latest.args | 2 +- ...-loader-qcow2-nvram-path.x86_64-latest.xml | 2 +- ...uto-efi-format-loader-qcow2-nvram-path.xml | 2 +- ...efi-format-loader-qcow2.x86_64-latest.args | 2 +- ...-efi-format-loader-qcow2.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-loader-qcow2.xml | 2 +- ...uto-efi-format-mismatch.x86_64-latest.args | 2 +- ...auto-efi-format-mismatch.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-mismatch.xml | 2 +- ...nvram-qcow2-network-nbd.x86_64-latest.args | 2 +- ...-nvram-qcow2-network-nbd.x86_64-latest.xml | 2 +- ...uto-efi-format-nvram-qcow2-network-nbd.xml | 2 +- ...format-nvram-qcow2-path.x86_64-latest.args | 2 +- ...-format-nvram-qcow2-path.x86_64-latest.xml | 2 +- ...mware-auto-efi-format-nvram-qcow2-path.xml | 2 +- ...-efi-format-nvram-qcow2.x86_64-latest.args | 2 +- ...o-efi-format-nvram-qcow2.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-nvram-qcow2.xml | 2 +- ...uto-efi-loader-insecure.x86_64-latest.args | 2 +- ...auto-efi-loader-insecure.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-insecure.xml | 2 +- ...-loader-path-nonstandard.x86_64-latest.xml | 2 +- ...mware-auto-efi-loader-path-nonstandard.xml | 2 +- ...re-auto-efi-loader-path.x86_64-latest.args | 2 +- ...are-auto-efi-loader-path.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-path.xml | 2 +- ...oader-secure.x86_64-latest.abi-update.args | 2 +- ...loader-secure.x86_64-latest.abi-update.xml | 2 +- ...-auto-efi-loader-secure.x86_64-latest.args | 2 +- ...e-auto-efi-loader-secure.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-secure.xml | 2 +- ...to-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...uto-efi-no-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-auto-efi-no-enrolled-keys.xml | 2 +- ...are-auto-efi-no-secboot.x86_64-latest.args | 2 +- ...ware-auto-efi-no-secboot.x86_64-latest.xml | 2 +- .../firmware-auto-efi-no-secboot.xml | 2 +- ...are-auto-efi-nvram-file.x86_64-latest.args | 2 +- ...ware-auto-efi-nvram-file.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-file.xml | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-network-iscsi.xml | 2 +- ...o-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...to-efi-nvram-network-nbd.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-network-nbd.xml | 2 +- ...are-auto-efi-nvram-path.x86_64-latest.args | 2 +- ...ware-auto-efi-nvram-path.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-path.xml | 2 +- ...ram-template-nonstandard.x86_64-latest.xml | 2 +- ...re-auto-efi-nvram-template-nonstandard.xml | 2 +- ...auto-efi-nvram-template.x86_64-latest.args | 2 +- ...-auto-efi-nvram-template.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-template.xml | 2 +- ...mware-auto-efi-rw-pflash.x86_64-latest.xml | 2 +- .../firmware-auto-efi-rw-pflash.xml | 2 +- .../firmware-auto-efi-rw.x86_64-latest.xml | 2 +- .../qemuxmlconfdata/firmware-auto-efi-rw.xml | 2 +- ...rmware-auto-efi-secboot.x86_64-latest.args | 2 +- ...irmware-auto-efi-secboot.x86_64-latest.xml | 2 +- .../firmware-auto-efi-secboot.xml | 2 +- ...rmware-auto-efi-smm-off.x86_64-latest.args | 2 +- ...irmware-auto-efi-smm-off.x86_64-latest.xml | 2 +- .../firmware-auto-efi-smm-off.xml | 2 +- ...ware-auto-efi-stateless.x86_64-latest.args | 2 +- ...mware-auto-efi-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-efi-stateless.xml | 2 +- ...are-auto-efi.x86_64-latest.abi-update.args | 2 +- ...ware-auto-efi.x86_64-latest.abi-update.xml | 2 +- .../firmware-auto-efi.x86_64-latest.args | 2 +- .../firmware-auto-efi.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-auto-efi.xml | 2 +- .../firmware-manual-bios-not-stateless.xml | 2 +- ...e-manual-bios-stateless.x86_64-latest.args | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-manual-bios-stateless.xml | 2 +- .../firmware-manual-bios.x86_64-latest.args | 2 +- .../firmware-manual-bios.x86_64-latest.xml | 2 +- .../qemuxmlconfdata/firmware-manual-bios.xml | 2 +- ...are-manual-efi-acpi-q35.x86_64-latest.args | 2 +- ...ware-manual-efi-acpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-efi-acpi-q35.xml | 2 +- ...are-manual-efi-features.x86_64-latest.args | 2 +- ...ware-manual-efi-features.x86_64-latest.xml | 2 +- .../firmware-manual-efi-features.xml | 2 +- .../firmware-manual-efi-loader-no-path.xml | 2 +- ...loader-path-nonstandard.x86_64-latest.args | 2 +- ...-loader-path-nonstandard.x86_64-latest.xml | 2 +- ...are-manual-efi-loader-path-nonstandard.xml | 2 +- ...anual-efi-loader-secure.x86_64-latest.args | 2 +- ...manual-efi-loader-secure.x86_64-latest.xml | 2 +- .../firmware-manual-efi-loader-secure.xml | 2 +- ...olled-keys-legacy-paths.x86_64-latest.args | 2 +- ...rolled-keys-legacy-paths.x86_64-latest.xml | 2 +- ...nual-efi-no-enrolled-keys-legacy-paths.xml | 2 +- ...al-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...ual-efi-no-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-manual-efi-no-enrolled-keys.xml | 2 +- ...no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...-no-secboot-legacy-paths.x86_64-latest.xml | 2 +- ...are-manual-efi-no-secboot-legacy-paths.xml | 2 +- ...e-manual-efi-no-secboot.x86_64-latest.args | 2 +- ...re-manual-efi-no-secboot.x86_64-latest.xml | 2 +- .../firmware-manual-efi-no-secboot.xml | 2 +- .../firmware-manual-efi-noacpi-q35.xml | 2 +- ...e-manual-efi-nvram-file.x86_64-latest.args | 2 +- ...re-manual-efi-nvram-file.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-file.xml | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 2 +- ...irmware-manual-efi-nvram-network-iscsi.xml | 2 +- ...l-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...al-efi-nvram-network-nbd.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-network-nbd.xml | 2 +- .../firmware-manual-efi-nvram-stateless.xml | 2 +- ...am-template-nonstandard.x86_64-latest.args | 2 +- ...ram-template-nonstandard.x86_64-latest.xml | 2 +- ...-manual-efi-nvram-template-nonstandard.xml | 2 +- ...re-manual-efi-nvram-template-stateless.xml | 2 +- ...nual-efi-nvram-template.x86_64-latest.args | 2 +- ...anual-efi-nvram-template.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-template.xml | 2 +- ...-manual-efi-rw-implicit.x86_64-latest.args | 2 +- ...e-manual-efi-rw-implicit.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-implicit.xml | 2 +- ...ual-efi-rw-legacy-paths.x86_64-latest.args | 2 +- ...nual-efi-rw-legacy-paths.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-legacy-paths.xml | 2 +- ...ual-efi-rw-modern-paths.x86_64-latest.args | 2 +- ...nual-efi-rw-modern-paths.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-modern-paths.xml | 2 +- .../firmware-manual-efi-rw.x86_64-latest.args | 2 +- .../firmware-manual-efi-rw.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw.xml | 2 +- ...fi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...efi-secboot-legacy-paths.x86_64-latest.xml | 2 +- ...rmware-manual-efi-secboot-legacy-paths.xml | 2 +- ...ware-manual-efi-secboot.x86_64-latest.args | 2 +- ...mware-manual-efi-secboot.x86_64-latest.xml | 2 +- .../firmware-manual-efi-secboot.xml | 2 +- ...re-manual-efi-stateless.x86_64-latest.args | 2 +- ...are-manual-efi-stateless.x86_64-latest.xml | 2 +- .../firmware-manual-efi-stateless.xml | 2 +- .../firmware-manual-efi.x86_64-latest.args | 2 +- .../firmware-manual-efi.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-manual-efi.xml | 2 +- ...e-manual-noefi-acpi-q35.x86_64-latest.args | 2 +- ...re-manual-noefi-acpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-noefi-acpi-q35.xml | 2 +- ...manual-noefi-noacpi-q35.x86_64-latest.args | 2 +- ...-manual-noefi-noacpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-noefi-noacpi-q35.xml | 2 +- ...pi-root-hotplug-disable.x86_64-latest.args | 2 +- .../pc-i440fx-acpi-root-hotplug-disable.xml | 2 +- ...cpi-root-hotplug-enable.x86_64-latest.args | 2 +- .../pc-i440fx-acpi-root-hotplug-enable.xml | 2 +- ...pm-emulator-crb-profile.x86_64-latest.args | 2 +- .../tpm-emulator-crb-profile.xml | 2 +- .../tpm-emulator-tpm2-enc.x86_64-latest.args | 2 +- .../qemuxmlconfdata/tpm-emulator-tpm2-enc.xml | 2 +- ...pm-emulator-tpm2-pstate.x86_64-latest.args | 2 +- .../tpm-emulator-tpm2-pstate.xml | 2 +- .../tpm-emulator-tpm2.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-emulator-tpm2.xml | 2 +- .../tpm-emulator.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-emulator.xml | 2 +- .../tpm-external.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-external.xml | 2 +- .../tpm-passthrough-crb.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-passthrough-crb.xml | 2 +- .../tpm-passthrough.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-passthrough.xml | 2 +- .../tseg-explicit-size.x86_64-latest.args | 2 +- .../tseg-explicit-size.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/tseg-explicit-size.xml | 2 +- .../vhost-vsock-auto.x86_64-latest.args | 2 +- .../vhost-vsock-auto.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/vhost-vsock-auto.xml | 2 +- 198 files changed, 56774 insertions(+), 193 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml -- 2.49.0

2 8

[PATCH v2] nwfilter: Remove 'qemu-announce-self' example
by Peter Krempa 07 Jul '25

07 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> The example allows packets sent by qemu after migration with broken protocol ID. The proper self announce is handled via 'qemu-announce-self-rarp'. The qemu bug was addressed by f8778a7785d530515b0db39 (released as v0.13.0). As we no longer support such old qemus, and allowing broken packets makes no sense. Remove the rule and make it into an alias of 'qemu-announce-self-rarp' to preserve compatibility. Adjust the existing examples to use only the proper rule.t Closes: https://gitlab.com/libvirt/libvirt/-/issues/792 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- v2: - keep the old rule as alias - update comment to say that it's no longer needed docs/firewall.rst | 1 - docs/formatnwfilter.rst | 2 +- src/nwfilter/xml/clean-traffic-gateway.xml | 2 +- src/nwfilter/xml/clean-traffic.xml | 2 +- src/nwfilter/xml/qemu-announce-self-rarp.xml | 2 ++ src/nwfilter/xml/qemu-announce-self.xml | 14 ++++---------- 6 files changed, 9 insertions(+), 14 deletions(-) diff --git a/docs/firewall.rst b/docs/firewall.rst index 26474d3317..81114d2c95 100644 --- a/docs/firewall.rst +++ b/docs/firewall.rst @@ -285,7 +285,6 @@ useful rules: fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic - 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is diff --git a/docs/formatnwfilter.rst b/docs/formatnwfilter.rst index 13e9a791af..e50497aaf8 100644 --- a/docs/formatnwfilter.rst +++ b/docs/formatnwfilter.rst @@ -438,7 +438,7 @@ several other filters. <filterref filter='allow-incoming-ipv4'/> <filterref filter='no-arp-spoofing'/> <filterref filter='no-other-l2-traffic'/> - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> To reference another filter, the XML node ``filterref`` needs to be provided diff --git a/src/nwfilter/xml/clean-traffic-gateway.xml b/src/nwfilter/xml/clean-traffic-gateway.xml index b8c204041a..1768a67697 100644 --- a/src/nwfilter/xml/clean-traffic-gateway.xml +++ b/src/nwfilter/xml/clean-traffic-gateway.xml @@ -30,5 +30,5 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/clean-traffic.xml b/src/nwfilter/xml/clean-traffic.xml index b8cde9c560..b0530da70a 100644 --- a/src/nwfilter/xml/clean-traffic.xml +++ b/src/nwfilter/xml/clean-traffic.xml @@ -25,6 +25,6 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self-rarp.xml b/src/nwfilter/xml/qemu-announce-self-rarp.xml index b7a848ad0f..db7b650320 100644 --- a/src/nwfilter/xml/qemu-announce-self-rarp.xml +++ b/src/nwfilter/xml/qemu-announce-self-rarp.xml @@ -11,4 +11,6 @@ arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> </rule> + + <filterref filter='no-other-rarp-traffic'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self.xml b/src/nwfilter/xml/qemu-announce-self.xml index 352db500de..73b77804cf 100644 --- a/src/nwfilter/xml/qemu-announce-self.xml +++ b/src/nwfilter/xml/qemu-announce-self.xml @@ -1,13 +1,7 @@ <filter name='qemu-announce-self' chain='root'> -  -  - <rule action='accept' direction='out'> - <mac protocolid='0x835'/> - </rule> - -  +  <filterref filter='qemu-announce-self-rarp'/> - <filterref filter='no-other-rarp-traffic'/> - </filter> -- 2.49.0

2 1

[PATCH] nwfilter: Remove 'qemu-announce-self' example
by Peter Krempa 07 Jul '25

07 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> The example allows packets sent by qemu after migration with broken protocol ID. The proper self announce is handled via 'qemu-announce-self-rarp'. The qemu bug was addressed by f8778a7785d530515b0db39 (released as v0.13.0). As we no longer support such old qemus, and allowing broken packets makes no sense remove the filter, and adjust the existing ones to refer to the proper name. Closes: https://gitlab.com/libvirt/libvirt/-/issues/792 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- docs/firewall.rst | 1 - docs/formatnwfilter.rst | 2 +- src/nwfilter/xml/clean-traffic-gateway.xml | 2 +- src/nwfilter/xml/clean-traffic.xml | 2 +- src/nwfilter/xml/meson.build | 1 - src/nwfilter/xml/qemu-announce-self-rarp.xml | 2 ++ src/nwfilter/xml/qemu-announce-self.xml | 13 ------------- 7 files changed, 5 insertions(+), 18 deletions(-) delete mode 100644 src/nwfilter/xml/qemu-announce-self.xml diff --git a/docs/firewall.rst b/docs/firewall.rst index 26474d3317..81114d2c95 100644 --- a/docs/firewall.rst +++ b/docs/firewall.rst @@ -285,7 +285,6 @@ useful rules: fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic - 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is diff --git a/docs/formatnwfilter.rst b/docs/formatnwfilter.rst index 13e9a791af..e50497aaf8 100644 --- a/docs/formatnwfilter.rst +++ b/docs/formatnwfilter.rst @@ -438,7 +438,7 @@ several other filters. <filterref filter='allow-incoming-ipv4'/> <filterref filter='no-arp-spoofing'/> <filterref filter='no-other-l2-traffic'/> - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> To reference another filter, the XML node ``filterref`` needs to be provided diff --git a/src/nwfilter/xml/clean-traffic-gateway.xml b/src/nwfilter/xml/clean-traffic-gateway.xml index b8c204041a..1768a67697 100644 --- a/src/nwfilter/xml/clean-traffic-gateway.xml +++ b/src/nwfilter/xml/clean-traffic-gateway.xml @@ -30,5 +30,5 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/clean-traffic.xml b/src/nwfilter/xml/clean-traffic.xml index b8cde9c560..b0530da70a 100644 --- a/src/nwfilter/xml/clean-traffic.xml +++ b/src/nwfilter/xml/clean-traffic.xml @@ -25,6 +25,6 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/meson.build b/src/nwfilter/xml/meson.build index 0d96c54ebe..de3f205a7c 100644 --- a/src/nwfilter/xml/meson.build +++ b/src/nwfilter/xml/meson.build @@ -22,7 +22,6 @@ nwfilter_xml_files = [ 'no-other-l2-traffic.xml', 'no-other-rarp-traffic.xml', 'qemu-announce-self-rarp.xml', - 'qemu-announce-self.xml', ] install_data(nwfilter_xml_files, install_dir: sysconfdir / 'libvirt' / 'nwfilter') diff --git a/src/nwfilter/xml/qemu-announce-self-rarp.xml b/src/nwfilter/xml/qemu-announce-self-rarp.xml index b7a848ad0f..db7b650320 100644 --- a/src/nwfilter/xml/qemu-announce-self-rarp.xml +++ b/src/nwfilter/xml/qemu-announce-self-rarp.xml @@ -11,4 +11,6 @@ arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> </rule> + + <filterref filter='no-other-rarp-traffic'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self.xml b/src/nwfilter/xml/qemu-announce-self.xml deleted file mode 100644 index 352db500de..0000000000 --- a/src/nwfilter/xml/qemu-announce-self.xml +++ /dev/null @@ -1,13 +0,0 @@ -<filter name='qemu-announce-self' chain='root'> -  -  - <rule action='accept' direction='out'> - <mac protocolid='0x835'/> - </rule> - -  - <filterref filter='qemu-announce-self-rarp'/> - <filterref filter='no-other-rarp-traffic'/> - -</filter> -- 2.49.0

3 4

[libvirt PATCH] qemu: prefer memfd if we have to format system memory
by Ján Tomko 07 Jul '25

07 Jul '25

From: Ján Tomko <jtomko(a)redhat.com> For any vhost-user device to work, the memory needs to be marked as shared. What we recommend to users (e.g. in the virtiofs quide [0]) is: <memoryBacking> <source type='memfd'/> <access mode='shared'/> </memoryBacking> Technically, only the access mode is needed: <memoryBacking> <access mode='shared'/> </memoryBacking> But this results in libvirt assuming the file backend. Switch this case to use memfd which should offer better performance, and less disk usage, at the cost of eating unswappable RAM. [0] https://libvirt.org/kbase/virtiofs.html Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_command.c | 9 +++++++-- tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args | 2 +- .../net-vhostuser-multiq.x86_64-latest.args | 2 +- .../net-vhostuser-passt.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args | 2 +- .../schema-reorder-domain-subelements.x86_64-latest.args | 2 +- .../qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args | 2 +- 7 files changed, 13 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7658cc4d39..ca9d4d6609 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3417,8 +3417,13 @@ qemuBuildMemoryBackendProps(virJSONValue **backendProps, if (!priv->memPrealloc) prealloc = true; - } else if (!nvdimmPath && - def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) { + } else if ((!nvdimmPath && + def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) || + (systemMemory && + memAccess && + !useHugepage && + def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_NONE && + virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_MEMORY_MEMFD))) { backendType = "memory-backend-memfd"; if (useHugepage && diff --git a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args index 93d2ef0d98..04732df68a 100644 --- a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args +++ b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args index 4ea3d4eebd..ac5c8b7652 100644 --- a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args index afbbe188cf..ee395deffe 100644 --- a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args index f5925c77fe..74454d3d24 100644 --- a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args index 76df9c30b0..5fb594df87 100644 --- a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args +++ b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-passtvhostuu/.config \ -accel kvm \ -cpu qemu64 \ -m size=16777216k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-passtvhostuu/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \ -overcommit mem-lock=off \ -smp 16,sockets=16,cores=1,threads=1 \ -uuid d79698e0-46b2-4459-87ee-7c762990dd6e \ diff --git a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args index 72ca38c305..eed9af8bb1 100644 --- a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args +++ b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"s390.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ -- 2.50.0

2 1

Create a new thread in Devel
by k4i31917＠nqmo.com 05 Jul '25

05 Jul '25

https://www.canadapleasure.com/ Create a new thread in Devel

1 0

[PATCH 0/3] qemu: Improve handling of architecture-specific defaults (SCSI)
by Andrea Bolognani 04 Jul '25

04 Jul '25

I was working on this last year, then sort of lost track. Jim's recent patch[1] caused me to remember about this work and look into picking it up again. This is only half of the original series, which itself was reduced in scope compared to the first revision. I'll try to get around to everything, but addressing one area at the time is most likely to succeed. Of course this will no longer apply cleanly once Jim's patch has been pushed. The conflict will be trivial to solve though. Changes from [v2]: * several patches have been pushed; * address review comments. Changes from [v1]: * several patches have been pushed; * of the remaining changes, only the ones related to SCSI and USB controllers have been retained. I still intend to pursue the rest, but those two are where the real nasty stuff happens, so I'm focusing on them only for now; * improve the handling of USB controllers on s390x; * make all the code dealing with the legacy USB controller obsolete and get rid of it; * use out arguments to return models, making the new helpers fall in line with the usual libvirt API conventions. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/B45S… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/FZ6B… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/G53M… Andrea Bolognani (3): qemu: Improve qemuDomainDefaultSCSIControllerModel() qemu: Clean up qemuDomainDefaultSCSIControllerModel() qemu: Use virtio-scsi by default on RISC-V src/qemu/qemu_domain.c | 48 +++++++++++++------ src/qemu/qemu_domain.h | 5 +- src/qemu/qemu_hotplug.c | 16 ++++--- src/qemu/qemu_postparse.c | 11 +++-- ...ault-models.riscv64-latest.abi-update.args | 5 +- ...fault-models.riscv64-latest.abi-update.xml | 11 +++-- ...64-virt-default-models.riscv64-latest.args | 5 +- ...v64-virt-default-models.riscv64-latest.xml | 11 +++-- 8 files changed, 73 insertions(+), 39 deletions(-) -- 2.50.0

2 4

[PATCH 0/1] docs : add doc on cpu model and features
by Hector CAO 04 Jul '25

04 Jul '25

From: Hector Cao <hector.cao(a)canonical.com> Hello, This is a follow-up of the submission: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/EZBL… Based on Jiri's feedback, it is better to tackle this situation by documentation. You can find here a proposal for the documentation. The section will be rendered at : https://libvirt.org/formatcaps.html Best regards, Hector Hector Cao (1): docs : add doc on cpu model and features docs/formatcaps.rst | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) -- 2.43.0

2 2

[PATCH v1] aspeed: Deprecate the ast2700a0-evb machine
by Jamin Lin 03 Jul '25

03 Jul '25

The ast2700a0-evb machine represents the first revision of the AST2700 and serves as the initial engineering sample rather than a production version. A newer revision, A1, is now supported, and the ast2700a1-evb should replace the older A0 version. Signed-off-by: Jamin Lin <jamin_lin(a)aspeedtech.com> --- docs/about/deprecated.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 42037131de..5a3ed71a64 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -315,6 +315,14 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. +Arm ``ast2700a0-evb`` machine (since 10.1) +'''''''''''''''''''''''''''''''''''''''''' + +The ``ast2700a0-evb`` machine represents the first revision of the AST2700 +and serves as the initial engineering sample rather than a production version. +A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should +replace the older A0 version. + Mips ``mipssim`` machine (since 10.0) ''''''''''''''''''''''''''''''''''''' -- 2.43.0

2 1

[PATCH] virdevmapper: Always use device name for finding targets
by bhavin192＠purelymail.com 02 Jul '25

02 Jul '25

From: Bhavin Gandhi <bhavin192(a)geeksocket.in> DM_TABLE_DEPS expects a device name in dm_ioctl.name. In one of the cases, full path of the device was getting returned causing the ioctl call to fail with `ENXIO (No such device or address)`. Also rename the function and variable names to better reflect that we are dealing with DM device names and not paths. This got introduced in 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e Resolves: https://gitlab.com/libvirt/libvirt/-/issues/790 Signed-off-by: Bhavin Gandhi <bhavin192(a)geeksocket.in> --- src/util/virdevmapper.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c index d0eae671ab..42c86d89cf 100644 --- a/src/util/virdevmapper.c +++ b/src/util/virdevmapper.c @@ -164,7 +164,7 @@ virDMOpen(void) static char * -virDMSanitizepath(const char *path) +virDMGetDeviceName(const char *path) { g_autofree char *dmDirPath = NULL; struct dirent *ent = NULL; @@ -205,7 +205,7 @@ virDMSanitizepath(const char *path) if (stat(tmp, &sb[1]) == 0 && sb[0].st_rdev == sb[1].st_rdev) { - return g_steal_pointer(&tmp); + return g_strdup(ent->d_name); } } @@ -219,7 +219,7 @@ virDevMapperGetTargetsImpl(int controlFD, GSList **devPaths, unsigned int ttl) { - g_autofree char *sanitizedPath = NULL; + g_autofree char *deviceName = NULL; g_autofree char *buf = NULL; struct dm_ioctl dm = { 0 }; struct dm_target_deps *deps = NULL; @@ -233,10 +233,10 @@ virDevMapperGetTargetsImpl(int controlFD, if (!virIsDevMapperDevice(path)) return 0; - if (!(sanitizedPath = virDMSanitizepath(path))) + if (!(deviceName = virDMGetDeviceName(path))) return 0; - if (virStrcpy(dm.name, sanitizedPath, DM_NAME_LEN) < 0) { + if (virStrcpy(dm.name, deviceName, DM_NAME_LEN) < 0) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("Resolved device mapper name too long")); return -1; -- 2.49.0

2 1

[PATCH 0/2] network: support NAT networking for FreeBSD/pf
by Roman Bogorodskiy 02 Jul '25

02 Jul '25

This series implements NAT networks support for FreeBSD using the Packet Filter (pf) firewall. The commit messages provide high-level details and limitations of the current implementation, and I'll use this cover letter to provide some more technical details and describe testing I have performed for this change. Libvirt FreeBSD/pf NAT testing For two networks: virsh # net-dumpxml default <network> <name>default</name> <uuid>68cd5419-9fda-4cf0-9ac6-2eb9c1ba41ed</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr0' stp='on' delay='0'/> <mac address='52:54:00:db:0e:e5'/> <ip address='192.168.122.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.122.2' end='192.168.122.254'/> </dhcp> </ip> </network> virsh # net-dumpxml natnet <network> <name>natnet</name> <uuid>d3c59659-3ceb-4482-a625-1f839a54429c</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:0a:fc:1d'/> <ip address='10.0.100.1' netmask='255.255.255.0'> <dhcp> <range start='10.0.100.2' end='10.0.100.254'/> </dhcp> </ip> </network> virsh # The following rules are generated: $ sudo pfctl -a '*' -sn nat-anchor "libvirt/*" all { nat-anchor "default" all { nat pass on re0 inet from 192.168.122.0/24 to <natdst> -> (re0) port 1024:65535 round-robin } nat-anchor "natnet" all { nat pass on re0 inet from 10.0.100.0/24 to <natdst> -> (re0) port 1024:65535 round-robin } } $ $ sudo pfctl -a 'libvirt/default' -t natdst -T show 0.0.0.0/0 !192.168.122.0/24 !224.0.0.0/24 !255.255.255.255 $ sudo pfctl -a 'libvirt/natnet' -t natdst -T show 0.0.0.0/0 !10.0.100.0/24 !224.0.0.0/24 !255.255.255.255 $ $ sudo pfctl -a '*' -sr scrub all fragment reassemble anchor "libvirt/*" all { anchor "default" all { pass quick on virbr0 inet from 192.168.122.0/24 to 192.168.122.0/24 flags S/SA keep state pass quick on virbr0 inet from 192.168.122.0/24 to 224.0.0.0/24 flags S/SA keep state pass quick on virbr0 inet from 192.168.122.0/24 to 255.255.255.255 flags S/SA keep state block drop on virbr0 all } anchor "natnet" all { pass quick on virbr1 inet from 10.0.100.0/24 to 10.0.100.0/24 flags S/SA keep state pass quick on virbr1 inet from 10.0.100.0/24 to 224.0.0.0/24 flags S/SA keep state pass quick on virbr1 inet from 10.0.100.0/24 to 255.255.255.255 flags S/SA keep state block drop on virbr1 all } } pass all flags S/SA keep state $ Create two guests attached to the "default" network, vmA and vmB. vmA $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:67:eb:de brd ff:ff:ff:ff:ff:ff inet 192.168.122.92/24 brd 192.168.122.255 scope global dynamic noprefixroute enp0s4 valid_lft 1082sec preferred_lft 1082sec inet6 fe80::5054:ff:fe67:ebde/64 scope link noprefixroute valid_lft forever preferred_lft forever vmA $ vmB $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:d2:8b:41 brd ff:ff:ff:ff:ff:ff inet 192.168.122.154/24 metric 100 brd 192.168.122.255 scope global dynamic enp0s4 valid_lft 1040sec preferred_lft 1040sec inet6 fe80::5054:ff:fed2:8b41/64 scope link valid_lft forever preferred_lft forever vmB $ Test NAT rules: vmA $ ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=14.7 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=10.7 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.1 ms --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2006ms rtt min/avg/max/mdev = 10.099/11.835/14.710/2.047 ms vmA $ vmB $ ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=15.1 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=11.0 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.4 ms --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2006ms rtt min/avg/max/mdev = 10.434/12.198/15.113/2.075 ms vmB $ vmA $ curl wttr.in/?0Q Fog _ - _ - _ - +4(1) °C _ - _ - _ ↙ 11 km/h _ - _ - _ - 0 km 0.0 mm vmA $ vmB $ curl wttr.in/?0Q Fog _ - _ - _ - +4(1) °C _ - _ - _ ↙ 11 km/h _ - _ - _ - 0 km 0.0 mm vmB $ Inter-VM connectivity: vmA $ ping -c 3 192.168.122.154 PING 192.168.122.154 (192.168.122.154) 56(84) bytes of data. 64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.253 ms 64 bytes from 192.168.122.154: icmp_seq=2 ttl=64 time=0.226 ms 64 bytes from 192.168.122.154: icmp_seq=3 ttl=64 time=0.269 ms --- 192.168.122.154 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2042ms rtt min/avg/max/mdev = 0.226/0.249/0.269/0.017 ms vmA $ vmA $ ssh 192.168.122.154 uname novel(a)192.168.122.154's password: Linux vmA $ Multicast test: vmA $ iperf -s -u -B 224.0.0.1 -i 1 ------------------------------------------------------------ Server listening on UDP port 5001 Joining multicast group 224.0.0.1 Server set to single client traffic mode (per multicast receive) UDP buffer size: 208 KByte (default) ------------------------------------------------------------ [ 1] local 224.0.0.1 port 5001 connected with 192.168.122.154 port 36963 [ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams [ 1] 0.00-1.00 sec 131 KBytes 1.07 Mbits/sec 0.030 ms 0/91 (0%) [ 1] 1.00-2.00 sec 128 KBytes 1.05 Mbits/sec 0.022 ms 0/89 (0%) [ 1] 2.00-3.00 sec 128 KBytes 1.05 Mbits/sec 0.021 ms 0/89 (0%) [ 1] 0.00-3.02 sec 389 KBytes 1.06 Mbits/sec 0.026 ms 0/271 (0%) vmB $ iperf -c 224.0.0.1 -u -T 32 -t 3 -i 1 ------------------------------------------------------------ Client connecting to 224.0.0.1, UDP port 5001 Sending 1470 byte datagrams, IPG target: 11215.21 us (kalman adjust) UDP buffer size: 208 KByte (default) ------------------------------------------------------------ [ 1] local 192.168.122.154 port 36963 connected with 224.0.0.1 port 5001 [ ID] Interval Transfer Bandwidth [ 1] 0.0000-1.0000 sec 131 KBytes 1.07 Mbits/sec [ 1] 1.0000-2.0000 sec 128 KBytes 1.05 Mbits/sec [ 1] 2.0000-3.0000 sec 128 KBytes 1.05 Mbits/sec [ 1] 0.0000-3.0173 sec 389 KBytes 1.06 Mbits/sec [ 1] Sent 272 datagrams vmB $ Broadcast test: vmA $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 net.ipv4.icmp_echo_ignore_broadcasts = 0 vmA $ vmB $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 net.ipv4.icmp_echo_ignore_broadcasts = 0 vmB $ host $ ping 192.168.122.255 PING 192.168.122.255 (192.168.122.255): 56 data bytes 64 bytes from 192.168.122.154: icmp_seq=0 ttl=64 time=0.199 ms 64 bytes from 192.168.122.92: icmp_seq=0 ttl=64 time=0.227 ms (DUP!) 64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.209 ms 64 bytes from 192.168.122.92: icmp_seq=1 ttl=64 time=0.235 ms (DUP!) ^C --- 192.168.122.255 ping statistics --- 2 packets transmitted, 2 packets received, +2 duplicates, 0.0% packet loss round-trip min/avg/max/stddev = 0.199/0.218/0.235/0.014 ms This testing does not cover any negative scenarios which are probably not that important at this point. Roman Bogorodskiy (2): network: bridge_driver: add BSD implementation network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 2 + src/network/bridge_driver_bsd.c | 107 +++++++++ src/network/bridge_driver_conf.c | 8 + src/network/bridge_driver_linux.c | 2 + src/network/bridge_driver_platform.c | 2 + src/network/meson.build | 1 + src/network/network_pf.c | 327 +++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 11 files changed, 482 insertions(+), 1 deletion(-) create mode 100644 src/network/bridge_driver_bsd.c create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 7

[libvirt PATCH] docs: clarify how to build without -Werror
by Ján Tomko 02 Jul '25

02 Jul '25

From: Ján Tomko <jtomko(a)redhat.com> --werror does not accept any arguments for me and setting git_werror was also needed to disable it with git. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/compiling.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/compiling.rst b/docs/compiling.rst index 0a47a50569..06a2d53c3a 100644 --- a/docs/compiling.rst +++ b/docs/compiling.rst @@ -105,8 +105,8 @@ Notes: ~~~~~~ By default when the ``meson`` is run from within a GIT checkout, it will turn -on -Werror for builds. This can be disabled with --werror=false, but this is -not recommended. +on -Werror for builds. This can be disabled with +`-Dwerror=false -Dgit_werror=false`, but this is not recommended. Please ensure that you have the appropriate minimal ``meson`` version installed in your build environment. The minimal version for a specific package can be -- 2.49.0

2 1

[PATCH 00/15] virt-aa-helper: Misc improvements
by Michal Privoznik 02 Jul '25

02 Jul '25

Inspired by a patchset against virt-aa-helper that I reviewed recently: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/QQXM… Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1866451277 Michal Prívozník (15): log_cleaner: Use virFileCanonicalizePath() virt-aa-helper: Use virFileCanonicalizePath() virpcimock: Automatically invent fakerootdir, if not provided virpcimock: Strip fakerootdir prefix in virFileCanonicalizePath() tests: Fix mocking of open() virt-aa-helper-test: Print errors to stderr virt-aa-helper-test: Silence ls virt-aa-helper-test: Test hostdevs unconditionally virt-aa-helper: Rework USB hostdev handling virt-aa-helper: Simplify paths collection virt-aa-helper: Decrease scope of @mem_path in get_files() virt-aa-helper: Use automatic memory freeing virt-aa-helper: Check retval of vah_add_file() virt-aa-helper: Drop cleanup label from get_files() virt-aa-helper-test: Switch to getopts src/logging/log_cleaner.c | 2 +- src/security/virt-aa-helper.c | 474 +++++++++++++++++----------------- tests/nssmock.c | 4 + tests/qemusecuritymock.c | 4 + tests/vircgroupmock.c | 4 + tests/virfilewrapper.c | 4 + tests/virpcimock.c | 41 ++- tests/virt-aa-helper-test | 77 +++--- tests/virtestmock.c | 4 + tests/virusbmock.c | 4 + 10 files changed, 353 insertions(+), 265 deletions(-) -- 2.49.0

3 21

[PATCH 00/10] Unify argument name of migration APIs
by Michal Privoznik 01 Jul '25

01 Jul '25

Some of our APIs have 'bandwidth' argument but then, at internal impl level it's renamed to 'resource', inconsistently. Since it's really describing bandwidth that the migration can use, let's rename it. Michal Prívozník (10): src: Unify argument name of virDomainMigratePrepare() src: Unify argument name of virDomainMigratePerform() src: Unify argument name of virDomainMigratePrepare2() src: Unify argument name of virDomainMigratePrepareTunnel() src: Unify argument name of virDomainMigratePrepare3() src: Unify argument name of virDomainMigratePrepareTunnel3() src: Unify argument name of virDomainMigrateBegin3() src: Unify argument name of virDomainMigratePerform3() qemu: Finish argument rename gendispatch: Finish rename of the migration argument src/driver-hypervisor.h | 16 +++---- src/esx/esx_driver.c | 2 +- src/libvirt_internal.h | 16 +++---- src/qemu/qemu_driver.c | 18 ++++---- src/qemu/qemu_migration.c | 72 ++++++++++++++--------------- src/remote/remote_daemon_dispatch.c | 10 ++-- src/remote/remote_driver.c | 24 +++++----- src/remote/remote_protocol.x | 16 +++---- src/remote_protocol-structs | 16 +++---- src/rpc/gendispatch.pl | 36 +++++++-------- 10 files changed, 113 insertions(+), 113 deletions(-) -- 2.49.0

2 12

[PATCH v2 0/3] tls: Remove all traces of key encipherment usage
by Peter Krempa 01 Jul '25

01 Jul '25

v2: - [1/3] removed also GNUTLS_KEY_KEY_ENCIPHERMENT use in fallback code - [2/3 new] removed 'encryption_key' usage from kbase examples - [3/3 new] removed GNUTLS_KEY_KEY_ENCIPHERMENT use in testsuite Peter Krempa (3): tls: Don't require 'keyEncipherment' to be enabled altoghther kbase: tlscerts: Drop 'encryption_key' feature request tests: virnettls*test: Drop use of GNUTLS_KEY_KEY_ENCIPHERMENT docs/kbase/tlscerts.rst | 2 -- src/rpc/virnettlscert.c | 34 ++++------------------------------ tests/virnettlscontexttest.c | 36 ++++++++++++++++++------------------ tests/virnettlssessiontest.c | 14 +++++++------- 4 files changed, 29 insertions(+), 57 deletions(-) -- 2.49.0

2 4

[PATCH] tests: validate an XML config with USB vendor/product set
by Daniel P. Berrangé 01 Jul '25

01 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The USB vendor/product is usually translated into a device/bus at startup using the hostdev logic. We don't run the latter in the unit test suite, but we can fake it by hardcoding a translation. This demonstrates that we format the command line with the normal device/bus properties, even when vendor/product is set. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- ...tdev-usb-vendor-product.x86_64-latest.args | 35 +++++++++++++++ ...stdev-usb-vendor-product.x86_64-latest.xml | 44 +++++++++++++++++++ .../hostdev-usb-vendor-product.xml | 36 +++++++++++++++ tests/qemuxmlconftest.c | 18 ++++++++ 4 files changed, 133 insertions(+) create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args new file mode 100644 index 0000000000..62338db872 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"usb-host","hostdevice":"/dev/bus/usb/042/4660","id":"hostdev0","guest-reset":true,"guest-resets-all":false,"bus":"usb.0","port":"1"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml new file mode 100644 index 0000000000..340df80263 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml @@ -0,0 +1,44 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <hostdev mode='subsystem' type='usb' managed='no'> + <source guestReset='uninitialized'> + <vendor id='0x1234'/> + <product id='0x4321'/> + </source> + </hostdev> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml new file mode 100644 index 0000000000..dfb668f208 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml @@ -0,0 +1,36 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <hostdev mode='subsystem' type='usb' managed='no'> + <source guestReset='uninitialized'> + <vendor id='0x1234'/> + <product id='0x4321'/> + </source> + </hostdev> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index f74bd2bb7a..fe90f029d9 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -474,6 +474,23 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv, } } + for (i = 0; i < vm->def->nhostdevs; i++) { + virDomainHostdevDef *hostdev = vm->def->hostdevs[i]; + + if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && + hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB) { + virDomainHostdevSubsysUSB *usb = &hostdev->source.subsys.u.usb; + if (!usb->device && !usb->bus) { + if (usb->vendor == 0x1234 && usb->product == 0x4321) { + usb->bus = 42; + usb->device = 0x1234; + } else { + g_assert_not_reached(); + } + } + } + } + if (flags & FLAG_SLIRP_HELPER) { for (i = 0; i < vm->def->nnets; i++) { virDomainNetDef *net = vm->def->nets[i]; @@ -2118,6 +2135,7 @@ mymain(void) DO_TEST_CAPS_LATEST("hostdev-usb-address-device"); DO_TEST_CAPS_LATEST("hostdev-usb-address-device-boot"); DO_TEST_CAPS_LATEST_PARSE_ERROR("hostdev-usb-duplicate"); + DO_TEST_CAPS_LATEST("hostdev-usb-vendor-product"); DO_TEST_CAPS_LATEST("hostdev-pci-address"); DO_TEST_CAPS_LATEST("hostdev-pci-address-device"); DO_TEST_CAPS_LATEST_PARSE_ERROR("hostdev-pci-duplicate"); -- 2.49.0

2 1

[PATCH] tls: Don't require 'keyEncipherment' to be enabled altoghther
by Peter Krempa 01 Jul '25

01 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Key encipherment is required only for RSA key exchange algorithm. With TLS 1.3 this is not even used as RSA is used only for authentication. Since we can't really check when it's required ahead of time drop the check completely. GnuTLS will moan if it will not be able to use RSA key exchange. In commit 11867b0224a2 I tried to relax the check for some eliptic curve algorithm that explicitly forbid it. Based on the above the proper solution is to completely remove it. Resolves: https://issues.redhat.com/browse/RHEL-100711 Fixes: 11867b0224a2b8dc34755ff0ace446b6842df1c1 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/rpc/virnettlscert.c | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/src/rpc/virnettlscert.c b/src/rpc/virnettlscert.c index f197995633..7024e858f0 100644 --- a/src/rpc/virnettlscert.c +++ b/src/rpc/virnettlscert.c @@ -162,34 +162,6 @@ static int virNetTLSCertCheckKeyUsage(gnutls_x509_crt_t cert, certFile); } } - if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) { - int alg = gnutls_x509_crt_get_pk_algorithm(cert, NULL); - - /* Per RFC8813 [1] which amends RFC5580 [2] ECDSA, ECDH, and ECMQV - * algorithms must not have 'keyEncipherment' present. - * - * [1] https://datatracker.ietf.org/doc/rfc8813/ - * [2] https://datatracker.ietf.org/doc/rfc5480 - */ - - switch (alg) { - case GNUTLS_PK_ECDSA: - case GNUTLS_PK_ECDH_X25519: - case GNUTLS_PK_ECDH_X448: - break; - - default: - if (critical) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Certificate %1$s usage does not permit key encipherment"), - certFile); - return -1; - } else { - VIR_WARN("Certificate %s usage does not permit key encipherment", - certFile); - } - } - } } return 0; -- 2.49.0

2 7

Release of libvirt-11.5.0
by Jiri Denemark 01 Jul '25

01 Jul '25

The 11.5.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Don't accept VIR_DUMP_LIVE flag in virDomainCoreDumpWithFormat() Unfortunately, QEMU always pauses vCPUs when doing a core dump. Therefore, there is no way for Libvirt to honor VIR_DUMP_LIVE flag semantics. Instead of silently pretending the flag works, an appropriate error is now reported. * New features * vmx: Add support for reporting NVMe disks in the domain XML * qemu: Add support for NVMe disks NVMe disks can now be emulated by using an ``nvme`` bus, but require a serial due to the hypervisor:: <target dev='nvme0n1' bus='nvme'/> <serial>qwertyuiop</serial> Multiple disks can be represented as different namespaces on the same controller, but they cannot have a different serial number due to the fact that it is the controller which ultimately has the serial number attached to it, but for ease of use it is automatically copied from the disk serial. * esx: Add support for specifying alternative CA bundle for remote peer verification Users can now use ``cacert`` parameter in the URI to specify a file path with CA certificate(s) that will be used for remote peer certificate validation. * qemu: add support for AMD IOMMU device The ``amd`` model for the ``<iommu>`` device is now supported. New attributes ``passtrhough`` and ``xtsup`` are also supported for this model. * Improvements * Include supported console types in domain capabilities Domain capabilities now include information about supported console types, such as:: <console supported='yes'> <enum name='type'> <value>pty</value> <value>tcp</value> </enum> </console> * virsh: Add waiting for domain state via ``virsh await`` The new helper command ``virsh await`` simplifies waiting on domain state which is normally announced via events. Currently two waiting conditions are implemented: ``domain-inactive``, and ``guest-agent-available``. * Bug fixes * qemu: Be more forgiving when acquiring QUERY job when formatting domain XML Since ``libvirt-11.0.0`` the ``virDomainGetXMLDesc()`` API used to format domain XML acquires QUERY job. But this caused a regression when the API might timeout for incoming migration. This is now fixed. * qemu: Fix shared filesystem detection on nonexistent paths Since ``libvirt-11.1.0`` nonexistent paths within directories marked as shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` would not be properly detected as being on a shared filesystem. * qemu: Properly emulate USB cdrom device CD-ROM devices on USB bus are now properly emulated as such which was not the case since libvirt switched to the modern qemu commandline sytnax for storage backends. Enjoy. Jirka

1 0

pci-hole64-size on q35 questions
by mitchell.augustin＠canonical.com 30 Jun '25

30 Jun '25

Hi, I'm trying to get a better understanding of how libvirt VMs interact with the default QEMU setting for pci-hole64-size on q35 hosts, to assess why my libvirt VMs behave differently from a similarly configured lxd VM. As I understand, both libvirt and lxd are using qemu q35 VMs under the hood, and both are inheriting their pci-hole64-size from qemu's default setting (correct me if that's wrong), but in my tests, I'm getting different behavior from them. I know lxd is probably out of scope from the libvirt project perspective, so consider this more of a libvirt question w/ some added lxd context. All of this is on a DGX B200 host, which contains large (~180GB VRAM) GPUs. With libvirt/virt-install, I created a q35 virtual machine with CPU host passthrough and 1 or more GPUs passed-through via --host-device. Without additional modifications, this works as expected, and I can initialize the GPU driver in the VM and run nvidia-smi. With lxd (which creates a q35 virtual machine with CPU host passthrough by default), I attached 1 GPU via "lxc config device add passthroughtest gpu gpu pci=1b:00.0". On that machine, the pci-hole64-size is too small by default, since I see these in my dmesg: [ 1.099110] pci 0000:00:01.5: bridge window [mem size 0x6000000000 64bit pref]: can't assign; no space [ 1.120274] pci 0000:00:01.5: bridge window [mem size 0x6000000000 64bit pref]: can't assign; no space [ 1.183281] pci 0000:06:00.0: BAR 2 [mem size 0x4000000000 64bit pref]: can't assign; no space [ 1.186320] pci 0000:06:00.0: BAR 0 [mem size 0x04000000 64bit pref]: can't assign; no space [ 1.189340] pci 0000:06:00.0: BAR 4 [mem size 0x02000000 64bit pref]: can't assign; no space and I cannot initialize the GPU driver since the BARs weren't mapped correctly. When I apply a larger hole size to my lxd VM via `lxc config set passthroughtest raw.qemu=' -global q35-pcihost.pci-hole64-size=8192G'`, I don't see any "can't assign; no space" messages, and the driver works as expected. My question about libvirt is - where (if at all) does libvirt interact with qemu's pci-hole64-size value? If libvirt does not automatically do something functionally similar to changing the hole size like I need to do above for lxd, and is in fact just using a qemu default value, is there some other related interaction happening in libvirt that might explain why my libvirt VMs don't require a manual change to pci-hole64-size, despite the fact that the relevant parts of the underlying qemu machine should be the same?

2 1

[libvirt PATCH] NEWS: document new AMD IOMMU device
by Ján Tomko 30 Jun '25

30 Jun '25

From: Ján Tomko <jtomko(a)redhat.com> Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Applies on top of Peter's NEWS patch NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 3ffdceda81..fd2d68a600 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -45,6 +45,12 @@ v11.5.0 (unreleased) with CA certificate(s) that will be used for remote peer certificate validation. + * qemu: add support for AMD IOMMU device + + The ``amd`` model for the ``<iommu>`` device is now supported. + New attributes ``passtrhough`` and ``xtsup`` are also supported for this + model. + * **Improvements** * Include supported console types in domain capabilities -- 2.49.0

2 1

Re: [PATCH v2 09/10] net: Add passt network backend
by Markus Armbruster 30 Jun '25

30 Jun '25

Laurent Vivier <lvivier(a)redhat.com> writes: > On 24/06/2025 10:16, Markus Armbruster wrote: >> Laurent Vivier <lvivier(a)redhat.com> writes: >> >>> This commit introduces support for passt as a new network backend. >>> passt is an unprivileged, user-mode networking solution that provides >>> connectivity for virtual machines by launching an external helper process. >>> >>> The implementation reuses the generic stream data handling logic. It >>> launches the passt binary using GSubprocess, passing it a file >>> descriptor from a socketpair() for communication. QEMU connects to >>> the other end of the socket pair to establish the network data stream. >>> >>> The PID of the passt daemon is tracked via a temporary file to >>> ensure it is terminated when QEMU exits. >>> >>> Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> >> >> [...] >> >>> diff --git a/qapi/net.json b/qapi/net.json >>> index 97ea1839813b..76d7654414f7 100644 >>> --- a/qapi/net.json >>> +++ b/qapi/net.json >>> @@ -112,6 +112,125 @@ >>> 'data': { >>> 'str': 'str' } } >>> >>> +## >>> +# @NetDevPasstOptions: >>> +# >>> +# Unprivileged user-mode network connectivity using passt >>> +# >>> +# @path: path to passt binary >> >> I'd prefer a more descriptive name. >> >> Elsewhere in this file, we refer to programs like this: >> >> # @script: script to initialize the interface >> # >> # @downscript: script to shut down the interface >> >> passt isn't a script, of course. >> >> I don't know, perhaps >> >> # @passt-filename: the passt program to run. >> >> or even >> >> # @passt: Filename of the passt program to run. >> >>> +# >>> +# @quiet: don't print informational messages >> >> What does the printing? A peek at the code I snipped suggests this flag >> is passed to the passt binary as --quiet. Correct? >> >>> +# >>> +# @debug: be verbose >>> +# >>> +# @trace: extra verbose >> >> Likewise for these two. >> >>> +# >>> +# @vhost-user: enable vhost-user [...] >>> +# @udp-ports: UDP ports to forward >> >> Is there anything in this struct that configures qemu-system-FOO itself, >> i.e. isn't just passed to passt? >> > > Yes, all parameters are just passed to passt. > > Do you think it's better not to add all these parameters to netdev backend but only one > generic containing the passt command line parameters? I'm not sure. Thoughts from libvirt's perspective?

4 4

[PATCH v3] remote/stream-event: Fix a memory leak in remoteStreamCallbackFree()
by liu.xuemei1＠zte.com.cn 30 Jun '25

30 Jun '25

From: Liu Song <liu.song13(a)zte.com.cn> The ff callback is never called in remoteStreamCallbackFree() because cbdata->cb can not be NULL. This causes a leak of 'cbdata->opaque'. The leak can be reproduced by attaching and detaching to the console of an VM using `virsh console`. ASAN reports the leak stack as: Direct leak of 288 byte(s) in 1 object(s) allocated from: #0 0x7f6edf6ba0c7 in calloc (/lib64/libasan.so.8+0xba0c7) #1 0x7f6edf5175b0 in g_malloc0 (/lib64/libglib-2.0.so.0+0x615b0) #2 0x7f6ede6d0be3 in g_type_create_instance (/lib64/libgobject-2.0.so.0+0x3cbe3) #3 0x7f6ede6b82cf in g_object_new_internal (/lib64/libgobject-2.0.so.0+0x242cf) #4 0x7f6ede6b9877 in g_object_new_with_properties (/lib64/libgobject-2.0.so.0+0x25877) #5 0x7f6ede6ba620 in g_object_new (/lib64/libgobject-2.0.so.0+0x26620) #6 0x7f6edeb78138 in virObjectNew ../src/util/virobject.c:252 #7 0x7f6edeb7a78b in virObjectLockableNew ../src/util/virobject.c:274 #8 0x558251e427e1 in virConsoleNew ../tools/virsh-console.c:369 #9 0x558251e427e1 in virshRunConsole ../tools/virsh-console.c:427 Signed-off-by: Liu Song <liu.song13(a)zte.com.cn> --- Changes in v3: - Remove the second reference to 'client', and unref 'client' in error path. src/remote/remote_daemon_stream.c | 7 ++++--- src/remote/remote_driver.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/remote/remote_daemon_stream.c b/src/remote/remote_daemon_stream.c index 453728a66b..b6099e3bc7 100644 --- a/src/remote/remote_daemon_stream.c +++ b/src/remote/remote_daemon_stream.c @@ -437,12 +437,13 @@ int daemonAddClientStream(virNetServerClient *client, return -1; } + virObjectRef(client); if (virStreamEventAddCallback(stream->st, 0, daemonStreamEvent, client, - virObjectUnref) < 0) + virObjectUnref) < 0) { + virObjectUnref(client); return -1; - - virObjectRef(client); + } if ((stream->filterID = virNetServerClientAddFilter(client, daemonStreamFilter, diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 2690c05267..9ac13469e9 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -5336,7 +5336,7 @@ static void remoteStreamCallbackFree(void *opaque) { struct remoteStreamCallbackData *cbdata = opaque; - if (!cbdata->cb && cbdata->ff) + if (cbdata->ff) (cbdata->ff)(cbdata->opaque); virObjectUnref(cbdata->st); -- 2.27.0

1 0

[PATCH] NEWS: Mention 'virsh await' and proper emulation of USB cdroms
by Peter Krempa 30 Jun '25

30 Jun '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 089224cbe3..3ffdceda81 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -58,6 +58,12 @@ v11.5.0 (unreleased) </enum> </console> + * virsh: Add waiting for domain state via ``virsh await`` + + The new helper command ``virsh await`` simplifies waiting on domain state + which is normally announced via events. Currently two waiting conditions are + implemented: ``domain-inactive``, and ``guest-agent-available``. + * **Bug fixes** * qemu: Be more forgiving when acquiring QUERY job when formatting domain XML @@ -72,6 +78,12 @@ v11.5.0 (unreleased) shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` would not be properly detected as being on a shared filesystem. + * qemu: Properly emulate USB cdrom device + + CD-ROM devices on USB bus are now properly emulated as such which was not + the case since libvirt switched to the modern qemu commandline sytnax for + storage backends. + v11.4.0 (2025-06-02) ==================== -- 2.49.0

2 1

[PATCH] NEWS: Mention shared filesystem detection fix
by Jiri Denemark 30 Jun '25

30 Jun '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index ee4e9a022e..089224cbe3 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -66,6 +66,12 @@ v11.5.0 (unreleased) domain XML acquires QUERY job. But this caused a regression when the API might timeout for incoming migration. This is now fixed. + * qemu: Fix shared filesystem detection on nonexistent paths + + Since ``libvirt-11.1.0`` nonexistent paths within directories marked as + shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` + would not be properly detected as being on a shared filesystem. + v11.4.0 (2025-06-02) ==================== -- 2.49.0

2 1