- Devel - libvirt List Archives

[PATCH v4 02/23] vhost: drop backend_features field
by Vladimir Sementsov-Ogievskiy 19 Jan '26

19 Jan '26

This field is mostly unused and sometimes confusing. We even have a TODO-like comment to drop it, the comment is removed in this commit. The field is used to held VHOST_USER_F_PROTOCOL_FEATURES for vhost-user and/or VHOST_NET_F_VIRTIO_NET_HDR for vhost-net (which may be vhost-user-net). But we can simply recalculate these two flags in place from hdev->features, and from net-client for VHOST_NET_F_VIRTIO_NET_HDR. Note: removing field from x-query-virtio-status result is incompatible change. We can do it because the command is unstable. Cc: devel(a)lists.libvirt.org Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Acked-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Daniil Tatianin <d-tatianin(a)yandex-team.ru> Acked-by: Raphael Norwitz <raphael.s.norwitz(a)gmail.com> --- hw/block/vhost-user-blk.c | 1 - hw/net/vhost_net.c | 26 ++++++++++++++------------ hw/scsi/vhost-scsi.c | 1 - hw/scsi/vhost-user-scsi.c | 1 - hw/virtio/vdpa-dev.c | 1 - hw/virtio/vhost-user.c | 17 ++++++++--------- hw/virtio/virtio-hmp-cmds.c | 2 -- hw/virtio/virtio-qmp.c | 4 ---- include/hw/virtio/vhost.h | 7 ------- qapi/virtio.json | 3 --- 10 files changed, 22 insertions(+), 41 deletions(-) diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index 4d81d2dc34..c8f7156ca6 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -348,7 +348,6 @@ static int vhost_user_blk_connect(DeviceState *dev, Error **errp) s->dev.nvqs = s->num_queues; s->dev.vqs = s->vhost_vqs; s->dev.vq_index = 0; - s->dev.backend_features = 0; vhost_dev_set_config_notifier(&s->dev, &blk_ops); diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 25e9f1fd24..fda90e231e 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -52,8 +52,14 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data, void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features) { - virtio_features_copy(net->dev.acked_features_ex, - net->dev.backend_features_ex); + virtio_features_clear(net->dev.acked_features_ex); + if (net->backend == -1) { + net->dev.acked_features = + net->dev.features & (1ULL << VHOST_USER_F_PROTOCOL_FEATURES); + } else if (!qemu_has_vnet_hdr(net->nc)) { + net->dev.acked_features = 1ULL << VHOST_NET_F_VIRTIO_NET_HDR; + } + vhost_ack_features_ex(&net->dev, net->feature_bits, features); } @@ -258,12 +264,9 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) if (r < 0) { goto fail; } - net->dev.backend_features = qemu_has_vnet_hdr(options->net_backend) - ? 0 : (1ULL << VHOST_NET_F_VIRTIO_NET_HDR); net->backend = r; net->dev.protocol_features = 0; } else { - virtio_features_clear(net->dev.backend_features_ex); net->dev.protocol_features = 0; net->backend = -1; @@ -284,13 +287,12 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) net->dev.features &= ~(1ULL << VIRTIO_NET_F_MRG_RXBUF); } - if (virtio_features_andnot(missing_features, - net->dev.backend_features_ex, - net->dev.features_ex)) { - fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT - " for backend\n", VIRTIO_FEATURES_PR(missing_features)); - goto fail; - } + if (!qemu_has_vnet_hdr(options->net_backend) && + (~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR))) { + fprintf(stderr, "vhost lacks feature mask 0x%llx for backend\n", + ~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR)); + goto fail; + } } /* Set sane init value. Override when guest acks. */ diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c index 699863cc10..859888fdba 100644 --- a/hw/scsi/vhost-scsi.c +++ b/hw/scsi/vhost-scsi.c @@ -275,7 +275,6 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp) vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vqs = vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, (void *)(uintptr_t)vhostfd, VHOST_BACKEND_TYPE_KERNEL, 0, errp); diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c index 3612897d4b..5070178dc2 100644 --- a/hw/scsi/vhost-user-scsi.c +++ b/hw/scsi/vhost-user-scsi.c @@ -159,7 +159,6 @@ static int vhost_user_scsi_connect(DeviceState *dev, Error **errp) vsc->dev.nvqs = VIRTIO_SCSI_VQ_NUM_FIXED + vs->conf.num_queues; vsc->dev.vqs = s->vhost_vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, &s->vhost_user, VHOST_BACKEND_TYPE_USER, 0, errp); diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 4532d63653..06179e402e 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -104,7 +104,6 @@ static void vhost_vdpa_device_realize(DeviceState *dev, Error **errp) v->dev.vqs = vqs; v->dev.vq_index = 0; v->dev.vq_index_end = v->dev.nvqs; - v->dev.backend_features = 0; v->started = false; ret = vhost_vdpa_get_iova_range(v->vhostfd, &iova_range); diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 7615ae2a9b..0ab1b14da5 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1470,14 +1470,15 @@ static int vhost_user_set_features(struct vhost_dev *dev, int ret; /* - * We need to include any extra backend only feature bits that - * might be needed by our device. Currently this includes the - * VHOST_USER_F_PROTOCOL_FEATURES bit for enabling protocol - * features. + * Don't lose VHOST_USER_F_PROTOCOL_FEATURES, which is vhost-user + * specific. */ - ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, - features | dev->backend_features, - log_enabled); + if (virtio_has_feature(dev->features, VHOST_USER_F_PROTOCOL_FEATURES)) { + features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; + } + + ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, features, + log_enabled); if (virtio_has_feature(dev->protocol_features, VHOST_USER_PROTOCOL_F_STATUS)) { @@ -2197,8 +2198,6 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque, (dev->config_ops && dev->config_ops->vhost_dev_config_notifier); uint64_t protocol_features; - dev->backend_features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; - err = vhost_user_get_u64(dev, VHOST_USER_GET_PROTOCOL_FEATURES, &protocol_features); if (err < 0) { diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c index 1daae482d3..4bf9a3109d 100644 --- a/hw/virtio/virtio-hmp-cmds.c +++ b/hw/virtio/virtio-hmp-cmds.c @@ -176,8 +176,6 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict) hmp_virtio_dump_features(mon, s->vhost_dev->features); monitor_printf(mon, " Acked features:\n"); hmp_virtio_dump_features(mon, s->vhost_dev->acked_features); - monitor_printf(mon, " Backend features:\n"); - hmp_virtio_dump_features(mon, s->vhost_dev->backend_features); monitor_printf(mon, " Protocol features:\n"); hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); } diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c index 968299fda0..916972e331 100644 --- a/hw/virtio/virtio-qmp.c +++ b/hw/virtio/virtio-qmp.c @@ -780,8 +780,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) vdev->guest_features_ex); status->host_features = qmp_decode_features(vdev->device_id, vdev->host_features_ex); - status->backend_features = qmp_decode_features(vdev->device_id, - vdev->backend_features_ex); switch (vdev->device_endian) { case VIRTIO_DEVICE_ENDIAN_LITTLE: @@ -822,8 +820,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) qmp_decode_features(vdev->device_id, hdev->features_ex); status->vhost_dev->acked_features = qmp_decode_features(vdev->device_id, hdev->acked_features_ex); - status->vhost_dev->backend_features = - qmp_decode_features(vdev->device_id, hdev->backend_features_ex); status->vhost_dev->protocol_features = qmp_decode_protocols(hdev->protocol_features); diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h index 1ee639dd7e..3e69e47833 100644 --- a/include/hw/virtio/vhost.h +++ b/include/hw/virtio/vhost.h @@ -100,16 +100,9 @@ struct vhost_dev { * * @features: available features provided by the backend * @acked_features: final negotiated features with front-end driver - * - * @backend_features: this is used in a couple of places to either - * store VHOST_USER_F_PROTOCOL_FEATURES to apply to - * VHOST_USER_SET_FEATURES or VHOST_NET_F_VIRTIO_NET_HDR. Its - * future use should be discouraged and the variable retired as - * its easy to confuse with the VirtIO backend_features. */ VIRTIO_DECLARE_FEATURES(features); VIRTIO_DECLARE_FEATURES(acked_features); - VIRTIO_DECLARE_FEATURES(backend_features); /** * @protocol_features: is the vhost-user only feature set by diff --git a/qapi/virtio.json b/qapi/virtio.json index cd67c4f52e..53ddc6b6a4 100644 --- a/qapi/virtio.json +++ b/qapi/virtio.json @@ -85,8 +85,6 @@ # # @acked-features: vhost_dev acked_features # -# @backend-features: vhost_dev backend_features -# # @protocol-features: vhost_dev protocol_features # # @max-queues: vhost_dev max_queues @@ -106,7 +104,6 @@ 'vq-index': 'int', 'features': 'VirtioDeviceFeatures', 'acked-features': 'VirtioDeviceFeatures', - 'backend-features': 'VirtioDeviceFeatures', 'protocol-features': 'VhostDeviceProtocols', 'max-queues': 'uint64', 'backend-cap': 'uint64', -- 2.52.0

1 0

[PATCH v2 0/3] libvirt-guests.sh: Declare and assign separately to avoid masking return values
by Michal Privoznik 19 Jan '26

19 Jan '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RXHD… diff to v1: - perfected the syntax-check rule - due to this fewer changes to libvirt-guests.sh.in file are necessary Michal Prívozník (3): libvirt-guests.sh: Declare and assign separately to avoid masking return values libvirt-guest.sh.in: Fix logical error in guest_is_on() syntax-check: Introduce sc_prohibit_local_with_subshell rule build-aux/syntax-check.mk | 11 +++++++++++ tools/libvirt-guests.sh.in | 12 ++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-) -- 2.52.0

2 5

[PATCH 0/5] tests: qemu: Prepare tests and add capability dump for qemu-11.0 development cycle (x86_64, aarch64)
by Peter Krempa 19 Jan '26

19 Jan '26

Few test cases meaningfully depend on the '5.0' machine type which will be removed in qemu-11.0. Freeze them, fix the rest and add capability dumps for the development cycle. Peter Krempa (5): qemuxmlconftest: Freeze 'cpu-numa-memory-oldstyle' case to qemu-10.2 qemuxmlconftest: Remove specific machine type from 'devices-acpi-index' qemuxmlconftest: Prepare 'fd-memory-numa-topology4' for removal of 'pc-i440fx-5.0' qemucapabilitiestest: Add data for the qemu-11.0 dev cycle (x86_64) qemucapabilitiestest: Add data for the qemu-11.0 dev cycle (aarch64) .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1344 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 2364 + .../qemu_11.0.0-virt.aarch64.xml | 251 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 251 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1344 + .../caps_11.0.0_aarch64.replies | 39101 +++++++++++++ .../caps_11.0.0_aarch64.xml | 530 + .../caps_11.0.0_x86_64.replies | 47697 ++++++++++++++++ .../caps_11.0.0_x86_64.xml | 4627 ++ ...u-numa-memory-oldstyle.x86_64-10.2.0.args} | 0 ...pu-numa-memory-oldstyle.x86_64-10.2.0.xml} | 0 .../devices-acpi-index.x86_64-latest.args | 2 +- .../devices-acpi-index.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/devices-acpi-index.xml | 2 +- ...a-topology4-old-machine.x86_64-10.2.0.args | 34 + ...ma-topology4-old-machine.x86_64-10.2.0.xml | 37 + .../fd-memory-numa-topology4-old-machine.xml | 37 + ...d-memory-numa-topology4.x86_64-latest.args | 6 +- .../fd-memory-numa-topology4.xml | 2 +- tests/qemuxmlconftest.c | 6 +- 20 files changed, 97629 insertions(+), 8 deletions(-) create mode 100644 tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_11.0.0_aarch64.replies create mode 100644 tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml create mode 100644 tests/qemucapabilitiesdata/caps_11.0.0_x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml rename tests/qemuxmlconfdata/{cpu-numa-memory-oldstyle.x86_64-latest.args => cpu-numa-memory-oldstyle.x86_64-10.2.0.args} (100%) rename tests/qemuxmlconfdata/{cpu-numa-memory-oldstyle.x86_64-latest.xml => cpu-numa-memory-oldstyle.x86_64-10.2.0.xml} (100%) create mode 100644 tests/qemuxmlconfdata/fd-memory-numa-topology4-old-machine.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/fd-memory-numa-topology4-old-machine.x86_64-10.2.0.xml create mode 100644 tests/qemuxmlconfdata/fd-memory-numa-topology4-old-machine.xml -- 2.52.0

2 6

[PATCH] bhyve: workaround for the lack of UTC clock on ARM64
by Roman Bogorodskiy 19 Jan '26

19 Jan '26

Currently, bhyve does not support UTC clock offset on ARM64. However, when <clock offset= > is not specified in the domain XML, UTC offset is used by default. That results in an incorrect configuration for the bhyve ARM64 guests by default. Workaround is to extend bhyveDomainDefPostParse() to fall back to the LOCALTIME clock offset when UTC clock offset is not supported by bhyve. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_domain.c | 6 ++++++ tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args | 1 - .../bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args | 1 - tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args | 1 - tests/bhyvexml2argvtest.c | 2 ++ tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml | 2 +- .../aarch64/bhyvexml2xmlout-bootloader.xml | 2 +- .../bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml | 2 +- tests/bhyvexml2xmltest.c | 4 +++- 9 files changed, 14 insertions(+), 7 deletions(-) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 0c33a67ca6..df0a008ecd 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -106,6 +106,12 @@ bhyveDomainDefPostParse(virDomainDef *def, VIR_DOMAIN_CONTROLLER_MODEL_ISA_DEFAULT); } + /* When not specified in the domain XML, clock.offset defaults to UTC which is + * not supported by bhyve on ARM64. So force it to LOCALTIME. */ + if ((def->clock.offset == VIR_DOMAIN_CLOCK_OFFSET_UTC) && + !(bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_RTC_UTC)) + def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + return 0; } diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args index 51eef94fd0..aef3ebd017 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ -s 2:0,virtio-blk,/tmp/freebsd.img \ diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args index a07e70d7d4..1079beee52 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -o bootrom=/usr/local/share/u-boot/u-boot-bhyve-arm64/u-boot.bin \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args index ae0e6bc1b3..4a031afb71 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ -s 2:0,virtio-blk,/tmp/freebsd.img \ diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 47b2726b14..c7c18c3690 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -333,6 +333,8 @@ mymain(void) /* arm64 tests */ virTestSetHostArch(VIR_ARCH_AARCH64); driver.caps = virBhyveCapsBuild(); + /* bhyve does not support UTC clock on ARM */ + driver.bhyvecaps ^= BHYVE_CAP_RTC_UTC; DO_TEST("base"); DO_TEST("console"); diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml index 573e42bfa9..ee72370047 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml @@ -8,7 +8,7 @@ <type arch='aarch64'>hvm</type> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml index 67047040bb..8c7ca5826e 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml @@ -9,7 +9,7 @@ <loader readonly='yes' type='rom'>/usr/local/share/u-boot/u-boot-bhyve-arm64/u-boot.bin</loader> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml index 2bea620cbe..d43ce8fd6f 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml @@ -8,7 +8,7 @@ <type arch='aarch64'>hvm</type> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 1d01436511..5df1f2b6ba 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -77,7 +77,7 @@ mymain(void) # define DO_TEST_FAILURE(name) \ DO_TEST_FULL(name, FLAG_EXPECT_FAILURE) - driver.bhyvecaps = BHYVE_CAP_AHCI32SLOT; + driver.bhyvecaps = BHYVE_CAP_AHCI32SLOT | BHYVE_CAP_RTC_UTC; DO_TEST_DIFFERENT("acpiapic"); DO_TEST_DIFFERENT("base"); @@ -146,6 +146,8 @@ mymain(void) virTestSetHostArch(VIR_ARCH_AARCH64); driver.caps = virBhyveCapsBuild(); + /* bhyve does not support UTC clock on ARM */ + driver.bhyvecaps ^= BHYVE_CAP_RTC_UTC; DO_TEST_DIFFERENT("base"); DO_TEST_DIFFERENT("console"); -- 2.52.0

2 1

[PATCH 0/4] qemuDomainSetThrottleGroup: Fix group name related issues
by Peter Krempa 19 Jan '26

19 Jan '26

Peter Krempa (4): qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice src/qemu/qemu_driver.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-) -- 2.52.0

2 5

[PATCH] scripts: don't import shutil in meson-warnings.py
by Laine Stump 19 Jan '26

19 Jan '26

From: Laine Stump <laine(a)redhat.com> It's never used, which makes flake8 complain. Fixes: 50ad6026adc227f5d364fd088c7c1b770e37eddb Signed-off-by: Laine Stump <laine(a)redhat.com> --- Pushed to fix the build scripts/meson-warnings.py | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/meson-warnings.py b/scripts/meson-warnings.py index d6e9539603..76949bc7e3 100644 --- a/scripts/meson-warnings.py +++ b/scripts/meson-warnings.py @@ -1,6 +1,5 @@ #!/usr/bin/env python3 -import shutil import sys with open(sys.argv[1], "w") as out: -- 2.52.0

2 1

[PATCH v4 0/7] qemu: Implement support for iommufd
by Nathan Chen 16 Jan '26

16 Jan '26

Hi, This is a follow up to the third patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/iommufd-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WIBZ… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Set per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 7 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 5 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 26 ++-- src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 20 +++ src/qemu/qemu_namespace.c | 16 ++- src/qemu/qemu_process.c | 118 ++++++++++++++++ src/security/security_apparmor.c | 32 ++++- src/security/security_dac.c | 59 ++++++-- src/security/security_selinux.c | 57 ++++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 127 ++++++++++++++++++ src/util/viriommufd.h | 27 ++++ src/util/virpci.c | 42 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 33 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 34 +++++ .../iommufd-virt-pci-bus-single.xml | 22 +++ .../iommufd-virt.aarch64-latest.args | 37 +++++ .../iommufd-virt.aarch64-latest.xml | 56 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 ++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 42 files changed, 1162 insertions(+), 62 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

3 17

[PATCH 0/3] Fix uninitialized variable in virSocketAddrFormatWithPrefix
by Julio Faracco 16 Jan '26

16 Jan '26

This series fixes a bug in virSocketAddrFormatWithPrefix() where an uninitialized variable was being used when masked=false, adds comprehensive test coverage to prevent regressions, and includes a minor code cleanup for consistency. The bug was discovered in the virSocketAddrFormatWithPrefix() function, which is used to format IP addresses with prefix notation (e.g., "1.2.3.4/24"). When the 'masked' parameter was false (meaning the caller wanted to format the original address with a prefix, not the network address), the 'network' variable was left uninitialized, leading to undefined behavior. Julio Faracco (3): util: Fix uninitialized variable in virSocketAddrFormatWithPrefix tests: Add tests for virSocketAddrFormatWithPrefix util: Standardize macro usage to check socket family src/util/virsocketaddr.c | 14 +++++--- tests/sockettest.c | 70 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 5 deletions(-) -- 2.52.0

2 8

[PATCH 0/8] Add multitouch input device support
by Julio Faracco 16 Jan '26

16 Jan '26

This patch series implements support for multitouch input devices in libvirt, addressing the multitouch feature request in [1]. Currently, libvirt supports various input devices including mouse, tablet, and keyboard, but lacks support for multitouch devices. This limitation prevents users from configuring VMs with proper multitouch capabilities, which is increasingly important for modern applications and touch-enabled displays. This series adds comprehensive multitouch support by: 1. Introducing the necessary data structures and enumerations to represent multitouch devices in the domain configuration 2. Extending the domain XML schema to allow users to specify multitouch input devices in their VM definitions 3. Implementing QEMU driver support to properly map multitouch devices to the virtio-input-host-multitouch QEMU device 4. Adding capability detection to identify when QEMU supports multitouch devices 5. Updating all relevant enumerations and mappings throughout the codebase to handle the new device type 6. Including test coverage to validate the XML parsing and QEMU command line generation After this series, users will be able to configure multitouch input devices in their domain XML like: <input type='multitouch' bus='virtio'/>. [1] https://gitlab.com/libvirt/libvirt/-/issues/808 Julio Faracco (8): conf: Add multitouch input type enum conf: Update the type name mapping in the VIR_ENUM_IMPL macro schemas: Update domain schema to support multitouch qemu: Add the multitouch case to map to the QEMU virtio device qemu: Add device properties for multitouch input qemu: Add the multitouch device capability Complete remaining enums with multitouch input type tests: Add multitouch support to virtio-input tests src/conf/domain_audit.c | 1 + src/conf/domain_conf.c | 2 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 1 + src/conf/schemas/domaincommon.rng | 1 + src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 8 ++++++++ src/qemu/qemu_validate.c | 5 +++++ src/security/security_dac.c | 2 ++ src/security/security_selinux.c | 2 ++ tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml | 1 + tests/qemuxmlconfdata/virtio-input.x86_64-latest.args | 1 + tests/qemuxmlconfdata/virtio-input.x86_64-latest.xml | 3 +++ tests/qemuxmlconfdata/virtio-input.xml | 1 + 15 files changed, 33 insertions(+) -- 2.52.0

3 13

[PATCH] util: Fix max socket calculation
by Alexandr Semenikhin 16 Jan '26

16 Jan '26

This patch changes how the maximum socket count is calculated. On some systems (e.g. GB200), physical_package_id values are not contiguous or zero-based. Instead of 0..N, they may contain large arbitrary identifiers (e.g. 256123234). The previous implementation assumed a 0..N range and used the maximum ID value directly. This caused: excessive memory allocation extremely large loop bounds OOM / DoS scenarios unnecessary CPU time consumption The new implementation computes the socket count as the number of unique package IDs present on the node, rather than relying on the maximum numeric value. Signed-off-by: Alexandr Semenikhin <alexandr2e78(a)gmail.com> --- src/util/virhostcpu.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 09395ddb04..113aa6881e 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -331,6 +331,8 @@ virHostCPUParseNode(const char *node, int siblings; unsigned int cpu; int direrr; + g_autoptr(GHashTable) st = g_hash_table_new(g_direct_hash, g_direct_equal); + gpointer sock_resolved; *threads = 0; *cores = 0; @@ -356,15 +358,29 @@ virHostCPUParseNode(const char *node, if (virHostCPUGetSocket(cpu, &sock) < 0) goto cleanup; - virBitmapSetBitExpand(sockets_map, sock); + if (!g_hash_table_lookup_extended(st, + GUINT_TO_POINTER(sock), + NULL, + &sock_resolved)) { + g_hash_table_insert(st, + GUINT_TO_POINTER(sock), + GUINT_TO_POINTER(sock_max)); + sock = sock_max; + sock_max++; + } else { + sock = GPOINTER_TO_UINT(sock_resolved); + } - if (sock > sock_max) - sock_max = sock; + virBitmapSetBitExpand(sockets_map, sock); } if (direrr < 0) goto cleanup; + if (sock_max == 0) { + g_hash_table_insert(st, GUINT_TO_POINTER(0), GUINT_TO_POINTER(sock_max)); + } + sock_max++; /* allocate cores maps for each socket */ @@ -400,6 +416,16 @@ virHostCPUParseNode(const char *node, if (virHostCPUGetSocket(cpu, &sock) < 0) goto cleanup; + + if (!g_hash_table_lookup_extended(st, + GUINT_TO_POINTER(sock), + NULL, + &sock_resolved)) { + goto cleanup; + } + + sock = GPOINTER_TO_UINT(sock_resolved); + if (!virBitmapIsBitSet(sockets_map, sock)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("CPU socket topology has changed")); -- 2.47.3

2 1

[PATCH v2 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 16 Jan '26

16 Jan '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename ebiptables unit tests and data files nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 37 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 26 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 210 + src/nwfilter/nwfilter_driver_conf.h | 66 + src/nwfilter/nwfilter_ebiptables_driver.c | 262 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 63 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2374 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 51 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 5 + tests/meson.build | 4 +- tests/nwfilternftablestest.c | 428 ++ ...ltest.c => nwfilterxml2ebipfirewalltest.c} | 4 +- ...nux.args => ah-ipv6-linux.ebiptables.args} | 0 .../ah-ipv6-linux.nftables.args | 304 ++ ...ah-linux.args => ah-linux.ebiptables.args} | 0 .../ah-linux.nftables.args | 298 ++ ...ux.args => all-ipv6-linux.ebiptables.args} | 0 .../all-ipv6-linux.nftables.args | 286 ++ ...l-linux.args => all-linux.ebiptables.args} | 0 .../all-linux.nftables.args | 280 ++ ...p-linux.args => arp-linux.ebiptables.args} | 0 .../arp-linux.nftables.args | 215 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + ...nux.args => comment-linux.ebiptables.args} | 0 .../comment-linux.nftables.args | 483 +++ ...x.args => conntrack-linux.ebiptables.args} | 0 .../conntrack-linux.nftables.args | 198 + ...ux.args => esp-ipv6-linux.ebiptables.args} | 0 .../esp-ipv6-linux.nftables.args | 304 ++ ...p-linux.args => esp-linux.ebiptables.args} | 0 .../esp-linux.nftables.args | 298 ++ ...x.args => example-1-linux.ebiptables.args} | 0 .../example-1-linux.nftables.args | 266 ++ ...x.args => example-2-linux.ebiptables.args} | 0 .../example-2-linux.nftables.args | 348 ++ ...ux.args => hex-data-linux.ebiptables.args} | 0 .../hex-data-linux.nftables.args | 357 ++ ...s => icmp-direction-linux.ebiptables.args} | 0 .../icmp-direction-linux.nftables.args | 238 ++ ... => icmp-direction2-linux.ebiptables.args} | 0 .../icmp-direction2-linux.nftables.args | 238 ++ ... => icmp-direction3-linux.ebiptables.args} | 0 .../icmp-direction3-linux.nftables.args | 184 + ...-linux.args => icmp-linux.ebiptables.args} | 0 .../icmp-linux.nftables.args | 252 ++ ...inux.args => icmpv6-linux.ebiptables.args} | 0 .../icmpv6-linux.nftables.args | 322 ++ ...-linux.args => igmp-linux.ebiptables.args} | 0 .../igmp-linux.nftables.args | 298 ++ ...ip-linux.args => ip-linux.ebiptables.args} | 0 .../ip-linux.nftables.args | 198 + ...linux.args => ipset-linux.ebiptables.args} | 0 ... => ipt-no-macspoof-linux.ebiptables.args} | 0 .../ipt-no-macspoof-linux.nftables.args | 169 + ...-linux.args => ipv6-linux.ebiptables.args} | 0 .../ipv6-linux.nftables.args | 474 +++ ...linux.args => iter1-linux.ebiptables.args} | 0 .../iter1-linux.nftables.args | 298 ++ ...linux.args => iter2-linux.ebiptables.args} | 0 .../iter2-linux.nftables.args | 3598 +++++++++++++++++ ...linux.args => iter3-linux.ebiptables.args} | 0 .../iter3-linux.nftables.args | 418 ++ ...c-linux.args => mac-linux.ebiptables.args} | 0 .../mac-linux.nftables.args | 180 + ...-linux.args => rarp-linux.ebiptables.args} | 0 .../rarp-linux.nftables.args | 215 + ...x.args => sctp-ipv6-linux.ebiptables.args} | 0 .../sctp-ipv6-linux.nftables.args | 314 ++ ...-linux.args => sctp-linux.ebiptables.args} | 0 .../sctp-linux.nftables.args | 314 ++ ...p-linux.args => stp-linux.ebiptables.args} | 0 ...inux.args => target-linux.ebiptables.args} | 0 .../target-linux.nftables.args | 452 +++ ...nux.args => target2-linux.ebiptables.args} | 0 .../target2-linux.nftables.args | 316 ++ ...ux.args => tcp-ipv6-linux.ebiptables.args} | 0 .../tcp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => tcp-linux.ebiptables.args} | 0 .../tcp-linux.nftables.args | 468 +++ ...ux.args => udp-ipv6-linux.ebiptables.args} | 0 .../udp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => udp-linux.ebiptables.args} | 0 .../udp-linux.nftables.args | 314 ++ ...rgs => udplite-ipv6-linux.ebiptables.args} | 0 .../udplite-ipv6-linux.nftables.args | 304 ++ ...nux.args => udplite-linux.ebiptables.args} | 0 .../udplite-linux.nftables.args | 298 ++ ...-linux.args => vlan-linux.ebiptables.args} | 0 .../vlan-linux.nftables.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 98 files changed, 18433 insertions(+), 365 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c rename tests/{nwfilterxml2firewalltest.c => nwfilterxml2ebipfirewalltest.c} (99%) rename tests/nwfilterxml2firewalldata/{ah-ipv6-linux.args => ah-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ah-linux.args => ah-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-ipv6-linux.args => all-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-linux.args => all-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args rename tests/nwfilterxml2firewalldata/{arp-linux.args => arp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml rename tests/nwfilterxml2firewalldata/{comment-linux.args => comment-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args rename tests/nwfilterxml2firewalldata/{conntrack-linux.args => conntrack-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-ipv6-linux.args => esp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-linux.args => esp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-1-linux.args => example-1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-2-linux.args => example-2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{hex-data-linux.args => hex-data-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction-linux.args => icmp-direction-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction2-linux.args => icmp-direction2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction3-linux.args => icmp-direction3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-linux.args => icmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmpv6-linux.args => icmpv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{igmp-linux.args => igmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ip-linux.args => ip-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipset-linux.args => ipset-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{ipt-no-macspoof-linux.args => ipt-no-macspoof-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipv6-linux.args => ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter1-linux.args => iter1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter2-linux.args => iter2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter3-linux.args => iter3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{mac-linux.args => mac-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args rename tests/nwfilterxml2firewalldata/{rarp-linux.args => rarp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-ipv6-linux.args => sctp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-linux.args => sctp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{stp-linux.args => stp-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{target-linux.args => target-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args rename tests/nwfilterxml2firewalldata/{target2-linux.args => target2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-ipv6-linux.args => tcp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-linux.args => tcp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-ipv6-linux.args => udp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-linux.args => udp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-ipv6-linux.args => udplite-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-linux.args => udplite-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args rename tests/nwfilterxml2firewalldata/{vlan-linux.args => vlan-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 11

[PATCH 0/4] Fix a few vlan-related issues
by Laine Stump 16 Jan '26

16 Jan '26

The main fix here is Patch 1, which adds the code necessary to support live update of the vlan tag for a direct (macvtap) passthrough interface, thus resolving two separate issues. The other three are just small annoyances that I found while testing. Laine Stump (4): qemu: update vlan tag of macvtap (direct) passthrough devices during update-device qemu: use actual/effective vlan when updating OVS-based interface vlan tag conf: validate that specified interface type supports vlan tags conf: simplify check for vlan tagging support in virDomainActualNetDefValidate() src/conf/domain_validate.c | 52 +++++++++++++++++++++++++++++++++----- src/qemu/qemu_hotplug.c | 14 ++++++++-- 2 files changed, 57 insertions(+), 9 deletions(-) -- 2.52.0

2 7

[PATCH 0/3] ci: massively cut down the build log sizes
by Daniel P. Berrangé 16 Jan '26

16 Jan '26

The build logs for the Fedora jobs in gitlab CI are all getting truncated with a message: [1278/1650] gcc -o te Job's log exceeded limit of 4194304 bytes. Job execution will continue but no more output will be collected. when we're only 3/4 of the way through the build process this is massively unhelpful if something fails at the end...like unit tests. Removing some -D flags and cutting down logs from the package install phase remove about 1 MB of log file output. Moving -W flags off the compiler command line, to a separate file, removes about another 2 MB of log file output. IOW, the overall log drops from 5.7 MB to 2.7 MB and are thus fully captured by gitlab. Patch 3 depends on: https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/563 Daniel P. Berrangé (3): src: remove some -D defines from compiler args meson: write all warning flags to 'c-warnings.txt' ci: regenerate with 'lcitool manifest' ci/buildenv/almalinux-10.sh | 142 +++++++++-------- ci/buildenv/almalinux-9.sh | 144 ++++++++--------- ci/buildenv/centos-stream-10.sh | 138 ++++++++-------- ci/buildenv/centos-stream-9.sh | 144 ++++++++--------- ci/buildenv/fedora-42.sh | 142 ++++++++--------- ci/buildenv/fedora-43-cross-mingw32.sh | 94 +++++------ ci/buildenv/fedora-43-cross-mingw64.sh | 94 +++++------ ci/buildenv/fedora-43.sh | 142 ++++++++--------- ci/buildenv/fedora-rawhide-cross-mingw32.sh | 96 +++++------ ci/buildenv/fedora-rawhide-cross-mingw64.sh | 96 +++++------ ci/buildenv/fedora-rawhide.sh | 144 ++++++++--------- ci/containers/almalinux-10.Dockerfile | 146 ++++++++--------- ci/containers/almalinux-9.Dockerfile | 148 ++++++++--------- ci/containers/centos-stream-10.Dockerfile | 142 ++++++++--------- ci/containers/centos-stream-9.Dockerfile | 148 ++++++++--------- ci/containers/fedora-42.Dockerfile | 148 ++++++++--------- .../fedora-43-cross-mingw32.Dockerfile | 102 ++++++------ .../fedora-43-cross-mingw64.Dockerfile | 102 ++++++------ ci/containers/fedora-43.Dockerfile | 148 ++++++++--------- .../fedora-rawhide-cross-mingw32.Dockerfile | 104 ++++++------ .../fedora-rawhide-cross-mingw64.Dockerfile | 104 ++++++------ ci/containers/fedora-rawhide.Dockerfile | 150 +++++++++--------- ci/gitlab/build-templates.yml | 6 +- meson.build | 114 ++++++------- scripts/meson-warnings.py | 9 ++ src/internal.h | 2 + src/meson.build | 6 +- src/remote/remote_protocol.x | 1 + 28 files changed, 1490 insertions(+), 1466 deletions(-) create mode 100644 scripts/meson-warnings.py -- 2.52.0

2 5

[PATCH] Align help text of virt-aa-helper with actual expectated input
by Erik Huelsmann 16 Jan '26

16 Jan '26

When virt-aa-helper is invoked with a -u parameter followed by an actual UUID as suggested by the help text, it throws an 'invalid UUID' error, even when the UUID is the UUID of an existing VM. With this adjustment of the help text, there's a better chance of users providing the correct input. Signed-off-by: Erik Huelsmann <ehuels(a)gmail.com> --- src/security/virt-aa-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index de0a826063..3f8dec98cc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -105,7 +105,7 @@ vah_usage(void) " -R | --remove unload profile\n" " Options:\n" " -d | --dryrun dry run\n" - " -u | --uuid <uuid> uuid (profile name)\n" + " -u | --uuid libvirt-<uuid> AppArmor profile name\n" " -h | --help this help\n" " Extra File:\n" " -f | --add-file <file> add file to a profile generated from XML\n" -- 2.43.0

2 2

[PATCH 00/29] qemu: Implement support for uefi-vars device and firmwares
by Andrea Bolognani 16 Jan '26

16 Jan '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 It needs a prerequisite series[1] to be applied first. Note that, while I consider the entire series to be ready for review, there are two patches that are marked as DONOTMERGE: that's because they respectively implement support for a JSON firmware descriptor syntax extension that has not yet been approved, and import into the tree firmware descriptor that are not yet part of the Fedora edk2 package. The latter depends on the former, of course, for which patches have been posted[2] to the QEMU mailing list. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/N2ET… [2] https://mail.gnu.org/archive/html/qemu-devel/2025-12/msg03462.html Andrea Bolognani (29): schemas: Drop pflashFormat schemas: Introduce firmware(Loader|Nvram)Formats schemas: Allow JSON format for NVRAM conf: Introduce VIR_STORAGE_FILE_JSON conf: Allow JSON format for NVRAM in the parser qemu_firmware: Rename qemuFirmwareFlashFile to qemuFirmwareFile qemu_firmware: Use qemuFirmwareFile in qemuFirmwareMappingMemory DONOTMERGE: qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs qemu_firmware: Fill in more information for ROMs qemu_firmware: Don't skip EnsureNVRAM() for ROMs qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check tests: Add firmware-manual-efi-qemuvars-q35 tests: Add firmware-manual-efi-qemuvars-aarch64 tests: Add firmware-manual-efi-qemuvars-nvram-network-nbd tests: Add firmware-auto-efi-enrolled-keys-aarch64 tests: Add firmware-auto-efi-format-nvram-json qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device qemu: Don't allow remote locations for JSON format NVRAM qemu_firmware: Generate correct name for JSON format NVRAM qemu_firmware: Update matching logic for ROMs qemu_firmware: Require host-uefi-vars feature for JSON NVRAM qemu_firmware: Allow JSON format for NVRAM DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate news: Document support for uefi-vars device and firmwares NEWS.rst | 10 + src/conf/domain_conf.c | 6 +- src/conf/schemas/domaincommon.rng | 22 +- src/conf/storage_source_conf.c | 2 +- src/conf/storage_source_conf.h | 1 + src/qemu/qemu_block.c | 2 + src/qemu/qemu_capabilities.c | 3 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 36 ++ src/qemu/qemu_firmware.c | 353 +++++++++++++++--- src/qemu/qemu_validate.c | 13 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + ...tdx.json => 50-edk2-ovmf-x64-microvm.json} | 12 +- .../firmware/60-edk2-ovmf-x64-inteltdx.json | 6 +- .../out/usr/share/qemu/firmware/91-bios.json | 33 ++ ...70-edk2-ovmf-qemuvars-x64-sb-enrolled.json | 35 ++ .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 33 ++ tests/qemufirmwaretest.c | 10 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...-enrolled-keys-aarch64.aarch64-latest.args | 32 ++ ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 ++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 + ...uto-efi-format-nvram-json.x86_64-8.2.0.err | 1 + ...o-efi-format-nvram-json.x86_64-latest.args | 35 ++ ...o-efi-format-nvram-json.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-format-nvram-json.xml | 18 + ...l-efi-qemuvars-aarch64.aarch64-latest.args | 33 ++ ...l-efi-qemuvars-aarch64.aarch64-latest.xml} | 24 +- .../firmware-manual-efi-qemuvars-aarch64.xml | 19 + ...muvars-nvram-network-nbd.x86_64-latest.err | 1 + ...-manual-efi-qemuvars-nvram-network-nbd.xml | 23 ++ ...manual-efi-qemuvars-q35.x86_64-latest.args | 35 ++ ...manual-efi-qemuvars-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-qemuvars-q35.xml | 19 + ...-manual-efi-tdx.x86_64-latest+inteltdx.xml | 2 +- tests/qemuxmlconftest.c | 8 + .../storagepoolcapsschemadata/poolcaps-fs.xml | 5 + .../poolcaps-full.xml | 5 + .../out/qcow2-qcow2_qcow2-qcow2_qcow2-auto | 2 +- .../out/qcow2-qcow2_qcow2-qcow2_raw-auto | 2 +- .../out/qcow2-qcow2_qcow2-qcow2_raw-raw | 2 +- tests/virstoragetestdata/out/qcow2-symlinks | 2 +- .../out/qcow2datafile-qcow2_qcow2-datafile | 2 +- 52 files changed, 824 insertions(+), 111 deletions(-) copy tests/qemufirmwaredata/out/usr/share/qemu/firmware/{60-edk2-ovmf-x64-inteltdx.json => 50-edk2-ovmf-x64-microvm.json} (56%) create mode 100644 tests/qemufirmwaredata/out/usr/share/qemu/firmware/91-bios.json create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.args copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-format-nvram-json.x86_64-latest.xml} (71%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.args copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-manual-efi-qemuvars-aarch64.aarch64-latest.xml} (52%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.args copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-qemuvars-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.xml -- 2.52.0

4 41

[PATCH 0/2] libvirt-guests.sh: Declare and assign separately to avoid masking return values
by Michal Privoznik 16 Jan '26

16 Jan '26

*** BLURB HERE *** Michal Prívozník (2): libvirt-guests.sh: Declare and assign separately to avoid masking return values syntax-check: Introduce sc_prohibit_local_with_subshell rule build-aux/syntax-check.mk | 6 ++++++ tools/libvirt-guests.sh.in | 34 +++++++++++++++++++++++----------- 2 files changed, 29 insertions(+), 11 deletions(-) -- 2.52.0

2 4

Re: [PATCH RFC v1 3/3] qapi/iothread: introduce poll-weight parameter for aio-poll
by Markus Armbruster 16 Jan '26

16 Jan '26

Cc: devel(a)lists.libvirt.org for a possible query-iothreads change discussed below. JAEHOON KIM <jhkim(a)linux.ibm.com> writes: > On 1/14/2026 1:48 AM, Markus Armbruster wrote: >> Jaehoon Kim <jhkim(a)linux.ibm.com> writes: >> >>> Introduce a new poll-weight parameter for aio-poll. This parameter >>> controls how much the most recent event interval affects the next >>> polling duration. When set to 0, a default value of 2 is used, meaning >>> the current interval contributes roughly 25% to the calculation. Larger >>> values decrease the weight of the current interval, enabling more >>> gradual adjustments to polling duration. >>> >>> Signed-off-by: Jaehoon Kim <jhkim(a)linux.ibm.com> >> [...] >> >>> diff --git a/qapi/misc.json b/qapi/misc.json >>> index 28c641fe2f..b21cc48a03 100644 >>> --- a/qapi/misc.json >>> +++ b/qapi/misc.json >>> @@ -85,6 +85,11 @@ >>> # @poll-shrink: how many ns will be removed from polling time, 0 means >>> # that it's not configured (since 2.9) >>> # >>> +# @poll-weight: the weight factor for adaptive polling. >>> +# Determines how much the current event interval contributes to >>> +# the next polling time calculation. 0 means that the default >>> +# value is used. (since 10.1) >> >> When the default value is used, the actual value being used remains >> hidden. Why? > > Actually, I just followed the existing pattern of poll-grow, which also > defaults to a factor of 2 when set to 0. Yes, and consistency is always desirable. But let's have a look at the new interface in isolation, to see whether it's actually good. > It wasn't my intention to hide the value; I kept this because the > previous API has been working fine without issues. > If you think the actual value should be visible, I'll consider ways to > make it explicit in the next version. As is, query-iothreads tells us "the weight factor for adaptive polling is X, and it was set by the user", or "the weight factor for adaptive polling was not set by the user, but picked by the system." If we returned the actual value, it would tell us "the weight factor for adaptive polling is X". Only the former interface tells us whether the user or the system picked. Only the latter interface tells us what the system picked. Which one is useful in practice? I'd argue the latter. A management application knows whether it set a value without query-iothreads' help, but it doesn't know what the system picked. The people coding it may know if a contract specifies what the system picks (see below). If we conclude that returning the actual value is better for new @poll-weight, then it would surely be better for @poll-grow and @poll-shrink, too. Could we still improve them? Libvirt developers, any advice? >>> +# >>> # @aio-max-batch: maximum number of requests in a batch for the AIO >>> # engine, 0 means that the engine will use its default (since 6.1) >>> # >>> @@ -96,6 +101,7 @@ >>> 'poll-max-ns': 'int', >>> 'poll-grow': 'int', >>> 'poll-shrink': 'int', >>> + 'poll-weight': 'int', >>> 'aio-max-batch': 'int' } } >>> >>> ## >>> diff --git a/qapi/qom.json b/qapi/qom.json >>> index 6f5c9de0f0..d90823478d 100644 >>> --- a/qapi/qom.json >>> +++ b/qapi/qom.json >>> @@ -606,6 +606,11 @@ >>> # algorithm detects it is spending too long polling without >>> # encountering events. 0 selects a default behaviour (default: 0) >>> # >>> +# @poll-weight: the weight factor for adaptive polling. >>> +# Determines how much the current event interval contributes to >>> +# the next polling time calculation. 0 selects a default >>> +# behaviour (default: 0) since 10.1. >> >> This leaves the actual default behavior unspecified. Is this a good >> idea? > > I agree that the documentation should be more explicit. > I'll update it to clarify that the default factor is 2 and explain its > meaning. I understand that you're mirroring how @poll-grow and @poll-shrink work, but let's ignore that for a minute. Compare four possible interfaces: 1. Optional @poll-weight defaults to 2. Values <= 0 are rejected. 2. Optional @poll-weight defaults to 2. Value 0 is replaced by the default value 2. Values < 0 are rejected. 3. Optional @poll-weight defaults to 0. Values < 0 are rejected. Value 0 makes the system pick a value, namely 2. 4. Optional @poll-weight defaults to 0. Values < 0 are rejected. Value 0 makes the system pick a value. It currently picks 2. The difference between 3. and 4. is that 3. makes "system picks 2" part of the contract, while 4. doesn't. 1. is the simplest. Is 2.'s additional complexity worthwhile? 3.'s? 4.'s? >>> +# >>> # The @aio-max-batch option is available since 6.1. >>> # >>> # Since: 2.0 >>> @@ -614,7 +619,8 @@ >>> 'base': 'EventLoopBaseProperties', >>> 'data': { '*poll-max-ns': 'int', >>> '*poll-grow': 'int', >>> - '*poll-shrink': 'int' } } >>> + '*poll-shrink': 'int', >>> + '*poll-weight': 'int' } } >>> >>> ## >>> # @MainLoopProperties: >> >> [...]

3 3

[RFC PATCH 0/3] qemu: Add support for control of persistent reservation migration
by Peter Krempa 15 Jan '26

15 Jan '26

Add support for migration of persistent reservations. Depends on RFC qemu patches: https://mail.gnu.org/archive/html/qemu-block/2026-01/msg00159.html Applies on top of my patches for new capabilities. Caps dump in 1/3 is based on a local build and thus will be replaced once I'll be doing an official update. Peter Krempa (3): DO_NOT_PUSH: qemucapabilitiestest: Regenerate with 'migrate-pr' patches qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR qemu: Implement support for persistent reservation migration control docs/formatdomain.rst | 3 +++ src/conf/domain_conf.c | 21 +++++++++++++++++++ src/conf/schemas/storagecommon.rng | 5 +++++ src/conf/storage_source_conf.c | 10 +++++++++ src/conf/storage_source_conf.h | 2 ++ src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 4 ++++ src/qemu/qemu_validate.c | 16 ++++++++++++++ .../caps_11.0.0_x86_64.replies | 8 ++++++- .../caps_11.0.0_x86_64.xml | 3 ++- ...irtio-scsi-reservations.x86_64-latest.args | 2 +- .../disk-virtio-scsi-reservations.xml | 2 +- 13 files changed, 75 insertions(+), 4 deletions(-) -- 2.52.0

1 3

[PATCH v2] domain_logcontext: Don't assume remote driver is always available
by Michal Privoznik 15 Jan '26

15 Jan '26

From: Michal Privoznik <mprivozn(a)redhat.com> Some functions inside of domain_logcontext.c call virLogManager APIs. But that one is available only when remote driver is enabled. Therefore, make domain_logcontext.c conditional, just like log_manager.c is: if config.has('WITH_REMOTE'). Resolves: https://gitlab.com/libvirt/libvirt/-/issues/842 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/7HSM… diff to v1: - Instead of #ifdef-ing virLogManager APIs, just make the whole domain_logcontext.c compiled conditionally. src/hypervisor/meson.build | 7 ++++++- src/libvirt_logging.syms | 7 +++++++ src/libvirt_private.syms | 7 ------- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/src/hypervisor/meson.build b/src/hypervisor/meson.build index c32703af88..91eaefbebc 100644 --- a/src/hypervisor/meson.build +++ b/src/hypervisor/meson.build @@ -2,11 +2,16 @@ hypervisor_sources = [ 'domain_cgroup.c', 'domain_driver.c', 'domain_interface.c', - 'domain_logcontext.c', 'virclosecallbacks.c', 'virhostdev.c', ] +if conf.has('WITH_REMOTE') + hypervisor_sources += [ + 'domain_logcontext.c' + ] +endif + stateful_driver_source_files += files(hypervisor_sources) hypervisor_lib = static_library( diff --git a/src/libvirt_logging.syms b/src/libvirt_logging.syms index e2a1a7109f..5e867703cb 100644 --- a/src/libvirt_logging.syms +++ b/src/libvirt_logging.syms @@ -3,6 +3,13 @@ # +# hypervisor/domain_logcontext.h +domainLogContextGetWriteFD; +domainLogContextMarkPosition; +domainLogContextNew; +domainLogContextReadFiltered; +domainLogContextWrite; + # logging/log_manager.h virLogManagerDomainAppendMessage; virLogManagerDomainGetLogFilePosition; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 4e57e4a8f6..51f4d6db24 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1695,13 +1695,6 @@ virDomainInterfaceStopDevice; virDomainInterfaceStopDevices; virDomainInterfaceVportRemove; -# hypervisor/domain_logcontext.h -domainLogContextGetWriteFD; -domainLogContextMarkPosition; -domainLogContextNew; -domainLogContextReadFiltered; -domainLogContextWrite; - # hypervisor/virclosecallbacks.h virCloseCallbacksDomainAdd; virCloseCallbacksDomainAlloc; -- 2.52.0

2 1

[PATCH] domain_logcontext: Don't assume remote driver is always available
by Michal Privoznik 15 Jan '26

15 Jan '26

From: Michal Privoznik <mprivozn(a)redhat.com> Some functions inside of domain_logcontext call virLogManager APIs. But that one is available only when remote driver is enabled (from src/logging/meson.build): if conf.has('WITH_REMOTE') log_driver_lib = static_library( 'virt_log_driver', [ log_driver_sources, log_protocol_generated, ], ... Guard calls to virLogManager APIs with #ifdef WITH_REMOTE. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/842 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hypervisor/domain_logcontext.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/src/hypervisor/domain_logcontext.c b/src/hypervisor/domain_logcontext.c index 41d1bbdf64..92f942eb81 100644 --- a/src/hypervisor/domain_logcontext.c +++ b/src/hypervisor/domain_logcontext.c @@ -71,7 +71,9 @@ domainLogContextFinalize(GObject *object) domainLogContext *ctxt = DOMAIN_LOG_CONTEXT(object); VIR_DEBUG("ctxt=%p", ctxt); +#ifdef WITH_REMOTE virLogManagerFree(ctxt->manager); +#endif VIR_FREE(ctxt->path); VIR_FORCE_CLOSE(ctxt->writefd); VIR_FORCE_CLOSE(ctxt->readfd); @@ -82,8 +84,8 @@ domainLogContextFinalize(GObject *object) domainLogContext * domainLogContextNew(bool stdioLogD, char *logDir, - const char *driver_name, - virDomainObj *vm, + const char *driver_name G_GNUC_UNUSED, + virDomainObj *vm G_GNUC_UNUSED, bool privileged, const char *basename) { @@ -96,6 +98,7 @@ domainLogContextNew(bool stdioLogD, ctxt->path = g_strdup_printf("%s/%s.log", logDir, basename); if (stdioLogD) { +#ifdef WITH_REMOTE ctxt->manager = virLogManagerNew(privileged); if (!ctxt->manager) goto error; @@ -110,6 +113,11 @@ domainLogContextNew(bool stdioLogD, &ctxt->pos); if (ctxt->writefd < 0) goto error; +#else /* !WITH_REMOTE */ + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("logd stdio handler is not supported")); + goto error; +#endif /* !WITH_REMOTE */ } else { if ((ctxt->writefd = open(ctxt->path, O_WRONLY | O_CREAT | O_APPEND, S_IRUSR | S_IWUSR)) < 0) { virReportSystemError(errno, _("failed to create logfile %1$s"), @@ -202,6 +210,7 @@ domainLogContextRead(domainLogContext *ctxt, (unsigned long long)ctxt->pos); if (ctxt->manager) { +#ifdef WITH_REMOTE buf = virLogManagerDomainReadLogFile(ctxt->manager, ctxt->path, ctxt->inode, @@ -211,6 +220,11 @@ domainLogContextRead(domainLogContext *ctxt, if (!buf) return -1; buflen = strlen(buf); +#else /* !WITH_REMOTE */ + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("logd stdio handler is not supported")); + return -1; +#endif /* !WITH_REMOTE */ } else { ssize_t got; @@ -315,14 +329,17 @@ domainLogContextGetWriteFD(domainLogContext *ctxt) void domainLogContextMarkPosition(domainLogContext *ctxt) { - if (ctxt->manager) + if (ctxt->manager) { +#ifdef WITH_REMOTE virLogManagerDomainGetLogFilePosition(ctxt->manager, ctxt->path, 0, &ctxt->inode, &ctxt->pos); - else +#endif /* WITH_REMOTE */ + } else { ctxt->pos = lseek(ctxt->writefd, 0, SEEK_END); + } } -- 2.52.0

3 2

Questions about device attach/detach semantics
by pascal.scholz＠cyberus-technology.de 15 Jan '26

15 Jan '26

Hi all, I'm part of Cyberus Technology and currently working on the Cloud Hypervisor driver backend of libvirt. We are currently implementing a feature to fix device bus addresses in the domain definitions for PCI devices, guaranteeing that devices remain available at the same address even after live migration and restarts, and across libvirt versions. In doing so, some questions came up about the intended semantics of the `--persistent` and `--live` flags in virsh commands and the synchronization between runtime and persistent configuration. So we wanted to ask you these questions. Our first question revolves around `virsh mirgate --persistent`. The documentation says `leaves the domain persistent on the destination host physical machine`, but what domain definition is used from the source side to migrate the VM? Is it that the live definition is sent, then migrated, and persisted on the receiver side? Or is the source's persistent XML sent to the receiver, and the receiver’s live definition created from the persistent definition received? The second question is about synchronization between live and persistent configuration. To achieve the goal of keeping the same device at the same PCI bus address across restarts and live migrations, to our understanding, we have to ensure that one device is written to both domain definitions with the same PCI bus address. Is this right, or do we miss something? The next questions are about attaching/detaching devices (live). With respect to our intention to implement fixed PCI bus addresses for devices, what would be the right semantics for the following cases? Are they even valid? The source code of the qemu driver leaves those questions open: 1) We attach a device `A` with `--persistent`and remove it with `--live`. If we now attach `B`, either via `--persistent` and `--live`, we expect that the PCI bus address formerly assigned to `A` is not reused for `B`. Is this correct? 2) If we attach a device `A` with `--live` and a second device `B` with `--persistent`, then `A` will not be present in the persistent domain XML. Still, we expect that `B` is added to both live and persistent definitions, using the same PCI bus address. By doing so, we would expect the attachment routines for the persistent definition not to assign the address handed out by the attachment routines of the live configuration for device `A`. In other words, even if `A` is not present in the persistent configuration, we would expect the address of `A` not be reused when attaching `B` to the persistent definition. Are those semantics correct? The last question is about target names for network devices (`ifname`). libvirt does generate names for such devices in certain situations. Whenever a device definition is parsed that contains an `ifname` that matches libvirt's generation rules, e.g. vnet*, it is blanked out (see `virDomainNetDefParseXML`, in domain_conf.c). When writing code that tries to identify network devices by their `ifname`s, we found that this would be impossible because devices with an autogenerated name will have a blank `ifname` in the definition. What is the expected semantics around fixed PCI bus addresses for such devices? Would it be right to assign a custom `ifname` to them in this case? Thanks in advance! Pascal

3 4

Resolving issue 135 (Qemu under AppArmor can't access volume-type disks)
by Erik Huelsmann 15 Jan '26

15 Jan '26

Hi, Several months ago, I ran into issue #135 which says that Qemu under AppArmor can't access LVM volume disks. I have been studying the code and the invocation of virt-aa-helper. I'm using 11.3.0 and 10.0.0 -- I'm working to compile and run a development version, but have my progress to share in the mean time. So far, I'm finding that if I create a volume-based disk XML entry in my domain definition: <disk type='volume' device='disk'> <driver name='qemu' type='qcow2'/> <source pool='default' volume='cirros.img'/> <target dev='sda' bus='scsi'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> with this, there is *no* XML (at all) on standard input in the virt-aa-helper command, whereas when using effectively the same definition, resolving the file manually, like this: <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/cirros.img'/> <target dev='sda' bus='scsi'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> I get full XML on standard input for virt-aa-helper, with this being the snippet for the disk definition: <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/cirros.img' index='1'/> <backingStore/> <target dev='sda' bus='scsi'/> <alias name='scsi0-0-0-0'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> I'm not asking for a fix, but would like to know if anybody has any "Ah hah!" moments about this - and if not, if there are some hints on how to test this, hopefully without needing to restart a VM over-and-over. Thanks in advance for any hints you may be able to provide! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

3 7

[PATCH 0/3] qemu: capabilities: Fetch properties of 'scsi-block' and 'scsi-generic' and add caps_10.2.0_aarch64 test data
by Peter Krempa 15 Jan '26

15 Jan '26

Peter Krempa (3): qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices qemucapabilitiesdata: Regenerate 'caps_10.2.0_x86_64' replies qemucapabilitestest: Add 'caps_10.2.0_aarch64' test data src/qemu/qemu_capabilities.c | 12 + .../qemu_10.2.0-virt.aarch64.xml | 251 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 251 + .../caps_10.0.0_aarch64.replies | 76 +- .../caps_10.0.0_ppc64.replies | 60 +- .../caps_10.0.0_s390x.replies | 64 +- .../caps_10.0.0_x86_64+amdsev.replies | 84 +- .../caps_10.0.0_x86_64.replies | 84 +- .../caps_10.1.0_s390x.replies | 64 +- .../caps_10.1.0_x86_64+inteltdx.replies | 88 +- .../caps_10.1.0_x86_64.replies | 88 +- .../caps_10.2.0_aarch64.replies | 39259 ++++++++++++++++ .../caps_10.2.0_aarch64.xml | 530 + .../caps_10.2.0_x86_64+mshv.replies | 88 +- .../caps_10.2.0_x86_64.replies | 186 +- .../caps_6.2.0_ppc64.replies | 60 +- .../caps_6.2.0_x86_64.replies | 84 +- .../caps_7.0.0_ppc64.replies | 60 +- .../caps_7.0.0_x86_64.replies | 84 +- .../caps_7.1.0_ppc64.replies | 60 +- .../caps_7.1.0_x86_64.replies | 84 +- .../caps_7.2.0_ppc.replies | 56 +- .../caps_7.2.0_x86_64+hvf.replies | 84 +- .../caps_7.2.0_x86_64.replies | 84 +- .../caps_8.0.0_x86_64.replies | 84 +- .../caps_8.1.0_s390x.replies | 60 +- .../caps_8.1.0_x86_64.replies | 84 +- .../caps_8.2.0_aarch64.replies | 76 +- .../caps_8.2.0_armv7l.replies | 76 +- .../caps_8.2.0_loongarch64.replies | 64 +- .../caps_8.2.0_s390x.replies | 60 +- .../caps_8.2.0_x86_64.replies | 84 +- .../caps_9.0.0_sparc.replies | 52 +- .../caps_9.0.0_x86_64.replies | 84 +- .../caps_9.1.0_riscv64.replies | 64 +- .../caps_9.1.0_s390x.replies | 64 +- .../caps_9.1.0_x86_64.replies | 84 +- .../caps_9.2.0_aarch64+hvf.replies | 72 +- .../caps_9.2.0_s390x.replies | 64 +- .../caps_9.2.0_x86_64+amdsev.replies | 84 +- .../caps_9.2.0_x86_64.replies | 84 +- ...arch64-cpu-passthrough.aarch64-latest.args | 2 +- ...aarch64-cpu-passthrough.aarch64-latest.xml | 2 +- ...ault-cpu-kvm-virt-10.0.aarch64-latest.args | 2 +- ...fault-cpu-kvm-virt-10.0.aarch64-latest.xml | 2 +- ...ault-cpu-tcg-virt-10.0.aarch64-latest.args | 1 - ...fault-cpu-tcg-virt-10.0.aarch64-latest.xml | 3 - ...aarch64-features-pauth.aarch64-latest.args | 2 +- .../aarch64-features-pauth.aarch64-latest.xml | 2 +- .../aarch64-features-sve.aarch64-latest.args | 2 +- .../aarch64-features-sve.aarch64-latest.xml | 2 +- .../aarch64-features-wrong.aarch64-latest.xml | 2 +- .../aarch64-gic-default.aarch64-latest.args | 2 +- .../aarch64-gic-default.aarch64-latest.xml | 2 +- .../aarch64-gic-none.aarch64-latest.args | 2 +- .../aarch64-gic-none.aarch64-latest.xml | 2 +- .../aarch64-kvm-32-on-64.aarch64-latest.args | 2 +- .../aarch64-kvm-32-on-64.aarch64-latest.xml | 2 +- .../aarch64-pci-serial.aarch64-latest.args | 1 - .../aarch64-pci-serial.aarch64-latest.xml | 3 - ...arch64-traditional-pci.aarch64-latest.args | 1 - ...aarch64-traditional-pci.aarch64-latest.xml | 3 - ...aarch64-usb-controller.aarch64-latest.args | 1 - .../aarch64-usb-controller.aarch64-latest.xml | 3 - ...ault-models.aarch64-latest.abi-update.args | 1 - ...fault-models.aarch64-latest.abi-update.xml | 3 - ...64-virt-default-models.aarch64-latest.args | 1 - ...h64-virt-default-models.aarch64-latest.xml | 3 - .../aarch64-virt-graphics.aarch64-latest.args | 1 - .../aarch64-virt-graphics.aarch64-latest.xml | 3 - ...h64-virt-headless-mmio.aarch64-latest.args | 1 - ...ch64-virt-headless-mmio.aarch64-latest.xml | 3 - .../aarch64-virt-headless.aarch64-latest.args | 1 - .../aarch64-virt-headless.aarch64-latest.xml | 3 - ...irt-minimal.aarch64-latest.abi-update.args | 1 - ...virt-minimal.aarch64-latest.abi-update.xml | 3 - .../aarch64-virt-minimal.aarch64-latest.args | 1 - .../aarch64-virt-minimal.aarch64-latest.xml | 3 - .../arm-vexpressa9-basic.aarch64-latest.args | 1 + .../arm-vexpressa9-basic.aarch64-latest.xml | 3 + .../arm-vexpressa9-nodevs.aarch64-latest.args | 1 + .../arm-vexpressa9-nodevs.aarch64-latest.xml | 3 + .../arm-vexpressa9-virtio.aarch64-latest.args | 1 + .../arm-vexpressa9-virtio.aarch64-latest.xml | 3 + .../cpu-topology5.aarch64-latest.args | 1 - .../cpu-topology5.aarch64-latest.xml | 3 +- ...ult-video-type-aarch64.aarch64-latest.args | 2 +- ...ault-video-type-aarch64.aarch64-latest.xml | 2 +- .../disk-arm-virtio-sd.aarch64-latest.args | 1 + .../disk-arm-virtio-sd.aarch64-latest.xml | 3 + ...efi-aarch64.aarch64-latest.abi-update.args | 1 - ...-efi-aarch64.aarch64-latest.abi-update.xml | 3 - ...mware-auto-efi-aarch64.aarch64-latest.args | 1 - ...rmware-auto-efi-aarch64.aarch64-latest.xml | 3 - ...-loader-raw.aarch64-latest.abi-update.args | 1 - ...t-loader-raw.aarch64-latest.abi-update.xml | 3 - ...-efi-format-loader-raw.aarch64-latest.args | 1 - ...o-efi-format-loader-raw.aarch64-latest.xml | 3 - ...i-aarch64-legacy-paths.aarch64-latest.args | 1 - ...fi-aarch64-legacy-paths.aarch64-latest.xml | 3 - ...anual-efi-acpi-aarch64.aarch64-latest.args | 1 - ...manual-efi-acpi-aarch64.aarch64-latest.xml | 3 - ...ual-efi-noacpi-aarch64.aarch64-latest.args | 1 - ...nual-efi-noacpi-aarch64.aarch64-latest.xml | 3 - ...l-noefi-noacpi-aarch64.aarch64-latest.args | 1 - ...al-noefi-noacpi-aarch64.aarch64-latest.xml | 3 - ...-smmuv3-pci-bus-single.aarch64-latest.args | 1 - ...u-smmuv3-pci-bus-single.aarch64-latest.xml | 3 - .../iommu-smmuv3-pci-bus.aarch64-latest.args | 1 - .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 3 - .../iommu-smmuv3.aarch64-latest.args | 1 - .../iommu-smmuv3.aarch64-latest.xml | 3 - ...ch-virt-console-native.aarch64-latest.args | 1 - ...ach-virt-console-native.aarch64-latest.xml | 3 - ...ch-virt-console-virtio.aarch64-latest.args | 1 - ...ach-virt-console-virtio.aarch64-latest.xml | 3 - ...-serial+console-native.aarch64-latest.args | 1 - ...t-serial+console-native.aarch64-latest.xml | 3 - ...ach-virt-serial-compat.aarch64-latest.args | 1 - ...mach-virt-serial-compat.aarch64-latest.xml | 3 - ...ach-virt-serial-native.aarch64-latest.args | 1 - ...mach-virt-serial-native.aarch64-latest.xml | 3 - .../mach-virt-serial-pci.aarch64-latest.args | 1 - .../mach-virt-serial-pci.aarch64-latest.xml | 3 - .../mach-virt-serial-usb.aarch64-latest.args | 1 - .../mach-virt-serial-usb.aarch64-latest.xml | 3 - ...e-expander-bus-aarch64.aarch64-latest.args | 1 - ...ie-expander-bus-aarch64.aarch64-latest.xml | 3 - .../pcihole64-virt.aarch64-latest.args | 1 - .../pcihole64-virt.aarch64-latest.xml | 3 - .../pvpanic-pci-aarch64.aarch64-latest.args | 1 - .../pvpanic-pci-aarch64.aarch64-latest.xml | 3 - ...pci-no-address-aarch64.aarch64-latest.args | 1 - ...-pci-no-address-aarch64.aarch64-latest.xml | 3 - ...automatic-virt-aarch64.aarch64-latest.args | 1 - ...-automatic-virt-aarch64.aarch64-latest.xml | 3 - ...-fallback-virt-aarch64.aarch64-latest.args | 1 - ...t-fallback-virt-aarch64.aarch64-latest.xml | 3 - ...r-default-virt-aarch64.aarch64-latest.args | 1 - ...er-default-virt-aarch64.aarch64-latest.xml | 3 - .../virtio-iommu-aarch64.aarch64-latest.args | 1 - .../virtio-iommu-aarch64.aarch64-latest.xml | 3 - 142 files changed, 42351 insertions(+), 932 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.2.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0.aarch64.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_aarch64.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml -- 2.52.0

2 4

[PATCH] qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type
by Peter Krempa 15 Jan '26

15 Jan '26

From: Peter Krempa <pkrempa(a)redhat.com> The concept of moving a seclabel is used e.g. when a new image is introduced to the backing chain (or one of the existing ones becomes active during block commit). What it does is that it moves the metedata remembering the original seclabel to the new image. That idea works reasonably well if both the original and new image are of same type e.g. a file, where they have comparable seclabel. It breaks down though when you e.g. create a snapshot stored in a 'file' on top of a disk originally backed by a 'block' storage source, since the seclabels differ quite siginificantly. This patch restricts the seclabel move in qemuSecurityMoveImageMetadata to happen only if the storage sources are of same type to avoid the issue. This means that the seclabels will not be remebered and will be restored to the default but it's better than to transfer wrong labels. Resolves: https://issues.redhat.com/browse/RHEL-114412 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_security.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c index 6bb0f9170d..84cb981a96 100644 --- a/src/qemu/qemu_security.c +++ b/src/qemu/qemu_security.c @@ -201,6 +201,16 @@ qemuSecurityMoveImageMetadata(virQEMUDriver *driver, if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) pid = vm->pid; + /* Moving seclabel metadata makes sense only when 'src' and 'dst' are of + * the same type. Otherwise 'dst' could end up with a seclabel that doesn't + * make sense for it (e.g. a seclabel originating from a block device /dev + * node moved to a file), once the seclabels are restored for it */ + if (src && dst && src->type != dst->type) { + VIR_DEBUG("dropping security label metadata instead of moving it from '%s' to '%s' due to type mismatch", + NULLSTR(src->path), NULLSTR(dst->path)); + dst = NULL; + } + return virSecurityManagerMoveImageMetadata(driver->securityManager, cfg->sharedFilesystems, pid, src, dst); -- 2.52.0

2 1

Release of libvirt-12.0.0
by Jiri Denemark 15 Jan '26

15 Jan '26

The 12.0.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * bhyve: SLIRP networking support Domain XMLs now can use SLIRP user-mode networking:: <interface type='user'> <model type='virtio'/> </interface> * bhyve: virtio-scsi support Domain XMLs now can use ``virtio-scsi`` devices:: <disk type='ctl'> <source dev='/dev/cam/ctl'/> <target dev='sda' bus='scsi'/> </disk> * bhyve: initial ARM64 support The bhyve driver now supports booting ARM64 domains on ARM64 hosts. This support is still in early stage of development and has some limitations. For example, it requires using ``<clock offset='localtime'/>`` in domain XMLs, and bootrom autofill is not implemented. * Improvements * qemu: Improvements and fixes to firmware selection Firmware selection now works more reliably and predictably in many scenarios. Notably, issues that were preventing the use of firmware designed for confidential VMs on aarch64 have been addressed. * network: Introduce port for DNS forwarder In the ``<dns/>`` section of network configuration users can set up forwarding of DNS requests to custom DNS servers. These are specified using ``addr`` attribute. But configuring port wasn't possible, until now. New ``port`` attribute is introduced, which allows overriding the default DNS port for given address. * Bug fixes * qemu: Fix startup of VMs with more than ~25 external snapshots After switch to json-c VMs with too deeply nested image chains would fail to start due to nesting depth limit in json-c, which is now increased to once again support backing chains up to 200 images deep. * qemu: TPM: Properly handle migration when storage resides on NFS The VM now can be properly migrated in scenarios where TPM data is stored on a shared filesystem on the destination but on the source it's either on a different NFS or unshared completely. * qemu: Treat memory device source nodemask as strict NUMA policy Until now, the NUMA policy for ``<memory/>`` devices was taken either from the guest NUMA node or ``<numatune/>``. But this may lead to discrepancies, where the memory device is configured to bind to a set of host NUMA nodes, but the guest NUMA node is to bind to a disjoint set of host NUMA nodes. To resolve this, specifying ``<nodemask/>`` for a memory device implies ``strict`` policy. * qemu: Relax validation of some hyperv features Since 11.9.0 release, libvirt performs dependency checks for hyperv features, for instance ``stimer`` requires ``synic``. But as it turned out, for some ancient machine types (e.g. 'pc-i440fx-3.0' or 'pc-q35-3.0') some dependencies are not true. Corresponding checks were removed. * esx: URI encode inventory objects twice Formatting domain XML for domains on an ESX server might fail if corresponding datacenter or datastore contained special characters (e.g. '+'). This is now fixed. * Fix race when checking whether a path is on a shared file system Finding an existing parent of a given path and checking whether it's on a shared file system was not atomic and thus the path could have been misinterpreted as non-shared if it was removed between these two operations. This could cause migration with an emulated TPM device stored on a shared file system to fail with the following bogus error:: Operation not supported: the running swtpm does not support migration with shared storage Enjoy. Jirka

1 0