- Devel - libvirt List Archives

[PATCH v3 0/3] qemu: Implement support for multiple device-pluggable SMMUv3s
by Nathan Chen 20 Nov '25

20 Nov '25

Hi, This is a follow up to the second patchset [0] for supporting multiple device-pluggable vSMMU instances. (re-sending this series for review) This patchset implements support for specifying multiple <iommu> devices within the VM definition when smmuv3 IOMMU model is specified with a pciBus driver attribute, and is tested with Shameer's recently accepted qemu series for user-creatable vSMMU devices [1] For instance, specifying the associated emulated device in a VM definition with multiple IOMMUs, configured to be routed to pcie-expander-bus or pcie-root controllers: <devices> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> ... <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </rng> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </rng> <iommu model='smmuv3'> <driver pciBus='0'/> </iommu> <iommu model='smmuv3'> <driver pciBus='1'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below. -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":2,"id":"pci.2","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pcie.0","id":"smmuv3.0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"smmuv3.1"}' \ ... -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.2","addr":"0x0"}' \ -object '{"qom-type":"rng-random","id":"objrng1","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng1","id":"rng1","bus":"pcie.0","addr":"0x4"}' \ Changes from v2: - Make multi-iommu adoption the first commit - Consolidate smmuv3Dev into smmuv3 model - Change 'parentIdx' attribute name to 'pciBus' - Change naming of virDomainDef 'iommu' attribute to 'iommus' - Move multi-iommu check to validation code - Move qemu dev props function to device-pluggable smmuv3 commit - Fix conditional statements per feedback Changes from v1: - Moved parentIdx attribute under <driver> - Revised qemuxmlconfdata test cases to attach emulated devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/nestedsmmuv3-no-accel-10-2… Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/IF6O… [1] https://lore.kernel.org/qemu-devel/20250829082543.7680-1-skolothumtho@nvidi… Nathan Chen (3): conf: Support multiple device-pluggable smmuv3 IOMMUs qemu: Implement pluggable-device smmuv3 tests: qemuxmlconfdata: provide device-pluggable smmuv3 sample XML and CLI args docs/formatdomain.rst | 4 + src/conf/domain_conf.c | 100 +++++++-- src/conf/domain_conf.h | 10 +- src/conf/domain_validate.c | 61 ++++-- src/conf/schemas/domaincommon.rng | 9 +- src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 15 +- src/qemu/qemu_command.c | 197 ++++++++++++------ src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_domain_address.c | 5 +- src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_postparse.c | 11 +- src/qemu/qemu_validate.c | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 41 ++++ .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 62 ++++++ .../qemuxmlconfdata/iommu-smmuv3-pci-bus.xml | 49 +++++ tests/qemuxmlconftest.c | 1 + 17 files changed, 455 insertions(+), 124 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.xml -- 2.43.0

2 7

RFC Gitlab #692
by Wesley Hershberger 19 Nov '25

19 Nov '25

Hi all, I'm working on Gitlab #692 [1] and would appreciate a quick discussion/review/sanity check of the direction I'm planning to take before I invest many days in a solution that misses some major consideration. I'll provide a summary of the issue here and then lay out the two approaches I'm considering. The AppArmor sVirt driver creates & loads a dynamic AppArmor profile by passing a domain's XML description to a separate program `virt-aa-helper` (see [2] for more details). When a device is hotplugged to a domain, the `virt-aa-helper` is called with a flag (`-F`) which appends a rule for that device's backing resource to the profile. The profile is reloaded from the XML description whenever a device is hotunplugged. However, the XML description for some devices does not contain enough information to create the corresponding AppArmor rule. When a profile containing a dynamic rule is reloaded, the dynamic rule is lost, and the device fails (this has been observed with macvtap devices). A similar situation occurs when temporary write access to snapshot layers is needed during block-commit; the `virt-aa-helper` is called with `-F` to add the temporary access and the profile is reloaded at the end of the operation to remove it again. However, this can have the unintended side-effect of wiping out other temporary accesses (for concurrent blockcommits) or removing access for devices added with `-F` (macvtap). A solution must: - Be persistent across libvirtd restarts - Correctly synchronize concurrent profile modifications We've conceived of two broad approaches to this issue: 1. Add fields to the domain XML schema (and persist them) so that the profile can be correctly generated using only the domain's XML description. 2. Create a separate XML file `/etc/apparmor.d/libvirt/libvirt-UUID-dynamic.xml` with only the information needed to produce the dynamic rules; access would be synchronized by a lock in libvirtd. `virt-aa-helper` would consume this file every time it runs; the file would be removed on Domain shutdown. Option 1 (Add fields to Domain schema) Concerns: ================================================ - User-visible schema changes - Do additional fields make sense in the domain schema? e.g. - a macvtap device path `/dev/tapX` - permissions info in `backingStore` elements - It may be non-trivial to chase down every device that could be affected by this issue and plumb through the additional fields (i.e. a complete solution may not be possible) Option 2 (Separate AppArmor XML) Concerns: ========================================== - User-visible additional file - Not generalizable for (future) sVirt drivers that depend on synchronizing a global resource - May require adding remove/restore hooks for the following sVirt interfaces: - virSecurityDomainSetImageFDLabel domainSetSecurityImageFDLabel; - virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel; I'd appreciate any input you'd be able to provide regarding the above trade-offs; specifically looking for guidance on what you would consider merging (in contrast to previous approaches [3]). Thanks very much for taking the time to review this, ~Wesley Hershberger Canonical Support [1] https://gitlab.com/libvirt/libvirt/-/issues/692 [2] https://gitlab.com/apparmor/apparmor/-/wikis/Libvirt [3] https://www.mail-archive.com/devel@lists.libvirt.org/msg07703.html

2 1

[PATCH 0/8] qemu: Add option to preserve shutdown VM during backup job and job/reconnection fixes
by Peter Krempa 19 Nov '25

19 Nov '25

This series first fixes few job handling, reconnection and backup job bugs and then implements an option to keep the VM process around when the guest OS shuts down during backup, so that the backup doesn't need to be restarted. Peter Krempa (8): virDomainNestedJobAllowed: Allow VIR_JOB_MODIFY_MIGRATION_SAFE if VIR_JOB_MODIFY is allowed qemuProcessReconnect: Continue reconnection if VM untergoes fake-reboot qemu: backup: Don't attempt to stop the NBD server twice qemuBlockJobProcessEventConcludedBackup: Notify the backup job later lib: Introduce VIR_DOMAIN_EVENT_SUSPENDED_GUEST_SHUTDOWN event reason lib: Introduce VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN flag qemu: backup: Add support for VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN kbase: Add note about preserving VM on shutdown to backup article docs/kbase/live_full_disk_backup.rst | 18 +++++ docs/manpages/virsh.rst | 6 ++ examples/c/misc/event-test.c | 3 + include/libvirt/libvirt-domain.h | 7 +- src/conf/backup_conf.h | 4 ++ src/conf/virdomainjob.c | 1 + src/libvirt-domain.c | 5 ++ src/qemu/qemu_backup.c | 61 +++++++++++++--- src/qemu/qemu_backup.h | 4 ++ src/qemu/qemu_blockjob.c | 7 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 101 +++++++++++++++++++++++++-- src/qemu/qemu_process.h | 3 +- tools/virsh-backup.c | 7 ++ tools/virsh-domain-event.c | 3 +- 15 files changed, 210 insertions(+), 22 deletions(-) -- 2.51.1

2 11

[PATCH] docs: domain: add watchdog notification support
by Massimiliano Minella via B4 Relay 19 Nov '25

19 Nov '25

From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..d70022a239 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0`, a notification is available when the watchdog fires, using +the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

2 1

RE: [PATCH] docs: domain: add watchdog notification support
by Massimiliano MINELLA 19 Nov '25

19 Nov '25

Hello, do you have any feedback on this patch? Best regards, Massimiliano General -----Original Message----- From: Massimiliano Minella via B4 Relay <devnull+massimiliano.minella.se.com(a)kernel.org> Sent: vendredi 3 octobre 2025 10:45 To: devel(a)lists.libvirt.org Cc: Massimiliano MINELLA <massimiliano.minella(a)se.com> Subject: [PATCH] docs: domain: add watchdog notification support [External email: Use caution with links and attachments] ________________________________ From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..c99560a3bd 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0` a notification when the watchdog fires is +available using the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

1 0

[PATCH 0/2] Fix detect_zeroes setup in qemu and improve tests
by Peter Krempa 19 Nov '25

19 Nov '25

See 2/2 for explanation. Peter Krempa (2): qemuxmlconftest: Improve coverage of 'disk-detect-zeroes' test case qemuDomainPrepareDiskSourceData: Setup 'detect_zeroes' for all layers src/qemu/qemu_domain.c | 6 +--- .../xml2json/file-backing_basic-detect.json | 3 ++ .../file-backing_basic-unmap-detect.json | 3 ++ .../file-backing_basic-unmap-ignore.json | 3 ++ .../disk-detect-zeroes.x86_64-latest.args | 20 +++++++++--- tests/qemuxmlconfdata/disk-detect-zeroes.xml | 31 +++++++++++++++++-- 6 files changed, 55 insertions(+), 11 deletions(-) -- 2.51.1

3 4

Plans for 11.10.0 release (freeze on 2025-11-25)
by Jiri Denemark 18 Nov '25

18 Nov '25

We are getting close to 11.10.0 release of libvirt. To aim for the release on Monday 01 Dec I suggest entering the freeze on Tuesday 25 Nov and tagging RC2 on Thursday 27 Nov. I hope this works for everyone. Jirka

1 0

[PATCH-for-10.2 v3 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 18 Nov '25

18 Nov '25

Since v2: - Generic 32-bit host removal message (danpb) Since v1: - 11.0 -> 10.2 v0 Cover: - Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.51.0

4 6

libvirt serial console on non-x86 platforms
by Leigh Brown 17 Nov '25

17 Nov '25

Hi Daniel, On a whim, I tried installing libvirt on a Raspberry Pi 5. I was pleasantly surprised to find that it all worked, apart from one small wrinkle. I typically use virt-install and set up a serial console, but this failed with the error: ERROR unsupported configuration: BIOS serial console only supported on x86 architectures I created the VM with a graphical console then manually adjusted the config afterwards to use a serial console and it all worked fine. After a bit of digging I saw an email[1] from yourself talking about how graphics=off has semantic effects beyond just controlling whether the firmware prints to the serial or not. After a bit more digging, I found out that Qemu 8.0[2] removed the sga device due to SeaBIOS 1.11.0 and newer supporting this feature natively when QEMU is started with the option -M graphics=off. I made the following small patch against the Debian package: --- libvirt-11.3.0.orig/src/qemu/qemu_validate.c +++ libvirt-11.3.0/src/qemu/qemu_validate.c @@ -1304,15 +1304,7 @@ qemuValidateDomainDef(const virDomainDef /* On x86 -machine graphics=off toggles the use of the * serial console in SeaBIOS (and theoretically other * firmwares). - * On non-x86, it has also sorts of other effects - * on QEMU device models created and so we don't - * want to allow its use. */ - if (!ARCH_IS_X86(def->os.arch)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("BIOS serial console only supported on x86 architectures")); - return -1; - } if (!def->nserials) { virReportError(VIR_ERR_XML_ERROR, "%s", _("need at least one serial port to use BIOS serial output")); With that change, I can now create VMs with a serial console through virt-install on the Raspberry PI 5. Have I got this right? If so, I'm happy to submit the patch. Regards, Leigh. -- [1] https://mail.gnu.org/archive/html/qemu-devel/2021-09/msg02417.html [2] https://wiki.qemu.org/ChangeLog/8.0

2 4

[PATCH-for-10.2 v2 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 17 Nov '25

17 Nov '25

- Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.51.0

1 2

[RFC 0/4] cover: RFE libvirt secret encryption on disk
by Arun Menon 17 Nov '25

17 Nov '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. First we introduce a secrets.conf file that has 2 configuration settings. 1. encrypt_data - This can be set to 0 or 1. If it is set to 1 then we encrypt the secrets. We recommend to keep this as the default setting. 2. master_encryption_key - This allows the user to set the path of the encryption file. The secrets.conf file is parsed during secrets driver initialization and accordingly the secrets are stored on the disk. By default the secrets driver will look into the CREDENTIALS_DIRECTORY environment variable in systemd. The systemd unit file is configured with a pre configured key using the SetCredentialEncrypted directive. This encrypted secret key is provided to the virtsecretd on service activation. If this file is not available, then the virtsecretd driver will check the master_encryption_key configuration in secrets.conf file, provided it is made available by the user. A boolean flag called value_encrypted is added to the secrets object, to indicate whether it is encrypted or not. This is not stored on the disk yet. It is important to add this functionality so that the secrets service behaves properly across restarts. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 Arun Menon (4): util: Add support for GnuTLS decryption secret: Set up default encrypted master key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add functionality to load and save secrets in encrypted format libvirt.spec.in | 1 + src/conf/virsecretobj.c | 13 ++ src/conf/virsecretobj.h | 7 + src/libvirt_private.syms | 3 + src/secret/meson.build | 7 + src/secret/secret_driver.c | 168 +++++++++++++++++++++++- src/secret/secrets.conf.in | 14 ++ src/secret/virtsecretd.service.extra.in | 8 ++ src/util/vircrypto.c | 130 +++++++++++++++++- src/util/vircrypto.h | 8 ++ tests/vircryptotest.c | 65 +++++++++ 11 files changed, 420 insertions(+), 4 deletions(-) create mode 100644 src/secret/secrets.conf.in -- 2.51.1

3 15

[PATCH 0/4] selinux: skip fallback label restore for shared media
by Cole Robinson 13 Nov '25

13 Nov '25

https://issues.redhat.com/browse/RHEL-126945 selinux label set/restore has race conditions on qemu:///session, where the xattr label remembering path is not used. See the above issue for a more detailed description of the problem. This series dodges the issue by skipping the fallback label restore for readonly resources like kernel and initrd, basically anything that would get the virt_content_t label. Note, disks already skip _all_ attempts to remember or restore selinux labels if the disk is marked readonly or shareable, and has done so for a long time. Maybe we should extend that out for anything that is inherently readonly or shareable, like kernel + initrd. But for now I stuck with the more conservative approach. And finally, this doesn't actually fix the race condition. If label remembering is working, the refcounting covers us. But if you disable label remembering at the qemu.conf level, there's likely similar issues in the DAC driver even for qemu:///system. I did not look into fixing the race but I suspect it involves keeping the security driver locked until the VM fully boots up. First two patches are not strictly related, but I noticed them while I was in the area Patch 3 adds the plumbing but no behavior change Patch 4 changes behavior Cole Robinson (4): selinux: Match remember/recall arguments for SavedStateLabel selinux: Don't remember labels for shareable SCSI devices selinux: Add is_shared plumbing to RestoreFileLabel selinux: Mark anything using content_context as shared src/security/security_selinux.c | 107 +++++++++++++++++++------------- 1 file changed, 63 insertions(+), 44 deletions(-) -- 2.51.1

2 5

[PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots
by Peter Krempa 13 Nov '25

13 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> External inactive snapshots are created by invoking 'qemu-img' which creates the file. Currently qemu-img creates image with mode 644 based on default umask as libvirt doesn't set any. Having a world-readable image is obviously wrong so set the umask to 0066 to have the file readable only by the owner. Resolves: https://bugs.debian.org/1120119 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_snapshot.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index d4994dd54e..6868910d9a 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -228,6 +228,9 @@ qemuSnapshotCreateQcow2Files(virDomainDef *def, NULL))) return -1; + /* ensure that new files are only readable by the user */ + virCommandSetUmask(cmd, 0066); + /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */ virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=", virStorageFileFormatTypeToString(defdisk->src->format)); -- 2.51.1

2 2

[PATCH] bhyve: s/provconn/privcon/
by Michal Privoznik 13 Nov '25

13 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> Due to a typo, the bhyve driver doesn't compile. Fix it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Merged as trivial. src/bhyve/bhyve_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 3a4e83d3d2..4b1ca80fc6 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -487,7 +487,7 @@ bhyveDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag return NULL; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) @@ -896,7 +896,7 @@ bhyveDomainCreateXML(virConnectPtr conn, start_flags |= VIR_BHYVE_PROCESS_START_AUTODESTROY; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainCreateXMLEnsureACL(conn, def) < 0) -- 2.51.0

1 0

[PATCH v5] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 13 Nov '25

13 Nov '25

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- v5: update wording and commit message docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index dacf2882e4..a781600a2f 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -484,6 +484,17 @@ Stream ``reconnect`` (since 9.2) The ``reconnect`` option only allows specifying second granularity timeouts, which is not enough for all types of use cases, use ``reconnect-ms`` instead. +TAP ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 60d196afe5..e8ccc8afc2 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -346,13 +346,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -369,7 +374,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -606,17 +611,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index 0223ceffeb..35a70096e8 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index 609ff24059..a4862d7087 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

3 3

[PATCH 0/1] cpu_map: fix vmx-* features wrong bitmaps
by Hector Cao 12 Nov '25

12 Nov '25

Hello, I'm unable to make virsh capabilities to detect the right CPU model on an Intel Granite Rapids platform. I would expect the get the CPU model defined in one of the src/cpu_map/x86_GraniteRapids*.xml files. The cause of the wrong detection is the fact that some vmx-* are not correctly detected and considered missing on this platform. When I take a look at the src/cpu_map/x86_features.xml file, I think that some of the vmx-* are wrongly defined. Taking as an example the vmx-apicv-xapic feature, it is defined as the first bit in the EAX register when we read the MSR 0x0000048b . But in Intel specification, this feature is represented as the first bit in the EDX register (32 higher bits). You can find in this submission the patch that fixes this issue, and this for all the affected MSRs. I tested this fix on my Granite Rapids platform and the CPU model is now correctly detected. Hector Cao (1): cpu_map: fix vmx-* features wrong bitmaps src/cpu_map/x86_features.xml | 136 +++++++++++++++++------------------ 1 file changed, 68 insertions(+), 68 deletions(-) -- 2.45.2

4 10

[PATCH 0/2] Remove use of deprecated 'xmlIndentTreeOutput' variable from libxml2
by Peter Krempa 11 Nov '25

11 Nov '25

The default from libxml2 is '1' which we wanted. Thus all use in separate processes is okay, and for the few exceptions (see 2/2) the resulting XML is mis-indented but valid for any app which would override it. Peter Krempa (2): virVBoxSnapshotConfSaveVboxFile: Don't modify deprecated 'xmlIndentTreeOutput' virXMLFormatMetadata: Don't modify deprecated 'xmlIndentTreeOutput' src/util/virxml.c | 10 ---------- src/vbox/vbox_snapshot_conf.c | 5 ----- 2 files changed, 15 deletions(-) -- 2.51.1

3 6

[PATCH 0/4] bhyve: support queue configuration for NVMe disks
by Roman Bogorodskiy 11 Nov '25

11 Nov '25

Roman Bogorodskiy (4): conf: domain_validate: make disk queue configuration driver specific bhyve: support queue configuration for NVMe disks bhyve: domain: refactor bhyveDomainDeviceDefValidate() bhyve: domain: improve disks validation src/bhyve/bhyve_command.c | 16 ++- src/bhyve/bhyve_domain.c | 110 +++++++++++++----- src/conf/domain_validate.c | 12 -- src/qemu/qemu_driver.c | 15 +++ src/qemu/qemu_validate.c | 14 +++ .../bhyvexml2argv-disk-virtio-queue-opts.xml | 23 ++++ .../bhyvexml2argvdata/bhyvexml2argv-nvme.args | 2 +- .../bhyvexml2argvdata/bhyvexml2argv-nvme.xml | 2 +- tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-nvme.xml | 2 +- 10 files changed, 148 insertions(+), 49 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-disk-virtio-queue-opts.xml -- 2.51.0

3 7

[PATCH 0/7] Fixes for CVE-2025-12748
by Martin Kletzander 11 Nov '25

11 Nov '25

ACL checks were performed after parsing a user provided XML in its entirety which could be written in a way that would make libvirt allocate too much memory and crash. Instead parse just the identifiers out of which only name and UUID are needed for ACL checks, perform those and then parse the whole definition. In order not to pass bogus UUID to the ACL functions, rewrite any generated UUID in the first step with a nil UUID since the ACLs cannot be written to expect a particular generated UUID as that would not make sense. If squashing the patches is preferred, let me know. Fixes: CVE-2025-12748 Reported-by: Святослав Терешин <s.tereshin(a)fobos-nt.ru> Martin Kletzander (7): conf: Add virDomainDefIDsParseString bhyve: Check ACLs before parsing the whole domain XML libxl: Check ACLs before parsing the whole domain XML lxc: Check ACLs before parsing the whole domain XML vz: Check ACLs before parsing the whole domain XML ch: Check ACLs before parsing the whole domain XML qemu: Check ACLs before parsing the whole domain XML src/bhyve/bhyve_driver.c | 24 ++++++++--- src/ch/ch_driver.c | 76 +++++++++++++++++++++++---------- src/conf/domain_conf.c | 29 +++++++++++++ src/conf/domain_conf.h | 3 ++ src/libvirt_private.syms | 1 + src/libxl/libxl_driver.c | 20 ++++++--- src/lxc/lxc_driver.c | 22 +++++++--- src/qemu/qemu_driver.c | 90 ++++++++++++++++++++------------------- src/qemu/qemu_migration.c | 21 ++++++++- src/qemu/qemu_migration.h | 4 +- src/qemu/qemu_saveimage.c | 25 +++++++++-- src/qemu/qemu_saveimage.h | 4 +- src/qemu/qemu_snapshot.c | 4 +- src/vz/vz_driver.c | 18 +++++--- 14 files changed, 243 insertions(+), 98 deletions(-) -- 2.51.2

3 14

Does our interface compatibility promise cover defaults?
by Markus Armbruster 11 Nov '25

11 Nov '25

From about/deprecated.rst: In general features are intended to be supported indefinitely once introduced into QEMU. In the event that a feature needs to be removed, it will be listed in this section. The feature will remain functional for the release in which it was deprecated and one further release. After these two releases, the feature is liable to be removed. Deprecated features may also generate warnings on the console when QEMU starts up, or if activated via a monitor command, however, this is not a mandatory requirement. This obviously applies to syntax and semantics of our external interface. Does it apply to default values there? If no: does this mean we can change defaults without notice? If yes: does this mean any change of defaults needs notice in about/deprecated.rst and the grace period? Note that changing a default is a silent change, like changing semantics / behavior, unlike changing syntax.

3 2

[PATCH] meson: default to system crypto policies where available
by Daniel P. Berrangé 10 Nov '25

10 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> In RHEL and Fedora, the built-in GNUTLS default priority is changed from "NORMAL" to "@SYSTEM", but because libvirt sets an explicit policy with gnutls we don't honour that. Instead we force "NORMAL" unless the 'tls_priority' meson option is changed. In RPM builds, meanwhile, we ask for "@LIBVIRT,SYSTEM" to make it look for a libvirt specific profile first, falling back to "@SYSTEM" This changes the meson option to default to "@LIBVIRT,SYSTEM" if the crypto-policies config is present on the local machine and the meson option -Dsystem=true is given. This gives developers more appropriate default behaviour, matching that seen in package builds. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- meson.build | 13 ++++++++++++- meson_options.txt | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index d68b37d0ba..c1871de64c 100644 --- a/meson.build +++ b/meson.build @@ -2035,7 +2035,18 @@ elif get_option('userfaultfd_sysctl').enabled() error('userfaultfd_sysctl option requires sysctl_config to be enabled') endif -conf.set_quoted('TLS_PRIORITY', get_option('tls_priority')) +prio = get_option('tls_priority') +if prio == 'auto' + # If local OS has 'crypto-policies' then default to that + policy = '/etc/crypto-policies/config' + if get_option('system') and \ + run_command('test', '-f', policy, check: false).returncode() == 0 + prio = '@LIBVIRT,SYSTEM' + else + prio = 'NORMAL' + endif +endif +conf.set_quoted('TLS_PRIORITY', prio) # test options diff --git a/meson_options.txt b/meson_options.txt index 3dc3e8667b..8b6b26dfc6 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -134,4 +134,4 @@ option('ssh_proxy', type: 'feature', value: 'auto', description: 'Build ssh-prox option('sysctl_config', type: 'feature', value: 'auto', description: 'Whether to install sysctl configs') # dep:sysctl_config option('userfaultfd_sysctl', type: 'feature', value: 'auto', description: 'Whether to install sysctl config for enabling unprivileged userfaultfd') -option('tls_priority', type: 'string', value: 'NORMAL', description: 'set the default TLS session priority string') +option('tls_priority', type: 'string', value: 'auto', description: 'set the default TLS session priority string') -- 2.51.1

2 1

[PATCH 0/3] docs: drvbhyve: documentation updates
by Roman Bogorodskiy 10 Nov '25

10 Nov '25

*** BLURB HERE *** Roman Bogorodskiy (3): docs: drvbhyve: document device passthrough docs: drvbhyve: improve the manpage link docs: drvbhyve: add guest-specific nodes section docs/drvbhyve.rst | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) -- 2.51.0

2 4

Downloading/uploading a VM from/to ESXi
by Konstantin Kharlamov 10 Nov '25

10 Nov '25

Hi, I'm in need of functional of downloading and uploading a VM from esxi. libvirt seems to lack it. From what I studied, at least downloading should be implemented by ExportVM SOAP function, and then by getting a list of URLs from its returned lease, while pinging the lease to make sure it doesn't timeout. I'm wondering is there any interest in libvirt in accepting such functional?

1 0

[PATCH 0/5] domain_capabilities: Use virXMLFormatElement() to format XML
by Michal Privoznik 10 Nov '25

10 Nov '25

*** BLURB HERE *** Michal Prívozník (5): domain_capabilities: Move indentation adjustment out of virDomainCapsCPUCustomFormat() domain_capabilities: Rework virDomainCapsCPUCustomFormat() domain_capabilities: Rework virDomainCapsCPUFormat() domain_capabilities: Check NULL in FORMAT_PROLOGUE domain_capabilities: Use virXMLFormatElement() in FORMAT_PROLOGUE and FORMAT_EPILOGUE macros src/conf/domain_capabilities.c | 135 ++++++++++---------- tests/domaincapsdata/bhyve_basic.x86_64.xml | 3 +- tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 3 +- tests/domaincapsdata/bhyve_uefi.x86_64.xml | 3 +- 4 files changed, 68 insertions(+), 76 deletions(-) -- 2.51.0

3 12

[libvirt PATCH] scripts: do not use uninitialized variable
by Ján Tomko 07 Nov '25

07 Nov '25

From: Ján Tomko <jtomko(a)redhat.com> A previous commit removed the 'ret' variable when switching to subprocess.run, but did not adjust the exit code. Fixes: 15c9ca383c2a814c61cc4ed16b4dad91221d8129 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as a build fix. scripts/check-file-access.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-file-access.py b/scripts/check-file-access.py index 71130d4dec..42c9c6b989 100755 --- a/scripts/check-file-access.py +++ b/scripts/check-file-access.py @@ -42,7 +42,7 @@ proc = subprocess.run(sys.argv[1:]) if proc.returncode != 0 or os.read(access_fd, 10) == b'': os.close(access_fd) os.remove(access_file) - sys.exit(ret) + sys.exit(proc.returncode) known_actions = ["open", "fopen", "access", "stat", "lstat", "connect"] -- 2.51.1

1 0