- Devel - libvirt List Archives

[PATCH] virt-aa-helper: Avoid duplicate when append rule
by Hector CAO 20 Aug '25

20 Aug '25

From: Hector Cao <hector.cao(a)canonical.com> when a device is dynamically attached to a VM, and it needs a special system access for apparmor, libvirt calls virt-aa-helper (with argument -F) to append a new rule to the apparmor profile of the VM. virt-aa-helper does not check for duplicate and blindly appends the rule to the profile. since there is no rule removal when a device is detached, this can make the profile grow in size if a big number of attach/detach operations are done and the profile might hit the size limit and futur attach operations might dysfunction because no rule can be added into the apparmor profile. this patch tries to mitigate this issue by doing a duplicate check when rules are appended into the profile. this fix does not guarantee the absence of duplicates but should be enough to prevent the profile to grow significantly in size and reach its size limit. Signed-off-by: Hector CAO <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index b662d971cb..a003c6dd9e 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -208,9 +208,20 @@ update_include_file(const char *include_file, const char *included_files, return -1; } - if (append && virFileExists(include_file)) - pcontent = g_strdup_printf("%s%s", existing, included_files); - else + if (append && virFileExists(include_file)) { + /* duplicate check: include_files might contain multiple rules + * the best is to check for each rule (separated by \n) but + * it might be overkilled, just do the check for the whole + * include_files. + * most of the time, include_files contains only one rule + * so this check is ok to avoid the overflow of the profile + * duplicates might still exist though. + */ + if (!strstr(existing, included_files)) { + pcontent = g_strdup_printf("%s%s", existing, included_files); + } else + pcontent = g_strdup(existing); + } else pcontent = g_strdup_printf("%s%s", warning, included_files); plen = strlen(pcontent); -- 2.34.1

3 2

[PATCH 0/4] Enable mshv support for Qemu domains
by Praveen K Paladugu 20 Aug '25

20 Aug '25

"[PATCH v3 00/26] Implementing a MSHV (Microsoft Hypervisor) accelerator" patchset in qemu-devel mailing list introduces MSHV support within Qemu. With above patchset, Qemu guests can be started with `-accel mshv` option to use Microsoft Hypervisor (/dev/mshv) as the hypervisor. Retaining Libvirt's naming convention, this translates to `hyperv` domains. Below is an excerpt of the xml to use with this patcset: ``` <domain type='hyperv'> <name>qemu_msh_testv</name> <cpu mode='host-model'/> <os> <type machine='q35'>hvm</type> </os> ... ``` This patch set introduces the necessary changes within libvirt to support Qemu guest with hyperv (mshv) hypervisor. Known issue: ``` abs_builddir=/home/user/QEMU_MSHV/libvirt/build/tests abs_top_srcdir=/home/user/QEMU_MSHV/libvirt LD_LIBRARY_PATH=/home/user/QEMU_MSHV/libvirt/build/tests:/home/user/QEMU_MSHV/libvirt/build/src abs_srcdir=/home/user/QEMU_MSHV/libvirt/tests VIR_TEST_EXPENSIVE=0 ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 LC_ALL=C LIBVIRT_AUTOSTART=0 G_DEBUG=fatal-warnings MALLOC_PERTURB_=255 abs_top_builddir=/home/user/QEMU_MSHV/libvirt/build /home/user/QEMU_MSHV/libvirt/build/tests/qemucapabilitiestest TEST: qemucapabilitiestest wrong expected command in /home/user/QEMU_MSHV/libvirt/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies:23538: : {"execute":"query-mshv","id":"libvirt-6"} expected {"execute":"qom-list-types","id":"libvirt-6"} ``` Could someone point me to the steps to regenerate the replies files to fix above issue? Praveen K Paladugu (4): qemu: introduce mshv capabilities qemu: probe mshv capabilities qemu: use mshv accel for hyperv domains qemu_cgroup: add /dev/mshv to default devices src/qemu/qemu_capabilities.c | 71 +++++++++++++++++++++++++++++++----- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 4 +- src/qemu/qemu_monitor.c | 9 +++-- src/qemu/qemu_monitor.h | 8 ++-- src/qemu/qemu_monitor_json.c | 13 ++++--- src/qemu/qemu_monitor_json.h | 10 ++--- 8 files changed, 88 insertions(+), 30 deletions(-) -- 2.50.1

3 11

FYI: Planned list outage Mon 25th Aug from 10:00 JST
by Daniel P. Berrangé 20 Aug '25

20 Aug '25

We have a planned outage of the libvirt.org mailing lists on Monday 25th August. The outage is anticipated to begin at approx 10:00 JST (Japan), and all going well, should last no more than a couple hours. There will be various cosmetic changes to the lists.libvirt.org web interface after the upgrade, due to the newer software versions introduced. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH v1 0/2] docs/tlscerts: minor improvements for TLS setup
by Sebastian Mitterle 20 Aug '25

20 Aug '25

Two minor improvements for the TLS setup documentation. Sebastian Mitterle (2): docs/tlscerts: document need for socket activation docs/tlscerts: mention dropped 'encryption_key' docs/kbase/tlscerts.rst | 42 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) -- 2.50.1

2 3

[PATCH 00/12] util: sync error_report & qemu_log output more closely
by Daniel P. Berrangé 20 Aug '25

20 Aug '25

This series is a tangent that came out of discussion in https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00903.html In thinking about adding thread info to error_report, I came to realize we should likely make qemu_log behave consistently with error_report & friends more generally. We already honour '-msg timestamp=on' in both (with duplicated code), and qemu_log doesn't honour the '-msg guest-name=on' parameter, nor will it include the binary name. This series shouldn't be considered mutually exclusive with Manos' backtrace suggestion above - it is complementary & each proposal can be evaluated independently. As an example of the current state, consider mixing error and log output today: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55ac6d97f700 dir=fish qcrypto_tls_creds_get_path TLS creds path creds=0x55ac6d97f700 filename=ca-cert.pem path=<none> qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:14:16.791413Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55e9a3458d10 dir=fish 2025-08-19T20:14:16.791429Z qcrypto_tls_creds_get_path TLS creds path creds=0x55e9a3458d10 filename=ca-cert.pem path=<none> 2025-08-19T20:14:16.791433Z fish food qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory And after this series is complete: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qemu-system-x86_64(1184284:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55a24ad5cb30 dir=fish qemu-system-x86_64(1184284:main): qcrypto_tls_creds_get_path TLS creds path creds=0x55a24ad5cb30 filename=ca-cert.pem path=<none> qemu-system-x86_64(1184284:main): Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:12:50.211823Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x5582183d8760 dir=fish 2025-08-19T20:12:50.211842Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_get_path TLS creds path creds=0x5582183d8760 filename=ca-cert.pem path=<none> 2025-08-19T20:12:50.211846Z [fish food] qemu-system-x86_64(1168876:main): Unable to access credentials fish/ca-cert.pem: No such file or directory The main things to note: * error_report/warn_report/qemu_log share the same output format and -msg applies to both * -msg debug-threads=on is now unconditionally enabled and thus the param is deprecated & ignored * Thread ID and name are unconditionally enabled * Guest name is surrounded in [...] brackets * The default output lines are typically 15 chars wider given that we always include the thread ID + name now * This takes the liberty of assigning the new file to the existing error-report.c maintainer (Markus) Since splitting it off into message.c instead of putting it all in error-report.c felt slightly nicer. One thing I didn't tackle is making the location info get reported for qemu_log. This is used to give context for error messages when parsing some CLI args, and could be interesting for log messages associated with those same CLI args. I'm not too happy with the constructor priority logic, but I don't see a better option, as I don't think it is practical to order .o files passed to the linker in a way that nicely guarantees the order of constructor execution. Daniel P. Berrangé (12): include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: set the name for the 'main' thread util: add API to fetch the current thread id util: add API to fetch the current thread name util: introduce common helper for error-report & log code util: convert error-report & log to message API for timestamp util: add support for formatting a workload name in messages util: add support for formatting a program name in messages util: add support for formatting thread info in messages util: add brackets around guest name in message context MAINTAINERS | 2 + docs/about/deprecated.rst | 7 +++ include/qemu/compiler.h | 8 +++ include/qemu/error-report.h | 4 -- include/qemu/message.h | 52 +++++++++++++++++ include/qemu/thread.h | 3 +- meson.build | 21 +++++++ monitor/monitor.c | 14 +++-- storage-daemon/qemu-storage-daemon.c | 6 ++ system/vl.c | 30 +++++++--- tests/qemu-iotests/041 | 2 +- tests/qemu-iotests/common.filter | 2 +- tests/unit/test-error-report.c | 6 +- util/error-report.c | 29 +--------- util/log.c | 20 +++---- util/meson.build | 1 + util/message.c | 69 ++++++++++++++++++++++ util/qemu-thread-posix.c | 60 ++++++++++++++----- util/qemu-thread-win32.c | 86 ++++++++++++++++++++-------- 19 files changed, 321 insertions(+), 101 deletions(-) create mode 100644 include/qemu/message.h create mode 100644 util/message.c -- 2.50.1

2 17

[PATCH] spec: Package newly introduced CH conf files
by Michal Privoznik 19 Aug '25

19 Aug '25

From: Michal Privoznik <mprivozn(a)redhat.com> In a recent commit of v11.6.0-25-g5dca0567f6 new config files for the CH driver were introduced. But corresponding change to the specfile was missing resulting in a broken rpmbuild. Just put those files into daemon-driver-ch rpm. Fixes: 5dca0567f694a7405ca3e796149aed857b1f6090 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- libvirt.spec.in | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 47644556d9..aff2707705 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2468,6 +2468,9 @@ exit 0 %{_unitdir}/virtchd.service %{_unitdir}/virtchd.socket %{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so +%config(noreplace) %{_sysconfdir}/libvirt/ch.conf +%{_datadir}/augeas/lenses/libvirtd_ch.aug +%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug %endif %files client -- 2.49.1

2 1

[PATCH v2 00/11] Enabling logging for ch guests
by Praveen K Paladugu 18 Aug '25

18 Aug '25

LogContext management is now moved from Qemu driver to hypervisor. After migrating Qemu to use domain_logcontext, I extended ch driver to use also use domain_logcontext to capture early boot failures within domain specific log files. Changes in V2: * refactored the patches to ensure all of them build. * ch driver will use virtlogd to consolidate logs from hypervisor and its domains. Praveen K Paladugu (11): hypervisor: copy qemu log context mgmt to hypervisor hypervisor: rename reference to qemu in domain_logcontext hypervisor: drop qemu specific args in domainLogContextNew hypervisor: Build domain_logcontext libvirt_private: export symbols from domain_logcontext qemu: Modify qemu driver to use domainLogContext qemu: delete qemu_logcontext files ch: Enable logging for ch domains ch: move curl_data and curl_callback definitions ch: Enable logging curl responses from ch ch: configure ch driver to use virlogd po/POTFILES | 2 +- src/ch/ch_conf.c | 1 + src/ch/ch_conf.h | 2 + src/ch/ch_monitor.c | 84 ++++++++++++------- src/ch/ch_monitor.h | 6 +- src/ch/ch_process.c | 36 ++++++-- .../domain_logcontext.c} | 78 +++++++++-------- src/hypervisor/domain_logcontext.h | 45 ++++++++++ src/hypervisor/meson.build | 1 + src/libvirt_private.syms | 6 ++ src/qemu/meson.build | 1 - src/qemu/qemu_domain.c | 28 +++---- src/qemu/qemu_domain.h | 12 +-- src/qemu/qemu_logcontext.h | 41 --------- src/qemu/qemu_nbdkit.c | 12 ++- src/qemu/qemu_process.c | 45 +++++----- 16 files changed, 236 insertions(+), 164 deletions(-) rename src/{qemu/qemu_logcontext.c => hypervisor/domain_logcontext.c} (79%) create mode 100644 src/hypervisor/domain_logcontext.h delete mode 100644 src/qemu/qemu_logcontext.h -- 2.47.0

4 16

[PATCH 1/2] network: bridge_driver: add BSD implementation
by Roman Bogorodskiy 18 Aug '25

18 Aug '25

Add BSD-specific platform flavor of the bridge driver which will be used as a base for Packet Filter (pf) based NAT networking implementation. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- po/POTFILES | 1 + src/network/bridge_driver_bsd.c | 114 +++++++++++++++++++++++++++ src/network/bridge_driver_conf.c | 4 + src/network/bridge_driver_platform.c | 2 + 4 files changed, 121 insertions(+) create mode 100644 src/network/bridge_driver_bsd.c diff --git a/po/POTFILES b/po/POTFILES index 084f60ba00..dc7293d0cd 100644 --- a/po/POTFILES +++ b/po/POTFILES @@ -145,6 +145,7 @@ src/lxc/lxc_hostdev.c src/lxc/lxc_native.c src/lxc/lxc_process.c src/network/bridge_driver.c +src/network/bridge_driver_bsd.c src/network/bridge_driver_conf.c src/network/bridge_driver_linux.c src/network/bridge_driver_nop.c diff --git a/src/network/bridge_driver_bsd.c b/src/network/bridge_driver_bsd.c new file mode 100644 index 0000000000..5914300763 --- /dev/null +++ b/src/network/bridge_driver_bsd.c @@ -0,0 +1,114 @@ +/* + * Copyright (C) 2025 FreeBSD Foundation + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "virlog.h" +#include "network_pf.h" + +#define VIR_FROM_THIS VIR_FROM_NONE + +VIR_LOG_INIT("network.bridge_driver_bsd"); + +static virErrorPtr errInitV4; +static virErrorPtr errInitV6; + +void networkPreReloadFirewallRules(virNetworkDriverState *driver G_GNUC_UNUSED, + bool startup G_GNUC_UNUSED, + bool force G_GNUC_UNUSED) +{ +} + + +void networkPostReloadFirewallRules(bool startup G_GNUC_UNUSED) +{ +} + + +int networkCheckRouteCollision(virNetworkDef *def G_GNUC_UNUSED) +{ + return 0; +} + +int networkAddFirewallRules(virNetworkDef *def G_GNUC_UNUSED, + virFirewallBackend firewallBackend, + virFirewall **fwRemoval G_GNUC_UNUSED) +{ + if (def->bridgeZone) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("zone %1$s requested for network %2$s but firewalld is not supported on BSD"), + def->bridgeZone, def->name); + return -1; + } + + if (def->forward.type == VIR_NETWORK_FORWARD_OPEN) { + VIR_DEBUG("No firewall rules to add for mode='open' network '%s'", def->name); + } else { + VIR_DEBUG("Adding firewall rules for mode='%s' network '%s' using %s", + virNetworkForwardTypeToString(def->forward.type), + def->name, + virFirewallBackendTypeToString(firewallBackend)); + + if (errInitV4 && + (virNetworkDefGetIPByIndex(def, AF_INET, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { + virSetError(errInitV4); + return -1; + } + + if (errInitV6 && + (virNetworkDefGetIPByIndex(def, AF_INET6, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || + def->ipv6nogw)) { + virSetError(errInitV6); + return -1; + } + + /* now actually add the rules */ + switch (firewallBackend) { + case VIR_FIREWALL_BACKEND_NONE: + virReportError(VIR_ERR_NO_SUPPORT, "%s", + _("No firewall backend is available")); + return -1; + + case VIR_FIREWALL_BACKEND_PF: + return pfAddFirewallRules(def); + + case VIR_FIREWALL_BACKEND_IPTABLES: + case VIR_FIREWALL_BACKEND_NFTABLES: + case VIR_FIREWALL_BACKEND_LAST: + virReportEnumRangeError(virFirewallBackend, firewallBackend); + return -1; + } + } + return 0; +} + +void +networkRemoveFirewallRules(virNetworkObj *obj, + bool unsetZone G_GNUC_UNUSED) +{ + virNetworkDef *def = virNetworkObjGetDef(obj); + if (def->forward.type == VIR_NETWORK_FORWARD_OPEN) { + VIR_DEBUG("No firewall rules to remove for mode='open' network '%s'", + def->name); + return; + } + + pfRemoveFirewallRules(def); +} diff --git a/src/network/bridge_driver_conf.c b/src/network/bridge_driver_conf.c index 309d64fa84..280c0f9c4f 100644 --- a/src/network/bridge_driver_conf.c +++ b/src/network/bridge_driver_conf.c @@ -130,6 +130,10 @@ virNetworkLoadDriverConfig(virNetworkDriverConfig *cfg G_GNUC_UNUSED, } case VIR_FIREWALL_BACKEND_PF: { + g_autofree char *pfctlInPath = virFindFileInPath(PFCTL); + + if (pfctlInPath) + fwBackendSelected = true; break; } diff --git a/src/network/bridge_driver_platform.c b/src/network/bridge_driver_platform.c index 9ddcb71063..42fbcdbc0b 100644 --- a/src/network/bridge_driver_platform.c +++ b/src/network/bridge_driver_platform.c @@ -25,6 +25,8 @@ #if defined(__linux__) # include "bridge_driver_linux.c" +#elif defined(__FreeBSD__) +# include "bridge_driver_bsd.c" #else # include "bridge_driver_nop.c" #endif -- 2.49.0

2 3

[PATCH v2 0/4] bhyve: implement domain{Block,Interface,Memory}Stats
by Roman Bogorodskiy 18 Aug '25

18 Aug '25

Changes since v1: - Added "bhyve: implement domainInterfaceStats" patch PS It was temping to factor out obtaining struct kinfo_proc using sysctlnametomib() + sysctl(), but I have to make it visible to use outside of virprocess, e.g. in bhyve_driver.c, so it doesn't look like it's worth the effort for now. Probably it'll make sense to implement a FreeBSD version of virProcessGetStat() once there are more users of this code. Roman Bogorodskiy (4): bhyve: implement domainInterfaceStats virprocess: implement virProcessGetStatInfo() for FreeBSD bhyve: implement domainMemoryStats bhyve: implement domainBlockStats src/bhyve/bhyve_driver.c | 140 +++++++++++++++++++++++++++++++++++++++ src/util/virprocess.c | 104 +++++++++++++++++++++-------- 2 files changed, 218 insertions(+), 26 deletions(-) -- 2.49.0

2 8

Plans for 11.7.0 release (freeze on 2025-08-25)
by Jiri Denemark 18 Aug '25

18 Aug '25

We are getting close to 11.7.0 release of libvirt. To aim for the release on Monday 01 Sep I suggest entering the freeze on Monday 25 Aug and tagging RC2 on Thursday 28 Aug. I hope this works for everyone. Jirka

1 0

[PATCH] bhyve: autofill NVRAM data for firmware='efi'
by Roman Bogorodskiy 18 Aug '25

18 Aug '25

When a domain configured with "<os firmware='efi'/>", autofill not only loader/firmware configuration, but also nvram. This also fixes the `scripts/domain/405-ovmf-nvram-efi.t` test in libvirt-tck for bhyve. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_firmware.c | 5 +++-- tests/bhyvexml2argvdata/bhyvexml2argv-firmware-efi.args | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/bhyve/bhyve_firmware.c b/src/bhyve/bhyve_firmware.c index 36bca490b6..57ad0031b0 100644 --- a/src/bhyve/bhyve_firmware.c +++ b/src/bhyve/bhyve_firmware.c @@ -72,8 +72,9 @@ bhyveFirmwareEnsureNVRAM(virDomainDef *def, /* otherwise we want to reset and re-populate the definition */ virObjectUnref(loader->nvram); } else { - /* Also do nothing if NVRAM is not requested */ - return; + /* Only add nvram for "<os firmware='efi'/>" */ + if (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) + return; } loader->nvram = virStorageSourceNew(); diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-firmware-efi.args b/tests/bhyvexml2argvdata/bhyvexml2argv-firmware-efi.args index c87dc7d779..16b9c50535 100644 --- a/tests/bhyvexml2argvdata/bhyvexml2argv-firmware-efi.args +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-firmware-efi.args @@ -5,7 +5,7 @@ bhyve \ -H \ -P \ -s 0:0,hostbridge \ --l bootrom,fakefirmwaredir/BHYVE_UEFI.fd \ +-l bootrom,fakefirmwaredir/BHYVE_UEFI.fd,fakenvramdir/bhyve_VARS.fd \ -s 1:0,lpc \ -s 2:0,ahci,hd:/tmp/freebsd.img \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:00:00:00 \ -- 2.49.0

2 1

[PATCH v4 0/3] CH: Add support for a configuration file and log level configuration
by Stefan Kober 18 Aug '25

18 Aug '25

Similar to the qemu.conf file that allows QEMU specific configurations we add the possibility to specify a ch.conf file for Cloud Hypervisor configuration. The initial single config option is the log level, which sets the verbosity of the Cloud Hypervisor process. This allows for simpler debugging when using Cloud Hypervisor via libvirt. Stefan Kober (3): ch: Add config file support ch: add log level configuration option NEWS: ch: announce log_level config option NEWS.rst | 5 +++++ src/ch/ch.conf | 11 ++++++++++ src/ch/ch_conf.c | 31 ++++++++++++++++++++++++++ src/ch/ch_conf.h | 18 +++++++++++++++ src/ch/ch_driver.c | 6 +++++ src/ch/ch_monitor.c | 6 +++++ src/ch/libvirtd_ch.aug | 40 ++++++++++++++++++++++++++++++++++ src/ch/meson.build | 12 ++++++++++ src/ch/test_libvirtd_ch.aug.in | 5 +++++ 9 files changed, 134 insertions(+) create mode 100644 src/ch/ch.conf create mode 100644 src/ch/libvirtd_ch.aug create mode 100644 src/ch/test_libvirtd_ch.aug.in -- 2.50.1

2 5

[PATCH v3 0/2] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 14 Aug '25

14 Aug '25

This series adds support for a new 'edid' attribute to the video model to control whether the EDID is visible to the guest. If the 'edid' attribute is unspecified then it is not generated in the domain XML, so the underlying virtualisation platform will continue to use its default. The 'edid' attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> v3 - Rebase onto master - Use backtacks for video models and values in docs/formatdomain.rst - Add edid attribute check in virDomainVideoDefCheckABIStability() - Remove disks from test XML files - Move video model edid attribute tests into the same section used by the existing video model tests v2 - Rebase onto master - Remove 2nd sentence from v1 patch 1 commit message - Remove unnecessary video->type check in qemu_command.c - Add patch 2 containing qemuxmlconftest test cases Mark Cave-Ayland (2): conf: add support for 'edid' attribute to video model tests/qemuxmlconfdata: add tests for video model 'edid' attribute docs/formatdomain.rst | 8 ++++ src/conf/domain_conf.c | 13 ++++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++ src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 3 ++ .../video-bochs-edid-none.x86_64-latest.args | 34 +++++++++++++++ .../video-bochs-edid-none.x86_64-latest.xml | 41 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-none.xml | 30 ++++++++++++++ .../video-bochs-edid-off.x86_64-latest.args | 34 +++++++++++++++ .../video-bochs-edid-off.x86_64-latest.xml | 41 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-off.xml | 30 ++++++++++++++ .../video-bochs-edid-on.x86_64-latest.args | 34 +++++++++++++++ .../video-bochs-edid-on.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/video-bochs-edid-on.xml | 30 ++++++++++++++ .../video-qxl-edid-off-fail.x86_64-latest.err | 1 + .../video-qxl-edid-off-fail.xml | 23 +++++++++++ .../video-qxl-edid-on-fail.x86_64-latest.err | 1 + .../video-qxl-edid-on-fail.xml | 23 +++++++++++ .../video-vga-edid-none.x86_64-latest.args | 34 +++++++++++++++ .../video-vga-edid-none.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-none.xml | 30 ++++++++++++++ .../video-vga-edid-off.x86_64-latest.args | 34 +++++++++++++++ .../video-vga-edid-off.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-off.xml | 30 ++++++++++++++ .../video-vga-edid-on.x86_64-latest.args | 34 +++++++++++++++ .../video-vga-edid-on.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-on.xml | 30 ++++++++++++++ .../video-virtio-edid-none.x86_64-latest.args | 34 +++++++++++++++ .../video-virtio-edid-none.x86_64-latest.xml | 41 +++++++++++++++++++ .../video-virtio-edid-none.xml | 30 ++++++++++++++ .../video-virtio-edid-off.x86_64-latest.args | 34 +++++++++++++++ .../video-virtio-edid-off.x86_64-latest.xml | 41 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-off.xml | 30 ++++++++++++++ .../video-virtio-edid-on.x86_64-latest.args | 34 +++++++++++++++ .../video-virtio-edid-on.x86_64-latest.xml | 41 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-on.xml | 30 ++++++++++++++ tests/qemuxmlconftest.c | 11 +++++ 38 files changed, 1045 insertions(+) create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.xml -- 2.43.0

2 4

[PATCH v2 18/24] qapi/migration: Deprecate capabilities commands
by Fabiano Rosas 13 Aug '25

13 Aug '25

The concept of capabilities is being merged into the concept of parameters. From now on, the commands that handle capabilities are deprecated in favor of the commands that handle parameters. Affected commands: - migrate-set-capabilities - query-migrate-capabilities Signed-off-by: Fabiano Rosas <farosas(a)suse.de> --- docs/about/deprecated.rst | 12 ++++++++++++ migration/migration-hmp-cmds.c | 6 ++++++ qapi/migration.json | 16 ++++++++++++++-- 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 42037131de..15474833ea 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -605,3 +605,15 @@ command documentation for details on the ``fdset`` usage. The ``zero-blocks`` capability was part of the block migration which doesn't exist anymore since it was removed in QEMU v9.1. + +``migrate-set-capabilities`` command (since 10.1) +''''''''''''''''''''''''''''''''''''''''''''''''' + +This command was deprecated. Use ``migrate-set-parameters`` instead +which now supports setting capabilities. + +``query-migrate-capabilities`` command (since 10.1) +''''''''''''''''''''''''''''''''''''''''''''''''''' + +This command was deprecated. Use ``query-migrate-parameters`` instead +which now supports querying capabilities. diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c index 8615340a6b..7f234d5aa8 100644 --- a/migration/migration-hmp-cmds.c +++ b/migration/migration-hmp-cmds.c @@ -229,6 +229,9 @@ void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict) { MigrationCapabilityStatusList *caps, *cap; + warn_report("info migrate_capabilities is deprecated;" + " use info migrate_parameters instead"); + caps = qmp_query_migrate_capabilities(NULL); if (caps) { @@ -616,6 +619,9 @@ void hmp_migrate_set_capability(Monitor *mon, const QDict *qdict) MigrationCapabilityStatus *value; int val; + warn_report("migrate_set_capability is deprecated;" + " use migrate_set_parameter instead"); + val = qapi_enum_parse(&MigrationCapability_lookup, cap, -1, &err); if (val < 0) { goto end; diff --git a/qapi/migration.json b/qapi/migration.json index 3d3f5624c5..c5e6ea1a2d 100644 --- a/qapi/migration.json +++ b/qapi/migration.json @@ -521,6 +521,11 @@ # # @capabilities: json array of capability modifications to make # +# Features: +# +# @deprecated: This command is deprecated in favor of +# migrate-set-parameters. +# # Since: 1.2 # # .. qmp-example:: @@ -530,7 +535,8 @@ # <- { "return": {} } ## { 'command': 'migrate-set-capabilities', - 'data': { 'capabilities': ['MigrationCapabilityStatus'] } } + 'data': { 'capabilities': ['MigrationCapabilityStatus'] }, + 'features': ['deprecated'] } ## # @query-migrate-capabilities: @@ -539,6 +545,11 @@ # # Returns: @MigrationCapabilityStatus # +# Features: +# +# @deprecated: This command is deprecated in favor of +# query-migrate-parameters. +# # Since: 1.2 # # .. qmp-example:: @@ -554,7 +565,8 @@ # {"state": false, "capability": "x-colo"} # ]} ## -{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus']} +{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus'], + 'features': ['deprecated'] } ## # @MultiFDCompression: -- 2.35.3

6 5

[PATCH] qemuxmlconftest: Paper over test failure at MacOS
by Michal Privoznik 13 Aug '25

13 Aug '25

From: Michal Privoznik <mprivozn(a)redhat.com> MacOS has its own dynamic linker (dyld) which is different to Linux/BSD one. But with a little help (by setting "DYLD_FORCE_FLAT_NAMESPACE" env var) it would behave similarly to Linux/BSD ones. In particular, if a library is preloaded via "DYLD_INSERT_LIBRARIES" on MacOS or "LD_PRELOAD" on Linux/BSD, then dlsym(RTLD_NEXT, ...) considers ALL preloaded libraries. For instance, the virFileCanonicalizePath() is reimplemented in virpcimock and qemuxml2argvmock. Each one of these reimplementations uses dlsym(RTLD_NEXT, ...) to look up and call virFileCanonicalizePath() from next library in the queue and possibly even the actual implementation from libvirt.so. This chaining of mocks allows us to have mock libraries that create stable, reproducible environment for tests. Now, because of unknown reason Apple decided to remove the flat namespace feature [1] (I recommend to just clone the repo and view the commit via 'git show' as github's web interface hides interesting bits away). They did so in 2022. And it wasn't until my commit of v11.6.0-19-g12c35ab161 that we've noticed this, because until that commit no two mock reimplemented the same function. Well, now they do and with flat namespaces gone the dlsym(RLTD_NEXT, ...) returns an address from libvirt.so instead of from next mock on the list. Since reimplementation of virFileCanonicalizePath() in qemuxml2argvmock.c is only to cover a case on some Linux systems and virpcimock.c creates full sysfs imitation of PCI devices, the latter is more important than the former. Therefore, switch order of those mocks. On Linux/BSD this has virtually no effect, but on MacOS it fixes the qemuxmlconftest failure. 1: https://github.com/apple-oss-distributions/dyld/commit/9a9e3e4cfa7de205d61f… Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemuxmlconftest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 0d1804f101..4e8eb18705 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -3052,11 +3052,11 @@ mymain(void) } VIR_TEST_MAIN_PRELOAD(mymain, + VIR_TEST_MOCK("virpci"), VIR_TEST_MOCK("qemuxml2argv"), VIR_TEST_MOCK("domaincaps"), VIR_TEST_MOCK("virrandom"), VIR_TEST_MOCK("qemucpu"), - VIR_TEST_MOCK("virpci"), VIR_TEST_MOCK("virnuma")) #else -- 2.49.1

2 1

[PATCH] docs: storage: fix the "since" tag
by Roman Bogorodskiy 13 Aug '25

13 Aug '25

Trivial :since: tag fix in the ZFS section. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- docs/storage.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/storage.rst b/docs/storage.rst index 344d3a32f8..b77e7ef144 100644 --- a/docs/storage.rst +++ b/docs/storage.rst @@ -719,7 +719,7 @@ FreeBSD, and :since:`since 1.3.2` experimental support for `ZFS on Linux <https://zfsonlinux.org/>`__ version 0.6.4 or newer is available. A pool could either be created manually using the ``zpool create`` command and -its name specified in the source section or :since:` since 1.2.9` source devices +its name specified in the source section or :since:`since 1.2.9` source devices could be specified to create a pool using libvirt. Please refer to the ZFS documentation for details on a pool creation. -- 2.49.0

2 1

[PATCH] docs: kbase/tlscerts: mention dropped 'encryption_key'
by Sebastian Mitterle 12 Aug '25

12 Aug '25

Older libvirt versions still only work if 'encryption_key' is enabled in the server and client certificates. Add a note. While at it, also add a note that after setting the certificates up, the TLS ports need to be restarted because I haven't found a mention of it elsewhere. Signed-off-by: Sebastian Mitterle <smitterl(a)redhat.com> --- docs/kbase/tlscerts.rst | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/kbase/tlscerts.rst b/docs/kbase/tlscerts.rst index 215d454998..a1ea4d5f21 100644 --- a/docs/kbase/tlscerts.rst +++ b/docs/kbase/tlscerts.rst @@ -213,6 +213,10 @@ clients to reach the server, both with and without domain name qualifiers. If clients are likely to connect to the server by IP address, then one or more 'ip_address' fields should also be added. +Important: If you're running a libvirt version before 11.6.0 you need to also add +``encryption_key`` to the template. Previous versions required this. + + Use the template file as input to a ``certtool`` command to sign the server certificate: @@ -299,7 +303,11 @@ briefly cover the steps. tls_www_client signing_key - and sign by doing: + + Important: If you're running a libvirt version before 11.6.0 you need to also add + ``encryption_key`` to the template. Previous versions required this. + + Create the certificate by running: :: @@ -317,10 +325,17 @@ briefly cover the steps. Troubleshooting TLS certificate problems ---------------------------------------- -failed to verify client's certificate - On the server side, run the libvirtd server with the '--listen' and - '--verbose' options while the client is connecting. The verbose log messages - should tell you enough to diagnose the problem. +* TLS socket + + After setting up your server certificates you'll have to restart the TLS socket + ``systemctl restart virtproxyd-tls.socket`` for modular daemon setup, or + ``systemctl restart libvirtd-tls.socket`` for the monolithic daemon setup. + +* failed to verify client's certificate + + On the server side, run the libvirtd server with the '--listen' and + '--verbose' options while the client is connecting. The verbose log messages + should tell you enough to diagnose the problem. You can use the virt-pki-validate shell script to analyze the setup on the client or server machines, preferably as root. It will try to point out the -- 2.50.1

2 3

[PATCH] qemu: don't warn about missing SMM for CVM firmware
by Daniel P. Berrangé 12 Aug '25

12 Aug '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Neither Intel TDX / AMD SEV(SNP) allow use of SMM, but the EDK2 firmware none the less supports secureboot. Libvirt currently issues bogus warnings about Fedora firmware warning : qemuFirmwareSanityCheck:1575 : Firmware description '/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json' has invalid set of features: requires-smm = 0, secure-boot = 1, enrolled-keys = 1 This removes the warning if the firmware descriptor indicates use of any confidential VM technology. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_firmware.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index f10137144e..dbec068738 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1540,6 +1540,7 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, bool requiresSMM = false; bool supportsSecureBoot = false; bool hasEnrolledKeys = false; + bool cvm = false; for (i = 0; i < fw->nfeatures; i++) { switch (fw->features[i]) { @@ -1552,13 +1553,15 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: hasEnrolledKeys = true; break; - case QEMU_FIRMWARE_FEATURE_NONE: - case QEMU_FIRMWARE_FEATURE_ACPI_S3: - case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_AMD_SEV: case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES: case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP: case QEMU_FIRMWARE_FEATURE_INTEL_TDX: + cvm = true; + break; + case QEMU_FIRMWARE_FEATURE_NONE: + case QEMU_FIRMWARE_FEATURE_ACPI_S3: + case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: case QEMU_FIRMWARE_FEATURE_LAST: @@ -1566,7 +1569,8 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, } } - if ((supportsSecureBoot != requiresSMM) || + if ((!cvm && + (supportsSecureBoot != requiresSMM)) || (hasEnrolledKeys && !supportsSecureBoot)) { VIR_WARN("Firmware description '%s' has invalid set of features: " "%s = %d, %s = %d, %s = %d", -- 2.50.1

3 4

[PATCH] Storage: ZFS: implement `resizeVol` method to support native resize
by George Melikov 12 Aug '25

12 Aug '25

From: George Melikov <mail(a)gmelikov.ru> ZFS doesn't have thick allocations, every allocation is thin-provisioned, so resize operation is essentially a zvol size limit change (`zfs set volsize=X pool/zvol_name`). Shrink is allowed too (which leads to data destruction), but shrink restriction is already implemented in libvirt, so this function doesn't need to check anything. This patch is posted via PR too and has green test runs https://gitlab.com/libvirt/libvirt/-/merge_requests/495 Signed-off-by: George Melikov <mail(a)gmelikov.ru> --- src/storage/storage_backend_zfs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/storage/storage_backend_zfs.c b/src/storage/storage_backend_zfs.c index 178b505e92..33434d0cac 100644 --- a/src/storage/storage_backend_zfs.c +++ b/src/storage/storage_backend_zfs.c @@ -439,6 +439,25 @@ virStorageBackendZFSDeletePool(virStoragePoolObj *pool, return virCommandRun(cmd, NULL); } +static int +virStorageBackendZFSResizeVol(virStoragePoolObj *pool, + virStorageVolDef *vol, + unsigned long long capacity, + unsigned int flags) +{ + virStoragePoolDef *def = virStoragePoolObjGetDef(pool); + g_autoptr(virCommand) resize_cmd = NULL; + + virCheckFlags(0, -1); + + resize_cmd = virCommandNewArgList(ZFS, "set", NULL); + virCommandAddArgFormat(resize_cmd, "volsize=%llu", capacity); + virCommandAddArgFormat(resize_cmd, "%s/%s", + def->source.name, vol->name); + + return virCommandRun(resize_cmd, NULL); +} + virStorageBackend virStorageBackendZFS = { .type = VIR_STORAGE_POOL_ZFS, @@ -450,6 +469,7 @@ virStorageBackend virStorageBackendZFS = { .deletePool = virStorageBackendZFSDeletePool, .uploadVol = virStorageBackendVolUploadLocal, .downloadVol = virStorageBackendVolDownloadLocal, + .resizeVol = virStorageBackendZFSResizeVol, }; -- 2.47.2

2 1

[PATCH 0/5] Cleanup of callers of virDomainDefGetVcpu
by Peter Krempa 12 Aug '25

12 Aug '25

Fix few issues with how virDomainDefGetVcpu is called and in related code. Peter Krempa (5): Unexport virCHProcessSetupVcpu virDomainVcpuDefPostParse: Remove impossible check qemu: domain: Remove unused qemuDomainGetVcpuHalted virCHDomainRefreshThreadInfo: Don't trust vcpu ID returned by hypervisor virCHDomainRefreshThreadInfo: Remove illusion that caller cares about return value src/ch/ch_domain.c | 17 ++++++++++------- src/ch/ch_domain.h | 2 +- src/ch/ch_process.c | 2 +- src/ch/ch_process.h | 3 --- src/conf/domain_postparse.c | 4 ---- src/qemu/qemu_domain.c | 15 --------------- src/qemu/qemu_domain.h | 1 - 7 files changed, 12 insertions(+), 32 deletions(-) -- 2.50.1

2 7

[PATCH v2 0/2] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 12 Aug '25

12 Aug '25

This series adds support for a new 'edid' attribute to the video model to control whether the EDID is visible to the guest. If the 'edid' attribute is unspecified then it is not generated in the domain XML, so the underlying virtualisation platform will continue to use its default. The 'edid' attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> v2 - Rebase onto master - Remove 2nd sentence from v1 patch 1 commit message - Remove unnecessary video->type check in qemu_command.c - Add patch 2 containing qemuxmlconftest test cases Mark Cave-Ayland (2): conf: add support for 'edid' attribute to video model tests/qemuxmlconfdata: add tests for video model 'edid' attribute docs/formatdomain.rst | 8 ++++ src/conf/domain_conf.c | 5 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++ src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_command.c | 3 ++ .../video-bochs-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-none.xml | 36 ++++++++++++++ .../video-bochs-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-off.xml | 36 ++++++++++++++ .../video-bochs-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-bochs-edid-on.xml | 36 ++++++++++++++ .../video-qxl-edid-off-fail.x86_64-latest.err | 1 + .../video-qxl-edid-off-fail.xml | 29 ++++++++++++ .../video-qxl-edid-on-fail.x86_64-latest.err | 1 + .../video-qxl-edid-on-fail.xml | 29 ++++++++++++ .../video-vga-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-none.xml | 36 ++++++++++++++ .../video-vga-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-off.xml | 36 ++++++++++++++ .../video-vga-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-on.xml | 36 ++++++++++++++ .../video-virtio-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../video-virtio-edid-none.xml | 36 ++++++++++++++ .../video-virtio-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-off.xml | 36 ++++++++++++++ .../video-virtio-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-on.xml | 36 ++++++++++++++ tests/qemuxmlconftest.c | 12 +++++ 38 files changed, 1185 insertions(+) create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.xml -- 2.43.0

2 6

[RFC] x86 Host CPU features detection by MSRs
by Hector Cao 12 Aug '25

12 Aug '25

Hello, This mail is a Request for Comment. On recent Intel CPUs, some of the CPU features (mostly vmx-* subfeatures) are listed and controlled via the MSRs (Model Specific Registers) instead of the traditional CPUID instruction method. Right now, libvirt reads the MSR's values via /dev/cpu/*/cpu populated by the msr kernel module. src/cpu/cpu_x86.c: ... /* This is best effort since there might be no way to read the MSR * when we are not running as root. */ for (i = 0; i < nmsrs; i++) { if (virHostCPUGetMSR(msrs[i], &msr) == 0) { virCPUx86DataItem item = { .type = VIR_CPU_X86_DATA_MSR, .data.msr = { ... There are 2 potential issues: 1) As stated in the source code comment above, MSR values read might fail when libvirt is not run as root. 2) MSR values read might fail if the MSR kernel module is not loaded, this is still the case in some of the Linux distros. The issue 2) has been brought up in Ubuntu/Debian : https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/271 but the feedback was to try to fix the issue in the libvirt source code itself. Indeed, libvirt already loads some kernel modules it depends on. For example the NBD kernel module in src/util/virtfile.c ... static bool virFileNBDLoadDriver(void) { if (virKModIsProhibited(NBD_DRIVER)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module: administratively prohibited")); return false; } else { g_autofree char *errbuf = NULL; if ((errbuf = virKModLoad(NBD_DRIVER))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module")); ... Andrea Bolognani's proposal of an approach that could work: 1. try using the unprivileged KVM API is available (or maybe the necessary information is exposed via QMP too?) like how QEMU does; 2. if that fails, try using the privileged /dev API; 3. if that fails too, load the msr module and try again; I would like to have some feedback from the libvirt community about if that is worth tackling these issues and the right way to do that. If we can end up with an agreement in this mail thread, I can work on the solution implementation and send it in a separate submission. Best regards, Hector

3 15

[PATCH v2 0/2] Remove libnl checks specific to Linux
by Akihiko Odaki 12 Aug '25

12 Aug '25

Supersedes: <20250308-require-v1-1-fe6850bf3f30(a)daynix.com> ("[PATCH] util: Require libnl for Linux") Based on previous discussions, this implements yet another approach to fix builds without libnl for Linux. Signed-off-by: Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp> --- Changes in v2: - Rebased. - Link to v1: https://lore.kernel.org/r/20250312-linux-v1-0-e5531bbe9708@daynix.com --- Akihiko Odaki (2): Remove libnl checks specific to Linux virnetlink: Remove stub functions src/libvirt_libnl.syms | 23 +++++ src/libvirt_private.syms | 19 ---- src/meson.build | 6 ++ src/remote/remote_daemon.c | 10 ++- src/util/meson.build | 5 +- src/util/virarptable.c | 2 +- src/util/virnetdev.c | 44 +-------- src/util/virnetdevbridge.c | 29 +----- src/util/virnetlink.c | 216 +++------------------------------------------ src/util/virnetlink.h | 11 +-- tests/virnetdevtest.c | 10 +-- 11 files changed, 64 insertions(+), 311 deletions(-) --- base-commit: 5085c7fd030ed4322608de1128811fc3bf61e201 change-id: 20250312-linux-30e6e1af51a5 Best regards, -- Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp>

1 2

[PATCH 0/2] qemu: Match firmware with fully resolved and canonicalized paths
by Michal Privoznik 12 Aug '25

12 Aug '25

As promised, this is a resend of previous patches: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XVHI… Diff to v1: - new patch 1/2 which fixes the mocking. James Le Cuirot (1): qemu: Match firmware with fully resolved and canonicalized paths Michal Prívozník (1): qemuxml2argvmock: Pretend FW blobs are always present src/qemu/qemu_firmware.c | 11 ++++++----- tests/qemuxml2argvmock.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) -- 2.49.1

2 3

[PATCH] ci: regenerate with 'lcitool manifest'
by Daniel P. Berrangé 04 Aug '25

04 Aug '25

From: Daniel P. Berrangé <berrange(a)redhat.com> This pulls in the fix for libxen which has been removed from armv7 in Debian sid. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pending: https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/537 ci/buildenv/debian-sid-cross-armv7l.sh | 1 - ci/containers/debian-sid-cross-armv7l.Dockerfile | 1 - 2 files changed, 2 deletions(-) diff --git a/ci/buildenv/debian-sid-cross-armv7l.sh b/ci/buildenv/debian-sid-cross-armv7l.sh index e014b3dd0f..3d662d73ed 100644 --- a/ci/buildenv/debian-sid-cross-armv7l.sh +++ b/ci/buildenv/debian-sid-cross-armv7l.sh @@ -77,7 +77,6 @@ function install_buildenv() { libssh2-1-dev:armhf \ libtirpc-dev:armhf \ libudev-dev:armhf \ - libxen-dev:armhf \ libxml2-dev:armhf \ systemtap-sdt-dev:armhf mkdir -p /usr/local/share/meson/cross diff --git a/ci/containers/debian-sid-cross-armv7l.Dockerfile b/ci/containers/debian-sid-cross-armv7l.Dockerfile index e6118a0d9b..5aaf29d22a 100644 --- a/ci/containers/debian-sid-cross-armv7l.Dockerfile +++ b/ci/containers/debian-sid-cross-armv7l.Dockerfile @@ -88,7 +88,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ libudev-dev:armhf \ - libxen-dev:armhf \ libxml2-dev:armhf \ systemtap-sdt-dev:armhf && \ eatmydata apt-get autoremove -y && \ -- 2.50.1

2 1