- Devel - libvirt List Archives

[PATCH v2 0/4] Some parsing functions refactor
by Kirill Shchetiniuk 23 Jul '25

23 Jul '25

This patch series is supposed to refactor the existing logic of some parsing functions, changing the previous approach of getting the string fisrt and then parsing the string itself. Now the parsing logic is implemented by using the appropriate virXMLProp* functions. Changelog fromm v1: 1. 'ret' temp value is now 'rc' 2. code style fixes 3. 'id' param is now parsed as not mandatory Kirill Shchetiniuk (4): conf: virNetDevVPortProfileParse refactor util: virSecretLookupParseSecret refactor conf: virDomainChrDefParseTargetXML refactor qemu: qemuDomainObjPrivateXMLParseVcpu refactor src/conf/domain_conf.c | 16 +--- src/conf/netdev_vport_profile_conf.c | 112 +++++++++++---------------- src/qemu/qemu_domain.c | 16 +--- src/util/virsecret.c | 19 ++--- 4 files changed, 55 insertions(+), 108 deletions(-) -- 2.49.0

2 7

libvirt-gitlab-executor - maintainer?
by Kristina Hanicova 23 Jul '25

23 Jul '25

Hello Libvirt friends, Is anyone interested in maintaining this orphaned repository: https://gitlab.com/libvirt/libvirt-gitlab-executor ? It is used in Cryptsetup CI and we would like to upstream some changes. If no one is interested, I am willing to take on the role of the maintainer myself:) Regards, Kristina Hanicova

4 4

[PATCH 0/4] qemu: add support for RBD namespace
by Peter Krempa 23 Jul '25

23 Jul '25

After recent inquiry on libvirt-users I've necromanced this already very old series that I still had laying around. This series: - turns virStorageSource's 'protocol' to real enum - removes virStorageSource's 'volume' - wires in the RBD support Han Han (1): qemu: Add support for RBD namespace. Peter Krempa (3): conf: Turn 'protocol' field of virStorageSource into proper enum type virStorageFileBackendGlusterInit: Refactor cleanup virStorageSource: Eliminate 'volume' field docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 36 ++------- src/conf/domain_validate.c | 2 +- src/conf/storage_source_conf.c | 79 ++++++++++++++++++- src/conf/storage_source_conf.h | 10 ++- src/libvirt_private.syms | 1 + src/libxl/libxl_conf.c | 4 +- src/libxl/xen_xl.c | 4 +- src/qemu/qemu_block.c | 41 ++++++---- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- .../storage_file_backend_gluster.c | 63 ++++++++------- src/storage_file/storage_source.c | 2 - .../storage_source_backingstore.c | 56 ++++--------- .../disk-network-rbd.x86_64-latest.args | 4 +- .../disk-network-rbd.x86_64-latest.xml | 4 +- tests/qemuxmlconfdata/disk-network-rbd.xml | 4 +- 17 files changed, 185 insertions(+), 137 deletions(-) -- 2.49.0

2 6

Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by P, Rajasekar 23 Jul '25

23 Jul '25

Hello libvirt community, I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). **Environment:** - libvirt version: 10.5.0 - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 - Disk image format: qcow2 - Host OS: RHEL 9.5 **Steps to reproduce:** 1. Create an external snapshot: virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic 2. Delete the snapshot: virsh snapshot-delete <vm> --snapshotname snap1 **Observed behavior:** - Changes from the overlay (snapshot) file are merged into the base image. - The snapshot metadata is removed from libvirt. - The snapshot file remains on disk (appears orphaned). **Questions:** - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. - Should the snapshot file be deleted automatically, or is manual cleanup required? - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? Thank you for your help and clarification! Best regards, Raj.

1 0

[RFC PATCH 0/8] Add support for Grace ACPI Extended GPU Memory (EGM) devices
by Ian May 22 Jul '25

22 Jul '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. RFC Status ========== This patch series is submitted as an RFC to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This 8-patch series adds a new device type 'acpi-egm-memory' with the following structure: 1. Schema definition - Add XML schema definition for the new ACPI EGM memory device 2. XML parsing - Implement XML parsing and internal data structures 3. Capability detection - Add QEMU capability detection for EGM support 4. Validation - Add validation logic for EGM device configuration 5. Command generation - Implement QEMU command line generation 6. Resource management - Setup required cgroup and namespace configurations 7. Documentation - Add comprehensive documentation 8. Testing - Add qemuxmlconftest for ACPI EGM memory device XML Configuration ================= Example usage in domain XML: <devices> <hostdev mode="subsystem" type="pci" managed="yes"> <alias name="ua-hostdev0"/> <source> <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </source> </hostdev> <acpiEgmMemory> <alias name="egm0"/> <pciDev>ua-hostdev0</pciDev> <numaNode>0</numaNode> </acpiEgmMemory> </devices> This configuration results in appropriate QEMU command line options: -object memory-backend-file,id=m0,mem-path=/dev/egm0,size=32G,share=on,prealloc=on -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 Implementation Notes ==================== The device validation includes checking that referenced PCI devices exist, NUMA nodes are valid, and device paths are accessible with proper permissions. Memory backing is configured automatically to use the EGM device path, and cgroups/namespaces are set up to allow safe access. Testing ======= I've tested XML parsing, validation, and qemu command line generation. The qemuxmlconftest passes for XML handling, though the command generation test currently fails since QEMU doesn't have acpi-egm-memory support yet, but the generated args look correct for when it does. Requirements ============ This feature requires: - NVIDIA ARM64 Grace platform with EGM support - Host kernel with EGM driver support [1] - QEMU with ACPI EGM device support [2] [1] https://github.com/ianm-nv/NV-Kernels/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (8): conf: Add schema definition for ACPI EGM memory device conf: Add definitions and XML parsing for ACPI EGM memory device qemu: Add capability detection for ACPI EGM memory device qemu: Add validation for ACPI EGM memory device configuration qemu: Add command line generation for ACPI EGM memory device qemu: Add cgroup and namespace setup for ACPI EGM memory device docs: Document ACPI EGM memory device tests: Add qemuxmlconftest for ACPI EGM memory device docs/formatdomain.rst | 80 ++++++++++++++ src/ch/ch_domain.c | 1 + src/conf/domain_conf.c | 102 ++++++++++++++++++ src/conf/domain_conf.h | 11 ++ src/conf/domain_postparse.c | 8 ++ src/conf/domain_validate.c | 23 ++++ src/conf/schemas/domaincommon.rng | 19 ++++ src/conf/virconftypes.h | 2 + src/libxl/libxl_driver.c | 6 ++ src/lxc/lxc_driver.c | 6 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 21 ++++ src/qemu/qemu_command.c | 37 +++++++ src/qemu/qemu_domain.c | 2 + src/qemu/qemu_domain_address.c | 2 + src/qemu/qemu_driver.c | 3 + src/qemu/qemu_hotplug.c | 5 + src/qemu/qemu_namespace.c | 21 ++++ src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_validate.c | 99 +++++++++++++++++ src/test/test_driver.c | 4 + tests/meson.build | 1 + .../caps_10.0.0_aarch64.xml | 1 + tests/qemuegmmock.c | 67 ++++++++++++ .../acpi-egm-memory.aarch64-latest.args | 1 + .../acpi-egm-memory.aarch64-latest.xml | 56 ++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 27 +++++ tests/qemuxmlconftest.c | 5 +- 29 files changed, 613 insertions(+), 1 deletion(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

1 8

[PATCH] news: document new crypto TLS priority string settings
by Daniel P. Berrangé 22 Jul '25

22 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c7885f01a0..e5e8626729 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -24,6 +24,14 @@ v11.6.0 (unreleased) flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. + * Allow control over QEMU TLS priority strings + + The qemu.conf file now has multiple settings allowing control over the + QEMU TLS priority strings, for the different subsystems in QEMU that + can support TLS. This can be used to workaround a current bug in GNUTLS + that is liable to cause crashes of the source QEMU when performing long + running live migration operations with TLS enabled. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.50.1

2 1

[PATCH 00/19] security_selinux: Refactor temporary variable cleanup
by Peter Krempa 22 Jul '25

22 Jul '25

Some cleanups resutling from analyzing some selinux code. Peter Krempa (19): security/security_driver.c/h: Fix function header formatting virSecuritySELinuxTransactionRun: Refactor cleanup virSecuritySELinuxMCSFind: Refactor variable clearing virSecuritySELinuxRestoreFileLabel: Refactor cleanup virSecuritySELinux(Set|Restore)TPMFileLabel: Automatically free 'cancel_path' virSecuritySELinuxRestoreFileLabels: Refactor variable freeing virSecuritySELinux(Set|Restore)HostdevCapsLabel: Refactor cleanup virSecuritySELinux(Set|Restore)ChardevLabel: Refactor cleanup virSecuritySELinuxSet(Daemon)SocketLabel: Refactor cleanup virSecuritySELinuxSetTapFDLabel: Refactor cleanup security_selinux: Declare internal autoptr cleanup helper for 'context_t' virSecuritySELinuxContextAddRange: Refactor cleanup of 'context_t' virSecuritySELinuxGenNewContext: Refactor cleanup virSecuritySELinuxReserveLabel: Refactor cleanup virSecuritySELinuxGetProcessLabel: Automatically free 'ctx' temp variable virSecuritySELinuxSetFilecon: Automatically free 'econ' temp variable virSecuritySELinuxRestoreInputLabel: Return values directly virSecuritySELinuxGenImageLabel: Refactor cleanup virSecuritySELinuxGetSecurityMountOptions: refactor printing src/security/security_driver.c | 5 +- src/security/security_driver.h | 5 +- src/security/security_selinux.c | 347 +++++++++++++------------------- 3 files changed, 149 insertions(+), 208 deletions(-) -- 2.50.0

2 20

[PATCH v2 0/1] nwfilter: Check before removing and reinserting iptable base chains
by Dion Bosschieter 22 Jul '25

22 Jul '25

Thanks for the feedback. I've applied the iptables -L with a callback handler. The callback handler then decides whether or not to create the base chains. I changed the commit message from "nwfilter: Avoid firewall hole during VM startup by checking rule presence" to "nwfilter: Check before removing and reinserting iptable base chains". I also edited nwfilterxml2firewalltest, so it pretends that currently there are no chains and I changed the expected order of the commonRules. Dion Bosschieter (1): nwfilter: Check before removing and reinserting iptable base chains src/nwfilter/nwfilter_ebiptables_driver.c | 203 +++++++++++++--------- tests/nwfilterxml2firewalltest.c | 58 +++++-- 2 files changed, 163 insertions(+), 98 deletions(-) -- 2.43.0

2 2

[PATCH] qemu: driver: Reformat function headers for block job APIs
by Peter Krempa 22 Jul '25

22 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7c203e32fe..a0f770b053 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14552,8 +14552,11 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, } static int -qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, - unsigned long bandwidth, unsigned int flags) +qemuDomainBlockRebase(virDomainPtr dom, + const char *path, + const char *base, + unsigned long bandwidth, + unsigned int flags) { virDomainObj *vm; int ret = -1; @@ -14625,8 +14628,11 @@ qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, static int -qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, - virTypedParameterPtr params, int nparams, +qemuDomainBlockCopy(virDomainPtr dom, + const char *disk, + const char *destxml, + virTypedParameterPtr params, + int nparams, unsigned int flags) { virQEMUDriver *driver = dom->conn->privateData; @@ -14703,7 +14709,9 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, static int -qemuDomainBlockPull(virDomainPtr dom, const char *path, unsigned long bandwidth, +qemuDomainBlockPull(virDomainPtr dom, + const char *path, + unsigned long bandwidth, unsigned int flags) { virDomainObj *vm; -- 2.50.0

2 1

[PATCH v2 0/1] network: introduce Packet Filter firewall backend
by Roman Bogorodskiy 22 Jul '25

22 Jul '25

Changes since v1: - Left only firewall backend changes - Build network_pf.c only on FreeBSD - pfAddIPSpecificFirewallRules: error message for lack of IPv6 support I have also added a basic docs/drvnetwork.rst, but I think it would make more sense to include it in the follow up series with the bridge driver changes as with this patch alone pf backend cannot be used just yet. Roman Bogorodskiy (1): network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 1 + src/network/bridge_driver_conf.c | 4 + src/network/bridge_driver_linux.c | 2 + src/network/meson.build | 4 + src/network/network_pf.c | 326 ++++++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 9 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 2

[PATCH] bhyve: implement timeout for bhyveload
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

The bhyveload(8) command does not have a native non-interactive mode. It means that in case of errors, e.g. invalid boot media, it just drops into a loader prompt and waits for user input. This behaviour makes it tricky for users to understand what's going on. To address that, run it with the timeout(1) tool which sends SIGTERM after a certain timeout, and then optionally sends SIGKILL if the command keeps hanging. These timeout values could be configured in the bhyve.conf. Setting timeout to 0 mean that bhyveload(8) will be executed directly, without timeout(1). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve.conf | 9 +++++++ src/bhyve/bhyve_command.c | 25 ++++++++++++++++--- src/bhyve/bhyve_conf.c | 12 +++++++++ src/bhyve/bhyve_utils.h | 3 +++ src/bhyve/libvirtd_bhyve.aug | 4 ++- src/bhyve/test_libvirtd_bhyve.aug.in | 2 ++ .../bhyvexml2argv-bhyveload-timeout.args | 10 ++++++++ .../bhyvexml2argv-bhyveload-timeout.ldargs | 7 ++++++ .../bhyvexml2argv-bhyveload-timeout.xml | 23 +++++++++++++++++ tests/bhyvexml2argvtest.c | 6 +++++ 10 files changed, 96 insertions(+), 5 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml diff --git a/src/bhyve/bhyve.conf b/src/bhyve/bhyve.conf index 2a8baacff3..dc8d3d8fd8 100644 --- a/src/bhyve/bhyve.conf +++ b/src/bhyve/bhyve.conf @@ -5,3 +5,12 @@ # Path to a directory with firmware files. By default it's pointing # to the directory that sysutils/bhyve-firmware installs files into. #firmware_dir = "/usr/local/share/uefi-firmware" + +# Set timeout for the bhyveload(8) command. This might be necessary +# because in case of errors bhyveload(8) drops to an interactive +# loader and hangs indefinitely. These timeout values are passed +# to the timeout(1) command. Please refer to its manual page for more +# details. When timeout is 0, bhyveload is executed directly. +# Units are seconds. +#bhyveload_timeout = 300 +#bhyveload_timeout_kill = 15 diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 5757a41e7e..ab6d6e92e4 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -921,11 +921,28 @@ virAppendBootloaderArgs(virCommand *cmd, virDomainDef *def) } static virCommand * -virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, virDomainDiskDef *disk) +virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, + struct _bhyveConn *driver, + virDomainDiskDef *disk) { virCommand *cmd; - - cmd = virCommandNew("bhyveload"); + g_autoptr(virBhyveDriverConfig) cfg = virBhyveDriverGetConfig(driver); + + if (cfg->bhyveloadTimeout > 0) { + /* TODO: update bhyve_process.c to interpret timeout(1) exit + * codes 124-127 to produce more meaningful error messages */ + cmd = virCommandNew("timeout"); + virCommandAddArg(cmd, "--foreground"); + virCommandAddArg(cmd, "--verbose"); + if (cfg->bhyveloadTimeoutKill > 0) { + virCommandAddArg(cmd, "-k"); + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeoutKill); + } + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeout); + virCommandAddArg(cmd, "bhyveload"); + } else { + cmd = virCommandNew("bhyveload"); + } if (def->os.bootloaderArgs == NULL) { VIR_DEBUG("bhyveload with default arguments"); @@ -1212,7 +1229,7 @@ virBhyveProcessBuildLoadCmd(struct _bhyveConn *driver, virDomainDef *def, if (disk == NULL) return NULL; - return virBhyveProcessBuildBhyveloadCmd(def, disk); + return virBhyveProcessBuildBhyveloadCmd(def, driver, disk); } else if (strstr(def->os.bootloader, "grub-bhyve") != NULL) { return virBhyveProcessBuildGrubbhyveCmd(def, driver, devmap_file, devicesmap_out); diff --git a/src/bhyve/bhyve_conf.c b/src/bhyve/bhyve_conf.c index f18b24f91d..182e00ee1d 100644 --- a/src/bhyve/bhyve_conf.c +++ b/src/bhyve/bhyve_conf.c @@ -2,6 +2,7 @@ * bhyve_conf.c: bhyve config file * * Copyright (C) 2017 Roman Bogorodskiy + * Copyright (C) 2025 The FreeBSD Foundation * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -60,6 +61,9 @@ virBhyveDriverConfigNew(void) cfg->libDir = g_strdup_printf("%s/lib/libvirt/bhyve", LOCALSTATEDIR); cfg->nvramDir = g_strdup_printf("%s/nvram", cfg->libDir); + cfg->bhyveloadTimeout = 300; + cfg->bhyveloadTimeoutKill = 15; + return cfg; } @@ -81,6 +85,14 @@ virBhyveLoadDriverConfig(struct _virBhyveDriverConfig *cfg, &cfg->firmwareDir) < 0) return -1; + if (virConfGetValueInt(conf, "bhyveload_timeout", + &cfg->bhyveloadTimeout) < 0) + return -1; + + if (virConfGetValueInt(conf, "bhyveload_timeout_kill", + &cfg->bhyveloadTimeoutKill) < 0) + return -1; + return 0; } diff --git a/src/bhyve/bhyve_utils.h b/src/bhyve/bhyve_utils.h index 9c9ea0a01a..8ed1fa5509 100644 --- a/src/bhyve/bhyve_utils.h +++ b/src/bhyve/bhyve_utils.h @@ -41,6 +41,9 @@ struct _virBhyveDriverConfig { char *firmwareDir; char *libDir; char *nvramDir; + + int bhyveloadTimeout; + int bhyveloadTimeoutKill; }; G_DEFINE_AUTOPTR_CLEANUP_FUNC(virBhyveDriverConfig, virObjectUnref); diff --git a/src/bhyve/libvirtd_bhyve.aug b/src/bhyve/libvirtd_bhyve.aug index b6bee261a6..0fd74d4bb3 100644 --- a/src/bhyve/libvirtd_bhyve.aug +++ b/src/bhyve/libvirtd_bhyve.aug @@ -23,9 +23,11 @@ module Libvirtd_bhyve = let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ] let log_entry = str_entry "firmware_dir" + let bhyveload_timeout = int_entry "bhyveload_timeout" + let bhyveload_timeout_kill = int_entry "bhyveload_timeout_kill" (* Each entry in the config is one of the following three ... *) - let entry = log_entry + let entry = log_entry | bhyveload_timeout | bhyveload_timeout_kill let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/bhyve/test_libvirtd_bhyve.aug.in b/src/bhyve/test_libvirtd_bhyve.aug.in index ec932b4b11..391648e71f 100644 --- a/src/bhyve/test_libvirtd_bhyve.aug.in +++ b/src/bhyve/test_libvirtd_bhyve.aug.in @@ -3,3 +3,5 @@ module Test_libvirtd_bhyve = test Libvirtd_bhyve.lns get conf = { "firmware_dir" = "/usr/local/share/uefi-firmware" } +{ "bhyveload_timeout" = "300" } +{ "bhyveload_timeout_kill" = "15" } diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args new file mode 100644 index 0000000000..153a1d5035 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci-hd,/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs new file mode 100644 index 0000000000..264ae48441 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs @@ -0,0 +1,7 @@ +timeout \ +--foreground \ +--verbose \ +-k 20s 300s bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml new file mode 100644 index 0000000000..0b8066733d --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml @@ -0,0 +1,23 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 2838b20c29..cc6b17233d 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -165,6 +165,8 @@ mymain(void) driver.config->firmwareDir = fakefirmwaredir; driver.config->nvramDir = fakenvramdir; + driver.config->bhyveloadTimeout = 0; + driver.config->bhyveloadTimeoutKill = 0; # define DO_TEST_FULL(name, flags) \ do { \ @@ -305,6 +307,10 @@ mymain(void) driver.bhyvecaps &= ~BHYVE_CAP_VNC_PASSWORD; DO_TEST_FAILURE("vnc-password"); + driver.config->bhyveloadTimeout = 300; + driver.config->bhyveloadTimeoutKill = 20; + DO_TEST("bhyveload-timeout"); + virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); virPortAllocatorRangeFree(driver.remotePorts); -- 2.49.0

2 1

[PATCH] bhyve: don't reset domain autostart flag on destroy
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

Currently, virBhyveProcessStop() uses the virDomainDeleteConfig() helper to clean up domain status. It passes BHYVE_STATE_DIR as a configuration dir and NULL as autostart dir, so the helper does its job, even though it has a different purpose. However, the issue is that it also resets the autostart (and autostartOnce) property. This results in a situation that when a persistent domain with autostart enabled gets destroyed, its autostart state is reported as disabled, which is not correct. To fix that, implement the bhyveProcessRemoveDomainStatus() which removes the status file without side effects on the virDomainObj object. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_process.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 5e77a9c4d6..79be6f7aba 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -427,6 +427,17 @@ virBhyveProcessStart(bhyveConn *driver, return virBhyveProcessStartImpl(driver, vm, reason); } +static void +bhyveProcessRemoveDomainStatus(const char *statusDir, + const char *name) +{ + g_autofree char *file = virDomainConfigFile(statusDir, name); + + if (unlink(file) < 0 && errno != ENOENT && errno != ENOTDIR) + VIR_WARN("Failed to remove domain XML for %s: %s", + name, g_strerror(errno)); +} + int virBhyveProcessStop(struct _bhyveConn *driver, virDomainObj *vm, @@ -483,7 +494,7 @@ virBhyveProcessStop(struct _bhyveConn *driver, cleanup: virPidFileDelete(BHYVE_STATE_DIR, vm->def->name); - virDomainDeleteConfig(BHYVE_STATE_DIR, NULL, vm); + bhyveProcessRemoveDomainStatus(BHYVE_STATE_DIR, vm->def->name); return ret; } -- 2.49.0

2 1

[PATCH 0/2] meson: Report library versions in the summary
by Michal Privoznik 18 Jul '25

18 Jul '25

Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1934463449 and if you shod individual builds you can see these in action. Michal Prívozník (2): meson: Convert attr_dep to dependency() meson: Report library versions in the summary meson.build | 77 ++++++++++++++++++++++++++--------------------------- 1 file changed, 38 insertions(+), 39 deletions(-) -- 2.49.1

2 3

[PATCH] qemu_tpm: Do not use persistent definition during pre-start checks
by Martin Kletzander 18 Jul '25

18 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Commit 3451987fca7c used the persistent TPM Definition in both calls to qemuTPMVirCommandSwtpmAddTPMState() but in one of the two cases it might've been NULL and what's more, it is not the right definition which should've been used. Change that to @tpm which is the current definition. The other call does not have access to the current definition and is only called during updating the profile. But for the sake of fewer future mistakes, keep the other one as is because there is no issue with calling it that way and adding logic that just skips the extra check on NULL could mistake someone in the future. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 5cb678df0eee..4c9445d72c39 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -852,7 +852,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArgFormat(cmd, "type=unixio,path=%s,mode=0600", tpm->data.emulator.source->data.nix.path); - qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, persistentTPMDef, cfg); + qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, tpm, cfg); virCommandAddArg(cmd, "--log"); if (tpm->data.emulator.debug != 0) -- 2.50.1

2 1

[PATCH 0/6] nss: Rework debugging
by Michal Privoznik 18 Jul '25

18 Jul '25

I've been debugging a problem with NSS plugin recently [1] and the fact that I had to recompile libvirt just to enable debugging printings for the NSS plugin turned out very inconvenient. Make the debug printings env var dependant and add a few more printings. 1: https://bugzilla.redhat.com/show_bug.cgi?id=2364285 Michal Prívozník (6): nss: Promote debug message to proper error when time() fails nss: Move logging into a separate file and turn it temporarily on nss: Make logging conditional on an envvar nss: Include filename in debug printings nss: Print module name nss: Debug print JSON files as they are parsed build-aux/syntax-check.mk | 2 +- docs/nss.rst | 13 ++++++ tools/nss/libvirt_nss.c | 8 +++- tools/nss/libvirt_nss.h | 30 +----------- tools/nss/libvirt_nss_leases.c | 12 +++-- tools/nss/libvirt_nss_log.c | 85 ++++++++++++++++++++++++++++++++++ tools/nss/libvirt_nss_log.h | 41 ++++++++++++++++ tools/nss/meson.build | 1 + 8 files changed, 158 insertions(+), 34 deletions(-) create mode 100644 tools/nss/libvirt_nss_log.c create mode 100644 tools/nss/libvirt_nss_log.h -- 2.49.0

3 10

[PATCH 0/3] qemu_tpm: Do not pollute logs with unnecessary warning
by Martin Kletzander 18 Jul '25

18 Jul '25

https://issues.redhat.com/browse/RHEL-80155 Martin Kletzander (3): qemu_tpm: Rename qemuTPMHasSharedStorage -> qemuTPMDomainHasSharedStorage qemu_tpm: Extract per-TPM functionality from qemuTPMDomainHasSharedStorage qemu_tpm: Only warn about missing locking feature on shared filesystems src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_tpm.c | 75 +++++++++++++++++++++++---------------- src/qemu/qemu_tpm.h | 4 +-- 3 files changed, 47 insertions(+), 34 deletions(-) -- 2.50.1

4 8

[PATCH 0/3] qemu: workaround for GNUTLS bug hitting live migration
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

This is a workaround for existing running QEMU processes which are susceptible to a GNUTLS crasher bug with non-multifd live migration: https://gitlab.com/qemu-project/qemu/-/issues/1937 which in turn is caused by a gnutls regression https://gitlab.com/gnutls/gnutls/-/issues/1717 Even if gnutls is fixed, running QEMU processes are still at risk until restarted, and that can't be done without live migrating workloads off, which triggers the bug we're trying to avoid. The only way to avoid this for running QEMU processes is to change the crypto priority string. On Fedora / RHEL distros we can do this on the target QEMU using /etc/crypto-policies configs, but many other distros have now adopted this - hint: this is a very useful thing to adopt. This series gives a more targetted workaround that is compatible with all distros and can be configured on either the source or dst hosts and whose impact is limited just to live migration. Daniel P. Berrangé (3): qemu: fix order of VNC TLS config entries qemu: sanitize blank lines in config file qemu: add ability to set TLS priority string with QEMU src/conf/storage_source_conf.c | 2 + src/conf/storage_source_conf.h | 1 + src/qemu/libvirtd_qemu.aug | 8 +- src/qemu/qemu.conf.in | 99 +++++++++++++++++-- src/qemu/qemu_backup.c | 5 +- src/qemu/qemu_blockjob.c | 1 + src/qemu/qemu_command.c | 15 ++- src/qemu/qemu_command.h | 1 + src/qemu/qemu_conf.c | 22 +++++ src/qemu/qemu_conf.h | 6 ++ src/qemu/qemu_domain.c | 3 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_hotplug.c | 4 +- src/qemu/qemu_hotplug.h | 1 + src/qemu/qemu_migration_params.c | 1 + src/qemu/test_libvirtd_qemu.aug.in | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 2 +- ...graphics-vnc-tls-secret.x86_64-latest.args | 2 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 6 ++ 20 files changed, 170 insertions(+), 20 deletions(-) -- 2.50.1

2 6

Re: download.libvirt.org HTTPS certificate expired causing download failures
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

On Fri, Jul 18, 2025 at 10:36:53AM +0000, Song, Jiaying (CN) wrote: > Hello libvirt team, > > I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. > > This causes download failures in automated builds and package fetching processes. For example, wget reports: > > wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz > ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': > Issued certificate has expired. > > Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? > > Thank you very much for your help! FYI, we connected on IRC and I got this sorted out. It was a result of us having to move to a new physical server on short notice a few weeks ago, combined with an OS upgrade from RHEL 7 to 9. We copied the certs, but failed to setup acme-tiny again on the new machine to renew them. In 3 months time we'll find out if I got the acme-tiny config correct, so if anyone notices problems at that time let me know.... With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH 0/7] tls: Improve validation of certificates if multiple certs are concatenated in one file
by Peter Krempa 18 Jul '25

18 Jul '25

Our code handled properly only multiple CA certs in one file. This patch extends the validation also to multiple client/server certs in one file. Peter Krempa (7): rpc: virnettlscontext: Fix formatting of function definitions virNetTLSContextNewPath: Refactor temporary variable usage virNetTLSCertCheckPair: Fix function definition formatting rpc: virnettlscert: Rename virNetTLSCertLoadCAListFromFile to virNetTLSCertLoadListFromFile virPKIValidateIdentity: Validate all concatenated certificates virNetTLSCertSanityCheck: Validate all concatenated certs Remove unused 'virNetTLSCertLoadFromFile' src/rpc/virnettlscert.c | 94 ++++++++++++-------------------------- src/rpc/virnettlscert.h | 6 ++- src/rpc/virnettlscontext.c | 89 +++++++++++++++++------------------- tools/virt-pki-validate.c | 20 ++++++-- 4 files changed, 90 insertions(+), 119 deletions(-) -- 2.50.0

2 16

download.libvirt.org HTTPS certificate expired causing download failures
by Song, Jiaying (CN) 18 Jul '25

18 Jul '25

Hello libvirt team, I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. This causes download failures in automated builds and package fetching processes. For example, wget reports: wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': Issued certificate has expired. Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? Thank you very much for your help! Best regards, Jiaying.

1 0

[PATCH 0/6] Make virConnectBaselineHypervisorCPU a bit more sane
by Jiri Denemark 18 Jul '25

18 Jul '25

See 2/6 for description of the issue this series is trying to deal with. Jiri Denemark (6): cpu: Show input CPU model names in debug log Clarify documentation of virConnectBaselineHypervisorCPU Change documentation style of virConnectBaselineCPUFlags Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag qemu: Implement VIR_CONNECT_BASELINE_CPU_IGNORE_HOST virsh: Add support for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag docs/manpages/virsh.rst | 20 +++++++++++++++----- include/libvirt/libvirt-host.h | 9 +++++++-- src/cpu/cpu.c | 2 +- src/libvirt-host.c | 30 +++++++++++++++++++++--------- src/qemu/qemu_driver.c | 30 +++++++++++++++++++++--------- tools/virsh-host.c | 8 ++++++++ 6 files changed, 73 insertions(+), 26 deletions(-) -- 2.50.0

3 9

[PATCH] src: fix typo in fixup_name()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Similar branches in the if-else structure look like bad copy-paste. Fix the typo. Fixes: a559ffec44 (src: rewrite ACL rule checker in Python) Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- scripts/check-aclrules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-aclrules.py b/scripts/check-aclrules.py index ed6805058b..13aed99243 100755 --- a/scripts/check-aclrules.py +++ b/scripts/check-aclrules.py @@ -88,7 +88,7 @@ def fixup_name(name): elif name.endswith("Mac"): name = name[:-3] + "MAC" elif name.endswith("Cpu"): - name = name[:-3] + "MAC" + name = name[:-3] + "CPU" elif name.endswith("Os"): name = name[:-2] + "OS" elif name.endswith("Nmi"): -- 2.39.2

2 1

[PATCH v2 0/5] bhyve: TCP console support
by Roman Bogorodskiy 17 Jul '25

17 Jul '25

Changes since v1: I misunderstood semantics of the 'mode' attribute of the <source> element, and used 'connect' while I should have used 'bind', because bhyve listens on the TCP socket and client connects to using using netcat (or any other similar tool). Now it's using the 'bind' value. Other changes: added validation to bhyve_domain.c, and unified error messages used in bhyve_command.c and bhyve_domain.c Roman Bogorodskiy (5): bhyve: support serial type 'tcp' bhyve: increase number of supported consoles to 4 docs: drvbhyve: document TCP console support bhyve: validate serial devices validation bhyve: sync error messages docs/drvbhyve.rst | 19 ++++++ src/bhyve/bhyve_capabilities.c | 3 +- src/bhyve/bhyve_command.c | 42 +++++++++----- src/bhyve/bhyve_domain.c | 27 +++++++++ .../bhyvexml2argv-4-consoles.args | 15 +++++ .../bhyvexml2argv-4-consoles.ldargs | 4 ++ .../bhyvexml2argv-4-consoles.xml | 35 +++++++++++ .../bhyvexml2argv-serial-invalid-port.args | 12 ++++ .../bhyvexml2argv-serial-invalid-port.ldargs | 4 ++ .../bhyvexml2argv-serial-invalid-port.xml | 28 +++++++++ .../bhyvexml2argv-serial-tcp.args | 12 ++++ .../bhyvexml2argv-serial-tcp.ldargs | 4 ++ .../bhyvexml2argv-serial-tcp.xml | 27 +++++++++ tests/bhyvexml2argvtest.c | 3 + .../bhyvexml2xmlout-4-consoles.xml | 58 +++++++++++++++++++ .../bhyvexml2xmlout-serial-tcp.xml | 46 +++++++++++++++ tests/bhyvexml2xmltest.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + 20 files changed, 328 insertions(+), 16 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-4-consoles.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-serial-tcp.xml -- 2.49.0

2 8

[PATCH] virshFindDisk: fix NULL-dereference of xmlCopyNode() result
by Anastasia Belova 17 Jul '25

17 Jul '25

xmlCopyNode() may return NULL. Add a check and log an error in this case. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 22766a1a53 ("virshFindDisk: Sanitize use of 'tmp' variable") Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> --- tools/virsh-domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 7253596f4a..8752294784 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12875,6 +12875,10 @@ virshFindDisk(const char *doc, STREQ_NULLABLE(sourceDir, path) || STREQ_NULLABLE(sourceName, path)) { xmlNodePtr ret = xmlCopyNode(nodes[i], 1); + if (!ret) { + vshError(NULL, "%s", _("Failed to copy node")); + return NULL; + } /* drop backing store since they are not needed here */ virshDiskDropBackingStore(ret); return ret; -- 2.43.0

3 2

[PATCH] network: fix memory leak in networkAddFirewallRules()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Add g_clear_pointer() to networkAddFirewallRules() after using virSetError() to free errInitV4 and errInitV6 to avoid memory leaks. Fixes: ef760a4133 (Revert "network: support setting firewalld zone for bridge device of open networks") Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- src/network/bridge_driver_linux.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 86f6a5915f..93d4d2c8ee 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -413,6 +413,7 @@ networkAddFirewallRules(virNetworkDef *def, (virNetworkDefGetIPByIndex(def, AF_INET, 0) || virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { virSetError(errInitV4); + g_clear_pointer(&errInitV4, virFreeError); return -1; } @@ -421,6 +422,7 @@ networkAddFirewallRules(virNetworkDef *def, virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || def->ipv6nogw)) { virSetError(errInitV6); + g_clear_pointer(&errInitV6, virFreeError); return -1; } -- 2.39.2

2 1