- Devel - libvirt List Archives

Re: [PATCH V2 0/5] fast qom tree get
by Markus Armbruster 07 Jul '25

07 Jul '25

Steve Sistare <steven.sistare(a)oracle.com> writes: > Using qom-list and qom-get to get all the nodes and property values in a > QOM tree can take multiple seconds because it requires 1000's of individual > QOM requests. Some managers fetch the entire tree or a large subset > of it when starting a new VM, and this cost is a substantial fraction of > start up time. > > To reduce this cost, consider QAPI calls that fetch more information in > each call: > * qom-list-get: given a path, return a list of properties and values. > * qom-list-getv: given a list of paths, return a list of properties and > values for each path. > * qom-tree-get: given a path, return all descendant nodes rooted at that > path, with properties and values for each. > > In all cases, a returned property is represented by ObjectPropertyValue, > with fields name, type, and value. If an error occurs when reading a value > the value field is omitted. Thus an error for one property will not cause a > bulk fetch operation to fail. > > To evaluate each method, I modified scripts/qmp/qom-tree to use the method, > verified all methods produce the same output, and timed each using: > > qemu-system-x86_64 -display none \ > -chardev socket,id=monitor0,path=/tmp/vm1.sock,server=on,wait=off \ > -mon monitor0,mode=control & > > time qom-tree -s /tmp/vm1.sock > /dev/null > > I only measured once per method, but the variation is low after a warm up run. > The 'real - user - sys' column is a proxy for QEMU CPU time. > > method real(s) user(s) sys(s) (real - user - sys)(s) > qom-list / qom-get 2.048 0.932 0.057 1.059 > qom-list-get 0.402 0.230 0.029 0.143 > qom-list-getv 0.200 0.132 0.015 0.053 > qom-tree-get 0.143 0.123 0.012 0.008 > > qom-tree-get is the clear winner, reducing elapsed time by a factor of 14X, > and reducing QEMU CPU time by 132X. > > qom-list-getv is slower when fetching the entire tree, but can beat > qom-tree-get when only a subset of the tree needs to be fetched (not shown). > qom-list-get is shown for comparison only, and is not included in this series. How badly do you need the additional performance qom-tree-get can give you in certain cases? I'm asking because I find qom-list-getv *much* simpler.

2 1

[PATCH 00/10] virDomainDriverAutoShutdown: Fix 3 bugs related to auto shutdown of VMs
by Peter Krempa 07 Jul '25

07 Jul '25

Following bugs are addressed: - ordering of systemd units, which cause the VMs to be killed prior to auto-shutdown finishing - transient VMs are attempted to be managesaved - restore of state is applied to VMs which the auto shutdown code didn't act on otherwise Peter Krempa (10): virSystemdCreateMachine: Document @maxthreds cgroup: Unexport 'virDomainCgroupInitCgroup' qemu: conf: Store 'autoShutdown' config in virDomainDriverAutoShutdownConfig hypervisor: domain: Extract logic for auto shutdown to virDomainDriverAutoShutdownActive virSystemdCreateMachine: Add flag to invert machined unit dependencies cgroup: Plumb the 'daemonDomainShutdown' parameter of 'virSystemdCreateMachine' to drivers qemu: Fix auto-shutdown of qemu VMs by the qemu driver hypervisor: Split out individual steps out of virDomainDriverAutoShutdown virDomainDriverAutoShutdownDoSave: Don't attempt to save transient VMs virDomainDriverAutoShutdown: Refactor selection logic for VMs src/ch/ch_process.c | 2 + src/hypervisor/domain_cgroup.c | 6 +- src/hypervisor/domain_cgroup.h | 11 +- src/hypervisor/domain_driver.c | 390 +++++++++++++++++++-------------- src/hypervisor/domain_driver.h | 1 + src/libvirt_private.syms | 2 +- src/lxc/lxc_cgroup.c | 1 + src/qemu/qemu.conf.in | 15 +- src/qemu/qemu_cgroup.c | 7 + src/qemu/qemu_conf.c | 30 +-- src/qemu/qemu_conf.h | 7 +- src/qemu/qemu_driver.c | 12 +- src/util/vircgroup.c | 7 +- src/util/vircgroup.h | 1 + src/util/virsystemd.c | 28 ++- src/util/virsystemd.h | 3 +- tests/virsystemdtest.c | 15 +- 17 files changed, 322 insertions(+), 216 deletions(-) -- 2.49.0

2 22

[PATCH 0/7] qemu-10.1 test data and dropped machine type cleanups
by Peter Krempa 07 Jul '25

07 Jul '25

Peter Krempa (7): qemuxmlconftest: x86_64: Drop explicit use of '2.10' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.12' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.5' machine type qemuxmlconftest: x86_64: Drop explicit use of '2.9' machine type qemuxmlconftest: x86_64: Bump 'firmware*' test cases to 'pc-i440fx-10.0' qemuxmlconftest: x86_64: Bump 'firmware*' test cases to 'pc-q35-10.0' qemucapabilitiestest: Add dump for the qemu-10.1 development cycle on x86_64 .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1722 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1827 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1722 + .../caps_10.1.0_x86_64.replies | 46736 ++++++++++++++++ .../caps_10.1.0_x86_64.xml | 4574 ++ ...host-model-fallback-tcg.x86_64-latest.args | 2 +- ...st-model-nofallback-tcg.x86_64-latest.args | 2 +- .../cpu-host-model-tcg.x86_64-latest.args | 2 +- .../firmware-auto-bios-not-stateless.xml | 2 +- .../firmware-auto-bios-nvram.xml | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios-stateless.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-auto-bios.xml | 2 +- ...ware-auto-efi-enrolled-keys-no-secboot.xml | 2 +- ...-auto-efi-enrolled-keys.x86_64-latest.args | 2 +- ...e-auto-efi-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-auto-efi-enrolled-keys.xml | 2 +- ...loader-qcow2-nvram-path.x86_64-latest.args | 2 +- ...-loader-qcow2-nvram-path.x86_64-latest.xml | 2 +- ...uto-efi-format-loader-qcow2-nvram-path.xml | 2 +- ...efi-format-loader-qcow2.x86_64-latest.args | 2 +- ...-efi-format-loader-qcow2.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-loader-qcow2.xml | 2 +- ...uto-efi-format-mismatch.x86_64-latest.args | 2 +- ...auto-efi-format-mismatch.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-mismatch.xml | 2 +- ...nvram-qcow2-network-nbd.x86_64-latest.args | 2 +- ...-nvram-qcow2-network-nbd.x86_64-latest.xml | 2 +- ...uto-efi-format-nvram-qcow2-network-nbd.xml | 2 +- ...format-nvram-qcow2-path.x86_64-latest.args | 2 +- ...-format-nvram-qcow2-path.x86_64-latest.xml | 2 +- ...mware-auto-efi-format-nvram-qcow2-path.xml | 2 +- ...-efi-format-nvram-qcow2.x86_64-latest.args | 2 +- ...o-efi-format-nvram-qcow2.x86_64-latest.xml | 2 +- .../firmware-auto-efi-format-nvram-qcow2.xml | 2 +- ...uto-efi-loader-insecure.x86_64-latest.args | 2 +- ...auto-efi-loader-insecure.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-insecure.xml | 2 +- ...-loader-path-nonstandard.x86_64-latest.xml | 2 +- ...mware-auto-efi-loader-path-nonstandard.xml | 2 +- ...re-auto-efi-loader-path.x86_64-latest.args | 2 +- ...are-auto-efi-loader-path.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-path.xml | 2 +- ...oader-secure.x86_64-latest.abi-update.args | 2 +- ...loader-secure.x86_64-latest.abi-update.xml | 2 +- ...-auto-efi-loader-secure.x86_64-latest.args | 2 +- ...e-auto-efi-loader-secure.x86_64-latest.xml | 2 +- .../firmware-auto-efi-loader-secure.xml | 2 +- ...to-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...uto-efi-no-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-auto-efi-no-enrolled-keys.xml | 2 +- ...are-auto-efi-no-secboot.x86_64-latest.args | 2 +- ...ware-auto-efi-no-secboot.x86_64-latest.xml | 2 +- .../firmware-auto-efi-no-secboot.xml | 2 +- ...are-auto-efi-nvram-file.x86_64-latest.args | 2 +- ...ware-auto-efi-nvram-file.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-file.xml | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-network-iscsi.xml | 2 +- ...o-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...to-efi-nvram-network-nbd.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-network-nbd.xml | 2 +- ...are-auto-efi-nvram-path.x86_64-latest.args | 2 +- ...ware-auto-efi-nvram-path.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-path.xml | 2 +- ...ram-template-nonstandard.x86_64-latest.xml | 2 +- ...re-auto-efi-nvram-template-nonstandard.xml | 2 +- ...auto-efi-nvram-template.x86_64-latest.args | 2 +- ...-auto-efi-nvram-template.x86_64-latest.xml | 2 +- .../firmware-auto-efi-nvram-template.xml | 2 +- ...mware-auto-efi-rw-pflash.x86_64-latest.xml | 2 +- .../firmware-auto-efi-rw-pflash.xml | 2 +- .../firmware-auto-efi-rw.x86_64-latest.xml | 2 +- .../qemuxmlconfdata/firmware-auto-efi-rw.xml | 2 +- ...rmware-auto-efi-secboot.x86_64-latest.args | 2 +- ...irmware-auto-efi-secboot.x86_64-latest.xml | 2 +- .../firmware-auto-efi-secboot.xml | 2 +- ...rmware-auto-efi-smm-off.x86_64-latest.args | 2 +- ...irmware-auto-efi-smm-off.x86_64-latest.xml | 2 +- .../firmware-auto-efi-smm-off.xml | 2 +- ...ware-auto-efi-stateless.x86_64-latest.args | 2 +- ...mware-auto-efi-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-efi-stateless.xml | 2 +- ...are-auto-efi.x86_64-latest.abi-update.args | 2 +- ...ware-auto-efi.x86_64-latest.abi-update.xml | 2 +- .../firmware-auto-efi.x86_64-latest.args | 2 +- .../firmware-auto-efi.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-auto-efi.xml | 2 +- .../firmware-manual-bios-not-stateless.xml | 2 +- ...e-manual-bios-stateless.x86_64-latest.args | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-manual-bios-stateless.xml | 2 +- .../firmware-manual-bios.x86_64-latest.args | 2 +- .../firmware-manual-bios.x86_64-latest.xml | 2 +- .../qemuxmlconfdata/firmware-manual-bios.xml | 2 +- ...are-manual-efi-acpi-q35.x86_64-latest.args | 2 +- ...ware-manual-efi-acpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-efi-acpi-q35.xml | 2 +- ...are-manual-efi-features.x86_64-latest.args | 2 +- ...ware-manual-efi-features.x86_64-latest.xml | 2 +- .../firmware-manual-efi-features.xml | 2 +- .../firmware-manual-efi-loader-no-path.xml | 2 +- ...loader-path-nonstandard.x86_64-latest.args | 2 +- ...-loader-path-nonstandard.x86_64-latest.xml | 2 +- ...are-manual-efi-loader-path-nonstandard.xml | 2 +- ...anual-efi-loader-secure.x86_64-latest.args | 2 +- ...manual-efi-loader-secure.x86_64-latest.xml | 2 +- .../firmware-manual-efi-loader-secure.xml | 2 +- ...olled-keys-legacy-paths.x86_64-latest.args | 2 +- ...rolled-keys-legacy-paths.x86_64-latest.xml | 2 +- ...nual-efi-no-enrolled-keys-legacy-paths.xml | 2 +- ...al-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...ual-efi-no-enrolled-keys.x86_64-latest.xml | 2 +- .../firmware-manual-efi-no-enrolled-keys.xml | 2 +- ...no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...-no-secboot-legacy-paths.x86_64-latest.xml | 2 +- ...are-manual-efi-no-secboot-legacy-paths.xml | 2 +- ...e-manual-efi-no-secboot.x86_64-latest.args | 2 +- ...re-manual-efi-no-secboot.x86_64-latest.xml | 2 +- .../firmware-manual-efi-no-secboot.xml | 2 +- .../firmware-manual-efi-noacpi-q35.xml | 2 +- ...e-manual-efi-nvram-file.x86_64-latest.args | 2 +- ...re-manual-efi-nvram-file.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-file.xml | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 2 +- ...irmware-manual-efi-nvram-network-iscsi.xml | 2 +- ...l-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...al-efi-nvram-network-nbd.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-network-nbd.xml | 2 +- .../firmware-manual-efi-nvram-stateless.xml | 2 +- ...am-template-nonstandard.x86_64-latest.args | 2 +- ...ram-template-nonstandard.x86_64-latest.xml | 2 +- ...-manual-efi-nvram-template-nonstandard.xml | 2 +- ...re-manual-efi-nvram-template-stateless.xml | 2 +- ...nual-efi-nvram-template.x86_64-latest.args | 2 +- ...anual-efi-nvram-template.x86_64-latest.xml | 2 +- .../firmware-manual-efi-nvram-template.xml | 2 +- ...-manual-efi-rw-implicit.x86_64-latest.args | 2 +- ...e-manual-efi-rw-implicit.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-implicit.xml | 2 +- ...ual-efi-rw-legacy-paths.x86_64-latest.args | 2 +- ...nual-efi-rw-legacy-paths.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-legacy-paths.xml | 2 +- ...ual-efi-rw-modern-paths.x86_64-latest.args | 2 +- ...nual-efi-rw-modern-paths.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw-modern-paths.xml | 2 +- .../firmware-manual-efi-rw.x86_64-latest.args | 2 +- .../firmware-manual-efi-rw.x86_64-latest.xml | 2 +- .../firmware-manual-efi-rw.xml | 2 +- ...fi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...efi-secboot-legacy-paths.x86_64-latest.xml | 2 +- ...rmware-manual-efi-secboot-legacy-paths.xml | 2 +- ...ware-manual-efi-secboot.x86_64-latest.args | 2 +- ...mware-manual-efi-secboot.x86_64-latest.xml | 2 +- .../firmware-manual-efi-secboot.xml | 2 +- ...re-manual-efi-stateless.x86_64-latest.args | 2 +- ...are-manual-efi-stateless.x86_64-latest.xml | 2 +- .../firmware-manual-efi-stateless.xml | 2 +- .../firmware-manual-efi.x86_64-latest.args | 2 +- .../firmware-manual-efi.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/firmware-manual-efi.xml | 2 +- ...e-manual-noefi-acpi-q35.x86_64-latest.args | 2 +- ...re-manual-noefi-acpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-noefi-acpi-q35.xml | 2 +- ...manual-noefi-noacpi-q35.x86_64-latest.args | 2 +- ...-manual-noefi-noacpi-q35.x86_64-latest.xml | 2 +- .../firmware-manual-noefi-noacpi-q35.xml | 2 +- ...pi-root-hotplug-disable.x86_64-latest.args | 2 +- .../pc-i440fx-acpi-root-hotplug-disable.xml | 2 +- ...cpi-root-hotplug-enable.x86_64-latest.args | 2 +- .../pc-i440fx-acpi-root-hotplug-enable.xml | 2 +- ...pm-emulator-crb-profile.x86_64-latest.args | 2 +- .../tpm-emulator-crb-profile.xml | 2 +- .../tpm-emulator-tpm2-enc.x86_64-latest.args | 2 +- .../qemuxmlconfdata/tpm-emulator-tpm2-enc.xml | 2 +- ...pm-emulator-tpm2-pstate.x86_64-latest.args | 2 +- .../tpm-emulator-tpm2-pstate.xml | 2 +- .../tpm-emulator-tpm2.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-emulator-tpm2.xml | 2 +- .../tpm-emulator.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-emulator.xml | 2 +- .../tpm-external.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-external.xml | 2 +- .../tpm-passthrough-crb.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-passthrough-crb.xml | 2 +- .../tpm-passthrough.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tpm-passthrough.xml | 2 +- .../tseg-explicit-size.x86_64-latest.args | 2 +- .../tseg-explicit-size.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/tseg-explicit-size.xml | 2 +- .../vhost-vsock-auto.x86_64-latest.args | 2 +- .../vhost-vsock-auto.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/vhost-vsock-auto.xml | 2 +- 198 files changed, 56774 insertions(+), 193 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml -- 2.49.0

2 8

[PATCH v2] nwfilter: Remove 'qemu-announce-self' example
by Peter Krempa 07 Jul '25

07 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> The example allows packets sent by qemu after migration with broken protocol ID. The proper self announce is handled via 'qemu-announce-self-rarp'. The qemu bug was addressed by f8778a7785d530515b0db39 (released as v0.13.0). As we no longer support such old qemus, and allowing broken packets makes no sense. Remove the rule and make it into an alias of 'qemu-announce-self-rarp' to preserve compatibility. Adjust the existing examples to use only the proper rule.t Closes: https://gitlab.com/libvirt/libvirt/-/issues/792 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- v2: - keep the old rule as alias - update comment to say that it's no longer needed docs/firewall.rst | 1 - docs/formatnwfilter.rst | 2 +- src/nwfilter/xml/clean-traffic-gateway.xml | 2 +- src/nwfilter/xml/clean-traffic.xml | 2 +- src/nwfilter/xml/qemu-announce-self-rarp.xml | 2 ++ src/nwfilter/xml/qemu-announce-self.xml | 14 ++++---------- 6 files changed, 9 insertions(+), 14 deletions(-) diff --git a/docs/firewall.rst b/docs/firewall.rst index 26474d3317..81114d2c95 100644 --- a/docs/firewall.rst +++ b/docs/firewall.rst @@ -285,7 +285,6 @@ useful rules: fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic - 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is diff --git a/docs/formatnwfilter.rst b/docs/formatnwfilter.rst index 13e9a791af..e50497aaf8 100644 --- a/docs/formatnwfilter.rst +++ b/docs/formatnwfilter.rst @@ -438,7 +438,7 @@ several other filters. <filterref filter='allow-incoming-ipv4'/> <filterref filter='no-arp-spoofing'/> <filterref filter='no-other-l2-traffic'/> - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> To reference another filter, the XML node ``filterref`` needs to be provided diff --git a/src/nwfilter/xml/clean-traffic-gateway.xml b/src/nwfilter/xml/clean-traffic-gateway.xml index b8c204041a..1768a67697 100644 --- a/src/nwfilter/xml/clean-traffic-gateway.xml +++ b/src/nwfilter/xml/clean-traffic-gateway.xml @@ -30,5 +30,5 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/clean-traffic.xml b/src/nwfilter/xml/clean-traffic.xml index b8cde9c560..b0530da70a 100644 --- a/src/nwfilter/xml/clean-traffic.xml +++ b/src/nwfilter/xml/clean-traffic.xml @@ -25,6 +25,6 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self-rarp.xml b/src/nwfilter/xml/qemu-announce-self-rarp.xml index b7a848ad0f..db7b650320 100644 --- a/src/nwfilter/xml/qemu-announce-self-rarp.xml +++ b/src/nwfilter/xml/qemu-announce-self-rarp.xml @@ -11,4 +11,6 @@ arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> </rule> + + <filterref filter='no-other-rarp-traffic'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self.xml b/src/nwfilter/xml/qemu-announce-self.xml index 352db500de..73b77804cf 100644 --- a/src/nwfilter/xml/qemu-announce-self.xml +++ b/src/nwfilter/xml/qemu-announce-self.xml @@ -1,13 +1,7 @@ <filter name='qemu-announce-self' chain='root'> -  -  - <rule action='accept' direction='out'> - <mac protocolid='0x835'/> - </rule> - -  +  <filterref filter='qemu-announce-self-rarp'/> - <filterref filter='no-other-rarp-traffic'/> - </filter> -- 2.49.0

2 1

[PATCH] nwfilter: Remove 'qemu-announce-self' example
by Peter Krempa 07 Jul '25

07 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> The example allows packets sent by qemu after migration with broken protocol ID. The proper self announce is handled via 'qemu-announce-self-rarp'. The qemu bug was addressed by f8778a7785d530515b0db39 (released as v0.13.0). As we no longer support such old qemus, and allowing broken packets makes no sense remove the filter, and adjust the existing ones to refer to the proper name. Closes: https://gitlab.com/libvirt/libvirt/-/issues/792 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- docs/firewall.rst | 1 - docs/formatnwfilter.rst | 2 +- src/nwfilter/xml/clean-traffic-gateway.xml | 2 +- src/nwfilter/xml/clean-traffic.xml | 2 +- src/nwfilter/xml/meson.build | 1 - src/nwfilter/xml/qemu-announce-self-rarp.xml | 2 ++ src/nwfilter/xml/qemu-announce-self.xml | 13 ------------- 7 files changed, 5 insertions(+), 18 deletions(-) delete mode 100644 src/nwfilter/xml/qemu-announce-self.xml diff --git a/docs/firewall.rst b/docs/firewall.rst index 26474d3317..81114d2c95 100644 --- a/docs/firewall.rst +++ b/docs/firewall.rst @@ -285,7 +285,6 @@ useful rules: fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic - 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is diff --git a/docs/formatnwfilter.rst b/docs/formatnwfilter.rst index 13e9a791af..e50497aaf8 100644 --- a/docs/formatnwfilter.rst +++ b/docs/formatnwfilter.rst @@ -438,7 +438,7 @@ several other filters. <filterref filter='allow-incoming-ipv4'/> <filterref filter='no-arp-spoofing'/> <filterref filter='no-other-l2-traffic'/> - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> To reference another filter, the XML node ``filterref`` needs to be provided diff --git a/src/nwfilter/xml/clean-traffic-gateway.xml b/src/nwfilter/xml/clean-traffic-gateway.xml index b8c204041a..1768a67697 100644 --- a/src/nwfilter/xml/clean-traffic-gateway.xml +++ b/src/nwfilter/xml/clean-traffic-gateway.xml @@ -30,5 +30,5 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/clean-traffic.xml b/src/nwfilter/xml/clean-traffic.xml index b8cde9c560..b0530da70a 100644 --- a/src/nwfilter/xml/clean-traffic.xml +++ b/src/nwfilter/xml/clean-traffic.xml @@ -25,6 +25,6 @@ <filterref filter='no-other-l2-traffic'/>  - <filterref filter='qemu-announce-self'/> + <filterref filter='qemu-announce-self-rarp'/> </filter> diff --git a/src/nwfilter/xml/meson.build b/src/nwfilter/xml/meson.build index 0d96c54ebe..de3f205a7c 100644 --- a/src/nwfilter/xml/meson.build +++ b/src/nwfilter/xml/meson.build @@ -22,7 +22,6 @@ nwfilter_xml_files = [ 'no-other-l2-traffic.xml', 'no-other-rarp-traffic.xml', 'qemu-announce-self-rarp.xml', - 'qemu-announce-self.xml', ] install_data(nwfilter_xml_files, install_dir: sysconfdir / 'libvirt' / 'nwfilter') diff --git a/src/nwfilter/xml/qemu-announce-self-rarp.xml b/src/nwfilter/xml/qemu-announce-self-rarp.xml index b7a848ad0f..db7b650320 100644 --- a/src/nwfilter/xml/qemu-announce-self-rarp.xml +++ b/src/nwfilter/xml/qemu-announce-self-rarp.xml @@ -11,4 +11,6 @@ arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> </rule> + + <filterref filter='no-other-rarp-traffic'/> </filter> diff --git a/src/nwfilter/xml/qemu-announce-self.xml b/src/nwfilter/xml/qemu-announce-self.xml deleted file mode 100644 index 352db500de..0000000000 --- a/src/nwfilter/xml/qemu-announce-self.xml +++ /dev/null @@ -1,13 +0,0 @@ -<filter name='qemu-announce-self' chain='root'> -  -  - <rule action='accept' direction='out'> - <mac protocolid='0x835'/> - </rule> - -  - <filterref filter='qemu-announce-self-rarp'/> - <filterref filter='no-other-rarp-traffic'/> - -</filter> -- 2.49.0

3 4

[libvirt PATCH] qemu: prefer memfd if we have to format system memory
by Ján Tomko 07 Jul '25

07 Jul '25

From: Ján Tomko <jtomko(a)redhat.com> For any vhost-user device to work, the memory needs to be marked as shared. What we recommend to users (e.g. in the virtiofs quide [0]) is: <memoryBacking> <source type='memfd'/> <access mode='shared'/> </memoryBacking> Technically, only the access mode is needed: <memoryBacking> <access mode='shared'/> </memoryBacking> But this results in libvirt assuming the file backend. Switch this case to use memfd which should offer better performance, and less disk usage, at the cost of eating unswappable RAM. [0] https://libvirt.org/kbase/virtiofs.html Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_command.c | 9 +++++++-- tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args | 2 +- .../net-vhostuser-multiq.x86_64-latest.args | 2 +- .../net-vhostuser-passt.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args | 2 +- .../schema-reorder-domain-subelements.x86_64-latest.args | 2 +- .../qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args | 2 +- 7 files changed, 13 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7658cc4d39..ca9d4d6609 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3417,8 +3417,13 @@ qemuBuildMemoryBackendProps(virJSONValue **backendProps, if (!priv->memPrealloc) prealloc = true; - } else if (!nvdimmPath && - def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) { + } else if ((!nvdimmPath && + def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) || + (systemMemory && + memAccess && + !useHugepage && + def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_NONE && + virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_MEMORY_MEMFD))) { backendType = "memory-backend-memfd"; if (useHugepage && diff --git a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args index 93d2ef0d98..04732df68a 100644 --- a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args +++ b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args index 4ea3d4eebd..ac5c8b7652 100644 --- a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args index afbbe188cf..ee395deffe 100644 --- a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args index f5925c77fe..74454d3d24 100644 --- a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu64 \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ diff --git a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args index 76df9c30b0..5fb594df87 100644 --- a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args +++ b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-passtvhostuu/.config \ -accel kvm \ -cpu qemu64 \ -m size=16777216k \ --object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-passtvhostuu/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \ +-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \ -overcommit mem-lock=off \ -smp 16,sockets=16,cores=1,threads=1 \ -uuid d79698e0-46b2-4459-87ee-7c762990dd6e \ diff --git a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args index 72ca38c305..eed9af8bb1 100644 --- a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args +++ b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args @@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -accel tcg \ -cpu qemu \ -m size=219136k \ --object '{"qom-type":"memory-backend-file","id":"s390.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ +-object '{"qom-type":"memory-backend-memfd","id":"s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \ -overcommit mem-lock=off \ -smp 1,sockets=1,cores=1,threads=1 \ -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ -- 2.50.0

2 1

Create a new thread in Devel
by k4i31917＠nqmo.com 05 Jul '25

05 Jul '25

https://www.canadapleasure.com/ Create a new thread in Devel

1 0

[PATCH 0/3] qemu: Improve handling of architecture-specific defaults (SCSI)
by Andrea Bolognani 04 Jul '25

04 Jul '25

I was working on this last year, then sort of lost track. Jim's recent patch[1] caused me to remember about this work and look into picking it up again. This is only half of the original series, which itself was reduced in scope compared to the first revision. I'll try to get around to everything, but addressing one area at the time is most likely to succeed. Of course this will no longer apply cleanly once Jim's patch has been pushed. The conflict will be trivial to solve though. Changes from [v2]: * several patches have been pushed; * address review comments. Changes from [v1]: * several patches have been pushed; * of the remaining changes, only the ones related to SCSI and USB controllers have been retained. I still intend to pursue the rest, but those two are where the real nasty stuff happens, so I'm focusing on them only for now; * improve the handling of USB controllers on s390x; * make all the code dealing with the legacy USB controller obsolete and get rid of it; * use out arguments to return models, making the new helpers fall in line with the usual libvirt API conventions. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/B45S… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/FZ6B… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/G53M… Andrea Bolognani (3): qemu: Improve qemuDomainDefaultSCSIControllerModel() qemu: Clean up qemuDomainDefaultSCSIControllerModel() qemu: Use virtio-scsi by default on RISC-V src/qemu/qemu_domain.c | 48 +++++++++++++------ src/qemu/qemu_domain.h | 5 +- src/qemu/qemu_hotplug.c | 16 ++++--- src/qemu/qemu_postparse.c | 11 +++-- ...ault-models.riscv64-latest.abi-update.args | 5 +- ...fault-models.riscv64-latest.abi-update.xml | 11 +++-- ...64-virt-default-models.riscv64-latest.args | 5 +- ...v64-virt-default-models.riscv64-latest.xml | 11 +++-- 8 files changed, 73 insertions(+), 39 deletions(-) -- 2.50.0

2 4

[PATCH 0/1] docs : add doc on cpu model and features
by Hector CAO 04 Jul '25

04 Jul '25

From: Hector Cao <hector.cao(a)canonical.com> Hello, This is a follow-up of the submission: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/EZBL… Based on Jiri's feedback, it is better to tackle this situation by documentation. You can find here a proposal for the documentation. The section will be rendered at : https://libvirt.org/formatcaps.html Best regards, Hector Hector Cao (1): docs : add doc on cpu model and features docs/formatcaps.rst | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) -- 2.43.0

2 2

[PATCH v1] aspeed: Deprecate the ast2700a0-evb machine
by Jamin Lin 03 Jul '25

03 Jul '25

The ast2700a0-evb machine represents the first revision of the AST2700 and serves as the initial engineering sample rather than a production version. A newer revision, A1, is now supported, and the ast2700a1-evb should replace the older A0 version. Signed-off-by: Jamin Lin <jamin_lin(a)aspeedtech.com> --- docs/about/deprecated.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 42037131de..5a3ed71a64 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -315,6 +315,14 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. +Arm ``ast2700a0-evb`` machine (since 10.1) +'''''''''''''''''''''''''''''''''''''''''' + +The ``ast2700a0-evb`` machine represents the first revision of the AST2700 +and serves as the initial engineering sample rather than a production version. +A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should +replace the older A0 version. + Mips ``mipssim`` machine (since 10.0) ''''''''''''''''''''''''''''''''''''' -- 2.43.0

2 1

[PATCH] virdevmapper: Always use device name for finding targets
by bhavin192＠purelymail.com 02 Jul '25

02 Jul '25

From: Bhavin Gandhi <bhavin192(a)geeksocket.in> DM_TABLE_DEPS expects a device name in dm_ioctl.name. In one of the cases, full path of the device was getting returned causing the ioctl call to fail with `ENXIO (No such device or address)`. Also rename the function and variable names to better reflect that we are dealing with DM device names and not paths. This got introduced in 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e Resolves: https://gitlab.com/libvirt/libvirt/-/issues/790 Signed-off-by: Bhavin Gandhi <bhavin192(a)geeksocket.in> --- src/util/virdevmapper.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c index d0eae671ab..42c86d89cf 100644 --- a/src/util/virdevmapper.c +++ b/src/util/virdevmapper.c @@ -164,7 +164,7 @@ virDMOpen(void) static char * -virDMSanitizepath(const char *path) +virDMGetDeviceName(const char *path) { g_autofree char *dmDirPath = NULL; struct dirent *ent = NULL; @@ -205,7 +205,7 @@ virDMSanitizepath(const char *path) if (stat(tmp, &sb[1]) == 0 && sb[0].st_rdev == sb[1].st_rdev) { - return g_steal_pointer(&tmp); + return g_strdup(ent->d_name); } } @@ -219,7 +219,7 @@ virDevMapperGetTargetsImpl(int controlFD, GSList **devPaths, unsigned int ttl) { - g_autofree char *sanitizedPath = NULL; + g_autofree char *deviceName = NULL; g_autofree char *buf = NULL; struct dm_ioctl dm = { 0 }; struct dm_target_deps *deps = NULL; @@ -233,10 +233,10 @@ virDevMapperGetTargetsImpl(int controlFD, if (!virIsDevMapperDevice(path)) return 0; - if (!(sanitizedPath = virDMSanitizepath(path))) + if (!(deviceName = virDMGetDeviceName(path))) return 0; - if (virStrcpy(dm.name, sanitizedPath, DM_NAME_LEN) < 0) { + if (virStrcpy(dm.name, deviceName, DM_NAME_LEN) < 0) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("Resolved device mapper name too long")); return -1; -- 2.49.0

2 1

[PATCH 0/2] network: support NAT networking for FreeBSD/pf
by Roman Bogorodskiy 02 Jul '25

02 Jul '25

This series implements NAT networks support for FreeBSD using the Packet Filter (pf) firewall. The commit messages provide high-level details and limitations of the current implementation, and I'll use this cover letter to provide some more technical details and describe testing I have performed for this change. Libvirt FreeBSD/pf NAT testing For two networks: virsh # net-dumpxml default <network> <name>default</name> <uuid>68cd5419-9fda-4cf0-9ac6-2eb9c1ba41ed</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr0' stp='on' delay='0'/> <mac address='52:54:00:db:0e:e5'/> <ip address='192.168.122.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.122.2' end='192.168.122.254'/> </dhcp> </ip> </network> virsh # net-dumpxml natnet <network> <name>natnet</name> <uuid>d3c59659-3ceb-4482-a625-1f839a54429c</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:0a:fc:1d'/> <ip address='10.0.100.1' netmask='255.255.255.0'> <dhcp> <range start='10.0.100.2' end='10.0.100.254'/> </dhcp> </ip> </network> virsh # The following rules are generated: $ sudo pfctl -a '*' -sn nat-anchor "libvirt/*" all { nat-anchor "default" all { nat pass on re0 inet from 192.168.122.0/24 to <natdst> -> (re0) port 1024:65535 round-robin } nat-anchor "natnet" all { nat pass on re0 inet from 10.0.100.0/24 to <natdst> -> (re0) port 1024:65535 round-robin } } $ $ sudo pfctl -a 'libvirt/default' -t natdst -T show 0.0.0.0/0 !192.168.122.0/24 !224.0.0.0/24 !255.255.255.255 $ sudo pfctl -a 'libvirt/natnet' -t natdst -T show 0.0.0.0/0 !10.0.100.0/24 !224.0.0.0/24 !255.255.255.255 $ $ sudo pfctl -a '*' -sr scrub all fragment reassemble anchor "libvirt/*" all { anchor "default" all { pass quick on virbr0 inet from 192.168.122.0/24 to 192.168.122.0/24 flags S/SA keep state pass quick on virbr0 inet from 192.168.122.0/24 to 224.0.0.0/24 flags S/SA keep state pass quick on virbr0 inet from 192.168.122.0/24 to 255.255.255.255 flags S/SA keep state block drop on virbr0 all } anchor "natnet" all { pass quick on virbr1 inet from 10.0.100.0/24 to 10.0.100.0/24 flags S/SA keep state pass quick on virbr1 inet from 10.0.100.0/24 to 224.0.0.0/24 flags S/SA keep state pass quick on virbr1 inet from 10.0.100.0/24 to 255.255.255.255 flags S/SA keep state block drop on virbr1 all } } pass all flags S/SA keep state $ Create two guests attached to the "default" network, vmA and vmB. vmA $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:67:eb:de brd ff:ff:ff:ff:ff:ff inet 192.168.122.92/24 brd 192.168.122.255 scope global dynamic noprefixroute enp0s4 valid_lft 1082sec preferred_lft 1082sec inet6 fe80::5054:ff:fe67:ebde/64 scope link noprefixroute valid_lft forever preferred_lft forever vmA $ vmB $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:d2:8b:41 brd ff:ff:ff:ff:ff:ff inet 192.168.122.154/24 metric 100 brd 192.168.122.255 scope global dynamic enp0s4 valid_lft 1040sec preferred_lft 1040sec inet6 fe80::5054:ff:fed2:8b41/64 scope link valid_lft forever preferred_lft forever vmB $ Test NAT rules: vmA $ ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=14.7 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=10.7 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.1 ms --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2006ms rtt min/avg/max/mdev = 10.099/11.835/14.710/2.047 ms vmA $ vmB $ ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=15.1 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=11.0 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.4 ms --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2006ms rtt min/avg/max/mdev = 10.434/12.198/15.113/2.075 ms vmB $ vmA $ curl wttr.in/?0Q Fog _ - _ - _ - +4(1) °C _ - _ - _ ↙ 11 km/h _ - _ - _ - 0 km 0.0 mm vmA $ vmB $ curl wttr.in/?0Q Fog _ - _ - _ - +4(1) °C _ - _ - _ ↙ 11 km/h _ - _ - _ - 0 km 0.0 mm vmB $ Inter-VM connectivity: vmA $ ping -c 3 192.168.122.154 PING 192.168.122.154 (192.168.122.154) 56(84) bytes of data. 64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.253 ms 64 bytes from 192.168.122.154: icmp_seq=2 ttl=64 time=0.226 ms 64 bytes from 192.168.122.154: icmp_seq=3 ttl=64 time=0.269 ms --- 192.168.122.154 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2042ms rtt min/avg/max/mdev = 0.226/0.249/0.269/0.017 ms vmA $ vmA $ ssh 192.168.122.154 uname novel(a)192.168.122.154's password: Linux vmA $ Multicast test: vmA $ iperf -s -u -B 224.0.0.1 -i 1 ------------------------------------------------------------ Server listening on UDP port 5001 Joining multicast group 224.0.0.1 Server set to single client traffic mode (per multicast receive) UDP buffer size: 208 KByte (default) ------------------------------------------------------------ [ 1] local 224.0.0.1 port 5001 connected with 192.168.122.154 port 36963 [ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams [ 1] 0.00-1.00 sec 131 KBytes 1.07 Mbits/sec 0.030 ms 0/91 (0%) [ 1] 1.00-2.00 sec 128 KBytes 1.05 Mbits/sec 0.022 ms 0/89 (0%) [ 1] 2.00-3.00 sec 128 KBytes 1.05 Mbits/sec 0.021 ms 0/89 (0%) [ 1] 0.00-3.02 sec 389 KBytes 1.06 Mbits/sec 0.026 ms 0/271 (0%) vmB $ iperf -c 224.0.0.1 -u -T 32 -t 3 -i 1 ------------------------------------------------------------ Client connecting to 224.0.0.1, UDP port 5001 Sending 1470 byte datagrams, IPG target: 11215.21 us (kalman adjust) UDP buffer size: 208 KByte (default) ------------------------------------------------------------ [ 1] local 192.168.122.154 port 36963 connected with 224.0.0.1 port 5001 [ ID] Interval Transfer Bandwidth [ 1] 0.0000-1.0000 sec 131 KBytes 1.07 Mbits/sec [ 1] 1.0000-2.0000 sec 128 KBytes 1.05 Mbits/sec [ 1] 2.0000-3.0000 sec 128 KBytes 1.05 Mbits/sec [ 1] 0.0000-3.0173 sec 389 KBytes 1.06 Mbits/sec [ 1] Sent 272 datagrams vmB $ Broadcast test: vmA $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 net.ipv4.icmp_echo_ignore_broadcasts = 0 vmA $ vmB $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 net.ipv4.icmp_echo_ignore_broadcasts = 0 vmB $ host $ ping 192.168.122.255 PING 192.168.122.255 (192.168.122.255): 56 data bytes 64 bytes from 192.168.122.154: icmp_seq=0 ttl=64 time=0.199 ms 64 bytes from 192.168.122.92: icmp_seq=0 ttl=64 time=0.227 ms (DUP!) 64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.209 ms 64 bytes from 192.168.122.92: icmp_seq=1 ttl=64 time=0.235 ms (DUP!) ^C --- 192.168.122.255 ping statistics --- 2 packets transmitted, 2 packets received, +2 duplicates, 0.0% packet loss round-trip min/avg/max/stddev = 0.199/0.218/0.235/0.014 ms This testing does not cover any negative scenarios which are probably not that important at this point. Roman Bogorodskiy (2): network: bridge_driver: add BSD implementation network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 2 + src/network/bridge_driver_bsd.c | 107 +++++++++ src/network/bridge_driver_conf.c | 8 + src/network/bridge_driver_linux.c | 2 + src/network/bridge_driver_platform.c | 2 + src/network/meson.build | 1 + src/network/network_pf.c | 327 +++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 11 files changed, 482 insertions(+), 1 deletion(-) create mode 100644 src/network/bridge_driver_bsd.c create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 7

[libvirt PATCH] docs: clarify how to build without -Werror
by Ján Tomko 02 Jul '25

02 Jul '25

From: Ján Tomko <jtomko(a)redhat.com> --werror does not accept any arguments for me and setting git_werror was also needed to disable it with git. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/compiling.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/compiling.rst b/docs/compiling.rst index 0a47a50569..06a2d53c3a 100644 --- a/docs/compiling.rst +++ b/docs/compiling.rst @@ -105,8 +105,8 @@ Notes: ~~~~~~ By default when the ``meson`` is run from within a GIT checkout, it will turn -on -Werror for builds. This can be disabled with --werror=false, but this is -not recommended. +on -Werror for builds. This can be disabled with +`-Dwerror=false -Dgit_werror=false`, but this is not recommended. Please ensure that you have the appropriate minimal ``meson`` version installed in your build environment. The minimal version for a specific package can be -- 2.49.0

2 1

[PATCH 00/15] virt-aa-helper: Misc improvements
by Michal Privoznik 02 Jul '25

02 Jul '25

Inspired by a patchset against virt-aa-helper that I reviewed recently: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/QQXM… Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1866451277 Michal Prívozník (15): log_cleaner: Use virFileCanonicalizePath() virt-aa-helper: Use virFileCanonicalizePath() virpcimock: Automatically invent fakerootdir, if not provided virpcimock: Strip fakerootdir prefix in virFileCanonicalizePath() tests: Fix mocking of open() virt-aa-helper-test: Print errors to stderr virt-aa-helper-test: Silence ls virt-aa-helper-test: Test hostdevs unconditionally virt-aa-helper: Rework USB hostdev handling virt-aa-helper: Simplify paths collection virt-aa-helper: Decrease scope of @mem_path in get_files() virt-aa-helper: Use automatic memory freeing virt-aa-helper: Check retval of vah_add_file() virt-aa-helper: Drop cleanup label from get_files() virt-aa-helper-test: Switch to getopts src/logging/log_cleaner.c | 2 +- src/security/virt-aa-helper.c | 474 +++++++++++++++++----------------- tests/nssmock.c | 4 + tests/qemusecuritymock.c | 4 + tests/vircgroupmock.c | 4 + tests/virfilewrapper.c | 4 + tests/virpcimock.c | 41 ++- tests/virt-aa-helper-test | 77 +++--- tests/virtestmock.c | 4 + tests/virusbmock.c | 4 + 10 files changed, 353 insertions(+), 265 deletions(-) -- 2.49.0

3 21

[PATCH 00/10] Unify argument name of migration APIs
by Michal Privoznik 01 Jul '25

01 Jul '25

Some of our APIs have 'bandwidth' argument but then, at internal impl level it's renamed to 'resource', inconsistently. Since it's really describing bandwidth that the migration can use, let's rename it. Michal Prívozník (10): src: Unify argument name of virDomainMigratePrepare() src: Unify argument name of virDomainMigratePerform() src: Unify argument name of virDomainMigratePrepare2() src: Unify argument name of virDomainMigratePrepareTunnel() src: Unify argument name of virDomainMigratePrepare3() src: Unify argument name of virDomainMigratePrepareTunnel3() src: Unify argument name of virDomainMigrateBegin3() src: Unify argument name of virDomainMigratePerform3() qemu: Finish argument rename gendispatch: Finish rename of the migration argument src/driver-hypervisor.h | 16 +++---- src/esx/esx_driver.c | 2 +- src/libvirt_internal.h | 16 +++---- src/qemu/qemu_driver.c | 18 ++++---- src/qemu/qemu_migration.c | 72 ++++++++++++++--------------- src/remote/remote_daemon_dispatch.c | 10 ++-- src/remote/remote_driver.c | 24 +++++----- src/remote/remote_protocol.x | 16 +++---- src/remote_protocol-structs | 16 +++---- src/rpc/gendispatch.pl | 36 +++++++-------- 10 files changed, 113 insertions(+), 113 deletions(-) -- 2.49.0

2 12

[PATCH v2 0/3] tls: Remove all traces of key encipherment usage
by Peter Krempa 01 Jul '25

01 Jul '25

v2: - [1/3] removed also GNUTLS_KEY_KEY_ENCIPHERMENT use in fallback code - [2/3 new] removed 'encryption_key' usage from kbase examples - [3/3 new] removed GNUTLS_KEY_KEY_ENCIPHERMENT use in testsuite Peter Krempa (3): tls: Don't require 'keyEncipherment' to be enabled altoghther kbase: tlscerts: Drop 'encryption_key' feature request tests: virnettls*test: Drop use of GNUTLS_KEY_KEY_ENCIPHERMENT docs/kbase/tlscerts.rst | 2 -- src/rpc/virnettlscert.c | 34 ++++------------------------------ tests/virnettlscontexttest.c | 36 ++++++++++++++++++------------------ tests/virnettlssessiontest.c | 14 +++++++------- 4 files changed, 29 insertions(+), 57 deletions(-) -- 2.49.0

2 4

[PATCH] tests: validate an XML config with USB vendor/product set
by Daniel P. Berrangé 01 Jul '25

01 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The USB vendor/product is usually translated into a device/bus at startup using the hostdev logic. We don't run the latter in the unit test suite, but we can fake it by hardcoding a translation. This demonstrates that we format the command line with the normal device/bus properties, even when vendor/product is set. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- ...tdev-usb-vendor-product.x86_64-latest.args | 35 +++++++++++++++ ...stdev-usb-vendor-product.x86_64-latest.xml | 44 +++++++++++++++++++ .../hostdev-usb-vendor-product.xml | 36 +++++++++++++++ tests/qemuxmlconftest.c | 18 ++++++++ 4 files changed, 133 insertions(+) create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args new file mode 100644 index 0000000000..62338db872 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"usb-host","hostdevice":"/dev/bus/usb/042/4660","id":"hostdev0","guest-reset":true,"guest-resets-all":false,"bus":"usb.0","port":"1"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml new file mode 100644 index 0000000000..340df80263 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml @@ -0,0 +1,44 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <hostdev mode='subsystem' type='usb' managed='no'> + <source guestReset='uninitialized'> + <vendor id='0x1234'/> + <product id='0x4321'/> + </source> + </hostdev> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml new file mode 100644 index 0000000000..dfb668f208 --- /dev/null +++ b/tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml @@ -0,0 +1,36 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <hostdev mode='subsystem' type='usb' managed='no'> + <source guestReset='uninitialized'> + <vendor id='0x1234'/> + <product id='0x4321'/> + </source> + </hostdev> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index f74bd2bb7a..fe90f029d9 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -474,6 +474,23 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv, } } + for (i = 0; i < vm->def->nhostdevs; i++) { + virDomainHostdevDef *hostdev = vm->def->hostdevs[i]; + + if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && + hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB) { + virDomainHostdevSubsysUSB *usb = &hostdev->source.subsys.u.usb; + if (!usb->device && !usb->bus) { + if (usb->vendor == 0x1234 && usb->product == 0x4321) { + usb->bus = 42; + usb->device = 0x1234; + } else { + g_assert_not_reached(); + } + } + } + } + if (flags & FLAG_SLIRP_HELPER) { for (i = 0; i < vm->def->nnets; i++) { virDomainNetDef *net = vm->def->nets[i]; @@ -2118,6 +2135,7 @@ mymain(void) DO_TEST_CAPS_LATEST("hostdev-usb-address-device"); DO_TEST_CAPS_LATEST("hostdev-usb-address-device-boot"); DO_TEST_CAPS_LATEST_PARSE_ERROR("hostdev-usb-duplicate"); + DO_TEST_CAPS_LATEST("hostdev-usb-vendor-product"); DO_TEST_CAPS_LATEST("hostdev-pci-address"); DO_TEST_CAPS_LATEST("hostdev-pci-address-device"); DO_TEST_CAPS_LATEST_PARSE_ERROR("hostdev-pci-duplicate"); -- 2.49.0

2 1

[PATCH] tls: Don't require 'keyEncipherment' to be enabled altoghther
by Peter Krempa 01 Jul '25

01 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Key encipherment is required only for RSA key exchange algorithm. With TLS 1.3 this is not even used as RSA is used only for authentication. Since we can't really check when it's required ahead of time drop the check completely. GnuTLS will moan if it will not be able to use RSA key exchange. In commit 11867b0224a2 I tried to relax the check for some eliptic curve algorithm that explicitly forbid it. Based on the above the proper solution is to completely remove it. Resolves: https://issues.redhat.com/browse/RHEL-100711 Fixes: 11867b0224a2b8dc34755ff0ace446b6842df1c1 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/rpc/virnettlscert.c | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/src/rpc/virnettlscert.c b/src/rpc/virnettlscert.c index f197995633..7024e858f0 100644 --- a/src/rpc/virnettlscert.c +++ b/src/rpc/virnettlscert.c @@ -162,34 +162,6 @@ static int virNetTLSCertCheckKeyUsage(gnutls_x509_crt_t cert, certFile); } } - if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) { - int alg = gnutls_x509_crt_get_pk_algorithm(cert, NULL); - - /* Per RFC8813 [1] which amends RFC5580 [2] ECDSA, ECDH, and ECMQV - * algorithms must not have 'keyEncipherment' present. - * - * [1] https://datatracker.ietf.org/doc/rfc8813/ - * [2] https://datatracker.ietf.org/doc/rfc5480 - */ - - switch (alg) { - case GNUTLS_PK_ECDSA: - case GNUTLS_PK_ECDH_X25519: - case GNUTLS_PK_ECDH_X448: - break; - - default: - if (critical) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Certificate %1$s usage does not permit key encipherment"), - certFile); - return -1; - } else { - VIR_WARN("Certificate %s usage does not permit key encipherment", - certFile); - } - } - } } return 0; -- 2.49.0

2 7

Release of libvirt-11.5.0
by Jiri Denemark 01 Jul '25

01 Jul '25

The 11.5.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Don't accept VIR_DUMP_LIVE flag in virDomainCoreDumpWithFormat() Unfortunately, QEMU always pauses vCPUs when doing a core dump. Therefore, there is no way for Libvirt to honor VIR_DUMP_LIVE flag semantics. Instead of silently pretending the flag works, an appropriate error is now reported. * New features * vmx: Add support for reporting NVMe disks in the domain XML * qemu: Add support for NVMe disks NVMe disks can now be emulated by using an ``nvme`` bus, but require a serial due to the hypervisor:: <target dev='nvme0n1' bus='nvme'/> <serial>qwertyuiop</serial> Multiple disks can be represented as different namespaces on the same controller, but they cannot have a different serial number due to the fact that it is the controller which ultimately has the serial number attached to it, but for ease of use it is automatically copied from the disk serial. * esx: Add support for specifying alternative CA bundle for remote peer verification Users can now use ``cacert`` parameter in the URI to specify a file path with CA certificate(s) that will be used for remote peer certificate validation. * qemu: add support for AMD IOMMU device The ``amd`` model for the ``<iommu>`` device is now supported. New attributes ``passtrhough`` and ``xtsup`` are also supported for this model. * Improvements * Include supported console types in domain capabilities Domain capabilities now include information about supported console types, such as:: <console supported='yes'> <enum name='type'> <value>pty</value> <value>tcp</value> </enum> </console> * virsh: Add waiting for domain state via ``virsh await`` The new helper command ``virsh await`` simplifies waiting on domain state which is normally announced via events. Currently two waiting conditions are implemented: ``domain-inactive``, and ``guest-agent-available``. * Bug fixes * qemu: Be more forgiving when acquiring QUERY job when formatting domain XML Since ``libvirt-11.0.0`` the ``virDomainGetXMLDesc()`` API used to format domain XML acquires QUERY job. But this caused a regression when the API might timeout for incoming migration. This is now fixed. * qemu: Fix shared filesystem detection on nonexistent paths Since ``libvirt-11.1.0`` nonexistent paths within directories marked as shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` would not be properly detected as being on a shared filesystem. * qemu: Properly emulate USB cdrom device CD-ROM devices on USB bus are now properly emulated as such which was not the case since libvirt switched to the modern qemu commandline sytnax for storage backends. Enjoy. Jirka

1 0

pci-hole64-size on q35 questions
by mitchell.augustin＠canonical.com 30 Jun '25

30 Jun '25

Hi, I'm trying to get a better understanding of how libvirt VMs interact with the default QEMU setting for pci-hole64-size on q35 hosts, to assess why my libvirt VMs behave differently from a similarly configured lxd VM. As I understand, both libvirt and lxd are using qemu q35 VMs under the hood, and both are inheriting their pci-hole64-size from qemu's default setting (correct me if that's wrong), but in my tests, I'm getting different behavior from them. I know lxd is probably out of scope from the libvirt project perspective, so consider this more of a libvirt question w/ some added lxd context. All of this is on a DGX B200 host, which contains large (~180GB VRAM) GPUs. With libvirt/virt-install, I created a q35 virtual machine with CPU host passthrough and 1 or more GPUs passed-through via --host-device. Without additional modifications, this works as expected, and I can initialize the GPU driver in the VM and run nvidia-smi. With lxd (which creates a q35 virtual machine with CPU host passthrough by default), I attached 1 GPU via "lxc config device add passthroughtest gpu gpu pci=1b:00.0". On that machine, the pci-hole64-size is too small by default, since I see these in my dmesg: [ 1.099110] pci 0000:00:01.5: bridge window [mem size 0x6000000000 64bit pref]: can't assign; no space [ 1.120274] pci 0000:00:01.5: bridge window [mem size 0x6000000000 64bit pref]: can't assign; no space [ 1.183281] pci 0000:06:00.0: BAR 2 [mem size 0x4000000000 64bit pref]: can't assign; no space [ 1.186320] pci 0000:06:00.0: BAR 0 [mem size 0x04000000 64bit pref]: can't assign; no space [ 1.189340] pci 0000:06:00.0: BAR 4 [mem size 0x02000000 64bit pref]: can't assign; no space and I cannot initialize the GPU driver since the BARs weren't mapped correctly. When I apply a larger hole size to my lxd VM via `lxc config set passthroughtest raw.qemu=' -global q35-pcihost.pci-hole64-size=8192G'`, I don't see any "can't assign; no space" messages, and the driver works as expected. My question about libvirt is - where (if at all) does libvirt interact with qemu's pci-hole64-size value? If libvirt does not automatically do something functionally similar to changing the hole size like I need to do above for lxd, and is in fact just using a qemu default value, is there some other related interaction happening in libvirt that might explain why my libvirt VMs don't require a manual change to pci-hole64-size, despite the fact that the relevant parts of the underlying qemu machine should be the same?

2 1

[libvirt PATCH] NEWS: document new AMD IOMMU device
by Ján Tomko 30 Jun '25

30 Jun '25

From: Ján Tomko <jtomko(a)redhat.com> Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Applies on top of Peter's NEWS patch NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 3ffdceda81..fd2d68a600 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -45,6 +45,12 @@ v11.5.0 (unreleased) with CA certificate(s) that will be used for remote peer certificate validation. + * qemu: add support for AMD IOMMU device + + The ``amd`` model for the ``<iommu>`` device is now supported. + New attributes ``passtrhough`` and ``xtsup`` are also supported for this + model. + * **Improvements** * Include supported console types in domain capabilities -- 2.49.0

2 1

Re: [PATCH v2 09/10] net: Add passt network backend
by Markus Armbruster 30 Jun '25

30 Jun '25

Laurent Vivier <lvivier(a)redhat.com> writes: > On 24/06/2025 10:16, Markus Armbruster wrote: >> Laurent Vivier <lvivier(a)redhat.com> writes: >> >>> This commit introduces support for passt as a new network backend. >>> passt is an unprivileged, user-mode networking solution that provides >>> connectivity for virtual machines by launching an external helper process. >>> >>> The implementation reuses the generic stream data handling logic. It >>> launches the passt binary using GSubprocess, passing it a file >>> descriptor from a socketpair() for communication. QEMU connects to >>> the other end of the socket pair to establish the network data stream. >>> >>> The PID of the passt daemon is tracked via a temporary file to >>> ensure it is terminated when QEMU exits. >>> >>> Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> >> >> [...] >> >>> diff --git a/qapi/net.json b/qapi/net.json >>> index 97ea1839813b..76d7654414f7 100644 >>> --- a/qapi/net.json >>> +++ b/qapi/net.json >>> @@ -112,6 +112,125 @@ >>> 'data': { >>> 'str': 'str' } } >>> >>> +## >>> +# @NetDevPasstOptions: >>> +# >>> +# Unprivileged user-mode network connectivity using passt >>> +# >>> +# @path: path to passt binary >> >> I'd prefer a more descriptive name. >> >> Elsewhere in this file, we refer to programs like this: >> >> # @script: script to initialize the interface >> # >> # @downscript: script to shut down the interface >> >> passt isn't a script, of course. >> >> I don't know, perhaps >> >> # @passt-filename: the passt program to run. >> >> or even >> >> # @passt: Filename of the passt program to run. >> >>> +# >>> +# @quiet: don't print informational messages >> >> What does the printing? A peek at the code I snipped suggests this flag >> is passed to the passt binary as --quiet. Correct? >> >>> +# >>> +# @debug: be verbose >>> +# >>> +# @trace: extra verbose >> >> Likewise for these two. >> >>> +# >>> +# @vhost-user: enable vhost-user [...] >>> +# @udp-ports: UDP ports to forward >> >> Is there anything in this struct that configures qemu-system-FOO itself, >> i.e. isn't just passed to passt? >> > > Yes, all parameters are just passed to passt. > > Do you think it's better not to add all these parameters to netdev backend but only one > generic containing the passt command line parameters? I'm not sure. Thoughts from libvirt's perspective?

4 4

[PATCH v3] remote/stream-event: Fix a memory leak in remoteStreamCallbackFree()
by liu.xuemei1＠zte.com.cn 30 Jun '25

30 Jun '25

From: Liu Song <liu.song13(a)zte.com.cn> The ff callback is never called in remoteStreamCallbackFree() because cbdata->cb can not be NULL. This causes a leak of 'cbdata->opaque'. The leak can be reproduced by attaching and detaching to the console of an VM using `virsh console`. ASAN reports the leak stack as: Direct leak of 288 byte(s) in 1 object(s) allocated from: #0 0x7f6edf6ba0c7 in calloc (/lib64/libasan.so.8+0xba0c7) #1 0x7f6edf5175b0 in g_malloc0 (/lib64/libglib-2.0.so.0+0x615b0) #2 0x7f6ede6d0be3 in g_type_create_instance (/lib64/libgobject-2.0.so.0+0x3cbe3) #3 0x7f6ede6b82cf in g_object_new_internal (/lib64/libgobject-2.0.so.0+0x242cf) #4 0x7f6ede6b9877 in g_object_new_with_properties (/lib64/libgobject-2.0.so.0+0x25877) #5 0x7f6ede6ba620 in g_object_new (/lib64/libgobject-2.0.so.0+0x26620) #6 0x7f6edeb78138 in virObjectNew ../src/util/virobject.c:252 #7 0x7f6edeb7a78b in virObjectLockableNew ../src/util/virobject.c:274 #8 0x558251e427e1 in virConsoleNew ../tools/virsh-console.c:369 #9 0x558251e427e1 in virshRunConsole ../tools/virsh-console.c:427 Signed-off-by: Liu Song <liu.song13(a)zte.com.cn> --- Changes in v3: - Remove the second reference to 'client', and unref 'client' in error path. src/remote/remote_daemon_stream.c | 7 ++++--- src/remote/remote_driver.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/remote/remote_daemon_stream.c b/src/remote/remote_daemon_stream.c index 453728a66b..b6099e3bc7 100644 --- a/src/remote/remote_daemon_stream.c +++ b/src/remote/remote_daemon_stream.c @@ -437,12 +437,13 @@ int daemonAddClientStream(virNetServerClient *client, return -1; } + virObjectRef(client); if (virStreamEventAddCallback(stream->st, 0, daemonStreamEvent, client, - virObjectUnref) < 0) + virObjectUnref) < 0) { + virObjectUnref(client); return -1; - - virObjectRef(client); + } if ((stream->filterID = virNetServerClientAddFilter(client, daemonStreamFilter, diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 2690c05267..9ac13469e9 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -5336,7 +5336,7 @@ static void remoteStreamCallbackFree(void *opaque) { struct remoteStreamCallbackData *cbdata = opaque; - if (!cbdata->cb && cbdata->ff) + if (cbdata->ff) (cbdata->ff)(cbdata->opaque); virObjectUnref(cbdata->st); -- 2.27.0

1 0

[PATCH] NEWS: Mention 'virsh await' and proper emulation of USB cdroms
by Peter Krempa 30 Jun '25

30 Jun '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 089224cbe3..3ffdceda81 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -58,6 +58,12 @@ v11.5.0 (unreleased) </enum> </console> + * virsh: Add waiting for domain state via ``virsh await`` + + The new helper command ``virsh await`` simplifies waiting on domain state + which is normally announced via events. Currently two waiting conditions are + implemented: ``domain-inactive``, and ``guest-agent-available``. + * **Bug fixes** * qemu: Be more forgiving when acquiring QUERY job when formatting domain XML @@ -72,6 +78,12 @@ v11.5.0 (unreleased) shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` would not be properly detected as being on a shared filesystem. + * qemu: Properly emulate USB cdrom device + + CD-ROM devices on USB bus are now properly emulated as such which was not + the case since libvirt switched to the modern qemu commandline sytnax for + storage backends. + v11.4.0 (2025-06-02) ==================== -- 2.49.0

2 1

[PATCH] NEWS: Mention shared filesystem detection fix
by Jiri Denemark 30 Jun '25

30 Jun '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index ee4e9a022e..089224cbe3 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -66,6 +66,12 @@ v11.5.0 (unreleased) domain XML acquires QUERY job. But this caused a regression when the API might timeout for incoming migration. This is now fixed. + * qemu: Fix shared filesystem detection on nonexistent paths + + Since ``libvirt-11.1.0`` nonexistent paths within directories marked as + shared filesystem (via the ``shared_filesystems`` option in ``qemu.conf`` + would not be properly detected as being on a shared filesystem. + v11.4.0 (2025-06-02) ==================== -- 2.49.0

2 1