- Devel - libvirt List Archives

[PATCH v2 00/38] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 09 Feb '26

09 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Note that, while I consider the entire series to be ready for review, there are two patches that are marked as DONOTMERGE: that's because they respectively implement support for a JSON firmware descriptor syntax extension that has not yet been approved, and import into the tree firmware descriptor that are not yet part of the Fedora edk2 package. The latter depends on the former, of course, for which patches have been posted[1] to the QEMU mailing list. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [1] https://mail.gnu.org/archive/html/qemu-devel/2026-02/msg02498.html [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (38): qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers qemu_firmware: Improve matching when loader.type is absent tests: Rename custom JSON firmware descriptors tests: Update JSON firmware descriptor for BIOS schema: Add varstore element conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check DONOTMERGE: qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs schema: Add varstore element for domcaps conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file include: Mention varstore where applicable virsh: Update for varstore handling docs: Update for varstore and improve news: Document support for uefi-vars device and firmwares NEWS.rst | 16 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 81 +++++--- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 44 +++-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 64 +++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 31 ++- src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 27 ++- src/qemu/qemu_firmware.c | 182 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++-- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 +++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 1 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 1 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 1 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 15 +- .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 28 +++ ...json => 71-edk2-ovmf-qemuvars-x64-sb.json} | 16 +- .../firmware/71-edk2-qemuvars-aarch64-sb.json | 27 +++ ...combined.json => 90-libvirt-combined.json} | 0 .../{91-bios.json => 91-libvirt-bios.json} | 2 +- ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 71 ++++--- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...auto-bios-not-stateless.x86_64-latest.xml} | 6 +- ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...enrolled-keys-aarch64.aarch64-latest.args} | 12 +- ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 +++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...-auto-efi-varstore-q35.x86_64-latest.args} | 5 +- ...e-auto-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...ual-bios-not-stateless.x86_64-latest.args} | 8 +- ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...nual-bios-not-stateless.x86_64-latest.xml} | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-manual-bios.x86_64-latest.xml | 6 +- ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...anual-efi-varstore-q35.x86_64-latest.args} | 5 +- ...manual-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 55 ++++-- tools/virsh-snapshot.c | 9 +- 179 files changed, 1296 insertions(+), 380 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 70-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 71-edk2-ovmf-qemuvars-x64-sb.json} (51%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/71-edk2-qemuvars-aarch64-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (90%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-auto-bios-not-stateless.x86_64-latest.xml} (84%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-varstore-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.args => firmware-auto-efi-varstore-q35.x86_64-latest.args} (83%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-varstore-q35.x86_64-latest.xml} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-bios-not-stateless.x86_64-latest.args} (84%) delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err copy tests/qemuxmlconfdata/{firmware-manual-bios.x86_64-latest.xml => firmware-manual-bios-not-stateless.x86_64-latest.xml} (90%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-aarch64.aarch64-latest.args} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-q35.x86_64-latest.args} (85%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-varstore-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

1 38

[PATCH] virsh: Switch cmdDomIfAddr() to vshTable
by Michal Privoznik 09 Feb '26

09 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> The aim of cmdDomIfAddr() is to obtain IP addresses for given domain and then print (ifName, MAC, type, IP Address) tuple. Preferably in an aligned table. This is hard to do with printf style of spacing ("%-NNs") since the interface name (ifName) can vary a lot in length. Fortunately, we have vshTable which is designed to handle this case. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-domain-monitor.c | 53 ++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index f4274f2721..c0db30cb11 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -2279,6 +2279,7 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) bool full = vshCommandOptBool(cmd, "full"); const char *sourcestr = NULL; int source = VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE; + g_autoptr(vshTable) table = NULL; if (vshCommandOptString(ctl, cmd, "interface", &ifacestr) < 0) return false; @@ -2299,28 +2300,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) goto cleanup; } - vshPrintExtra(ctl, " %-10s %-20s %-8s %s\n%s%s\n", _("Name"), - _("MAC address"), _("Protocol"), _("Address"), - _("-------------------------------------------------"), - _("------------------------------")); + table = vshTableNew(_("Name"), _("MAC address"), _("Protocol"), _("Address"), NULL); + if (!table) + return false; for (i = 0; i < ifaces_count; i++) { virDomainInterfacePtr iface = ifaces[i]; const char *type = NULL; + const char *hwaddr = "N/A"; if (ifacestr && STRNEQ(ifacestr, iface->name)) continue; + if (iface->hwaddr) + hwaddr = iface->hwaddr; + /* When the interface has no IP address */ if (!iface->naddrs) { - vshPrint(ctl, " %-10s %-17s %-12s %s\n", - iface->name, - iface->hwaddr ? iface->hwaddr : "N/A", "N/A", "N/A"); + if (vshTableRowAppend(table, + iface->name, hwaddr, "N/A", "N/A", NULL) < 0) + goto cleanup; continue; } for (j = 0; j < iface->naddrs; j++) { - g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_autofree char *ip_addr_str = NULL; switch (iface->addrs[j].type) { @@ -2332,26 +2335,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) break; } - virBufferAsprintf(&buf, "%-12s %s/%d", - type, iface->addrs[j].addr, - iface->addrs[j].prefix); - - ip_addr_str = virBufferContentAndReset(&buf); - - if (!ip_addr_str) - ip_addr_str = g_strdup(""); + ip_addr_str = g_strdup_printf("%s/%d", + iface->addrs[j].addr, + iface->addrs[j].prefix); /* Don't repeat interface name */ - if (full || !j) - vshPrint(ctl, " %-10s %-17s %s\n", - iface->name, - NULLSTR_EMPTY(iface->hwaddr), ip_addr_str); - else - vshPrint(ctl, " %-10s %-17s %s\n", - "-", "-", ip_addr_str); + if (full || !j) { + if (vshTableRowAppend(table, + iface->name, + NULLSTR_EMPTY(iface->hwaddr), + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } else { + if (vshTableRowAppend(table, + "-", "-", + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } } } + vshTablePrintToStdout(table, ctl); + ret = true; cleanup: -- 2.52.0

2 1

[PATCH] qapi/net: deprecate TAP fd and vhostfd options
by Vladimir Sementsov-Ogievskiy 09 Feb '26

09 Feb '26

They are the same as fds and vhostfds, except they accept only one fd. Let's deprecate redundant options. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- Hi all! after "[PATCH v2 00/12] net: refactoring and fixes" options fd and vhostfd becomes redundant, fds and vhostfds may be used instead. this patch also based on "[PATCH v6] qapi: net: deprecate vhostforce option", that's why it's sent separately. Based-on: <20260129213215.1405459-1-vsementsov(a)yandex-team.ru> Based-on: <20251113071711.349651-1-vsementsov(a)yandex-team.ru> docs/about/deprecated.rst | 6 ++++++ qapi/net.json | 9 +++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index e8ff478583..9010f8ab07 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -451,6 +451,12 @@ TAP ``vhostforce`` (since 11.0) The ``vhostforce`` option is redundant with the ``vhost`` option. If they conflict, ``vhost`` takes precedence. Just use ``vhost``. +TAP ``fd`` and ``vhostfd`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Use ``fds`` and ``vhostfds`` correspondingly, each set with one fd +instead of ``fd`` and ``vhsotfd``. + Vhost-user ``vhostforce`` (since 11.0) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/qapi/net.json b/qapi/net.json index 9a00d578e9..2d5aed3ef8 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -326,8 +326,7 @@ # # @fd: file descriptor of an already opened tap # -# @fds: multiple file descriptors of already opened multiqueue capable -# tap +# @fds: multiple file descriptors of already opened tap # # @script: script to initialize the interface # @@ -359,13 +358,15 @@ # Features: # # @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# Member @fd is deprecated. Use @fds instead. +# Member @vhostfd is deprecated. Use @vhostfds instead. # # Since: 1.2 ## { 'struct': 'NetdevTapOptions', 'data': { '*ifname': 'str', - '*fd': 'str', + '*fd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*fds': 'str', '*script': 'str', '*downscript': 'str', @@ -374,7 +375,7 @@ '*sndbuf': 'size', '*vnet_hdr': 'bool', '*vhost': 'bool', - '*vhostfd': 'str', + '*vhostfd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*vhostfds': 'str', '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', -- 2.52.0

3 6

[PATCH v6 00/27] hw/i386/pc: Remove deprecated 2.6 and 2.7 PC machines
by Zhao Liu 07 Feb '26

07 Feb '26

Hi, This v6 is based on the master branch at the commit 0fc482b73d8e ("Merge tag 'pull-aspeed-20260105' of https://github.com/legoater/qemu into staging"). Since there's the discussion around fw_cfg_init_io_nodma() [*], v6 doesn't include that cleanups. Therefore, comparing v5, v6 has *very* minimal changes and most of patches have been reviewed (except patch 15 - I think it needs an additianl review :-) ). Thanks for your patience and review! Introduction ============ A brief introduction from Philippe's v4: The versioned 'pc' and 'q35' machines up to 2.12 been marked as deprecated three releases ago, and are older than 6 years, so according to our support policy we can remove them. This series only includes the 2.6 and 2.7 machines removal, as it is a big enough number of LoC removed. Rest will follow. Change Log ========== (Main) changes since v5: * Merge pc & q35 changes for testing DSDT tables into one patch and simplify the commit message. * Reorganize S-o-b and collect review tags from Igor. (Main) changes since v4: * Completely remove the legacy CPU hotplug approach. - New patch 2-8. - Test CPU hot-plug & hot-unplug via qmp. * Keep "dma_enabled" property in fw_cfg_io_properties[] since Sun4u & Sun4v are still using it. - About more details, please see commit message of patch 15. * Temporarily keep these properties: "cpuid-0xb" (of X86CPU), "fill-mtrr-mask" (of X86CPU), "version" (of IOAPICCommonState). - These properties will be deprecated first before removal, in another series. * Keep "l3-cache" (of X86CPU) and "page-per-vq" (of VirtIOPCIProxy), since they are still in use (e.g., libvirt). Reference ========= [*]: https://lore.kernel.org/qemu-devel/20251203060942.57851-1-philmd@linaro.org/ Best Regards, Zhao --- Igor Mammedov (1): tests/acpi: Allow DSDT table change for x86 machines Philippe Mathieu-Daudé (22): hw/i386/pc: Remove deprecated pc-q35-2.6 and pc-i440fx-2.6 machines hw/i386/pc: Remove PCMachineClass::legacy_cpu_hotplug field hw/nvram/fw_cfg: Rename fw_cfg_init_mem() with '_nodma' suffix hw/mips/loongson3_virt: Prefer using fw_cfg_init_mem_nodma() hw/nvram/fw_cfg: Factor fw_cfg_init_mem_internal() out hw/nvram/fw_cfg: Rename fw_cfg_init_mem_wide() -> fw_cfg_init_mem_dma() hw/i386/x86: Remove X86MachineClass::fwcfg_dma_enabled field hw/i386/pc: Remove multiboot.bin hw/i386: Assume fw_cfg DMA is always enabled hw/i386: Remove linuxboot.bin hw/i386/pc: Remove pc_compat_2_6[] array hw/intc/apic: Remove APICCommonState::legacy_instance_id field hw/core/machine: Remove hw_compat_2_6[] array hw/virtio/virtio-mmio: Remove VirtIOMMIOProxy::format_transport_address field hw/i386/pc: Remove deprecated pc-q35-2.7 and pc-i440fx-2.7 machines hw/i386/pc: Remove pc_compat_2_7[] array target/i386/cpu: Remove CPUX86State::full_cpuid_auto_level field hw/audio/pcspk: Remove PCSpkState::migrate field hw/core/machine: Remove hw_compat_2_7[] array hw/i386/intel_iommu: Remove IntelIOMMUState::buggy_eim field hw/virtio/virtio-pci: Remove VirtIOPCIProxy::ignore_backend_features field hw/char/virtio-serial: Do not expose the 'emergency-write' property Zhao Liu (4): pc: Start with modern CPU hotplug interface by default acpi: Remove legacy cpu hotplug utilities docs/specs/acpi_cpu_hotplug: Remove legacy cpu hotplug descriptions tests/acpi: Update DSDT tables for pc & q35 machines docs/specs/acpi_cpu_hotplug.rst | 28 +- hw/acpi/acpi-cpu-hotplug-stub.c | 19 +- hw/acpi/cpu.c | 10 - hw/acpi/cpu_hotplug.c | 348 ------------------ hw/acpi/generic_event_device.c | 1 + hw/acpi/ich9.c | 61 +-- hw/acpi/meson.build | 2 +- hw/acpi/piix4.c | 61 +-- hw/arm/virt.c | 2 +- hw/audio/pcspk.c | 10 - hw/char/virtio-serial-bus.c | 9 +- hw/core/machine.c | 17 - hw/hppa/machine.c | 2 +- hw/i386/acpi-build.c | 7 +- hw/i386/fw_cfg.c | 16 +- hw/i386/intel_iommu.c | 5 +- hw/i386/microvm.c | 3 - hw/i386/multiboot.c | 7 +- hw/i386/pc.c | 25 +- hw/i386/pc_piix.c | 23 -- hw/i386/pc_q35.c | 24 -- hw/i386/x86-common.c | 8 +- hw/i386/x86.c | 2 - hw/intc/apic_common.c | 5 - hw/loongarch/fw_cfg.c | 4 +- hw/loongarch/virt-acpi-build.c | 1 - hw/mips/loongson3_virt.c | 2 +- hw/nvram/fw_cfg.c | 22 +- hw/riscv/virt.c | 4 +- hw/virtio/virtio-mmio.c | 15 - hw/virtio/virtio-pci.c | 5 +- include/hw/acpi/cpu.h | 1 - include/hw/acpi/ich9.h | 4 +- include/hw/acpi/piix4.h | 4 +- include/hw/core/boards.h | 6 - include/hw/i386/apic_internal.h | 1 - include/hw/i386/intel_iommu.h | 1 - include/hw/i386/pc.h | 9 - include/hw/i386/x86.h | 2 - include/hw/nvram/fw_cfg.h | 9 +- include/hw/virtio/virtio-mmio.h | 1 - include/hw/virtio/virtio-pci.h | 1 - include/hw/virtio/virtio-serial.h | 2 - pc-bios/meson.build | 2 - pc-bios/multiboot.bin | Bin 1024 -> 0 bytes pc-bios/optionrom/Makefile | 2 +- pc-bios/optionrom/linuxboot.S | 195 ---------- pc-bios/optionrom/multiboot.S | 232 ------------ pc-bios/optionrom/multiboot_dma.S | 234 +++++++++++- pc-bios/optionrom/optionrom.h | 4 - target/i386/cpu.c | 119 +++--- target/i386/cpu.h | 3 - tests/data/acpi/x86/pc/DSDT | Bin 8611 -> 8598 bytes tests/data/acpi/x86/pc/DSDT.acpierst | Bin 8522 -> 8509 bytes tests/data/acpi/x86/pc/DSDT.acpihmat | Bin 9936 -> 9923 bytes tests/data/acpi/x86/pc/DSDT.bridge | Bin 15482 -> 15469 bytes tests/data/acpi/x86/pc/DSDT.cphp | Bin 9075 -> 9062 bytes tests/data/acpi/x86/pc/DSDT.dimmpxm | Bin 10265 -> 10252 bytes tests/data/acpi/x86/pc/DSDT.hpbridge | Bin 8562 -> 8549 bytes tests/data/acpi/x86/pc/DSDT.hpbrroot | Bin 5100 -> 5087 bytes tests/data/acpi/x86/pc/DSDT.ipmikcs | Bin 8683 -> 8670 bytes tests/data/acpi/x86/pc/DSDT.memhp | Bin 9970 -> 9957 bytes tests/data/acpi/x86/pc/DSDT.nohpet | Bin 8469 -> 8456 bytes tests/data/acpi/x86/pc/DSDT.numamem | Bin 8617 -> 8604 bytes tests/data/acpi/x86/pc/DSDT.roothp | Bin 12404 -> 12391 bytes tests/data/acpi/x86/q35/DSDT | Bin 8440 -> 8427 bytes tests/data/acpi/x86/q35/DSDT.acpierst | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.acpihmat | Bin 9765 -> 9752 bytes .../data/acpi/x86/q35/DSDT.acpihmat-generic-x | Bin 12650 -> 12637 bytes .../acpi/x86/q35/DSDT.acpihmat-noinitiator | Bin 8719 -> 8706 bytes tests/data/acpi/x86/q35/DSDT.applesmc | Bin 8486 -> 8473 bytes tests/data/acpi/x86/q35/DSDT.bridge | Bin 12053 -> 12040 bytes tests/data/acpi/x86/q35/DSDT.core-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.core-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.cphp | Bin 8904 -> 8891 bytes tests/data/acpi/x86/q35/DSDT.cxl | Bin 13231 -> 13218 bytes tests/data/acpi/x86/q35/DSDT.dimmpxm | Bin 10094 -> 10081 bytes tests/data/acpi/x86/q35/DSDT.ipmibt | Bin 8515 -> 8502 bytes tests/data/acpi/x86/q35/DSDT.ipmismbus | Bin 8528 -> 8515 bytes tests/data/acpi/x86/q35/DSDT.ivrs | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.memhp | Bin 9799 -> 9786 bytes tests/data/acpi/x86/q35/DSDT.mmio64 | Bin 9570 -> 9557 bytes tests/data/acpi/x86/q35/DSDT.multi-bridge | Bin 13293 -> 13280 bytes tests/data/acpi/x86/q35/DSDT.noacpihp | Bin 8302 -> 8289 bytes tests/data/acpi/x86/q35/DSDT.nohpet | Bin 8298 -> 8285 bytes tests/data/acpi/x86/q35/DSDT.numamem | Bin 8446 -> 8433 bytes tests/data/acpi/x86/q35/DSDT.pvpanic-isa | Bin 8541 -> 8528 bytes tests/data/acpi/x86/q35/DSDT.thread-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.thread-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm12 | Bin 9046 -> 9033 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm2 | Bin 9072 -> 9059 bytes tests/data/acpi/x86/q35/DSDT.type4-count | Bin 18674 -> 18661 bytes tests/data/acpi/x86/q35/DSDT.viot | Bin 14697 -> 14684 bytes tests/data/acpi/x86/q35/DSDT.xapic | Bin 35803 -> 35790 bytes tests/qtest/test-x86-cpuid-compat.c | 11 - 95 files changed, 363 insertions(+), 1228 deletions(-) delete mode 100644 hw/acpi/cpu_hotplug.c delete mode 100644 pc-bios/multiboot.bin delete mode 100644 pc-bios/optionrom/linuxboot.S delete mode 100644 pc-bios/optionrom/multiboot.S -- 2.34.1

3 30

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant B
by Peter Krempa 06 Feb '26

06 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. Thus this version is the more cautious approach of adding a capability and only switching the generator once deprecations are set up. While adding the capability I've also uncovered a bug in the QMP query strings where it was not possible to query features of an object member. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (5): virQEMUQAPISchemaTraverseObject: Consider features also on current members qemu: capabilities: Introduce QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL qemuxmlconftest: Add version-locked test cases for the use of -netdev tap with fd/vhostfd qemuBuildHostNetProps: Use 'fds', 'vhostfds' with QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_capabilities.c | 8 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_qapi.c | 26 + .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 11 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-10.2.0.args | 36 + .../qemuxmlconfdata/net-eth.x86_64-10.2.0.xml | 44 + .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-10.2.0.args | 42 + .../net-virtio-vhost.x86_64-10.2.0.xml | 65 + .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 4 + 32 files changed, 2048 insertions(+), 1828 deletions(-) create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.xml create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.xml -- 2.53.0

1 5

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant A
by Peter Krempa 06 Feb '26

06 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. This is the optimistic approach should it be possible for us to unconditionally use the plural variands. Reordering the patches shows that the proposal causes test suite failures in our code. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (2): qemuBuildHostNetProps: Use only plural form of 'fds' and 'vhostfds' properties [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_command.c | 24 +- .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 10 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- 22 files changed, 1815 insertions(+), 1842 deletions(-) -- 2.53.0

1 2

[PATCH v2 0/2] target/arm: Deprecate '-cpu any'
by Philippe Mathieu-Daudé 06 Feb '26

06 Feb '26

Arm '-cpu any' is aliased to '-cpu max' since more than 5 years. Deprecate the former in preparation of removal. v2: s/any/max/ in target/arm/cpu.c comment Philippe Mathieu-Daudé (2): target/arm: Remove dead code target/arm: Deprecate '-cpu any' (remplaced by '-cpu max') docs/about/deprecated.rst | 8 ++++++++ target/arm/cpu.h | 2 +- target/arm/cpu.c | 1 + target/arm/tcg/cpu32.c | 3 --- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.52.0

3 7

[PATCH] hyperv: Avoid memleak in hypervDomainDefParsePhysicalDisk
by Michal Privoznik 06 Feb '26

06 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> When parsing a physical disk, the @hostResouce is escaped once with the retval being stored into @hostEscaped. Then, it's escaped again, but the retval is stored into the very same variable, leading to a leak where intermediate value is lost. 256 bytes in 1 blocks are definitely lost in loss record 469 of 483 at 0x49543A0: realloc (vg_replace_malloc.c:1804) by 0x516C251: g_realloc (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BB7E: g_string_expand (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BFF9: g_string_insert_len (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x4A58B5F: g_string_append_len_inline (gstring.h:247) by 0x4A58B5F: virBufferAdd (virbuffer.c:164) by 0x4AFDA71: virStringReplace (virstring.c:708) by 0x4DA4381: hypervDomainDefParsePhysicalDisk (hyperv_driver.c:1375) by 0x4DA4A18: hypervDomainDefParseStorage (hyperv_driver.c:1487) by 0x4DA9E31: hypervDomainGetXMLDesc (hyperv_driver.c:2761) by 0x4DFB3E5: virDomainGetXMLDesc (libvirt-domain.c:2898) by 0x406D39B: cmdDumpXML (virsh-domain.c:10787) by 0x40B13B1: vshCommandRun (vsh.c:1383) Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hyperv/hyperv_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index 8dd56f39dc..203bbeb8a5 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -1351,6 +1351,7 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, virDomainDiskDef *disk = NULL; char **hostResource = entry->data->HostResource.data; g_autofree char *hostEscaped = NULL; + g_autofree char *hostEscapedTwice = NULL; g_autofree char *driveNumberStr = NULL; g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; int addr = -1, ctrlr_idx = -1; @@ -1373,12 +1374,12 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, /* Query Msvm_DiskDrive for the DriveNumber */ hostEscaped = virStringReplace(*hostResource, "\\\"", "\""); - hostEscaped = virStringReplace(hostEscaped, "\\", "\\\\"); + hostEscapedTwice = virStringReplace(hostEscaped, "\\", "\\\\"); /* quotes must be preserved, so virBufferEscapeSQL can't be used */ virBufferAsprintf(&query, MSVM_DISKDRIVE_WQL_SELECT "WHERE __PATH='%s'", - hostEscaped); + hostEscapedTwice); if (hypervGetWmiClass(Msvm_DiskDrive, &diskdrive) < 0) goto cleanup; -- 2.52.0

2 1

[PATCH] virt-aa-helper: Fix unchecked return values
by Dmitry Lopatin 06 Feb '26

06 Feb '26

Add missing return value checks to fix the following issues reported by the static analyzer: - vah_add_file() call when adding render node path to the AppArmor profile (line 1029) was not checked, while there are examples with return code check throughout the code. - vah_add_file() call when adding default render node path (line 1037) had the same issue. - virDriverLoadModule() call when loading the storage driver (line 908) was not checked, while there are examples with return code check throughout the code. Signed-off-by: Dmitry Lopatin <dmitry.lopatin(a)flant.com> --- src/security/virt-aa-helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 067a17f331..07e5882237 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -905,7 +905,8 @@ get_files(vahControl * ctl) /* load the storage driver so that backing store can be accessed */ #ifdef WITH_STORAGE - virDriverLoadModule("storage", "storageRegister", false); + if (virDriverLoadModule("storage", "storageRegister", false) < 0) + goto cleanup; #endif for (i = 0; i < ctl->def->ndisks; i++) { @@ -1026,7 +1027,8 @@ get_files(vahControl * ctl) const char *rendernode = virDomainGraphicsGetRenderNode(graphics); if (rendernode) { - vah_add_file(&buf, rendernode, "rw"); + if (vah_add_file(&buf, rendernode, "rw") != 0) + goto cleanup; needsgl = true; } else { if (virDomainGraphicsNeedsAutoRenderNode(graphics)) { @@ -1034,7 +1036,8 @@ get_files(vahControl * ctl) needsgl = true; if (defaultRenderNode) { - vah_add_file(&buf, defaultRenderNode, "rw"); + if (vah_add_file(&buf, defaultRenderNode, "rw") != 0) + goto cleanup; VIR_FREE(defaultRenderNode); } } -- 2.34.1

5 9

[PATCH] src/esx/esx_vi.c: Debug path element comparisons
by Richard W.M. Jones 06 Feb '26

06 Feb '26

Libvirt vpx:// and esx:// URIs are quite obscure. In particular it is very difficult to construct a correct path to a VMware resource. Basically you are iterating over VMware structures blindly with no way to know what your choices are at each level in the path. This commit doesn't directly address this. It's still difficult. But at least let's add the true path choices to the debug output so someone could in theory use 'LIBVIRT_DEBUG=1' to find out what possible choices exist at a path level. For example this command fails because the label (which looks like an IPv6 address, but is really a label) should use "::" instead of ":0:": LIBVIRT_DEBUG=1 virsh -c 'vpx://root@.../data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/?no_verify=1' In the debugging output we now print: 2026-02-05 10:58:25.421+0000: 1528876: debug : esxVI_LookupManagedObjectHelper:4956 : comparing path element 'aaaa:52:0:49e0:2eea:7fff:fee6:eca0' with candidate name 'aaaa:52::49e0:2eea:7fff:fee6:eca0' 2026-02-05 10:58:25.421+0000: 1528876: error : esxVI_Context_LookupManagedObjectsByPath:1098 : internal error: Could not find compute resource specified in '/data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/' In an ideal world we should improve the error message to show the possible choices, but the way the code is structured makes that prohibitive. Related: https://issues.redhat.com/browse/RHEL-145080 --- src/esx/esx_vi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 8d2ffb3f8f..cfd783622d 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -4953,6 +4953,8 @@ esxVI_LookupManagedObjectHelper(esxVI_Context *ctx, goto cleanup; } + VIR_DEBUG("comparing path element '%s' with candidate name '%s'", + name, name_candidate); if (STREQ(name_candidate, name)) { /* Found item with matching name */ break; -- 2.52.0

2 2

[PATCH v5 02/23] vhost: drop backend_features field
by Vladimir Sementsov-Ogievskiy 06 Feb '26

06 Feb '26

This field is mostly unused and sometimes confusing. We even have a TODO-like comment to drop it, the comment is removed in this commit. The field is used to held VHOST_USER_F_PROTOCOL_FEATURES for vhost-user and/or VHOST_NET_F_VIRTIO_NET_HDR for vhost-net (which may be vhost-user-net). But we can simply recalculate these two flags in place from hdev->features, and from net-client for VHOST_NET_F_VIRTIO_NET_HDR. Note: removing field from x-query-virtio-status result is incompatible change. We can do it because the command is unstable. Cc: devel(a)lists.libvirt.org Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Acked-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Daniil Tatianin <d-tatianin(a)yandex-team.ru> Acked-by: Raphael Norwitz <raphael.s.norwitz(a)gmail.com> --- hw/block/vhost-user-blk.c | 1 - hw/net/vhost_net.c | 26 ++++++++++++++------------ hw/scsi/vhost-scsi.c | 1 - hw/scsi/vhost-user-scsi.c | 1 - hw/virtio/vdpa-dev.c | 1 - hw/virtio/vhost-user.c | 17 ++++++++--------- hw/virtio/virtio-hmp-cmds.c | 2 -- hw/virtio/virtio-qmp.c | 4 ---- include/hw/virtio/vhost.h | 7 ------- qapi/virtio.json | 3 --- 10 files changed, 22 insertions(+), 41 deletions(-) diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index c151e83677..dc99de0263 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -348,7 +348,6 @@ static int vhost_user_blk_connect(DeviceState *dev, Error **errp) s->dev.nvqs = s->num_queues; s->dev.vqs = s->vhost_vqs; s->dev.vq_index = 0; - s->dev.backend_features = 0; vhost_dev_set_config_notifier(&s->dev, &blk_ops); diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 25e9f1fd24..fda90e231e 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -52,8 +52,14 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data, void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features) { - virtio_features_copy(net->dev.acked_features_ex, - net->dev.backend_features_ex); + virtio_features_clear(net->dev.acked_features_ex); + if (net->backend == -1) { + net->dev.acked_features = + net->dev.features & (1ULL << VHOST_USER_F_PROTOCOL_FEATURES); + } else if (!qemu_has_vnet_hdr(net->nc)) { + net->dev.acked_features = 1ULL << VHOST_NET_F_VIRTIO_NET_HDR; + } + vhost_ack_features_ex(&net->dev, net->feature_bits, features); } @@ -258,12 +264,9 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) if (r < 0) { goto fail; } - net->dev.backend_features = qemu_has_vnet_hdr(options->net_backend) - ? 0 : (1ULL << VHOST_NET_F_VIRTIO_NET_HDR); net->backend = r; net->dev.protocol_features = 0; } else { - virtio_features_clear(net->dev.backend_features_ex); net->dev.protocol_features = 0; net->backend = -1; @@ -284,13 +287,12 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) net->dev.features &= ~(1ULL << VIRTIO_NET_F_MRG_RXBUF); } - if (virtio_features_andnot(missing_features, - net->dev.backend_features_ex, - net->dev.features_ex)) { - fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT - " for backend\n", VIRTIO_FEATURES_PR(missing_features)); - goto fail; - } + if (!qemu_has_vnet_hdr(options->net_backend) && + (~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR))) { + fprintf(stderr, "vhost lacks feature mask 0x%llx for backend\n", + ~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR)); + goto fail; + } } /* Set sane init value. Override when guest acks. */ diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c index 699863cc10..859888fdba 100644 --- a/hw/scsi/vhost-scsi.c +++ b/hw/scsi/vhost-scsi.c @@ -275,7 +275,6 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp) vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vqs = vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, (void *)(uintptr_t)vhostfd, VHOST_BACKEND_TYPE_KERNEL, 0, errp); diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c index 3612897d4b..5070178dc2 100644 --- a/hw/scsi/vhost-user-scsi.c +++ b/hw/scsi/vhost-user-scsi.c @@ -159,7 +159,6 @@ static int vhost_user_scsi_connect(DeviceState *dev, Error **errp) vsc->dev.nvqs = VIRTIO_SCSI_VQ_NUM_FIXED + vs->conf.num_queues; vsc->dev.vqs = s->vhost_vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, &s->vhost_user, VHOST_BACKEND_TYPE_USER, 0, errp); diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 4532d63653..06179e402e 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -104,7 +104,6 @@ static void vhost_vdpa_device_realize(DeviceState *dev, Error **errp) v->dev.vqs = vqs; v->dev.vq_index = 0; v->dev.vq_index_end = v->dev.nvqs; - v->dev.backend_features = 0; v->started = false; ret = vhost_vdpa_get_iova_range(v->vhostfd, &iova_range); diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 3ffb6af19f..e21013f2ca 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1470,14 +1470,15 @@ static int vhost_user_set_features(struct vhost_dev *dev, int ret; /* - * We need to include any extra backend only feature bits that - * might be needed by our device. Currently this includes the - * VHOST_USER_F_PROTOCOL_FEATURES bit for enabling protocol - * features. + * Don't lose VHOST_USER_F_PROTOCOL_FEATURES, which is vhost-user + * specific. */ - ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, - features | dev->backend_features, - log_enabled); + if (virtio_has_feature(dev->features, VHOST_USER_F_PROTOCOL_FEATURES)) { + features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; + } + + ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, features, + log_enabled); if (virtio_has_feature(dev->protocol_features, VHOST_USER_PROTOCOL_F_STATUS)) { @@ -2197,8 +2198,6 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque, (dev->config_ops && dev->config_ops->vhost_dev_config_notifier); uint64_t protocol_features; - dev->backend_features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; - err = vhost_user_get_u64(dev, VHOST_USER_GET_PROTOCOL_FEATURES, &protocol_features); if (err < 0) { diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c index 1daae482d3..4bf9a3109d 100644 --- a/hw/virtio/virtio-hmp-cmds.c +++ b/hw/virtio/virtio-hmp-cmds.c @@ -176,8 +176,6 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict) hmp_virtio_dump_features(mon, s->vhost_dev->features); monitor_printf(mon, " Acked features:\n"); hmp_virtio_dump_features(mon, s->vhost_dev->acked_features); - monitor_printf(mon, " Backend features:\n"); - hmp_virtio_dump_features(mon, s->vhost_dev->backend_features); monitor_printf(mon, " Protocol features:\n"); hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); } diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c index 968299fda0..916972e331 100644 --- a/hw/virtio/virtio-qmp.c +++ b/hw/virtio/virtio-qmp.c @@ -780,8 +780,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) vdev->guest_features_ex); status->host_features = qmp_decode_features(vdev->device_id, vdev->host_features_ex); - status->backend_features = qmp_decode_features(vdev->device_id, - vdev->backend_features_ex); switch (vdev->device_endian) { case VIRTIO_DEVICE_ENDIAN_LITTLE: @@ -822,8 +820,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) qmp_decode_features(vdev->device_id, hdev->features_ex); status->vhost_dev->acked_features = qmp_decode_features(vdev->device_id, hdev->acked_features_ex); - status->vhost_dev->backend_features = - qmp_decode_features(vdev->device_id, hdev->backend_features_ex); status->vhost_dev->protocol_features = qmp_decode_protocols(hdev->protocol_features); diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h index 3dfec5e15c..e139e05985 100644 --- a/include/hw/virtio/vhost.h +++ b/include/hw/virtio/vhost.h @@ -100,16 +100,9 @@ struct vhost_dev { * * @features: available features provided by the backend * @acked_features: final negotiated features with front-end driver - * - * @backend_features: this is used in a couple of places to either - * store VHOST_USER_F_PROTOCOL_FEATURES to apply to - * VHOST_USER_SET_FEATURES or VHOST_NET_F_VIRTIO_NET_HDR. Its - * future use should be discouraged and the variable retired as - * its easy to confuse with the VirtIO backend_features. */ VIRTIO_DECLARE_FEATURES(features); VIRTIO_DECLARE_FEATURES(acked_features); - VIRTIO_DECLARE_FEATURES(backend_features); /** * @protocol_features: is the vhost-user only feature set by diff --git a/qapi/virtio.json b/qapi/virtio.json index cd67c4f52e..53ddc6b6a4 100644 --- a/qapi/virtio.json +++ b/qapi/virtio.json @@ -85,8 +85,6 @@ # # @acked-features: vhost_dev acked_features # -# @backend-features: vhost_dev backend_features -# # @protocol-features: vhost_dev protocol_features # # @max-queues: vhost_dev max_queues @@ -106,7 +104,6 @@ 'vq-index': 'int', 'features': 'VirtioDeviceFeatures', 'acked-features': 'VirtioDeviceFeatures', - 'backend-features': 'VirtioDeviceFeatures', 'protocol-features': 'VhostDeviceProtocols', 'max-queues': 'uint64', 'backend-cap': 'uint64', -- 2.52.0

1 0

[PATCH v2 0/7] virtio-iommu: Support setting aw-bits and granule
by Michal Privoznik 06 Feb '26

06 Feb '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3HN6… diff to v1: - setting of granule is done in a subelement of driver now Michal Prívozník (7): conf: Teach virDomainParseMemory() new retval qemu_capabilities: Introduce QEMU_CAPS_VIRTIO_IOMMU_AW_BITS conf: Allow aw_bits for virtio-iommu qemu_command: Generate aw_bits prop for virtio-iommu conf: Introduce granule attribute for virtio-iommu qemu_validate: Check whether granule of virtio-iommu is supported qemu_command: Generate granule prop for virtio-iommu docs/formatdomain.rst | 40 +++++++- src/conf/domain_conf.c | 95 +++++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 21 +++- src/conf/schemas/domaincommon.rng | 22 +++++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +++ src/qemu/qemu_validate.c | 30 +++++- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_ppc64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_riscv64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_aarch64+hvf.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + .../virtio-iommu-aarch64.aarch64-latest.args | 2 +- .../virtio-iommu-aarch64.aarch64-latest.xml | 3 + .../qemuxmlconfdata/virtio-iommu-aarch64.xml | 6 +- ...io-iommu-dma-translation.x86_64-latest.err | 2 +- .../virtio-iommu-x86_64.x86_64-latest.args | 2 +- .../virtio-iommu-x86_64.x86_64-latest.xml | 3 + tests/qemuxmlconfdata/virtio-iommu-x86_64.xml | 6 +- 37 files changed, 247 insertions(+), 21 deletions(-) -- 2.52.0

2 11

[PATCH 0/3] apparmor: Separate seclabel generation and profile loading
by Michal Privoznik 04 Feb '26

04 Feb '26

See 3/3 for explanation. Michal Prívozník (3): security: Introduce virSecurityDomainLoadProfile() qemu: Call virSecurityManagerLoadProfile() at the end of qemuProcessPrepareDomain() security_apparmor: Move profile loading into .domainLoadProfile callback src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 7 +++++++ src/qemu/qemu_security.h | 1 + src/security/security_apparmor.c | 31 +++++++++++++++++++++++-------- src/security/security_driver.h | 4 ++++ src/security/security_manager.c | 13 +++++++++++++ src/security/security_manager.h | 2 ++ src/security/security_stack.c | 15 +++++++++++++++ 8 files changed, 66 insertions(+), 8 deletions(-) -- 2.52.0

2 4

Download of volume: alternating frames of 262120 and 24 bytes
by Erik Huelsmann 03 Feb '26

03 Feb '26

Hi, While analysing traffic generated by "virsh vol-download", I noticed that the download stream exhibits the following pattern (over qemu+ssh://): <Start> Read 4 bytes (= frame length field) Read 262144 bytes (= header + payload ; VIR_NET_MESSAGE_HEADER_MAX (24) + VIR_NET_MESSAGE_LEGACY_PAYLOAD_MAX (262120)) Read 4 bytes (= frame length field) Read 48 bytes (= header + payload) <Go back to Start> While nothing seems to be actually wrong with this pattern, the average payload on large data transfers is only (262120+24)/2 == 131072 and the CPU makes double the iterations necessary. I'll be trying to figure out where this comes from, but I imagine that will be pretty hard to track down. Two questions: 1. Do you see the same thing? 2. Any ideas/hints where I could start looking? Regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 8

[PATCH v2 0/2] bhyve: improve loader handling on arm64
by Roman Bogorodskiy 03 Feb '26

03 Feb '26

Changes since v1: - Make the default loader uboot path configurable in bhyve.conf. It might be useful for users and also way simpler to mock in the test than the hardcoded value in the code. Roman Bogorodskiy (2): bhyve: improve loader handling on arm64 bhyve: conf: do not hardcode datadir in bhyve.conf src/bhyve/{bhyve.conf => bhyve.conf.in} | 7 +++++- src/bhyve/bhyve_conf.c | 8 +++++++ src/bhyve/bhyve_domain.c | 23 +++++++++++++++++++ src/bhyve/bhyve_utils.h | 2 ++ src/bhyve/meson.build | 13 +++++++++-- .../aarch64/bhyvexml2argv-base.args | 1 + .../aarch64/bhyvexml2argv-base.ldargs | 8 +------ .../aarch64/bhyvexml2argv-console.args | 1 + .../aarch64/bhyvexml2argv-console.ldargs | 8 +------ tests/bhyvexml2argvmock.c | 20 +++++++++++++++- tests/bhyvexml2argvtest.c | 2 ++ .../aarch64/bhyvexml2xmlout-base.xml | 1 + .../aarch64/bhyvexml2xmlout-console.xml | 1 + tests/bhyvexml2xmltest.c | 4 ++++ 14 files changed, 81 insertions(+), 18 deletions(-) rename src/bhyve/{bhyve.conf => bhyve.conf.in} (73%) -- 2.52.0

2 6

[PATCH 0/9] bhyve: A couple of memleak fixes
by Michal Privoznik 03 Feb '26

03 Feb '26

*** BLURB HERE *** Michal Prívozník (9): bhyve: Avoid memleak in bhyveParsePassthru() bhyve: Avoid leaking @addrs in bhyveDomainAssignPCIAddresses() bhyve_command: Avoid leaking @buf in virBhyveProcessBuildBhyveCmd() bhyve_command: Avoid memleak in bhyveBuildNetArgStr() bhyvexml2argvmock: Provide virCPUProbeHost() bhyvexml2argvtest: Avoid leaking driver caps bhyvexml2argvtest: Don't leak parts of driver config bhyvexml2argvtest: Avoid leaking firmwareDir bhyvexml2xmltest: Avoid leaking driver caps src/bhyve/bhyve_command.c | 26 ++++++++++++-------------- src/bhyve/bhyve_device.c | 10 +++++++--- src/bhyve/bhyve_parse_command.c | 2 +- tests/bhyvexml2argvmock.c | 8 ++++++++ tests/bhyvexml2argvtest.c | 10 +++++++--- tests/bhyvexml2xmltest.c | 1 + 6 files changed, 36 insertions(+), 21 deletions(-) -- 2.52.0

2 10

[PATCH] rpcgen: Pass XDRPROC_T_3ARGS to test_demo.c
by Michal Privoznik 03 Feb '26

03 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> In previous commit of v12.0.0-85-g2c66b6d72c we've tried to solve a problem where xdrproc_t is a prototype of a function which takes only two arguments instead of three. See original commit for more info. The fix consists of a config time check and setting XDRPROC_T_3ARGS accordingly (in meson-config.h). This works for nearly all of our code, except rpcgen which is intentionally independent of the rest of the code. Therefore, the macro has to be set extra - by specifying it on the compiler cmd line. Fixes: 2c66b6d72cd48d3cf80f957f55cfb1548feb46c4 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- scripts/rpcgen/tests/meson.build | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/rpcgen/tests/meson.build b/scripts/rpcgen/tests/meson.build index 057a61433d..4df7471a99 100644 --- a/scripts/rpcgen/tests/meson.build +++ b/scripts/rpcgen/tests/meson.build @@ -4,13 +4,17 @@ rpcgen_tests = files([ 'test_parser.py', ]) +xdrproc_flags = [] +if conf.has('XDRPROC_T_3ARGS') + xdrproc_flags += [ '-DXDRPROC_T_3ARGS' ] +endif test_demo = executable( 'test_demo', [ 'test_demo.c' ], c_args: [ '-Dabs_srcdir="@0@"'.format(meson.current_source_dir()), - ] + cc_flags_relaxed_frame_limit, + ] + cc_flags_relaxed_frame_limit + xdrproc_flags, dependencies: [ xdr_dep, glib_dep ], -- 2.52.0

3 2

[PATCH] build: add detection of xdrproc_t arguments count
by Roman Bogorodskiy 03 Feb '26

03 Feb '26

According to 9fa3a8ab6fd82ad2f5a14b490696085061418718, macOS insists on passing 3 arguments for xdrproc_t. Passing 3 arguments was a good common ground, but since recently[1] FreeBSD only accepts 2 arguments. Add a meson.build check whether 3 arguments are accepted, and add macros which passes either 2 or 3 arguments to xdrproc_t based on the result of this check. 1: https://cgit.freebsd.org/src/commit/?id=ac5a19ec6989675c8ec6c3ca245dba243d1… Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- meson.build | 19 +++++++++++++++++++ scripts/rpcgen/tests/test_demo.c | 12 +++++++++--- src/rpc/virnetmessage.c | 10 ++++++++-- 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/meson.build b/meson.build index 964d1fa4e1..4a4f89c1cb 100644 --- a/meson.build +++ b/meson.build @@ -893,6 +893,25 @@ else xdr_dep = dependency('', required: false) endif +if xdr_dep.found() + xdrproc_3arg_code = ''' + #include <rpc/xdr.h> + + bool_t test_filter(XDR *xdr, void *data, unsigned int opaque_flags) { + return TRUE; + } + + int main() { + XDR xdr; + xdrproc_t filter = (xdrproc_t)&test_filter; + (*filter)(&xdr, NULL, 0); + return 0; + } + ''' + if cc.compiles(xdrproc_3arg_code, dependencies: xdr_dep) + conf.set('XDRPROC_T_3ARGS', 1) + endif +endif # generic build dependencies diff --git a/scripts/rpcgen/tests/test_demo.c b/scripts/rpcgen/tests/test_demo.c index e6ba7ddbc5..82eda89592 100644 --- a/scripts/rpcgen/tests/test_demo.c +++ b/scripts/rpcgen/tests/test_demo.c @@ -8,6 +8,12 @@ # define xdr_uint64_t xdr_u_int64_t #endif +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC(proc, xdr, data) (proc(&xdr, data, 0)) +#else +# define XDRPROC(proc, xdr, data) (proc(&xdr, data)) +#endif + #include "demo.h" #include "demo.c" @@ -27,7 +33,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 1: serialize the vorig and compare to the data in test .bin files */ xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vorig, 0); + ret = !!XDRPROC(proc, xdr, vorig); g_assert_cmpint(ret, ==, !fail); if (fail) @@ -54,7 +60,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 2: de-serialize the state to create a new object */ xdrmem_create(&xdr, buf, buflen, XDR_DECODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); @@ -68,7 +74,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); diff --git a/src/rpc/virnetmessage.c b/src/rpc/virnetmessage.c index af0f9cb30b..e66df5c9e2 100644 --- a/src/rpc/virnetmessage.c +++ b/src/rpc/virnetmessage.c @@ -34,6 +34,12 @@ VIR_LOG_INIT("rpc.netmessage"); +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data, 0)) +#else +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data)) +#endif + virNetMessage *virNetMessageNew(bool tracked) { virNetMessage *msg; @@ -367,7 +373,7 @@ int virNetMessageEncodePayload(virNetMessage *msg, msg->bufferLength - msg->bufferOffset, XDR_ENCODE); /* Try to encode the payload. If the buffer is too small increase it. */ - while (!(*filter)(&xdr, data, 0)) { + while (!XDRPROC_FILTER(*filter, xdr, data)) { unsigned int newlen = msg->bufferLength - VIR_NET_MESSAGE_LEN_MAX; newlen *= 2; @@ -424,7 +430,7 @@ int virNetMessageDecodePayload(virNetMessage *msg, xdrmem_create(&xdr, msg->buffer + msg->bufferOffset, msg->bufferLength - msg->bufferOffset, XDR_DECODE); - if (!(*filter)(&xdr, data, 0)) { + if (!XDRPROC_FILTER(*filter, xdr, data)) { virReportError(VIR_ERR_RPC, "%s", _("Unable to decode message payload")); goto error; } -- 2.52.0

4 7

[RFC PATCH] Prioritise and validate cgroup2 canonical mount on /sys/fs/cgroup
by Rogério Vinhal Nunes 03 Feb '26

03 Feb '26

Hey folks, we've gotten an issue with how libvirt is currently detecting the cgroup2 mounts. Basically we expose cgroup2 mounts in a container from the host-level and libvirt was selecting that instead of the container-level mount, which uses the canonical path. The current logic basically iterate on the mounts until it finds a cgroup2 mount and uses that. If there's multiple, it will override until the last one is read, which is not very safe. I've cut a quick patch that should: 1. Validate that the mount is actually an existing directory in the context 2. Prefer the canonical mount (/sys/fs/cgroup) if it's available 3. only override it once, so it will not go through lists of mounts overriding up to the end I'm happy to get some feedback here especially on step 3 as I'm not very sure how we should proceed on non-canonical situations or if we should at all. Maybe the best solution is to just use the canonical path? From 4a0bf5c5b1e1cd4e0393981a25e1407d29beb43e Mon Sep 17 00:00:00 2001 From: Rogerio Vinhal Nunes <rogervn(a)meta.com> Date: Mon, 2 Feb 2026 19:24:52 +0000 Subject: [PATCH] Preferred /sys/fs/cgroup as a canonical mount but also verifies if the mount is an existing directory in the namespace. The reason for this is preventing that mounts that are not visible in the container namespace or additional cgroupv2 mounts to share host context might be incorrectly taken as targets here. --- src/util/vircgroupv2.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c index eaf5ae98f6..aa8c950691 100644 --- a/src/util/vircgroupv2.c +++ b/src/util/vircgroupv2.c @@ -23,6 +23,7 @@ #ifdef __linux__ # include <mntent.h> # include <sys/mount.h> +# include <sys/stat.h> #endif /* __linux__ */ #include "internal.h" @@ -46,6 +47,8 @@ VIR_LOG_INIT("util.cgroup"); #define VIR_FROM_THIS VIR_FROM_CGROUP +#define VIR_CGROUP_SYSFS_MOUNT "/sys/fs/cgroup" + VIR_ENUM_DECL(virCgroupV2Controller); VIR_ENUM_IMPL(virCgroupV2Controller, VIR_CGROUP_CONTROLLER_LAST, @@ -173,12 +176,26 @@ virCgroupV2DetectMounts(virCgroup *group, const char *mntOpts G_GNUC_UNUSED, const char *mntDir) { + struct stat sb; + if (STRNEQ(mntType, "cgroup2")) return 0; - VIR_FREE(group->unified.mountPoint); + if (stat(mntDir, &sb) < 0 || !S_ISDIR(sb.st_mode)) { + VIR_DEBUG("Skipping non-directory cgroup2 mount: %s", mntDir); + return 0; + } + + /* Always prefer /sys/fs/cgroup as the canonical mount point. + * If we already have /sys/fs/cgroup, don't override it. + * Otherwise, use the first valid directory we find as fallback. */ + if (STREQ(mntDir, VIR_CGROUP_SYSFS_MOUNT)) { + VIR_FREE(group->unified.mountPoint); + group->unified.mountPoint = g_strdup(mntDir); + } else if (!group->unified.mountPoint) { + group->unified.mountPoint = g_strdup(mntDir); + } - group->unified.mountPoint = g_strdup(mntDir); return 0; } -- 2.52.0

1 0

[RFC PATCH v4 0/7] riscv: add initial sdext support
by Chao Liu 03 Feb '26

03 Feb '26

Hi, Per Daniel's review feedback, this v4 series is based on Alistair's riscv-to-apply.next branch [3]. It depends on patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series (not included; apply them first) [2]. It is based on RISC-V Debug Specification 1.0 [1]. It introduces the sdext/sdtrig config bits, DCSR/DPC/DSCRATCH state, Debug Mode enter/leave helpers, DRET, EBREAK entry, single-step, and trigger action=debug mode. To reduce review load, this series focuses on the Sdext features first. The Debug Module (DM) and related flows will follow in a later series. Changes in v4: - Fixed linux-user build errors: moved debug_mode/dcsr/dpc/dscratch fields inside #ifndef CONFIG_USER_ONLY block in cpu.h, and wrapped all code using these fields with proper guards. (Daniel) - Updated dependency from single patch (patch 5 only) to patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series to avoid compilation errors. Changes in v3: - Rebase onto Alistair's riscv-to-apply.next branch. - Depend on Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." (not included; apply it first) [2]. - Patch 2: default sdext to false in riscv_cpu_extensions[]. Changes in v2: - Drop the RHCT expected AML update from this series. - Replace the split sdext/sdtrig config bits patch with deprecating the 'debug' CPU property. - Rebase and update patch subjects to target/riscv prefix. Changes in v1: - Debug Mode entry/exit updates DCSR/DPC and restores execution via DRET. - EBREAK honors DCSR ebreak bits and enters Debug Mode when enabled. - Single-step uses DCSR.STEP with a TB flag and a helper at TB exit. It references Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." [2]. - Sdtrig supports action=debug mode for mcontrol/mcontrol6 and reports inst-count triggers in tinfo. Differences vs Debug Spec (known gaps): - No Debug Module (no DMI, dmcontrol/dmstatus, haltreq/resumereq). - No debug ROM, program buffer, abstract commands, or SBA. - Resume is modeled by leaving Debug Mode at cpu_exec_enter. - Step/exception ordering is simplified: if the stepped instruction traps, the normal exception is taken and Debug Mode is not forced. - Several DCSR fields are not fully modeled (stopcount/stoptime, etc). Roadmap (next stage, DM focus): 1) Add a DM core with DMI access and hart state tracking. 2) Implement halt/resume handshake and move Debug Mode transitions under DM control. 3) Add debug ROM, program buffer, and abstract commands for GPR/CSR and memory access. 4) Add SBA if required by tooling. 5) Tighten ordering rules for step/exception/trigger priorities. References: [1] https://github.com/riscv/riscv-debug-spec/releases/tag/1.0 [2] https://lore.kernel.org/qemu-devel/20260108132631.9429-1-max.chou@sifive.co… [3] https://github.com/alistair23/qemu/tree/riscv-to-apply.next Thanks, Chao Chao Liu (6): target/riscv: add sdext debug CSRs state target/riscv: add sdext Debug Mode helpers target/riscv: add dret instruction target/riscv: add sdext enter Debug Mode on ebreak target/riscv: add sdext single-step support target/riscv: add sdtrig trigger action=debug mode Daniel Henrique Barboza (1): target/riscv: deprecate 'debug' CPU property docs/about/deprecated.rst | 7 + include/exec/translation-block.h | 4 +- target/riscv/cpu.c | 62 ++++++++- target/riscv/cpu.h | 9 ++ target/riscv/cpu_bits.h | 33 +++++ target/riscv/cpu_cfg_fields.h.inc | 3 +- target/riscv/cpu_helper.c | 90 ++++++++++++ target/riscv/csr.c | 128 +++++++++++++++++- target/riscv/debug.c | 58 +++++++- target/riscv/helper.h | 3 + target/riscv/insn32.decode | 1 + .../riscv/insn_trans/trans_privileged.c.inc | 24 ++++ target/riscv/machine.c | 44 ++++-- target/riscv/op_helper.c | 70 ++++++++++ target/riscv/tcg/tcg-cpu.c | 21 ++- target/riscv/translate.c | 16 ++- 16 files changed, 548 insertions(+), 25 deletions(-) -- 2.52.0

2 15

Qemu pause-before-switchover and libvirt live migration
by Rogério Vinhal Nunes 02 Feb '26

02 Feb '26

Hello, I’m looking into the libvirt hooks that are available to make use of during a live migration, but there's only hooks on migration begin and migration end. On qemu directly I’m able to use pause-before-switchover migration capability to run a custom operation just before it moves to the destination, but within libvirt it seems that while this is leveraged internally, it’s not currently exposed to the client in a way I can use. Does anyone have any suggestions on how I could expose this to the client in a generic and sensible way? Thanks, Rogerio

3 11

[PATCH v6 0/7] qemu: Implement support for iommufd
by Nathan Chen 02 Feb '26

02 Feb '26

Hi, This is a follow up to the fifth patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v5: - Updated documentation to point to 12.1.0 (QEMU and KVM only) - Move define and VIR_LOG_INIT out of #ifdef __linux__ block in viriommufd.h - Remove unneeded virPCIDeviceFree() from AppArmorSetSecurityHostdevLabel - Always error out if per-process accounting failed Changes from v4: - Move qemuProcessOpenVfioFds() to qemu_process.h in patch 4/7 - Add `linux/iommufd.h` into headers list in the meson.build file - Correct viriommufd.c pre-processor definition indentations - Restore call to virIOMMUFDSetRLimitMode() in patch 5/7 - Fix indentations for various print function calls - Move the qemuProcessOpenVfioFds() call to qemuProcessPrepareHost() - Make qemuProcessOpenVfioFds() static - Remove unnecessary formatting and comment in virPCIDeviceGetVfioPath() - Clean up namespace and cgroup changes with conditional check for iommufd - Remove virIOMMUFDSupported() - Fix seclabel return logic - In Apparmor seclabel logic, use g_autoptr for virPCIDevice pointer Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/commits/iommufd-v6-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/GKSD… Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Support per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 6 + meson.build | 1 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 4 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 3 + src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 17 +++ src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_process.c | 121 ++++++++++++++++++ src/security/security_apparmor.c | 28 ++-- src/security/security_dac.c | 49 +++++-- src/security/security_selinux.c | 47 +++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 111 ++++++++++++++++ src/util/viriommufd.h | 25 ++++ src/util/virpci.c | 39 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 32 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 31 +++++ .../iommufd-virt-pci-bus-single.xml | 22 ++++ .../iommufd-virt.aarch64-latest.args | 36 ++++++ .../iommufd-virt.aarch64-latest.xml | 53 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 +++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 43 files changed, 1090 insertions(+), 44 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 11

[PATCH 0/2] target/arm: Deprecate '-cpu any'
by Philippe Mathieu-Daudé 02 Feb '26

02 Feb '26

Arm '-cpu any' is aliased to '-cpu max' since more than 5 years. Deprecate the former in preparation of removal. Philippe Mathieu-Daudé (2): target/arm: Remove dead code target/arm: Deprecate '-cpu any' (remplaced by '-cpu max') docs/about/deprecated.rst | 8 ++++++++ target/arm/cpu.c | 1 + target/arm/tcg/cpu32.c | 3 --- 3 files changed, 9 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH v5 0/7] qemu: Implement support for iommufd
by Nathan Chen 30 Jan '26

30 Jan '26

Hi, This is a follow up to the fourth patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v4: - Move qemuProcessOpenVfioFds() to qemu_process.h in patch 4/7 - Add `linux/iommufd.h` into headers list in the meson.build file - Correct viriommufd.c pre-processor definition indentations - Restore call to virIOMMUFDSetRLimitMode() in patch 5/7 - Fix indentations for various print function calls - Move the qemuProcessOpenVfioFds() call to qemuProcessPrepareHost() - Make qemuProcessOpenVfioFds() static - Remove unnecessary formatting and comment in virPCIDeviceGetVfioPath() - Clean up namespace and cgroup changes with conditional check for iommufd - Remove virIOMMUFDSupported() - Fix seclabel return logic - In Apparmor seclabel logic, use g_autoptr for virPCIDevice pointer Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/commits/iommufd-v5-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/4BEU… Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Support per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 7 + meson.build | 1 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 4 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 3 + src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 17 +++ src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_process.c | 121 ++++++++++++++++++ src/security/security_apparmor.c | 31 +++-- src/security/security_dac.c | 49 +++++-- src/security/security_selinux.c | 47 +++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 111 ++++++++++++++++ src/util/viriommufd.h | 25 ++++ src/util/virpci.c | 39 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 32 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 31 +++++ .../iommufd-virt-pci-bus-single.xml | 22 ++++ .../iommufd-virt.aarch64-latest.args | 36 ++++++ .../iommufd-virt.aarch64-latest.xml | 53 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 +++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 43 files changed, 1093 insertions(+), 45 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 21

[PATCH] networkxmlconftest: Expect success for "hostdev" case only on Linux
by Michal Privoznik 30 Jan '26

30 Jan '26

From: Michal Privoznik <mprivozn(a)redhat.com> Our network has multiple means of forwarding the traffic and 'hostdev' is one of them. This mode means that the network is configured to use a set of PCI devices which are then assigned to individual domains to use (PCI device assignment). Now, as of v12.0.0-61-gecb2e06bdf our test runners (testCompareXMLToXMLFiles() and testCompareXMLToConfFiles()) call networkValidateTests(). For aforementioned type of network this means checking that the specified set of devices contains only VFs (see v3.2.0-rc1~24 for more info). It is true that our virpcimock is preloaded which mimics VFs, but our utils module (virpci.c specifically) talks to sysfs to check various PCI device attributes, including whether it's a VF. This obviously works on Linux and doesn't work anywhere else. Therefore, until our utils module is taught how to check PCI attribs on other systems, make the "hostdev" test case expect validation failure on non-Linux systems. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/networkxmlconftest.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/networkxmlconftest.c b/tests/networkxmlconftest.c index b32a39c553..b74d5b14f5 100644 --- a/tests/networkxmlconftest.c +++ b/tests/networkxmlconftest.c @@ -313,7 +313,16 @@ mymain(void) DO_TEST("bandwidth-network"); DO_TEST("openvswitch-net"); DO_TEST_VALIDATE_ERROR("passthrough-pf"); +#ifdef __linux__ DO_TEST("hostdev"); +#else + /* Our test runners call networkValidateTests() which for + * <forward mode='hostdev'/> means validating that PCI + * devices are VFs. It's done so by querying sysfs which + * obviously works on Linux only. Thus, expect a validation + * error elsewhere. */ + DO_TEST_VALIDATE_ERROR("hostdev"); +#endif DO_TEST_FLAGS("hostdev-pf", VIR_NETWORK_XML_INACTIVE); DO_TEST_FLAGS("hostdev-pf-driver-model", VIR_NETWORK_XML_INACTIVE); DO_TEST("ptr-domains-auto"); -- 2.52.0

2 1