- Devel - libvirt List Archives

Release of libvirt-11.6.0
by Jiri Denemark 01 Aug '25

01 Aug '25

The 11.6.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag This new flag for virConnectBaselineHypervisorCPU can be used for computing a baseline CPU on any host. Without the VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. * Allow control over QEMU TLS priority strings The qemu.conf file now has multiple settings allowing control over the QEMU TLS priority strings, for the different subsystems in QEMU that can support TLS. This can be used to workaround a current bug in GNUTLS that is liable to cause crashes of the source QEMU when performing long running live migration operations with TLS enabled. * Add support for disabling deprecated CPU model features by default for s390 domains Starting an s390 domain with host-model will now default to setting the ``deprecated_features`` attribute to ``off``, ensuring the domain starts with a migration-compatible CPU model to newer systems. This behavior can be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. * bhyve: Add TCP console support TCP serial devices can now be configured with ``<serial type='tcp'>``:: <serial type='tcp'> <source mode='bind' host='127.0.0.1' service='12345'/> <target type='serial' port='0'/> </serial> Additionally, number of supported consoles increased to 4. * qemu: Add support for RBD namespaces Allow specifying the 'namespace' within a RBD image pool. * Improvements * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V The previous default of ``lsilogic`` is unsupported by modern operating systems. ``virtio-scsi`` is a more suitable default for ARM and RISC-V ``virt`` machine types. * Clarify documentation of virConnectBaselineHypervisorCPU The documentation makes it clear virConnectBaselineHypervisorCPU is supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. * Allow specifying zero discard granularity for block devices This can be used to tell some guest operating systems (notably Windows) to not trim the disk. * bhyve: Add timeout handling for bhyveload It is now possible to run ``bhyveload`` with the ``timeout`` tool, which can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. Timeout values are set using the ``bhyveload_timeout`` and ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. * nss: Improve debugging Debugging messages from NSS modules can be now enabled by setting the ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special meaning to its value. * rpc: Removed requirement for TLS certificates to support 'key encipherment' With TLS 1.3, key encipherment is not required even for RSA keys. Other key types didn't even support it so they were wrongly refused even in cases when they would work with libvirt. The TLS certificate validation now no longer requires 'key encipherment' to be enabled. * Bug fixes * bhyve: Fix resetting of the autostart flag of the domain on destroy. * The nwfilter driver no longer recreates the base iptable/ip6tables chains The nwfilter driver had a impl mistake causing it to recreate the base chains for iptables/ip6tables every time a VM was started. This allowed a small window where traffic might not be fully filtered. It now handles iptables/ip6tables the same way as ebtables, creating the base chains only if they did not already exist. * Fix systemd unit ordering for auto-shutdown of domains via the daemon The ordering of systemd units created by libvirt for individual machines needed to be adapted when the shutdown of VMs on host shutdown is done via the virt daemon itself (rather than ``libvirt-guests.service``) to ensure that the VMs are not terminated before the virt daemon can deal with them. Enjoy. Jirka

1 0

[PATCH] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 01 Aug '25

01 Aug '25

Add the ability to enable/disable exposing the EDID information to the guest. This allows migration from legacy machine types that have EDID disabled to a newer machine type without any change becoming visible to the guest. The edid attribute can specified in the domain XML as below: <video> <model type='virtio' edid='off'/> </video> If the edid attribute is unspecified, it is not generated so that the virtualisation platform will continue to use its default. The edid attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> --- docs/formatdomain.rst | 8 ++++++++ src/conf/domain_conf.c | 5 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++++++++ src/conf/schemas/domaincommon.rng | 5 +++++ src/qemu/qemu_command.c | 7 +++++++ 6 files changed, 37 insertions(+) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 976746e292..7fe8b03a56 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -7103,6 +7103,14 @@ A video device. sub-element is valid for model types "vga", "qxl", "bochs", "gop", and "virtio". + :since:`Since 11.7.0` (QEMU driver only), the ``model`` element may have an + optional ``edid`` attribute that can be set to "on" or "off". If the ``edid`` + attribute is not specified then the device will use its default value. + Otherwise setting ``edid`` to "on" will expose the device EDID blob to the + guest, whilst setting it to "off" will hide the device EDID blob from the + guest. The ``edid`` attribute is only valid for model types "vga", "bochs", + and "virtio". + ``acceleration`` Configure if video acceleration should be enabled. diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 59958c2f08..10cc6d7432 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13535,6 +13535,9 @@ virDomainVideoModelDefParseXML(virDomainVideoDef *def, if (virXMLPropTristateSwitch(node, "blob", VIR_XML_PROP_NONE, &def->blob) < 0) return -1; + if (virXMLPropTristateSwitch(node, "edid", VIR_XML_PROP_NONE, &def->edid) < 0) + return -1; + return 0; } @@ -26629,6 +26632,8 @@ virDomainVideoDefFormat(virBuffer *buf, virBufferAddLit(buf, " primary='yes'"); if (def->blob != VIR_TRISTATE_SWITCH_ABSENT) virBufferAsprintf(buf, " blob='%s'", virTristateSwitchTypeToString(def->blob)); + if (def->edid != VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(buf, " edid='%s'", virTristateSwitchTypeToString(def->edid)); if (def->accel || def->res) { virBufferAddLit(buf, ">\n"); virBufferAdjustIndent(buf, 2); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 596d138973..425ccfa97c 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1895,6 +1895,7 @@ struct _virDomainVideoDef { virDomainDeviceInfo info; virDomainVirtioOptions *virtio; virDomainVideoBackendType backend; + virTristateSwitch edid; }; /* graphics console modes */ diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 40edecef83..60a2e46b7e 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -231,6 +231,17 @@ virDomainVideoDefValidate(const virDomainVideoDef *video, } } + if ((video->type != VIR_DOMAIN_VIDEO_TYPE_BOCHS) && + (video->type != VIR_DOMAIN_VIDEO_TYPE_VGA) && + (video->type != VIR_DOMAIN_VIDEO_TYPE_VIRTIO)) { + if (video->edid != VIR_TRISTATE_SWITCH_ABSENT) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("video type '%1$s' does not support edid"), + virDomainVideoTypeToString(video->type)); + return -1; + } + } + return 0; } diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index a714c3fcc5..d84f20637c 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -4807,6 +4807,11 @@ <ref name="virOnOff"/> </attribute> </optional> + <optional> + <attribute name="edid"> + <ref name="virOnOff"/> + </attribute> + </optional> <optional> <element name="acceleration"> <optional> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 457dee7029..db00f9b173 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4739,6 +4739,13 @@ qemuBuildDeviceVideoCmd(virCommand *cmd, return -1; } + if ((video->type == VIR_DOMAIN_VIDEO_TYPE_BOCHS) || + (video->type == VIR_DOMAIN_VIDEO_TYPE_VGA) || + (video->type == VIR_DOMAIN_VIDEO_TYPE_VIRTIO)) { + if (virJSONValueObjectAdd(&props, "T:edid", video->edid, NULL) < 0) + return -1; + } + if (video->res) { if (virJSONValueObjectAdd(&props, "p:xres", video->res->x, -- 2.43.0

3 6

[PATCH] NEWS: Mention RBD namespaces, and auto-shutdown/key encipherment fixes
by Peter Krempa 31 Jul '25

31 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 5a320b7f33..6db9c998d9 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -51,6 +51,10 @@ v11.6.0 (unreleased) Additionally, number of supported consoles increased to 4. + * qemu: Add support for RBD namespaces + + Allow specifying the 'namespace' within a RBD image pool. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V @@ -83,6 +87,13 @@ v11.6.0 (unreleased) ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special meaning to its value. + * rpc: Removed requirement for TLS certificates to support 'key encipherment' + + With TLS 1.3, key encipherment is not required even for RSA keys. Other key + types didn't even support it so they were wrongly refused even in cases when + they would work with libvirt. The TLS certificate validation now no longer + requires 'key encipherment' to be enabled. + * **Bug fixes** * bhyve: Fix resetting of the autostart flag of the domain on destroy. @@ -96,6 +107,14 @@ v11.6.0 (unreleased) ebtables, creating the base chains only if they did not already exist. + * Fix systemd unit ordering for auto-shutdown of domains via the daemon + + The ordering of systemd units created by libvirt for individual machines + needed to be adapted when the shutdown of VMs on host shutdown is done + via the virt daemon itself (rather than ``libvirt-guests.service``) to + ensure that the VMs are not terminated before the virt daemon can deal with + them. + v11.5.0 (2025-07-01) ==================== -- 2.50.1

2 1

Question about SEV* guests and automatic firmware selection
by Jim Fehlig 31 Jul '25

31 Jul '25

Hi All, While investigating an internal bug report, we noticed that a minimal firmware auto-selection configuration along with SEV* fails to find a match. E.g. the following config <domain type="kvm"> <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <boot dev="hd"/> </os> <launchSecurity type="sev"> <policy>0x07</policy> </launchSecurity> ... </domain> Fails with "Unable to find 'efi' firmware that is compatible with the current configuration". A firmware that should match has the following json description { "description": "UEFI firmware for x86_64, with AMD SEV", "interface-types": [ "uefi" ], "mapping": { "device": "flash", "mode": "stateless", "executable": { "filename": "/usr/share/qemu/ovmf-x86_64-sev.bin", "format": "raw" } }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "acpi-s4", "amd-sev", "amd-sev-es", "amd-sev-snp", "verbose-dynamic" ], "tags": [ ] } Auto-selection works fine if I specify a 'stateless' firmware, e.g. amend the above config with <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <loader stateless="yes"/> <boot dev="hd"/> </os> Being unfamiliar with the firmware auto-selection code, I tried the below naive hack, which only led to test failures and the subsequent runtime error "unable to find any master var store for loader: /usr/share/qemu/ovmf-x86_64-sev.bin". Should auto-selection work with the minimal config, or is it expected that user also specify a stateless firmware? Regards, Jim diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 2d0ec0b4fa..660b74141a 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1293,15 +1293,17 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } - if (loader && loader->stateless == VIR_TRISTATE_BOOL_YES) { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { - VIR_DEBUG("Discarding loader without stateless flash"); - return false; - } - } else { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { - VIR_DEBUG("Discarding loader without split flash"); - return false; + if (loader) { + if (loader->stateless == VIR_TRISTATE_BOOL_YES) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { + VIR_DEBUG("Discarding loader without stateless flash"); + return false; + } + } else if (loader->stateless == VIR_TRISTATE_BOOL_NO) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + VIR_DEBUG("Discarding loader without split flash"); + return false; + } } }

3 6

[PATCH] news: document fixed nwfilter driver base chain creation
by Daniel P. Berrangé 30 Jul '25

30 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e5e8626729..c7bfac1db4 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -48,6 +48,14 @@ v11.6.0 (unreleased) * **Bug fixes** + * The nwfilter driver no longer recreates the base iptable/ip6tables chains + + The nwfilter driver had a impl mistake causing it to recreate the + base chains for iptables/ip6tables every time a VM was started. + This allowed a small window where traffic might not be fully + filtered. It now handles iptables/ip6tables the same way as + ebtables, creating the base chains only if they did not already + exist. v11.5.0 (2025-07-01) ==================== -- 2.50.1

2 1

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 30 Jul '25

30 Jul '25

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7f08e45537..d6919bdf4c 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -59,6 +59,12 @@ v11.6.0 (unreleased) This can be used to tell some guest operating systems (notably Windows) to not trim the disk. + * nss: Improve debugging + + Debugging printings from NSS modules can be now enabled by setting the + ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special + meaning to its value. + * **Bug fixes** -- 2.49.1

2 1

[PATCH] NEWS: document bhyve changes for the release
by Roman Bogorodskiy 30 Jul '25

30 Jul '25

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225..447259d66e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -40,6 +40,17 @@ v11.6.0 (unreleased) be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. + * bhyve: Add TCP console support + + TCP serial devices can now be configured with ``<serial type='tcp'>``:: + + <serial type='tcp'> + <source mode='bind' host='127.0.0.1' service='12345'/> + <target type='serial' port='0'/> + </serial> + + Additionally, number of supported consoles increased to 4. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V @@ -54,8 +65,16 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * bhyve: Add timeout handling for bhyveload + + It is now possible to run ``bhyveload`` with the ``timeout`` tool, which + can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. + Timeout values are set using the ``bhyveload_timeout`` and + ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. + * **Bug fixes** + * bhyve: Fix resetting of the autostart flag of the domain on destroy. v11.5.0 (2025-07-01) ==================== -- 2.49.0

2 2

Plans for 11.6.0 release (freeze on 2025-07-28)
by Jiri Denemark 30 Jul '25

30 Jul '25

We are getting close to 11.6.0 release of libvirt. To aim for the release on Friday 01 Aug I suggest entering the freeze on Monday 28 Jul and tagging RC2 on Wednesday 30 Jul. I hope this works for everyone. Jirka

1 1

[PATCH 0/2] qemu: Match firmware with fully resolved and canonicalized paths
by James Le Cuirot 29 Jul '25

29 Jul '25

From: James Le Cuirot <jlecuirot(a)microsoft.com> Distros may provide compatibility symlinks after moving firmware files around, but they won't work for existing VMs when doing a straight string comparison. virFileComparePaths has been used to do this, but it was previously only resolving the last path component, despite what the description says. James Le Cuirot (2): util: Fully resolve paths with virFileComparePaths qemu: Match firmware with fully resolved and canonicalized paths src/qemu/qemu_firmware.c | 11 ++++++----- src/util/virfile.c | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.49.0

4 6

[PATCH 0/2] Revert recent patches causing test dependance on host state
by Peter Krempa 29 Jul '25

29 Jul '25

Revert the patches as we're in code freeze. Peter Krempa (2): Revert "qemuxmlconfdata: Regenerate outputs after last commit" Revert "qemu: Match firmware with fully resolved and canonicalized paths" src/qemu/qemu_firmware.c | 11 +++++------ ...anual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++------- ...i-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++------- ...ual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- ...l-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- 10 files changed, 22 insertions(+), 39 deletions(-) -- 2.50.0

2 3

[PATCH pushed] qemuxmlconfdata: Regenerate outputs after last commit
by Peter Krempa 29 Jul '25

29 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Commit 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 modified how the EFI paths are detected but didn't update the outputs. Fixes: 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed as build fix. ...manual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...-manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++++++--- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...anual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...al-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...e-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- 9 files changed, 33 insertions(+), 17 deletions(-) diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args index 83b1ce46ab..7bf2aeb570 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/AAVMF/AAVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml index 2e5c4fe584..0ee421fe6f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader> + <nvram template='/usr/share/edk2/aarch64/vars-template-pflash.raw' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml index b452ebaca2..4bfc7cdd0c 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args index 2113a46e80..d1b0377986 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml index 83623f1de2..490e298f7f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml index cbadd0f0c8..beb146d35a 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> - <nvram template='/path/to/OVMF_VARS.fd' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram template='/path/to/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml index 44d200134b..41e5742c21 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> -- 2.50.0

1 0

[PATCH] include: fix version for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST
by Daniel P. Berrangé 28 Jul '25

28 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- include/libvirt/libvirt-host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-host.h b/include/libvirt/libvirt-host.h index 19043235b2..8922d00e0c 100644 --- a/include/libvirt/libvirt-host.h +++ b/include/libvirt/libvirt-host.h @@ -975,7 +975,7 @@ typedef enum { /* filter out non-migratable features (Since: 1.2.14) */ VIR_CONNECT_BASELINE_CPU_MIGRATABLE = (1 << 1), /* when computing a baseline from several CPUs, do not make the result - * dependent on the current host (Since: 11.5.0) */ + * dependent on the current host (Since: 11.6.0) */ VIR_CONNECT_BASELINE_CPU_IGNORE_HOST = (1 << 2), } virConnectBaselineCPUFlags; -- 2.50.1

2 1

[PATCH] NEWS: Mention zero discard_granularity option
by Martin Kletzander 28 Jul '25

28 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225a6..7f08e455377b 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -54,6 +54,11 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * Allow specifying zero discard granularity for block devices + + This can be used to tell some guest operating systems (notably Windows) to + not trim the disk. + * **Bug fixes** -- 2.50.1

2 1

[PATCH] include: s/RECREATION/RECREATED/ in domain event names
by Daniel P. Berrangé 28 Jul '25

28 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> New event reasons were added in commit 1af740c5012bb45dfe96c77bcd6b20c28b6bb45d Author: Zhenzhong Duan <zhenzhong.duan(a)intel.com> Date: Thu Jul 10 03:21:21 2025 -0400 qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation but the naming did not match existing reason names, so adapt to match. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- examples/c/misc/event-test.c | 8 ++++---- include/libvirt/libvirt-domain.h | 4 ++-- src/qemu/qemu_process.c | 4 ++-- tools/virsh-domain-event.c | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/examples/c/misc/event-test.c b/examples/c/misc/event-test.c index bafa929c47..347ec44682 100644 --- a/examples/c/misc/event-test.c +++ b/examples/c/misc/event-test.c @@ -143,8 +143,8 @@ eventDetailToString(int event, case VIR_DOMAIN_EVENT_STARTED_WAKEUP: return "Event wakeup"; - case VIR_DOMAIN_EVENT_STARTED_RECREATION: - return "Recreation"; + case VIR_DOMAIN_EVENT_STARTED_RECREATED: + return "Recreated"; case VIR_DOMAIN_EVENT_STARTED_LAST: break; @@ -230,8 +230,8 @@ eventDetailToString(int event, case VIR_DOMAIN_EVENT_STOPPED_FROM_SNAPSHOT: return "Snapshot"; - case VIR_DOMAIN_EVENT_STOPPED_RECREATION: - return "Recreation"; + case VIR_DOMAIN_EVENT_STOPPED_RECREATED: + return "Recreated"; case VIR_DOMAIN_EVENT_STOPPED_LAST: break; diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index fad58cf409..1811c55005 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5051,7 +5051,7 @@ typedef enum { VIR_DOMAIN_EVENT_STARTED_RESTORED = 2, /* Restored from a state file (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STARTED_FROM_SNAPSHOT = 3, /* Restored from snapshot (Since: 0.8.0) */ VIR_DOMAIN_EVENT_STARTED_WAKEUP = 4, /* Started due to wakeup event (Since: 0.9.11) */ - VIR_DOMAIN_EVENT_STARTED_RECREATION = 5, /* Secure guest recreation (Since: 10.1.0) */ + VIR_DOMAIN_EVENT_STARTED_RECREATED = 5, /* Secure guest recreation (Since: 10.1.0) */ # ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_EVENT_STARTED_LAST /* (Since: 0.9.10) */ @@ -5116,7 +5116,7 @@ typedef enum { VIR_DOMAIN_EVENT_STOPPED_SAVED = 4, /* Saved to a state file (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STOPPED_FAILED = 5, /* Host emulator/mgmt failed (Since: 0.5.0) */ VIR_DOMAIN_EVENT_STOPPED_FROM_SNAPSHOT = 6, /* offline snapshot loaded (Since: 0.8.0) */ - VIR_DOMAIN_EVENT_STOPPED_RECREATION = 7, /* Secure guest recreation (Since: 10.1.0) */ + VIR_DOMAIN_EVENT_STOPPED_RECREATED = 7, /* Secure guest recreation (Since: 10.1.0) */ # ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_EVENT_STOPPED_LAST /* (Since: 0.9.10) */ diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 8f3d357b9f..6b7b971f27 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -476,7 +476,7 @@ qemuProcessFakeRebootViaRecreate(virDomainObj *vm, bool locked) event = virDomainEventLifecycleNewFromObj(vm, VIR_DOMAIN_EVENT_STOPPED, - VIR_DOMAIN_EVENT_STOPPED_RECREATION); + VIR_DOMAIN_EVENT_STOPPED_RECREATED); virObjectEventStateQueue(driver->domainEventState, event); /* skip remove inactive domain from active list */ @@ -501,7 +501,7 @@ qemuProcessFakeRebootViaRecreate(virDomainObj *vm, bool locked) virDomainAuditStart(vm, "booted", true); event = virDomainEventLifecycleNewFromObj(vm, VIR_DOMAIN_EVENT_STARTED, - VIR_DOMAIN_EVENT_STARTED_RECREATION); + VIR_DOMAIN_EVENT_STARTED_RECREATED); virObjectEventStateQueue(driver->domainEventState, event); qemuDomainSaveStatus(vm); diff --git a/tools/virsh-domain-event.c b/tools/virsh-domain-event.c index 21dbf6e1d2..a47fdfc7fd 100644 --- a/tools/virsh-domain-event.c +++ b/tools/virsh-domain-event.c @@ -72,7 +72,7 @@ VIR_ENUM_IMPL(virshDomainEventStarted, N_("Restored"), N_("Snapshot"), N_("Event wakeup"), - N_("Recreation")); + N_("Recreated")); VIR_ENUM_DECL(virshDomainEventSuspended); VIR_ENUM_IMPL(virshDomainEventSuspended, @@ -106,7 +106,7 @@ VIR_ENUM_IMPL(virshDomainEventStopped, N_("Saved"), N_("Failed"), N_("Snapshot"), - N_("Recreation")); + N_("Recreated")); VIR_ENUM_DECL(virshDomainEventShutdown); VIR_ENUM_IMPL(virshDomainEventShutdown, -- 2.50.1

2 1

Entering freeze for libvirt-11.6.0
by Jiri Denemark 28 Jul '25

28 Jul '25

I have just tagged v11.6.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

2 1

[RFC 0/4] Implement automatic attachment of the vhostuser port
by yong.huang＠smartx.com 28 Jul '25

28 Jul '25

From: Hyman Huang <yong.huang(a)smartx.com> This series offer an automated method to configure a vhostuser interface in server mode, simplifying integration with DPDK-enabled Open vSwitch bridges. To ensure simplicity and forward compatibility, we introduce openvswitch backend support for vhostuser interfaces in XML configuration, with an optional 'autoiface' attribute. Here is an example of the config for a vhostuser interface that attached to bridge automatically: <interface type='vhostuser'> <mac address='52:54:00:3b:83:1b'/> <source type='unix' path='/tmp/vhost2.sock' mode='server'/> <virtualport type='openvswitch'> <parameters interfaceid='9317d6b7-5fae-4464-a7e9-87d90eff2204'/> </virtualport> <backend type='openvswitch' autoiface='yes'> <parameters bridge='ovsbr-ddpbxnhaq'/> </backend> <model type='virtio'/> <driver queues='5'/> </interface> The backend element specifies the backend implementation of the vhostuser interface type. The type attribute is required and currently supports supports openvswitch and passt. If type is openvswitch, the autoiface attribute may be specified (yes or no), if autoiface is yes, the parameters element bridge attribute is mandatory. Libvirt will derive the interface name by extracting the substring after the '/' character in the vhostuser server path, and attach it to the bridge specified by the bridge attribute. Please review. Thanks. Yong Hyman Huang (4): qemu_passt: Make logFile backend-specific conf: Introduce autoiface attribute for vhostuser interface util: Add iface argument to virNetDevOpenvswitchAddPort qemu: Implement automatic attachment of the vhostuser port docs/formatdomain.rst | 37 ++++++++- src/conf/domain_conf.c | 75 +++++++++++++++++-- src/conf/domain_conf.h | 13 +++- src/conf/domain_postparse.c | 46 ++++++++++++ src/conf/domain_validate.c | 24 ++++++ src/conf/schemas/domaincommon.rng | 20 +++++ src/lxc/lxc_process.c | 3 +- src/qemu/qemu_command.c | 3 + src/qemu/qemu_hotplug.c | 4 + src/qemu/qemu_interface.c | 46 ++++++++++++ src/qemu/qemu_interface.h | 3 + src/qemu/qemu_passt.c | 4 +- src/qemu/qemu_process.c | 4 + src/util/virnetdevopenvswitch.c | 36 ++++++++- src/util/virnetdevopenvswitch.h | 10 ++- src/util/virnetdevtap.c | 3 +- .../net-vhostuser.x86_64-latest.xml | 10 +++ tests/qemuxmlconfdata/net-vhostuser.xml | 10 +++ 18 files changed, 336 insertions(+), 15 deletions(-) -- 2.27.0

2 6

[PATCH v6 0/3] Fix virtio console port assignment issue
by Aaron M. Brown 26 Jul '25

26 Jul '25

Changelog: --- v6: - Fixed issue with console auto port index starting from 1 instead of 0 --- v5: - Added xml tests to tests/qemuxmlconfdata - Fixed virito -> virtio typo in commit message --- v4: - Update commit messages --- v3: - Added Reviewed-By - Included CI Results Link --- v2: - Split patch into two commits - Added fixes tag --- This libvirt patch series does the following: 1. fixes an issue with virtio console device port auto assignment on virtio-serial buses 2. updates console port reservation comment and changes the allowZero variable to allowPortZero for clarity 3. Adds tests for virtio console on the vioserial bus Currently in libvirt, a virtio console device cannot be auto assigned a port number greater than zero on a virtio-serial bus. This leads to port collision errors when adding more than 1 virtio console device on a single virtio-serial bus. After applying this patch, one can add multiple console ports under a single virtio-serial bus. Here is a link to CI results for this series: https://gitlab.com/aaronbmalik/libvirt/-/pipelines/1942021076 Aaron M. Brown (3): tests: Add console-virtio-vioserial tests domain_addr: Fix virtio console port autoassign on virtio-serial bus domain_addr: update virtconsole port reservation comment and allowZero var src/conf/domain_addr.c | 50 ++++++++++----- ...rial-autoassign-address.x86_64-latest.args | 44 +++++++++++++ ...erial-autoassign-address.x86_64-latest.xml | 63 +++++++++++++++++++ ...nsole-virtio-serial-autoassign-address.xml | 48 ++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 192 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.xml -- 2.39.5 (Apple Git-154)

3 8

[PATCH v5 0/5] Disable Deprecated Features by Default on s390 CPU Models
by Collin Walling 25 Jul '25

25 Jul '25

Changelog v5 - dropped the "none" test in qemuxmlactivetest (see commit for details) - reordered patches to introduce some tests first, then add qemu.conf changes v4 - added qemu.conf option to dictate the default behavior for the deprecated_features attribute (Boris) - added qemuxmlactivetests (Boris) - snuck in missing documentation for deprecated_features in formatdomain.rst v3 - added qemu caps check to avoid breaking s390 guests trying to default deprecated_features='off' on QEMU versions that do not support reporting these features v2 - changed behavior from disabling features on the host model to instead flagging the guest CPU to disable deprecated features - removed disabling deprecated features on host model in virQEMUCapsInitCPUModelS390 - added flagging deprecated_feats in qemuProcessUpdateGuestCPU - added tests for deprecated_features='on' - split virQEMUCapsUpdateCPUDeprecatedFeatures update and qemuProcessUpdateGuestCPU changes The intention of reporting deprecated features and modifying the guest CPU model was to alleviate the user from the burden of preparing a guest with the necessary amendments to assure migration to newer hardware. While that goal was met by way of the "deprecated_features='on|off'" attribute, it still adds an extra step that the user must be aware to prepare a guest for migration and the errors that stem from an unsuccessful migration (due to feature incompatibility) is not always clear how to resolve. These patches make s390 CPU *host models* migration ready from the get-go by introducing a qemu.conf option for disabling deprecated features by default. They may still be disabled for other model types via the respective attribute, or reenabled if desired. The configured behavior may be overridden by explicitly providing the attribute within the guest XML. Boris Fiuczynski (2): tests: new qemuxmlactive tests for s390x qemu: add default_cpu_deprecated_features configuration option Collin Walling (3): docs: domain: document deprecated_features attribute qemu: caps: add virCPUFeaturePolicy param to virQEMUCapsUpdateCPUDeprecatedFeatures qemu: process: refactor deprecated features code docs/formatdomain.rst | 8 ++++ src/qemu/libvirtd_qemu.aug | 3 ++ src/qemu/qemu.conf.in | 14 ++++++ src/qemu/qemu_capabilities.c | 6 +-- src/qemu/qemu_capabilities.h | 3 +- src/qemu/qemu_conf.c | 33 +++++++++++++ src/qemu/qemu_conf.h | 12 +++++ src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_process.c | 46 +++++++++++++++---- src/qemu/test_libvirtd_qemu.aug.in | 1 + ...cated-features-off-active.s390x-latest.xml | 25 ++++++++++ ...ted-features-off-inactive.s390x-latest.xml | 25 ++++++++++ ...ecated-features-on-active.s390x-latest.xml | 25 ++++++++++ ...ated-features-on-inactive.s390x-latest.xml | 25 ++++++++++ tests/qemuxmlactivetest.c | 10 +++- ...deprecated-features-none.s390x-latest.args | 32 +++++++++++++ ...-deprecated-features-none.s390x-latest.xml | 25 ++++++++++ .../cpu-model-deprecated-features-none.xml | 15 ++++++ ...l-deprecated-features-on.s390x-latest.args | 32 +++++++++++++ ...el-deprecated-features-on.s390x-latest.xml | 25 ++++++++++ .../cpu-model-deprecated-features-on.xml | 15 ++++++ ...default-video-type-s390x.s390x-latest.args | 2 +- ...vfio-zpci-ccw-memballoon.s390x-latest.args | 2 +- .../launch-security-s390-pv.s390x-latest.args | 2 +- ...t-cpu-kvm-ccw-virtio-4.2.s390x-latest.args | 2 +- .../s390-defaultconsole.s390x-latest.args | 2 +- .../s390-panic.s390x-latest.args | 2 +- tests/qemuxmlconftest.c | 2 + 28 files changed, 375 insertions(+), 22 deletions(-) create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-off-active.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-off-inactive.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-on-active.s390x-latest.xml create mode 100644 tests/qemuxmlactive2xmldata/cpu-model-deprecated-features-on-inactive.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-none.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-on.xml -- 2.49.0

5 18

[PATCH] NEWS: mention disabling deprecated features by default on s390 CPU models
by Collin Walling 25 Jul '25

25 Jul '25

Signed-off-by: Collin Walling <walling(a)linux.ibm.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e5e8626729..6cc8f23225 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -32,6 +32,14 @@ v11.6.0 (unreleased) that is liable to cause crashes of the source QEMU when performing long running live migration operations with TLS enabled. + * Add support for disabling deprecated CPU model features by default for s390 domains + + Starting an s390 domain with host-model will now default to setting the + ``deprecated_features`` attribute to ``off``, ensuring the domain starts + with a migration-compatible CPU model to newer systems. This behavior can + be modified by setting the ``default_cpu_deprecated_features`` option in + the qemu.conf file. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.49.0

2 1

Re: Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by Peter Krempa 25 Jul '25

25 Jul '25

On Wed, Jul 23, 2025 at 04:57:57 +0000, P, Rajasekar via Users wrote: > Hello libvirt community, > > I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). > > **Environment:** > - libvirt version: 10.5.0 Note that this was released almost a year ago. > - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 > - Disk image format: qcow2 > - Host OS: RHEL 9.5 > > **Steps to reproduce:** > 1. Create an external snapshot: > virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic > 2. Delete the snapshot: > virsh snapshot-delete <vm> --snapshotname snap1 > > **Observed behavior:** > - Changes from the overlay (snapshot) file are merged into the base image. > - The snapshot metadata is removed from libvirt. > - The snapshot file remains on disk (appears orphaned). You mean that the original overlay images remained on disk? e.g. /path/to/originalimage.snap1 ? > **Questions:** > - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. Yes it is intended, because deleting a snapshot is effectively meaning "I don't want to return to this point any more" so the extra overlay makes no sense. > - Should the snapshot file be deleted automatically, or is manual cleanup required? If you mean the overlay, then yes it should have been deleted. > - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? The semantics of external and internal snapshots are supposed to be indentical. I don't think we document to a deep extent the actual behaviour WRT to the disk files.

1 0

شهادة الأبوة في المغرب
by walid falcon 24 Jul '25

24 Jul '25

كل ما تحتاج معرفته حول شهادة الأبوة بالمغرب يمكنك تحميل الطلب من خلال الرابط المباشر https://www.targir.com/2025/04/blog-post_14.html معلومات شاملة لاستخراج شهادة الأبوة والإجراءات القانونية المرتبطة بها ما هي شهادة الأبوة في المغرب؟ شهادة الأبوة وثيقة قانونية تصدر بناءً على حكم قضائي، وتُثبت العلاقة البنوية بين الطفل ووالده البيولوجي، في حال عدم وجود عقد زواج رسمي أو تسجيل سابق. تُعَد هذه الشهادة جزءًا من الإجراءات القضائية التي تدخل ضمن قضايا الحالة المدنية. الحالات التي تستوجب استخراج شهادة الأبوة 1. الأطفال غير المسجلين في الحالة المدنية عندما يولد طفل خارج إطار الزواج أو لم يُسجَّل بصفة قانونية في دفتر الحالة المدنية، يحتاج الأب إلى رفع دعوى للحصول على شهادة الأبوة. 2. إثبات النسب في غياب عقد زواج في حالات عدم توفر وثيقة الزواج بين الأبوين، يُلجأ إلى المحكمة لتقديم التصريح بالأبوة. إجراءات الحصول على شهادة الأبوة أولا: رفع دعوى أمام المحكمة يتوجب على الأب أو ولي أمر الطفل تقديم طلب إلى المحكمة الابتدائية التي يقع فيها مقر سكن الطفل أو الأب، وذلك من أجل إصدار حكم قضائي بإثبات الأبوة. ثانياً: الوثائق المطلوبة نسخة من بطاقة التعريف الوطنية عقد الازدياد الخاص بالطفل (إن وُجد) شهادة طبية للولادة شهادة السكنى وثائق أو إثباتات تدعم علاقة الأب بالطفل نموذج شهادة الأبوة pdf تتيح بعض المواقع الإلكترونية تحميل نموذج شهادة الأبوة PDF قابل للطباعة، غير أن إصدارها الرسمي لا يتم إلا بعد حكم قضائي، ويتم توجيهها لمصلحة الحالة المدنية لتسجيل الطفل. الأسئلة الشائعة حول شهادة الأبوة هل يمكن تقديم طلب شهادة الأبوة إلكترونياً؟ لا، المسطرة تظل قضائية وتتطلب الحضور أمام المحكمة. ما هي مدة الحصول على شهادة الأبوة؟ قد تختلف المدة حسب عدد الجلسات، ولكن عادة ما تستغرق بين شهر إلى ثلاثة أشهر، حسب تعقيد الملف. صلة بين شهادة الأبوة وبعض التصاريح القانونية الأخرى تم الربط ضمن هذا الدليل بين شهادة الأبوة وبعض المفاهيم القانونية الأخرى التي يبحث عنها الكثير، مثل: 1. التصريح الأمني وتصريح السفر غالباً ما يُطلب في بعض الحالات القانونية توفير تصريح أمني عند استخراج أوراق ثبوتية، كما هو الحال في: الأوراق المطلوبة لاستخراج تصريح السفر من منطقة التجنيد تصريح أمني مستعجل التصريح الأمني الإلكتروني 2. استبدال التصريح برخصة قيادة في حالات مثل شروط إصدار رخصة قيادة بعد التصريح أو تجديد التصريح إلى رخصة، من المهم التأكد من إثبات الهوية القانونية، وهو ما يجعل شهادة الأبوة ضرورية في بعض الحالات القانونية الخاصة. شهادة الأبوة الغاية من هذه الوثيقة هي إثبات علاقة الأبوة بالابن سواء كان راشدا أم قاصرا وغالبا ما تطلب في بعض المساطر الإدارية. صاحب الطلب المغربي المقيم بالخارج الوثائق المطلوبة بالنسبة للراشد : · بطاقة التسجيل ؛ · الدفتر العائلي بالنسبة للقاصر : · بطاقة تسجيل الأب ؛ · الدفتر العائلي . المصلحة المكلفة باستلام الوثائق المطلوبة المصالح القنصلية التابعة لمحل إقامة صاحب الطلب المصلحة المكلفة بتقديم الخدمة المصالح القنصلية التابعة لمحل إقامة صاحب الطلب في حالة تعذر الحصول على الخدمة مؤسسة الوسيط لأجل الاتصال وزارة الشؤون الخارجية والتعاون مصدر المعلومات (الإدارة المعنية) وزارة الشؤون الخارجية والتعاون_أرشيف يمكنك تحميل الطلب من خلال الرابط المباشر نموذج شهادة الأبوة بالمغرب محكمة الأسرة بـ: [اسم المدينة] رقم الملف: [يُترك للمحكمة] رقم القضية: [يُترك للمحكمة] بيان تصريح بالأبوة أنا الموقع أسفله: الاسم الكامل: [الاسم الكامل للأب] رقم بطاقة التعريف الوطنية: [رقم CIN] تاريخ ومكان الازدياد: [تاريخ ومكان ولادة الأب] العنوان الكامل: [عنوان الإقامة] المهنة: [المهنة الحالية] أُصرّح بموجب هذا، وبكامل قواي العقلية والقانونية، بما يلي: أن الطفل (ة) المسمى (ة): [اسم الطفل/ة] المولود (ة) بتاريخ: [تاريخ الولادة] بـ: [مكان الولادة] هو(هي) ابني/ابنتي البيولوجي(ة)، وقد وُلد(ت) نتيجة علاقة أبوية قائمة بيني وبين السيدة: [اسم الأم]، المولودة بتاريخ: [تاريخ ميلاد الأم]، والحاملة لرقم بطاقة التعريف الوطنية: [رقم CIN الأم]. وأتحمل كامل المسؤولية القانونية والأبوية تجاه هذا الطفل/ة، وأطلب من المحكمة الموقرة إصدار حكم قضائي يثبت نسب الطفل لي، وتمكينه من التسجيل في الحالة المدنية. الإمضاء الإسم الكامل: _____________________ التوقيع: ___________________________ التاريخ: ____ / ____ / ________ ملاحظات : يُرفق هذا النموذج بالوثائق الداعمة كـ: نسخة البطاقة الوطنية، شهادة السكنى، شهادة الولادة، وغيرها. يُودَع لدى كتابة ضبط المحكمة الابتدائية (قسم قضاء الأسرة) التي يقع ضمن اختصاصها محل ولادة الطفل أو محل سكن الأب.

1 0

[PATCH v1] virBitmapNextClearBit: Correct virBitmapNextClearBit function header comment
by Aaron M. Brown 23 Jul '25

23 Jul '25

This patch corrects the header comment for virBitmapNextClearBIt. Currently, the header comment reads: `@pos can be -1 to search for the first set bit.` However, this statement is false. We can prove this by referencing the virbitmaptest functions, i.e virbitmaptest.c:223, in which i = 0 if (virBitmapNextClearBIt(bitmap, -1) != 0) return -1 Because this is a zero set, this case would fail if the header statement was true as is. Signed-off-by: Aaron M. Brown <aaronmbr(a)linux.ibm.com> --- src/util/virbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virbitmap.c b/src/util/virbitmap.c index 8a3f33c806..1a3e75671c 100644 --- a/src/util/virbitmap.c +++ b/src/util/virbitmap.c @@ -948,7 +948,7 @@ virBitmapLastSetBit(virBitmap *bitmap) * @pos: the position after which to search for a clear bit * * Search for the first clear bit after position @pos in bitmap @bitmap. - * @pos can be -1 to search for the first set bit. Position starts + * @pos can be -1 to search for the first clear bit. Position starts * at 0. * * Returns the position of the found bit, or -1 if no bit found. -- 2.39.5 (Apple Git-154)

3 2

[PATCH 0/2] virnetdevvportprofile: Misc cleanups
by Michal Privoznik 23 Jul '25

23 Jul '25

*** BLURB HERE *** Michal Prívozník (2): virnetdevvportprofile: Drop explicit enum virNetDevVPortProfile declaration virnetdevvportprofile: Turn 'virtPortType' of virNetDevVPortProfile into proper enum type src/conf/netdev_vport_profile_conf.c | 11 +++++------ src/hypervisor/virhostdev.c | 1 + src/qemu/qemu_migration_cookie.c | 2 ++ src/util/virnetdevvportprofile.c | 19 ++++++++++++++++--- src/util/virnetdevvportprofile.h | 4 ++-- 5 files changed, 26 insertions(+), 11 deletions(-) -- 2.49.1

2 3

[PATCH 0/5] secdriver: Misc cleanups
by Michal Privoznik 23 Jul '25

23 Jul '25

*** BLURB HERE *** Michal Prívozník (5): security: Drop some G_GNUC_UNUSED attributes security_selinux: Drop needless checks for seclabel->model == "selinux" security_dac: Drop needless checks for seclabel->model == "dac" security_apparmor: Drop needless checks for seclabel->model == "apparmor" security_dac: Drop needles typecast in virSecurityDACGenLabel() src/security/security_apparmor.c | 18 +--------- src/security/security_dac.c | 14 ++------ src/security/security_selinux.c | 59 +++----------------------------- 3 files changed, 8 insertions(+), 83 deletions(-) -- 2.49.1

2 6

[PATCH v2 0/4] Some parsing functions refactor
by Kirill Shchetiniuk 23 Jul '25

23 Jul '25

This patch series is supposed to refactor the existing logic of some parsing functions, changing the previous approach of getting the string fisrt and then parsing the string itself. Now the parsing logic is implemented by using the appropriate virXMLProp* functions. Changelog fromm v1: 1. 'ret' temp value is now 'rc' 2. code style fixes 3. 'id' param is now parsed as not mandatory Kirill Shchetiniuk (4): conf: virNetDevVPortProfileParse refactor util: virSecretLookupParseSecret refactor conf: virDomainChrDefParseTargetXML refactor qemu: qemuDomainObjPrivateXMLParseVcpu refactor src/conf/domain_conf.c | 16 +--- src/conf/netdev_vport_profile_conf.c | 112 +++++++++++---------------- src/qemu/qemu_domain.c | 16 +--- src/util/virsecret.c | 19 ++--- 4 files changed, 55 insertions(+), 108 deletions(-) -- 2.49.0

2 7

libvirt-gitlab-executor - maintainer?
by Kristina Hanicova 23 Jul '25

23 Jul '25

Hello Libvirt friends, Is anyone interested in maintaining this orphaned repository: https://gitlab.com/libvirt/libvirt-gitlab-executor ? It is used in Cryptsetup CI and we would like to upstream some changes. If no one is interested, I am willing to take on the role of the maintainer myself:) Regards, Kristina Hanicova

4 4

[PATCH 0/4] qemu: add support for RBD namespace
by Peter Krempa 23 Jul '25

23 Jul '25

After recent inquiry on libvirt-users I've necromanced this already very old series that I still had laying around. This series: - turns virStorageSource's 'protocol' to real enum - removes virStorageSource's 'volume' - wires in the RBD support Han Han (1): qemu: Add support for RBD namespace. Peter Krempa (3): conf: Turn 'protocol' field of virStorageSource into proper enum type virStorageFileBackendGlusterInit: Refactor cleanup virStorageSource: Eliminate 'volume' field docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 36 ++------- src/conf/domain_validate.c | 2 +- src/conf/storage_source_conf.c | 79 ++++++++++++++++++- src/conf/storage_source_conf.h | 10 ++- src/libvirt_private.syms | 1 + src/libxl/libxl_conf.c | 4 +- src/libxl/xen_xl.c | 4 +- src/qemu/qemu_block.c | 41 ++++++---- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- .../storage_file_backend_gluster.c | 63 ++++++++------- src/storage_file/storage_source.c | 2 - .../storage_source_backingstore.c | 56 ++++--------- .../disk-network-rbd.x86_64-latest.args | 4 +- .../disk-network-rbd.x86_64-latest.xml | 4 +- tests/qemuxmlconfdata/disk-network-rbd.xml | 4 +- 17 files changed, 185 insertions(+), 137 deletions(-) -- 2.49.0

2 6

Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by P, Rajasekar 23 Jul '25

23 Jul '25

Hello libvirt community, I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). **Environment:** - libvirt version: 10.5.0 - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 - Disk image format: qcow2 - Host OS: RHEL 9.5 **Steps to reproduce:** 1. Create an external snapshot: virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic 2. Delete the snapshot: virsh snapshot-delete <vm> --snapshotname snap1 **Observed behavior:** - Changes from the overlay (snapshot) file are merged into the base image. - The snapshot metadata is removed from libvirt. - The snapshot file remains on disk (appears orphaned). **Questions:** - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. - Should the snapshot file be deleted automatically, or is manual cleanup required? - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? Thank you for your help and clarification! Best regards, Raj.

1 0

[RFC PATCH 0/8] Add support for Grace ACPI Extended GPU Memory (EGM) devices
by Ian May 22 Jul '25

22 Jul '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. RFC Status ========== This patch series is submitted as an RFC to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This 8-patch series adds a new device type 'acpi-egm-memory' with the following structure: 1. Schema definition - Add XML schema definition for the new ACPI EGM memory device 2. XML parsing - Implement XML parsing and internal data structures 3. Capability detection - Add QEMU capability detection for EGM support 4. Validation - Add validation logic for EGM device configuration 5. Command generation - Implement QEMU command line generation 6. Resource management - Setup required cgroup and namespace configurations 7. Documentation - Add comprehensive documentation 8. Testing - Add qemuxmlconftest for ACPI EGM memory device XML Configuration ================= Example usage in domain XML: <devices> <hostdev mode="subsystem" type="pci" managed="yes"> <alias name="ua-hostdev0"/> <source> <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </source> </hostdev> <acpiEgmMemory> <alias name="egm0"/> <pciDev>ua-hostdev0</pciDev> <numaNode>0</numaNode> </acpiEgmMemory> </devices> This configuration results in appropriate QEMU command line options: -object memory-backend-file,id=m0,mem-path=/dev/egm0,size=32G,share=on,prealloc=on -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 Implementation Notes ==================== The device validation includes checking that referenced PCI devices exist, NUMA nodes are valid, and device paths are accessible with proper permissions. Memory backing is configured automatically to use the EGM device path, and cgroups/namespaces are set up to allow safe access. Testing ======= I've tested XML parsing, validation, and qemu command line generation. The qemuxmlconftest passes for XML handling, though the command generation test currently fails since QEMU doesn't have acpi-egm-memory support yet, but the generated args look correct for when it does. Requirements ============ This feature requires: - NVIDIA ARM64 Grace platform with EGM support - Host kernel with EGM driver support [1] - QEMU with ACPI EGM device support [2] [1] https://github.com/ianm-nv/NV-Kernels/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (8): conf: Add schema definition for ACPI EGM memory device conf: Add definitions and XML parsing for ACPI EGM memory device qemu: Add capability detection for ACPI EGM memory device qemu: Add validation for ACPI EGM memory device configuration qemu: Add command line generation for ACPI EGM memory device qemu: Add cgroup and namespace setup for ACPI EGM memory device docs: Document ACPI EGM memory device tests: Add qemuxmlconftest for ACPI EGM memory device docs/formatdomain.rst | 80 ++++++++++++++ src/ch/ch_domain.c | 1 + src/conf/domain_conf.c | 102 ++++++++++++++++++ src/conf/domain_conf.h | 11 ++ src/conf/domain_postparse.c | 8 ++ src/conf/domain_validate.c | 23 ++++ src/conf/schemas/domaincommon.rng | 19 ++++ src/conf/virconftypes.h | 2 + src/libxl/libxl_driver.c | 6 ++ src/lxc/lxc_driver.c | 6 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 21 ++++ src/qemu/qemu_command.c | 37 +++++++ src/qemu/qemu_domain.c | 2 + src/qemu/qemu_domain_address.c | 2 + src/qemu/qemu_driver.c | 3 + src/qemu/qemu_hotplug.c | 5 + src/qemu/qemu_namespace.c | 21 ++++ src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_validate.c | 99 +++++++++++++++++ src/test/test_driver.c | 4 + tests/meson.build | 1 + .../caps_10.0.0_aarch64.xml | 1 + tests/qemuegmmock.c | 67 ++++++++++++ .../acpi-egm-memory.aarch64-latest.args | 1 + .../acpi-egm-memory.aarch64-latest.xml | 56 ++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 27 +++++ tests/qemuxmlconftest.c | 5 +- 29 files changed, 613 insertions(+), 1 deletion(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

1 8

[PATCH] news: document new crypto TLS priority string settings
by Daniel P. Berrangé 22 Jul '25

22 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c7885f01a0..e5e8626729 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -24,6 +24,14 @@ v11.6.0 (unreleased) flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. + * Allow control over QEMU TLS priority strings + + The qemu.conf file now has multiple settings allowing control over the + QEMU TLS priority strings, for the different subsystems in QEMU that + can support TLS. This can be used to workaround a current bug in GNUTLS + that is liable to cause crashes of the source QEMU when performing long + running live migration operations with TLS enabled. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.50.1

2 1

[PATCH 00/19] security_selinux: Refactor temporary variable cleanup
by Peter Krempa 22 Jul '25

22 Jul '25

Some cleanups resutling from analyzing some selinux code. Peter Krempa (19): security/security_driver.c/h: Fix function header formatting virSecuritySELinuxTransactionRun: Refactor cleanup virSecuritySELinuxMCSFind: Refactor variable clearing virSecuritySELinuxRestoreFileLabel: Refactor cleanup virSecuritySELinux(Set|Restore)TPMFileLabel: Automatically free 'cancel_path' virSecuritySELinuxRestoreFileLabels: Refactor variable freeing virSecuritySELinux(Set|Restore)HostdevCapsLabel: Refactor cleanup virSecuritySELinux(Set|Restore)ChardevLabel: Refactor cleanup virSecuritySELinuxSet(Daemon)SocketLabel: Refactor cleanup virSecuritySELinuxSetTapFDLabel: Refactor cleanup security_selinux: Declare internal autoptr cleanup helper for 'context_t' virSecuritySELinuxContextAddRange: Refactor cleanup of 'context_t' virSecuritySELinuxGenNewContext: Refactor cleanup virSecuritySELinuxReserveLabel: Refactor cleanup virSecuritySELinuxGetProcessLabel: Automatically free 'ctx' temp variable virSecuritySELinuxSetFilecon: Automatically free 'econ' temp variable virSecuritySELinuxRestoreInputLabel: Return values directly virSecuritySELinuxGenImageLabel: Refactor cleanup virSecuritySELinuxGetSecurityMountOptions: refactor printing src/security/security_driver.c | 5 +- src/security/security_driver.h | 5 +- src/security/security_selinux.c | 347 +++++++++++++------------------- 3 files changed, 149 insertions(+), 208 deletions(-) -- 2.50.0

2 20

[PATCH v2 0/1] nwfilter: Check before removing and reinserting iptable base chains
by Dion Bosschieter 22 Jul '25

22 Jul '25

Thanks for the feedback. I've applied the iptables -L with a callback handler. The callback handler then decides whether or not to create the base chains. I changed the commit message from "nwfilter: Avoid firewall hole during VM startup by checking rule presence" to "nwfilter: Check before removing and reinserting iptable base chains". I also edited nwfilterxml2firewalltest, so it pretends that currently there are no chains and I changed the expected order of the commonRules. Dion Bosschieter (1): nwfilter: Check before removing and reinserting iptable base chains src/nwfilter/nwfilter_ebiptables_driver.c | 203 +++++++++++++--------- tests/nwfilterxml2firewalltest.c | 58 +++++-- 2 files changed, 163 insertions(+), 98 deletions(-) -- 2.43.0

2 2

[PATCH] qemu: driver: Reformat function headers for block job APIs
by Peter Krempa 22 Jul '25

22 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7c203e32fe..a0f770b053 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14552,8 +14552,11 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, } static int -qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, - unsigned long bandwidth, unsigned int flags) +qemuDomainBlockRebase(virDomainPtr dom, + const char *path, + const char *base, + unsigned long bandwidth, + unsigned int flags) { virDomainObj *vm; int ret = -1; @@ -14625,8 +14628,11 @@ qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, static int -qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, - virTypedParameterPtr params, int nparams, +qemuDomainBlockCopy(virDomainPtr dom, + const char *disk, + const char *destxml, + virTypedParameterPtr params, + int nparams, unsigned int flags) { virQEMUDriver *driver = dom->conn->privateData; @@ -14703,7 +14709,9 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, static int -qemuDomainBlockPull(virDomainPtr dom, const char *path, unsigned long bandwidth, +qemuDomainBlockPull(virDomainPtr dom, + const char *path, + unsigned long bandwidth, unsigned int flags) { virDomainObj *vm; -- 2.50.0

2 1

[PATCH v2 0/1] network: introduce Packet Filter firewall backend
by Roman Bogorodskiy 22 Jul '25

22 Jul '25

Changes since v1: - Left only firewall backend changes - Build network_pf.c only on FreeBSD - pfAddIPSpecificFirewallRules: error message for lack of IPv6 support I have also added a basic docs/drvnetwork.rst, but I think it would make more sense to include it in the follow up series with the bridge driver changes as with this patch alone pf backend cannot be used just yet. Roman Bogorodskiy (1): network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 1 + src/network/bridge_driver_conf.c | 4 + src/network/bridge_driver_linux.c | 2 + src/network/meson.build | 4 + src/network/network_pf.c | 326 ++++++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 9 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 2

[PATCH] bhyve: implement timeout for bhyveload
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

The bhyveload(8) command does not have a native non-interactive mode. It means that in case of errors, e.g. invalid boot media, it just drops into a loader prompt and waits for user input. This behaviour makes it tricky for users to understand what's going on. To address that, run it with the timeout(1) tool which sends SIGTERM after a certain timeout, and then optionally sends SIGKILL if the command keeps hanging. These timeout values could be configured in the bhyve.conf. Setting timeout to 0 mean that bhyveload(8) will be executed directly, without timeout(1). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve.conf | 9 +++++++ src/bhyve/bhyve_command.c | 25 ++++++++++++++++--- src/bhyve/bhyve_conf.c | 12 +++++++++ src/bhyve/bhyve_utils.h | 3 +++ src/bhyve/libvirtd_bhyve.aug | 4 ++- src/bhyve/test_libvirtd_bhyve.aug.in | 2 ++ .../bhyvexml2argv-bhyveload-timeout.args | 10 ++++++++ .../bhyvexml2argv-bhyveload-timeout.ldargs | 7 ++++++ .../bhyvexml2argv-bhyveload-timeout.xml | 23 +++++++++++++++++ tests/bhyvexml2argvtest.c | 6 +++++ 10 files changed, 96 insertions(+), 5 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml diff --git a/src/bhyve/bhyve.conf b/src/bhyve/bhyve.conf index 2a8baacff3..dc8d3d8fd8 100644 --- a/src/bhyve/bhyve.conf +++ b/src/bhyve/bhyve.conf @@ -5,3 +5,12 @@ # Path to a directory with firmware files. By default it's pointing # to the directory that sysutils/bhyve-firmware installs files into. #firmware_dir = "/usr/local/share/uefi-firmware" + +# Set timeout for the bhyveload(8) command. This might be necessary +# because in case of errors bhyveload(8) drops to an interactive +# loader and hangs indefinitely. These timeout values are passed +# to the timeout(1) command. Please refer to its manual page for more +# details. When timeout is 0, bhyveload is executed directly. +# Units are seconds. +#bhyveload_timeout = 300 +#bhyveload_timeout_kill = 15 diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 5757a41e7e..ab6d6e92e4 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -921,11 +921,28 @@ virAppendBootloaderArgs(virCommand *cmd, virDomainDef *def) } static virCommand * -virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, virDomainDiskDef *disk) +virBhyveProcessBuildBhyveloadCmd(virDomainDef *def, + struct _bhyveConn *driver, + virDomainDiskDef *disk) { virCommand *cmd; - - cmd = virCommandNew("bhyveload"); + g_autoptr(virBhyveDriverConfig) cfg = virBhyveDriverGetConfig(driver); + + if (cfg->bhyveloadTimeout > 0) { + /* TODO: update bhyve_process.c to interpret timeout(1) exit + * codes 124-127 to produce more meaningful error messages */ + cmd = virCommandNew("timeout"); + virCommandAddArg(cmd, "--foreground"); + virCommandAddArg(cmd, "--verbose"); + if (cfg->bhyveloadTimeoutKill > 0) { + virCommandAddArg(cmd, "-k"); + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeoutKill); + } + virCommandAddArgFormat(cmd, "%ds", cfg->bhyveloadTimeout); + virCommandAddArg(cmd, "bhyveload"); + } else { + cmd = virCommandNew("bhyveload"); + } if (def->os.bootloaderArgs == NULL) { VIR_DEBUG("bhyveload with default arguments"); @@ -1212,7 +1229,7 @@ virBhyveProcessBuildLoadCmd(struct _bhyveConn *driver, virDomainDef *def, if (disk == NULL) return NULL; - return virBhyveProcessBuildBhyveloadCmd(def, disk); + return virBhyveProcessBuildBhyveloadCmd(def, driver, disk); } else if (strstr(def->os.bootloader, "grub-bhyve") != NULL) { return virBhyveProcessBuildGrubbhyveCmd(def, driver, devmap_file, devicesmap_out); diff --git a/src/bhyve/bhyve_conf.c b/src/bhyve/bhyve_conf.c index f18b24f91d..182e00ee1d 100644 --- a/src/bhyve/bhyve_conf.c +++ b/src/bhyve/bhyve_conf.c @@ -2,6 +2,7 @@ * bhyve_conf.c: bhyve config file * * Copyright (C) 2017 Roman Bogorodskiy + * Copyright (C) 2025 The FreeBSD Foundation * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -60,6 +61,9 @@ virBhyveDriverConfigNew(void) cfg->libDir = g_strdup_printf("%s/lib/libvirt/bhyve", LOCALSTATEDIR); cfg->nvramDir = g_strdup_printf("%s/nvram", cfg->libDir); + cfg->bhyveloadTimeout = 300; + cfg->bhyveloadTimeoutKill = 15; + return cfg; } @@ -81,6 +85,14 @@ virBhyveLoadDriverConfig(struct _virBhyveDriverConfig *cfg, &cfg->firmwareDir) < 0) return -1; + if (virConfGetValueInt(conf, "bhyveload_timeout", + &cfg->bhyveloadTimeout) < 0) + return -1; + + if (virConfGetValueInt(conf, "bhyveload_timeout_kill", + &cfg->bhyveloadTimeoutKill) < 0) + return -1; + return 0; } diff --git a/src/bhyve/bhyve_utils.h b/src/bhyve/bhyve_utils.h index 9c9ea0a01a..8ed1fa5509 100644 --- a/src/bhyve/bhyve_utils.h +++ b/src/bhyve/bhyve_utils.h @@ -41,6 +41,9 @@ struct _virBhyveDriverConfig { char *firmwareDir; char *libDir; char *nvramDir; + + int bhyveloadTimeout; + int bhyveloadTimeoutKill; }; G_DEFINE_AUTOPTR_CLEANUP_FUNC(virBhyveDriverConfig, virObjectUnref); diff --git a/src/bhyve/libvirtd_bhyve.aug b/src/bhyve/libvirtd_bhyve.aug index b6bee261a6..0fd74d4bb3 100644 --- a/src/bhyve/libvirtd_bhyve.aug +++ b/src/bhyve/libvirtd_bhyve.aug @@ -23,9 +23,11 @@ module Libvirtd_bhyve = let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ] let log_entry = str_entry "firmware_dir" + let bhyveload_timeout = int_entry "bhyveload_timeout" + let bhyveload_timeout_kill = int_entry "bhyveload_timeout_kill" (* Each entry in the config is one of the following three ... *) - let entry = log_entry + let entry = log_entry | bhyveload_timeout | bhyveload_timeout_kill let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/bhyve/test_libvirtd_bhyve.aug.in b/src/bhyve/test_libvirtd_bhyve.aug.in index ec932b4b11..391648e71f 100644 --- a/src/bhyve/test_libvirtd_bhyve.aug.in +++ b/src/bhyve/test_libvirtd_bhyve.aug.in @@ -3,3 +3,5 @@ module Test_libvirtd_bhyve = test Libvirtd_bhyve.lns get conf = { "firmware_dir" = "/usr/local/share/uefi-firmware" } +{ "bhyveload_timeout" = "300" } +{ "bhyveload_timeout_kill" = "15" } diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args new file mode 100644 index 0000000000..153a1d5035 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci-hd,/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs new file mode 100644 index 0000000000..264ae48441 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.ldargs @@ -0,0 +1,7 @@ +timeout \ +--foreground \ +--verbose \ +-k 20s 300s bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml new file mode 100644 index 0000000000..0b8066733d --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-bhyveload-timeout.xml @@ -0,0 +1,23 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 2838b20c29..cc6b17233d 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -165,6 +165,8 @@ mymain(void) driver.config->firmwareDir = fakefirmwaredir; driver.config->nvramDir = fakenvramdir; + driver.config->bhyveloadTimeout = 0; + driver.config->bhyveloadTimeoutKill = 0; # define DO_TEST_FULL(name, flags) \ do { \ @@ -305,6 +307,10 @@ mymain(void) driver.bhyvecaps &= ~BHYVE_CAP_VNC_PASSWORD; DO_TEST_FAILURE("vnc-password"); + driver.config->bhyveloadTimeout = 300; + driver.config->bhyveloadTimeoutKill = 20; + DO_TEST("bhyveload-timeout"); + virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); virPortAllocatorRangeFree(driver.remotePorts); -- 2.49.0

2 1

[PATCH] bhyve: don't reset domain autostart flag on destroy
by Roman Bogorodskiy 21 Jul '25

21 Jul '25

Currently, virBhyveProcessStop() uses the virDomainDeleteConfig() helper to clean up domain status. It passes BHYVE_STATE_DIR as a configuration dir and NULL as autostart dir, so the helper does its job, even though it has a different purpose. However, the issue is that it also resets the autostart (and autostartOnce) property. This results in a situation that when a persistent domain with autostart enabled gets destroyed, its autostart state is reported as disabled, which is not correct. To fix that, implement the bhyveProcessRemoveDomainStatus() which removes the status file without side effects on the virDomainObj object. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_process.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 5e77a9c4d6..79be6f7aba 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -427,6 +427,17 @@ virBhyveProcessStart(bhyveConn *driver, return virBhyveProcessStartImpl(driver, vm, reason); } +static void +bhyveProcessRemoveDomainStatus(const char *statusDir, + const char *name) +{ + g_autofree char *file = virDomainConfigFile(statusDir, name); + + if (unlink(file) < 0 && errno != ENOENT && errno != ENOTDIR) + VIR_WARN("Failed to remove domain XML for %s: %s", + name, g_strerror(errno)); +} + int virBhyveProcessStop(struct _bhyveConn *driver, virDomainObj *vm, @@ -483,7 +494,7 @@ virBhyveProcessStop(struct _bhyveConn *driver, cleanup: virPidFileDelete(BHYVE_STATE_DIR, vm->def->name); - virDomainDeleteConfig(BHYVE_STATE_DIR, NULL, vm); + bhyveProcessRemoveDomainStatus(BHYVE_STATE_DIR, vm->def->name); return ret; } -- 2.49.0

2 1

[PATCH 0/2] meson: Report library versions in the summary
by Michal Privoznik 18 Jul '25

18 Jul '25

Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1934463449 and if you shod individual builds you can see these in action. Michal Prívozník (2): meson: Convert attr_dep to dependency() meson: Report library versions in the summary meson.build | 77 ++++++++++++++++++++++++++--------------------------- 1 file changed, 38 insertions(+), 39 deletions(-) -- 2.49.1

2 3

[PATCH] qemu_tpm: Do not use persistent definition during pre-start checks
by Martin Kletzander 18 Jul '25

18 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Commit 3451987fca7c used the persistent TPM Definition in both calls to qemuTPMVirCommandSwtpmAddTPMState() but in one of the two cases it might've been NULL and what's more, it is not the right definition which should've been used. Change that to @tpm which is the current definition. The other call does not have access to the current definition and is only called during updating the profile. But for the sake of fewer future mistakes, keep the other one as is because there is no issue with calling it that way and adding logic that just skips the extra check on NULL could mistake someone in the future. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 5cb678df0eee..4c9445d72c39 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -852,7 +852,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArgFormat(cmd, "type=unixio,path=%s,mode=0600", tpm->data.emulator.source->data.nix.path); - qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, persistentTPMDef, cfg); + qemuTPMVirCommandSwtpmAddTPMState(cmd, &tpm->data.emulator, tpm, cfg); virCommandAddArg(cmd, "--log"); if (tpm->data.emulator.debug != 0) -- 2.50.1

2 1

[PATCH 0/6] nss: Rework debugging
by Michal Privoznik 18 Jul '25

18 Jul '25

I've been debugging a problem with NSS plugin recently [1] and the fact that I had to recompile libvirt just to enable debugging printings for the NSS plugin turned out very inconvenient. Make the debug printings env var dependant and add a few more printings. 1: https://bugzilla.redhat.com/show_bug.cgi?id=2364285 Michal Prívozník (6): nss: Promote debug message to proper error when time() fails nss: Move logging into a separate file and turn it temporarily on nss: Make logging conditional on an envvar nss: Include filename in debug printings nss: Print module name nss: Debug print JSON files as they are parsed build-aux/syntax-check.mk | 2 +- docs/nss.rst | 13 ++++++ tools/nss/libvirt_nss.c | 8 +++- tools/nss/libvirt_nss.h | 30 +----------- tools/nss/libvirt_nss_leases.c | 12 +++-- tools/nss/libvirt_nss_log.c | 85 ++++++++++++++++++++++++++++++++++ tools/nss/libvirt_nss_log.h | 41 ++++++++++++++++ tools/nss/meson.build | 1 + 8 files changed, 158 insertions(+), 34 deletions(-) create mode 100644 tools/nss/libvirt_nss_log.c create mode 100644 tools/nss/libvirt_nss_log.h -- 2.49.0

3 10

[PATCH 0/3] qemu_tpm: Do not pollute logs with unnecessary warning
by Martin Kletzander 18 Jul '25

18 Jul '25

https://issues.redhat.com/browse/RHEL-80155 Martin Kletzander (3): qemu_tpm: Rename qemuTPMHasSharedStorage -> qemuTPMDomainHasSharedStorage qemu_tpm: Extract per-TPM functionality from qemuTPMDomainHasSharedStorage qemu_tpm: Only warn about missing locking feature on shared filesystems src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_tpm.c | 75 +++++++++++++++++++++++---------------- src/qemu/qemu_tpm.h | 4 +-- 3 files changed, 47 insertions(+), 34 deletions(-) -- 2.50.1

4 8

[PATCH 0/3] qemu: workaround for GNUTLS bug hitting live migration
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

This is a workaround for existing running QEMU processes which are susceptible to a GNUTLS crasher bug with non-multifd live migration: https://gitlab.com/qemu-project/qemu/-/issues/1937 which in turn is caused by a gnutls regression https://gitlab.com/gnutls/gnutls/-/issues/1717 Even if gnutls is fixed, running QEMU processes are still at risk until restarted, and that can't be done without live migrating workloads off, which triggers the bug we're trying to avoid. The only way to avoid this for running QEMU processes is to change the crypto priority string. On Fedora / RHEL distros we can do this on the target QEMU using /etc/crypto-policies configs, but many other distros have now adopted this - hint: this is a very useful thing to adopt. This series gives a more targetted workaround that is compatible with all distros and can be configured on either the source or dst hosts and whose impact is limited just to live migration. Daniel P. Berrangé (3): qemu: fix order of VNC TLS config entries qemu: sanitize blank lines in config file qemu: add ability to set TLS priority string with QEMU src/conf/storage_source_conf.c | 2 + src/conf/storage_source_conf.h | 1 + src/qemu/libvirtd_qemu.aug | 8 +- src/qemu/qemu.conf.in | 99 +++++++++++++++++-- src/qemu/qemu_backup.c | 5 +- src/qemu/qemu_blockjob.c | 1 + src/qemu/qemu_command.c | 15 ++- src/qemu/qemu_command.h | 1 + src/qemu/qemu_conf.c | 22 +++++ src/qemu/qemu_conf.h | 6 ++ src/qemu/qemu_domain.c | 3 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_hotplug.c | 4 +- src/qemu/qemu_hotplug.h | 1 + src/qemu/qemu_migration_params.c | 1 + src/qemu/test_libvirtd_qemu.aug.in | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 2 +- ...graphics-vnc-tls-secret.x86_64-latest.args | 2 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 6 ++ 20 files changed, 170 insertions(+), 20 deletions(-) -- 2.50.1

2 6

Re: download.libvirt.org HTTPS certificate expired causing download failures
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

On Fri, Jul 18, 2025 at 10:36:53AM +0000, Song, Jiaying (CN) wrote: > Hello libvirt team, > > I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. > > This causes download failures in automated builds and package fetching processes. For example, wget reports: > > wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz > ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': > Issued certificate has expired. > > Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? > > Thank you very much for your help! FYI, we connected on IRC and I got this sorted out. It was a result of us having to move to a new physical server on short notice a few weeks ago, combined with an OS upgrade from RHEL 7 to 9. We copied the certs, but failed to setup acme-tiny again on the new machine to renew them. In 3 months time we'll find out if I got the acme-tiny config correct, so if anyone notices problems at that time let me know.... With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH 0/7] tls: Improve validation of certificates if multiple certs are concatenated in one file
by Peter Krempa 18 Jul '25

18 Jul '25

Our code handled properly only multiple CA certs in one file. This patch extends the validation also to multiple client/server certs in one file. Peter Krempa (7): rpc: virnettlscontext: Fix formatting of function definitions virNetTLSContextNewPath: Refactor temporary variable usage virNetTLSCertCheckPair: Fix function definition formatting rpc: virnettlscert: Rename virNetTLSCertLoadCAListFromFile to virNetTLSCertLoadListFromFile virPKIValidateIdentity: Validate all concatenated certificates virNetTLSCertSanityCheck: Validate all concatenated certs Remove unused 'virNetTLSCertLoadFromFile' src/rpc/virnettlscert.c | 94 ++++++++++++-------------------------- src/rpc/virnettlscert.h | 6 ++- src/rpc/virnettlscontext.c | 89 +++++++++++++++++------------------- tools/virt-pki-validate.c | 20 ++++++-- 4 files changed, 90 insertions(+), 119 deletions(-) -- 2.50.0

2 16

download.libvirt.org HTTPS certificate expired causing download failures
by Song, Jiaying (CN) 18 Jul '25

18 Jul '25

Hello libvirt team, I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. This causes download failures in automated builds and package fetching processes. For example, wget reports: wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': Issued certificate has expired. Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? Thank you very much for your help! Best regards, Jiaying.

1 0

[PATCH 0/6] Make virConnectBaselineHypervisorCPU a bit more sane
by Jiri Denemark 18 Jul '25

18 Jul '25

See 2/6 for description of the issue this series is trying to deal with. Jiri Denemark (6): cpu: Show input CPU model names in debug log Clarify documentation of virConnectBaselineHypervisorCPU Change documentation style of virConnectBaselineCPUFlags Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag qemu: Implement VIR_CONNECT_BASELINE_CPU_IGNORE_HOST virsh: Add support for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag docs/manpages/virsh.rst | 20 +++++++++++++++----- include/libvirt/libvirt-host.h | 9 +++++++-- src/cpu/cpu.c | 2 +- src/libvirt-host.c | 30 +++++++++++++++++++++--------- src/qemu/qemu_driver.c | 30 +++++++++++++++++++++--------- tools/virsh-host.c | 8 ++++++++ 6 files changed, 73 insertions(+), 26 deletions(-) -- 2.50.0

3 9

[PATCH] src: fix typo in fixup_name()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Similar branches in the if-else structure look like bad copy-paste. Fix the typo. Fixes: a559ffec44 (src: rewrite ACL rule checker in Python) Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- scripts/check-aclrules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-aclrules.py b/scripts/check-aclrules.py index ed6805058b..13aed99243 100755 --- a/scripts/check-aclrules.py +++ b/scripts/check-aclrules.py @@ -88,7 +88,7 @@ def fixup_name(name): elif name.endswith("Mac"): name = name[:-3] + "MAC" elif name.endswith("Cpu"): - name = name[:-3] + "MAC" + name = name[:-3] + "CPU" elif name.endswith("Os"): name = name[:-2] + "OS" elif name.endswith("Nmi"): -- 2.39.2

2 1

[PATCH v2 0/5] bhyve: TCP console support
by Roman Bogorodskiy 17 Jul '25

17 Jul '25

Changes since v1: I misunderstood semantics of the 'mode' attribute of the <source> element, and used 'connect' while I should have used 'bind', because bhyve listens on the TCP socket and client connects to using using netcat (or any other similar tool). Now it's using the 'bind' value. Other changes: added validation to bhyve_domain.c, and unified error messages used in bhyve_command.c and bhyve_domain.c Roman Bogorodskiy (5): bhyve: support serial type 'tcp' bhyve: increase number of supported consoles to 4 docs: drvbhyve: document TCP console support bhyve: validate serial devices validation bhyve: sync error messages docs/drvbhyve.rst | 19 ++++++ src/bhyve/bhyve_capabilities.c | 3 +- src/bhyve/bhyve_command.c | 42 +++++++++----- src/bhyve/bhyve_domain.c | 27 +++++++++ .../bhyvexml2argv-4-consoles.args | 15 +++++ .../bhyvexml2argv-4-consoles.ldargs | 4 ++ .../bhyvexml2argv-4-consoles.xml | 35 +++++++++++ .../bhyvexml2argv-serial-invalid-port.args | 12 ++++ .../bhyvexml2argv-serial-invalid-port.ldargs | 4 ++ .../bhyvexml2argv-serial-invalid-port.xml | 28 +++++++++ .../bhyvexml2argv-serial-tcp.args | 12 ++++ .../bhyvexml2argv-serial-tcp.ldargs | 4 ++ .../bhyvexml2argv-serial-tcp.xml | 27 +++++++++ tests/bhyvexml2argvtest.c | 3 + .../bhyvexml2xmlout-4-consoles.xml | 58 +++++++++++++++++++ .../bhyvexml2xmlout-serial-tcp.xml | 46 +++++++++++++++ tests/bhyvexml2xmltest.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + 20 files changed, 328 insertions(+), 16 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-4-consoles.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-serial-tcp.xml -- 2.49.0

2 8

[PATCH] virshFindDisk: fix NULL-dereference of xmlCopyNode() result
by Anastasia Belova 17 Jul '25

17 Jul '25

xmlCopyNode() may return NULL. Add a check and log an error in this case. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 22766a1a53 ("virshFindDisk: Sanitize use of 'tmp' variable") Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> --- tools/virsh-domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 7253596f4a..8752294784 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12875,6 +12875,10 @@ virshFindDisk(const char *doc, STREQ_NULLABLE(sourceDir, path) || STREQ_NULLABLE(sourceName, path)) { xmlNodePtr ret = xmlCopyNode(nodes[i], 1); + if (!ret) { + vshError(NULL, "%s", _("Failed to copy node")); + return NULL; + } /* drop backing store since they are not needed here */ virshDiskDropBackingStore(ret); return ret; -- 2.43.0

3 2

[PATCH] network: fix memory leak in networkAddFirewallRules()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Add g_clear_pointer() to networkAddFirewallRules() after using virSetError() to free errInitV4 and errInitV6 to avoid memory leaks. Fixes: ef760a4133 (Revert "network: support setting firewalld zone for bridge device of open networks") Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- src/network/bridge_driver_linux.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 86f6a5915f..93d4d2c8ee 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -413,6 +413,7 @@ networkAddFirewallRules(virNetworkDef *def, (virNetworkDefGetIPByIndex(def, AF_INET, 0) || virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { virSetError(errInitV4); + g_clear_pointer(&errInitV4, virFreeError); return -1; } @@ -421,6 +422,7 @@ networkAddFirewallRules(virNetworkDef *def, virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || def->ipv6nogw)) { virSetError(errInitV6); + g_clear_pointer(&errInitV6, virFreeError); return -1; } -- 2.39.2

2 1

[PATCH 0/2] Introduce hardware UUID (hwuuid) element
by Mark Cave-Ayland 17 Jul '25

17 Jul '25

Following on from the discussions at [1] and more recently [2], this series introduces a new hardware UUID (hwuuid) element that allows an external UUID to be provided to the guest, as opposed to the libvirt domain UUID. The use case for this feature is to allow a domain to cloned and then restarted without changing its guest-visible UUID e.g. via dmidecode. Patch 1 introduces the new hardware UUID (hwuuid) element along with an implementation for the QEMU driver, whilst patch 2 adds additional tests to ensure the hwuuid functionality is working as expected. Note that from reading the source it doesn't appear as if all virtualisation platforms will support this feature: I've included the relevant changes for the QEMU driver since that is what we use here at Nutanix. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HGFT… Mark Cave-Ayland (2): conf: introduce hardware UUID (hwuuid) element qemuxmlconftest: add tests for new hardware UUID (hwuuid) element docs/formatdomain.rst | 7 ++++ src/conf/domain_conf.c | 38 +++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 6 ++- ...hwuuid-smbios-uuid-match.x86_64-latest.err | 1 + .../hwuuid-smbios-uuid-match.xml | 36 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 35 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/hwuuid.xml | 30 ++++++++++++++ tests/qemuxmlconftest.c | 3 ++ 11 files changed, 199 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.xml -- 2.43.0

2 4