- Devel - libvirt List Archives

[PATCH] secret: Use UMask= in virt-secret-init-encryption.service
by Jim Fehlig 17 Apr '26

17 Apr '26

From: Jim Fehlig <jfehlig(a)suse.com> Switch to using systemd's native UMask= directive, instead of using umask directly in ExecStart=. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/secret/virt-secret-init-encryption.service.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/secret/virt-secret-init-encryption.service.in b/src/secret/virt-secret-init-encryption.service.in index 8fd54002a0..5cf4149188 100644 --- a/src/secret/virt-secret-init-encryption.service.in +++ b/src/secret/virt-secret-init-encryption.service.in @@ -5,4 +5,5 @@ ConditionPathExists=!@localstatedir@/lib/libvirt/secrets/secrets-encryption-key [Service] Type=oneshot -ExecStart=/usr/bin/sh -c 'umask 0077 && (dd if=/dev/random status=none bs=32 count=1 | systemd-creds encrypt --name=secrets-encryption-key - @localstatedir@/lib/libvirt/secrets/secrets-encryption-key)' +UMask=0077 +ExecStart=/usr/bin/sh -c 'dd if=/dev/random status=none bs=32 count=1 | systemd-creds encrypt --name=secrets-encryption-key - @localstatedir@/lib/libvirt/secrets/secrets-encryption-key' -- 2.51.0

2 1

[PATCH pushed] hyperv: Use 'size_t' for variable named 'i'
by Peter Krempa 16 Apr '26

16 Apr '26

From: Peter Krempa <pkrempa(a)redhat.com> Per our syntax check iterator variables ought to be declared as 'size_t'. Fixes: 9a82b2a92fc91e4a46bb7d77cfefe2b2d04a0b6e Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/hyperv/hyperv_wmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index f0be0fa3fb..1e39e6d61f 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -871,7 +871,7 @@ hypervOutputParamReferenceId(WsXmlNodeH node) { WsXmlNodeH selector_set = NULL; WsXmlNodeH selector = NULL; - int i = 0; + size_t i = 0; if (node) selector_set = ws_xml_find_in_tree(node, XML_NS_WS_MAN, "SelectorSet", TRUE); @@ -922,7 +922,7 @@ hypervResponseGetOutputParam(hypervPrivate *priv, char *provider_ns = NULL; const char *rv_str = NULL; int return_code; - int i = 0; + size_t i = 0; body = ws_xml_get_soap_body(response); if (!body) { -- 2.53.0

1 0

[PATCH] virarptable: add FreeBSD support
by Roman Bogorodskiy 15 Apr '26

15 Apr '26

Add a FreeBSD implementation of the virArpTableGet() function. Update the bhyve driver's bhyveDomainInterfaceAddresses() to use it for the VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP source type. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_driver.c | 5 +- src/util/virarptable.c | 105 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 107 insertions(+), 3 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 93c07c6945..c8dd1a728a 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -1868,12 +1868,15 @@ bhyveDomainInterfaceAddresses(virDomainPtr domain, goto cleanup; switch (source) { + case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP: + ret = virDomainNetARPInterfaces(vm->def, ifaces); + break; + case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE: ret = virDomainNetDHCPInterfaces(vm->def, ifaces); break; case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT: - case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP: virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, _("Unsupported IP address data source %1$d"), source); diff --git a/src/util/virarptable.c b/src/util/virarptable.c index 20d11f97b0..2c5a58b695 100644 --- a/src/util/virarptable.c +++ b/src/util/virarptable.c @@ -1,7 +1,8 @@ /* - * virarptable.c Linux ARP table handling + * virarptable.c ARP table handling * * Copyright (C) 2018 Chen Hanxiao + * Copyright (C) 2026 The FreeBSD Foundation * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -22,6 +23,16 @@ #ifdef __linux__ # include <linux/rtnetlink.h> +#elif defined(__FreeBSD__) +# include <sys/types.h> +# include <sys/socket.h> +# include <sys/sysctl.h> +# include <net/if.h> +# include <net/if_dl.h> +# include <net/if_types.h> +# include <netinet/in.h> +# include <net/route.h> +# include <arpa/inet.h> #endif #include "viralloc.h" @@ -145,6 +156,96 @@ virArpTableGet(void) return NULL; } +#elif defined(__FreeBSD__) + +# define ROUNDUP(a) \ + ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long)) +# define ADVANCE(x, n) (x += ROUNDUP((n)->rtm_msglen)) + +virArpTable * +virArpTableGet(void) +{ + int num = 0; + int mib[6]; + size_t needed; + g_autofree char *buf = NULL; + char *next, *lim; + struct rt_msghdr *rtm; + struct sockaddr_in *sin; + struct sockaddr_dl *sdl; + virArpTable *table = NULL; + + mib[0] = CTL_NET; + mib[1] = PF_ROUTE; + mib[2] = 0; + mib[3] = AF_INET; + mib[4] = NET_RT_FLAGS; + mib[5] = RTF_LLINFO; + + if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0) { + virReportSystemError(errno, "%s", _("failed to get ARP table via sysctl")); + return NULL; + } + + if (needed == 0) + return NULL; + + buf = g_new0(char, needed); + + if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) { + virReportSystemError(errno, "%s", _("failed to get ARP table via sysctl")); + return NULL; + } + + table = g_new0(virArpTable, 1); + + lim = buf + needed; + VIR_WARNINGS_NO_CAST_ALIGN + for (next = buf; next < lim;) { + rtm = (struct rt_msghdr *)next; + + if (rtm->rtm_msglen == 0) + break; + + sin = (struct sockaddr_in *)(rtm + 1); + sdl = (struct sockaddr_dl *)((char *)sin + ROUNDUP(sin->sin_len)); + + if (sdl->sdl_alen && + (sdl->sdl_type == IFT_ETHER || sdl->sdl_type == IFT_BRIDGE)) { + g_autofree char *ipstr = NULL; + virSocketAddr virAddr = { 0 }; + virMacAddr macaddr; + char ifmac[VIR_MAC_STRING_BUFLEN]; + + VIR_REALLOC_N(table->t, num + 1); + table->n = num + 1; + + virAddr.len = sizeof(virAddr.data.inet4); + virAddr.data.inet4.sin_family = AF_INET; + virAddr.data.inet4.sin_addr = sin->sin_addr; + ipstr = virSocketAddrFormat(&virAddr); + + table->t[num].ipaddr = g_strdup(ipstr); + + memcpy(macaddr.addr, LLADDR(sdl), VIR_MAC_BUFLEN); + + virMacAddrFormat(&macaddr, ifmac); + + table->t[num].mac = g_strdup(ifmac); + + num++; + } + + ADVANCE(next, rtm); + } + VIR_WARNINGS_RESET + + return table; +} + +# undef ROUNDUP +# undef ADVANCE + #else virArpTable * @@ -155,7 +256,7 @@ virArpTableGet(void) return NULL; } -#endif /* __linux__ */ +#endif void virArpTableFree(virArpTable *table) -- 2.52.0

2 2

[PATCH 02/14] migration/qapi: Rename MigrationStats to MigrationRAMStats
by Peter Xu 15 Apr '26

15 Apr '26

This stats is only about RAM, make it accurate. This paves way for statistics for all devices. Thanks to Markus, who pointed out that docs/devel/qapi-code-gen.rst has a section "Compatibility considerations" stated: Since type names are not visible in the Client JSON Protocol, types may be freely renamed. Even certain refactorings are invisible, such as splitting members from one type into a common base type. Hence this change is not ABI violation according to the document. While at it, touch up the lines to make it read better, correct the restriction on migration status being 'active' or 'completed': over time we grew too many new status that will also report "ram" section. Cc: Daniel P. Berrangé <berrange(a)redhat.com> Cc: devel(a)lists.libvirt.org Reviewed-by: Markus Armbruster <armbru(a)redhat.com> Signed-off-by: Peter Xu <peterx(a)redhat.com> --- docs/about/removed-features.rst | 2 +- qapi/migration.json | 10 +++++----- migration/migration-stats.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index 557a24679a..ccd49b5615 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -699,7 +699,7 @@ was superseded by ``sections``. ``query-migrate`` return value member ``skipped`` (removed in 9.1) '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' -Member ``skipped`` of the ``MigrationStats`` struct hasn't been used +Member ``skipped`` of the ``MigrationRAMStats`` struct hasn't been used for more than 10 years. Removed with no replacement. ``migrate`` command option ``inc`` (removed in 9.1) diff --git a/qapi/migration.json b/qapi/migration.json index 7134d4ce47..e3ad3f0604 100644 --- a/qapi/migration.json +++ b/qapi/migration.json @@ -12,7 +12,7 @@ { 'include': 'sockets.json' } ## -# @MigrationStats: +# @MigrationRAMStats: # # Detailed migration status. # @@ -64,7 +64,7 @@ # # Since: 0.14 ## -{ 'struct': 'MigrationStats', +{ 'struct': 'MigrationRAMStats', 'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' , 'duplicate': 'int', 'normal': 'int', @@ -209,8 +209,8 @@ # If this field is not returned, no migration process has been # initiated # -# @ram: `MigrationStats` containing detailed migration status, only -# returned if status is 'active' or 'completed'(since 1.2) +# @ram: Detailed migration RAM statistics, only returned if migration +# is in progress or completed (since 1.2) # # @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE # migration statistics, only returned if XBZRLE feature is on and @@ -309,7 +309,7 @@ # Since: 0.14 ## { 'struct': 'MigrationInfo', - 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationStats', + 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationRAMStats', '*vfio': 'VfioStats', '*xbzrle-cache': 'XBZRLECacheStats', '*total-time': 'int', diff --git a/migration/migration-stats.h b/migration/migration-stats.h index c0f50144c9..1153520f7a 100644 --- a/migration/migration-stats.h +++ b/migration/migration-stats.h @@ -27,7 +27,7 @@ /* * These are the ram migration statistic counters. It is loosely - * based on MigrationStats. + * based on MigrationRAMStats. */ typedef struct { /* -- 2.53.0

3 3

We are evaluating Intel QAT acceleration for QEMU live migration
by Rohit jadhav 15 Apr '26

15 Apr '26

Hi Team, QEMU uses GnuTLS for TLS migration, while Intel QAT TLS acceleration is available via OpenSSL engine/provider. Is there any supported way to enable QAT acceleration for migration TLS today, or does this require modifying QEMU to use OpenSSL instead of GnuTLS?

3 2

[PATCH] qemu: Add support for 'VIR_DOMAIN_BLOCK_RESIZE_CAPACITY' with qcow2 using the 'data-file' feature
by Peter Krempa 15 Apr '26

15 Apr '26

From: Peter Krempa <pkrempa(a)redhat.com> If a qcow2 image uses a 'data-file' on a local block device we can still honour VIR_DOMAIN_BLOCK_RESIZE_CAPACITY but use the capacity of the data-file instead. The code is modified to first pick the virStorageSource which we'll probe for size based on the config of the VM and uses to determine the new size. Resolves: https://redhat.atlassian.net/browse/RHEL-155809 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 49 ++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 19 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b5ea0086b9..997dbf986c 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9446,6 +9446,7 @@ qemuDomainBlockResize(virDomainPtr dom, const char *nodename = NULL; virDomainDiskDef *disk = NULL; virDomainDiskDef *persistDisk = NULL; + virStorageSource *size_src = NULL; virCheckFlags(VIR_DOMAIN_BLOCK_RESIZE_BYTES | VIR_DOMAIN_BLOCK_RESIZE_CAPACITY | @@ -9495,36 +9496,46 @@ qemuDomainBlockResize(virDomainPtr dom, goto endjob; } - /* The physical capacity is needed both when automatic sizing is requested - * and when a slice is used on top of a block device. + /* When resizing to capacity (or when resizing a device with a storage slice + * -> effectively removing the slice) it's possible that we're dealing with + * a qcow2 image using the 'data-file' feature in which case we want to use + * the size of the data file. Similarly all limitations about the support of + * VIR_DOMAIN_BLOCK_RESIZE_CAPACITY are based on the actual 'data-file' + * which stores the actual blocks and thus represents the capacity. */ - if (virStorageSourceIsBlockLocal(disk->src) && - ((flags & VIR_DOMAIN_BLOCK_RESIZE_CAPACITY) || - disk->src->sliceStorage)) { + if ((flags & VIR_DOMAIN_BLOCK_RESIZE_CAPACITY) || disk->src->sliceStorage) { g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(priv->driver); - if (qemuDomainStorageUpdatePhysical(cfg, vm, disk->src) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, - _("failed to update capacity of '%1$s'"), disk->src->path); - goto endjob; + if (disk->src->dataFileStore) + size_src = disk->src->dataFileStore; + else + size_src = disk->src; + + if (flags & VIR_DOMAIN_BLOCK_RESIZE_CAPACITY) { + if (!qemuBlockStorageSourceIsRaw(size_src) || + !virStorageSourceIsBlockLocal(size_src)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("block resize to full capacity supported only with 'raw' or local block-based disks")); + goto endjob; + } } + if (virStorageSourceIsBlockLocal(size_src)) { + if (qemuDomainStorageUpdatePhysical(cfg, vm, size_src) < 0) { + virReportError(VIR_ERR_OPERATION_FAILED, + _("failed to update capacity of '%1$s'"), size_src->path); + goto endjob; + } + } } if (flags & VIR_DOMAIN_BLOCK_RESIZE_CAPACITY) { - if (!qemuBlockStorageSourceIsRaw(disk->src) || - !virStorageSourceIsBlockLocal(disk->src)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("block resize to full capacity supported only with 'raw' local block-based disks")); - goto endjob; - } - if (size == 0) { - size = disk->src->physical; - } else if (size != disk->src->physical) { + size = size_src->physical; + } else if (size != size_src->physical) { virReportError(VIR_ERR_INVALID_ARG, _("Requested resize to '%1$llu' but device size is '%2$llu'"), - size, disk->src->physical); + size, size_src->physical); goto endjob; } } -- 2.53.0

2 1

[PATCH v2 0/3] qemu: Add infrastructure to prevent accidental disk shrink via 'virDomainBlockResize' (part 1)
by Peter Krempa 15 Apr '26

15 Apr '26

Shrinking a disk accidentally equals data loss and thus very bad time for anyone mis-typing. This series adds a new flag to virDomainBlockResize to prevent such a thing if the user only intends to extend the disk. v2: - extracted only the first part of the series adding the flag preventing shrink and exposing it - the second part dealing with detecting if the flag is supported will be posted later along with a better approach to probe flags Peter Krempa (3): virDomainBlockResizeFlags: Convert to prefix-style docs API/qemu: Introduce 'VIR_DOMAIN_BLOCK_RESIZE_EXTEND' for 'virDomainBlockResize' virsh: blockresize: Introduce '--extend' flag docs/manpages/virsh.rst | 7 ++++++- include/libvirt/libvirt-domain.h | 10 ++++++++-- src/libvirt-domain.c | 5 +++++ src/qemu/qemu_driver.c | 32 +++++++++++++++++++++++++++++++- tools/virsh-domain.c | 7 +++++++ 5 files changed, 57 insertions(+), 4 deletions(-) -- 2.53.0

2 4

[PATCH] bhyve: add blkiotune support
by Roman Bogorodskiy 15 Apr '26

15 Apr '26

FreeBSD supports resource limiting with the rctl(4) framework. It supports various resource types, including I/O resources. It allows to limit resources for users, processes, login classes, and jails. To apply blkiotune limits set limits for the bhyve process. I/O related resources supported by rctl(4) are: readbps filesystem reads, in bytes per second writebps filesystem writes, in bytes per second readiops filesystem reads, in operations per second writeiops filesystem writes, in operations per second Thus, the actual commands look like: rctl -a process:$bhyvepid:writebps:throttle=10000000 rctl -a process:$bhyvepid:readbps:throttle=10000000 rctl -a process:$bhyvepid:writeiops:throttle=20000 rctl -a process:$bhyvepid:readiops:throttle=20000 This is different from the current blkiotune modeling in libvirt as it requires specific device to apply limits to. To adapt this model to per-domain I/O limits, update domain schema to specify "*" as a device name. The rctl(8) may be not available or not enabled, so add a capability check for that. Per process rules get removed when the process disappears, so no special clean up is necessary. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_capabilities.c | 25 +++++++- src/bhyve/bhyve_capabilities.h | 1 + src/bhyve/bhyve_domain.c | 6 ++ src/bhyve/bhyve_process.c | 59 +++++++++++++++++++ src/conf/schemas/domaincommon.rng | 5 +- ...yvexml2argv-blkiotune-multiple-devices.xml | 39 ++++++++++++ .../x86_64/bhyvexml2argv-blkiotune.args | 10 ++++ .../x86_64/bhyvexml2argv-blkiotune.ldargs | 4 ++ .../x86_64/bhyvexml2argv-blkiotune.xml | 32 ++++++++++ tests/bhyvexml2argvtest.c | 2 + .../x86_64/bhyvexml2xmlout-blkiotune.xml | 42 +++++++++++++ tests/bhyvexml2xmltest.c | 2 + 12 files changed, 225 insertions(+), 2 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index c3fb88fe9f..1088d75407 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -24,6 +24,7 @@ #include <config.h> #include <sys/utsname.h> #include <dirent.h> +#include <sys/sysctl.h> #include <sys/types.h> #include "viralloc.h" @@ -40,7 +41,6 @@ VIR_LOG_INIT("bhyve.bhyve_capabilities"); - virCaps * virBhyveCapsBuild(void) { @@ -334,6 +334,27 @@ bhyveProbeCapsVNCPassword(unsigned int *caps, char *binary) } +static int +bhyveProbeCapsRctl(unsigned int *caps) +{ + bool racct_enable; + size_t racct_enable_len; + g_autofree char *rctl = NULL; + + if (!(rctl = virFindFileInPath("rctl"))) + return 0; + + racct_enable_len = sizeof(racct_enable); + if (sysctlbyname("kern.racct.enable", &racct_enable, + &racct_enable_len, NULL, 0) < 0) + return 0; + + if (racct_enable) + *caps |= BHYVE_CAP_RCTL; + + return 0; +} + int virBhyveProbeCaps(unsigned int *caps) { @@ -356,6 +377,8 @@ virBhyveProbeCaps(unsigned int *caps) if ((ret = bhyveProbeCapsVNCPassword(caps, binary))) goto out; + if ((ret = bhyveProbeCapsRctl(caps))) + goto out; out: VIR_FREE(binary); diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 31fd9ab86a..0302b68e22 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -57,6 +57,7 @@ typedef enum { BHYVE_CAP_NVME = 1 << 11, BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, + BHYVE_CAP_RCTL = 1 << 14, } virBhyveCapsFlags; int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps); diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 4594d7673f..48e1451d8b 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -464,6 +464,12 @@ bhyveDomainDefValidate(const virDomainDef *def, } } + if (def->blkio.ndevices > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Per device I/O tuning is not supported")); + return -1; + } + if (!def->os.loader) return 0; diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 1d436da609..b5ebe0aa61 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -34,6 +34,7 @@ #include "bhyve_device.h" #include "bhyve_driver.h" +#include "bhyve_capabilities.h" #include "bhyve_command.h" #include "bhyve_firmware.h" #include "bhyve_monitor.h" @@ -132,6 +133,61 @@ bhyveProcessStopHook(struct _bhyveConn *driver, VIR_HOOK_SUBOP_END, NULL, xml, NULL); } +static int +bhyveSetResourceLimits(struct _bhyveConn *driver, virDomainObj *vm) +{ + virBlkioDevice *device; + char **rules = NULL; + size_t i, nrules = 0; + int ret = -1; + + if (!vm->def->blkio.ndevices) + return 0; + + if ((bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_RCTL) == 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Cannot set resource limits: RACCT/RCTL is either not supported or not enabled")); + return ret; + } + + device = &vm->def->blkio.devices[0]; + +#define BHYVE_APPEND_RCTL_RULE(field, type, format) \ + do { \ + if ((field)) { \ + virBuffer buf = VIR_BUFFER_INITIALIZER; \ + char *rule; \ + virBufferAsprintf(&buf, "process:%d:" type ":throttle=" format, \ + vm->pid, (field)); \ + rule = virBufferContentAndReset(&buf); \ + VIR_APPEND_ELEMENT(rules, nrules, rule); \ + } \ + } while (0) + + BHYVE_APPEND_RCTL_RULE(device->riops, "readiops", "%u"); + BHYVE_APPEND_RCTL_RULE(device->wiops, "writeiops", "%u"); + BHYVE_APPEND_RCTL_RULE(device->rbps, "readbps", "%llu"); + BHYVE_APPEND_RCTL_RULE(device->wbps, "writebps", "%llu"); + +#undef BHYVE_APPEND_RCTL_RULE + + for (i = 0; i < nrules; i++) { + g_autoptr(virCommand) cmd = virCommandNew("rctl"); + virCommandAddArgList(cmd, "-a", rules[i], NULL); + + if (virCommandRun(cmd, NULL) < 0) + goto cleanup; + } + + ret = 0; + + cleanup: + for (i = 0; i < nrules; i++) + VIR_FREE(rules[i]); + VIR_FREE(rules); + return ret; +} + static int virBhyveProcessStartImpl(struct _bhyveConn *driver, virDomainObj *vm, @@ -258,6 +314,9 @@ virBhyveProcessStartImpl(struct _bhyveConn *driver, BHYVE_STATE_DIR) < 0) goto cleanup; + if (bhyveSetResourceLimits(driver, vm) < 0) + goto cleanup; + if (bhyveProcessStartHook(driver, vm, VIR_HOOK_BHYVE_OP_STARTED) < 0) goto cleanup; diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index db1dcd3bb7..c7f442a4c1 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -1049,7 +1049,10 @@ <element name="device"> <interleave> <element name="path"> - <ref name="absFilePath"/> + <choice> + <ref name="absFilePath"/> + <value>*</value> + </choice> </element> <optional> <element name="weight"> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml new file mode 100644 index 0000000000..a6b689ad9a --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml @@ -0,0 +1,39 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>*</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + <device> + <path>/dev/hda</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args new file mode 100644 index 0000000000..507e0be668 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml new file mode 100644 index 0000000000..956d96cf18 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml @@ -0,0 +1,32 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>*</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index b7749fec6f..c098149ad5 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -289,6 +289,8 @@ mymain(void) DO_TEST_FAILURE("slirp-ip"); DO_TEST("virtio-scsi"); DO_TEST("vcpupin"); + DO_TEST("blkiotune"); + DO_TEST_FAILURE("blkiotune-multiple-devices"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml new file mode 100644 index 0000000000..4170303a6e --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml @@ -0,0 +1,42 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <blkiotune> + <device> + <path>*</path> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + </device> + </blkiotune> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <source bridge='virbr0'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 950aaea672..ae12b37064 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -133,6 +133,8 @@ mymain(void) DO_TEST_DIFFERENT("slirp"); DO_TEST_DIFFERENT("virtio-scsi"); DO_TEST_DIFFERENT("numa"); + DO_TEST_DIFFERENT("blkiotune"); + DO_TEST_FAILURE("blkiotune-multiple-devices"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.52.0

2 1

[PATCH] docs: Change TD example policy to 0x10000000
by Zhenzhong Duan 15 Apr '26

15 Apr '26

The definition of BIT0 in policy element comes from TDX spec, but it makes confusion for some customers whether 0 or 1 activates debug: 1. We know that "off-TD debug mode" basically means debug from outside the TD --> 1 activates debug. 2. But when a customer is not aware of the term "off-TD debug" it is very easy to misinterpret this as "TD debug mode off" --> 1 deactivates debug. Given that the policy example uses "0x10000001", the second interpretation even becomes more likely, because a customer may assume that security by default is applied in the example. Thus, change the policy in example configuration to "0x10000000" and update BIT0 definition to be more explicit. Suggested-by: Fuhry Benny <benny.fuhry(a)intel.com> Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)intel.com> --- docs/formatdomain.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 1a4bd4c6e9..b589fc9429 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -9834,7 +9834,7 @@ Example configuration: <domain> ... <launchSecurity type='tdx'> - <policy>0x10000001</policy> + <policy>0x10000000</policy> <mrConfigId>xxx</mrConfigId> <mrOwner>xxx</mrOwner> <mrOwnerConfig>xxx</mrOwnerConfig> @@ -9855,7 +9855,9 @@ Example configuration: ====== ==================================================================================== Bit(s) Description ====== ==================================================================================== - 0 Guest TD runs in off-TD debug mode when set + 0 Activate off-TD debug when set, i.e., activate debug from outside the TD. Its VCPU + state and private memory are accessible by the host VMM. + Deactivate off-TD debug when clear, i.e., deactivate debug from outside the TD. 1:27 reserved 28 Disable EPT violation conversion to #VE on guest TD access of PENDING pages when set 29:63 reserved -- 2.47.3

2 1

[PATCH v3 0/4] hyperv: Add snapshot create/delete support
by Jonathon Jongsma 14 Apr '26

14 Apr '26

Add ability to create and delete basic snapshots in thed hyperv driver. Changes in v3: - Rebase to latest master - update comments about release version 12.2.0 -> 12.3.0 - mention snapshot-create limitations in commit message Changes in v2: - re-word error message about configuring disks / memory for snapshots - split out the utility function for extracting async method output params Jonathon Jongsma (4): hyperv: Add snapshot related WMI class definitions hyperv: Implement domainSnapshotDelete() hyperv: Add a utility function for getting method output params hyperv: Implement domainSnapshotCreateXML() src/hyperv/hyperv_driver.c | 129 ++++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 139 ++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.h | 17 ++++ src/hyperv/hyperv_wmi_generator.input | 42 ++++++++ 4 files changed, 327 insertions(+) -- 2.53.0

2 9