- Devel - libvirt List Archives

[PATCH 0/2] ci: Bump to Debian 13 and drop Cirrus
by Michal Privoznik 02 Jun '26

02 Jun '26

Green(-ish) pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2569490163 Failed jobs are unrelated to this change. Michal Prívozník (2): ci: regenerate with 'lcitool manifest' ci: Drop cirrus ci/README.rst | 58 ------ ci/buildenv/debian-12-cross-mips64el.sh | 109 ----------- ci/buildenv/debian-12-cross-mipsel.sh | 109 ----------- ...-aarch64.sh => debian-13-cross-aarch64.sh} | 0 ...ss-armv6l.sh => debian-13-cross-armv6l.sh} | 2 - ...ss-armv7l.sh => debian-13-cross-armv7l.sh} | 3 - ...-cross-i686.sh => debian-13-cross-i686.sh} | 2 - ...-ppc64le.sh => debian-13-cross-ppc64le.sh} | 0 ci/buildenv/debian-13-cross-riscv64.sh | 109 +++++++++++ ...ross-s390x.sh => debian-13-cross-s390x.sh} | 0 ci/buildenv/{debian-12.sh => debian-13.sh} | 0 ci/buildenv/debian-sid-cross-mips64el.sh | 109 ----------- ci/buildenv/debian-sid-cross-riscv64.sh | 109 +++++++++++ ci/cirrus/build.yml | 30 --- ci/cirrus/freebsd-14.vars | 16 -- ci/cirrus/freebsd-15.vars | 16 -- ci/cirrus/macos-14.vars | 16 -- .../debian-12-cross-mips64el.Dockerfile | 115 ----------- .../debian-12-cross-mipsel.Dockerfile | 115 ----------- ...ile => debian-13-cross-aarch64.Dockerfile} | 2 +- ...file => debian-13-cross-armv6l.Dockerfile} | 4 +- ...file => debian-13-cross-armv7l.Dockerfile} | 5 +- ...erfile => debian-13-cross-i686.Dockerfile} | 4 +- ...ile => debian-13-cross-ppc64le.Dockerfile} | 2 +- .../debian-13-cross-riscv64.Dockerfile | 115 +++++++++++ ...rfile => debian-13-cross-s390x.Dockerfile} | 2 +- ...ian-12.Dockerfile => debian-13.Dockerfile} | 2 +- .../debian-sid-cross-mips64el.Dockerfile | 115 ----------- .../debian-sid-cross-riscv64.Dockerfile | 115 +++++++++++ ci/gitlab/build-templates.yml | 53 ------ ci/gitlab/builds.yml | 178 ++++++------------ ci/gitlab/containers.yml | 56 +++--- ci/manifest.yml | 32 +--- 33 files changed, 547 insertions(+), 1056 deletions(-) delete mode 100644 ci/buildenv/debian-12-cross-mips64el.sh delete mode 100644 ci/buildenv/debian-12-cross-mipsel.sh rename ci/buildenv/{debian-12-cross-aarch64.sh => debian-13-cross-aarch64.sh} (100%) rename ci/buildenv/{debian-12-cross-armv6l.sh => debian-13-cross-armv6l.sh} (98%) rename ci/buildenv/{debian-12-cross-armv7l.sh => debian-13-cross-armv7l.sh} (97%) rename ci/buildenv/{debian-12-cross-i686.sh => debian-13-cross-i686.sh} (98%) rename ci/buildenv/{debian-12-cross-ppc64le.sh => debian-13-cross-ppc64le.sh} (100%) create mode 100644 ci/buildenv/debian-13-cross-riscv64.sh rename ci/buildenv/{debian-12-cross-s390x.sh => debian-13-cross-s390x.sh} (100%) rename ci/buildenv/{debian-12.sh => debian-13.sh} (100%) delete mode 100644 ci/buildenv/debian-sid-cross-mips64el.sh create mode 100644 ci/buildenv/debian-sid-cross-riscv64.sh delete mode 100644 ci/cirrus/build.yml delete mode 100644 ci/cirrus/freebsd-14.vars delete mode 100644 ci/cirrus/freebsd-15.vars delete mode 100644 ci/cirrus/macos-14.vars delete mode 100644 ci/containers/debian-12-cross-mips64el.Dockerfile delete mode 100644 ci/containers/debian-12-cross-mipsel.Dockerfile rename ci/containers/{debian-12-cross-aarch64.Dockerfile => debian-13-cross-aarch64.Dockerfile} (99%) rename ci/containers/{debian-12-cross-armv6l.Dockerfile => debian-13-cross-armv6l.Dockerfile} (97%) rename ci/containers/{debian-12-cross-armv7l.Dockerfile => debian-13-cross-armv7l.Dockerfile} (96%) rename ci/containers/{debian-12-cross-i686.Dockerfile => debian-13-cross-i686.Dockerfile} (97%) rename ci/containers/{debian-12-cross-ppc64le.Dockerfile => debian-13-cross-ppc64le.Dockerfile} (99%) create mode 100644 ci/containers/debian-13-cross-riscv64.Dockerfile rename ci/containers/{debian-12-cross-s390x.Dockerfile => debian-13-cross-s390x.Dockerfile} (99%) rename ci/containers/{debian-12.Dockerfile => debian-13.Dockerfile} (98%) delete mode 100644 ci/containers/debian-sid-cross-mips64el.Dockerfile create mode 100644 ci/containers/debian-sid-cross-riscv64.Dockerfile -- 2.53.0

3 4

[PATCHv2] lxc: truncate LOOP_GET_STATUS64.lo_file_name for long loop backing paths
by Radoslaw Smigielski 01 Jun '26

01 Jun '26

From: Radoslaw Smigielski <rsmigiel(a)redhat.com> LXC domains using a file-backed filesystem with the loop driver fail to start when the backing image path is longer than LO_NAME_SIZE (64 bytes, 63 characters plus NUL). virFileLoopDeviceAssociate() treated a failed virStrcpy() into loop_info64.lo_file_name as fatal and reported a misleading virReportSystemError(errno, ...), so users saw errors such as "Unable to set backing file ...: Success" or ENOENT even when the file existed. The kernel only stores a short name in lo_file_name for LOOP_SET_STATUS64 metadata. The backing file is opened by full path. Copy the path with virStrcpy(), allow truncation into lo_file_name, and mark truncation with '*' at LO_NAME_SIZE - 2 to match losetup behavior. Log truncation at debug level only. XML example that failed before this change: <filesystem type='file' accessmode='passthrough'> <driver type='loop' format='raw'/> <source file='/root/demoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.raw'/> <target dir='/'/> </filesystem> Fixes: https://gitlab.com/libvirt/libvirt/-/work_items/63 Signed-off-by: Radoslaw Smigielski <rsmigiel(a)redhat.com> --- src/util/virfile.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index a0c6cb804862..443d0ed9adab 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -995,11 +995,15 @@ int virFileLoopDeviceAssociate(const char *file, lo.lo_flags = LO_FLAGS_AUTOCLEAR; - /* Set backing file name for LOOP_GET_STATUS64 queries */ + /* lo_file_name is loop device name, max length is LO_NAME_SIZE bytes. + * Truncate loop device name if file path is longer than LO_NAME_SIZE, + * and still use the full path to open backing file. */ if (virStrcpy((char *) lo.lo_file_name, file, LO_NAME_SIZE) < 0) { - virReportSystemError(errno, - _("Unable to set backing file %1$s"), file); - goto cleanup; + /* virStrcpy() only returns -1 on truncation. Mark truncation with + * asterisk at position LO_NAME_SIZE-2 to match losetup behavior. */ + lo.lo_file_name[LO_NAME_SIZE - 2] = '*'; + VIR_DEBUG("lo_file_name for '%s' truncated to %d bytes in loop metadata", + file, LO_NAME_SIZE); } if ((fsfd = open(file, O_RDWR)) < 0) { -- 2.54.0

1 0

[PATCH v1 0/7] Add TLS-PSK support for migration
by Abhisek Panda 01 Jun '26

01 Jun '26

QEMU provides the ability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, the patch series introduce the alternative pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. During a migration, the parties negotiate which unique key to utilize for encrypting the migration data. To improve the security further, we utilize different key files for each migration session. Abhisek Panda (7): conf: Add configuration params for TLS-PSK include: define VIR_MIGRATE_TLS_PSK flag qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects include: define VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY include/libvirt/libvirt-domain.h | 31 ++- src/qemu/libvirtd_qemu.aug | 2 + src/qemu/qemu.conf.in | 27 ++- src/qemu/qemu_alias.c | 19 +- src/qemu/qemu_alias.h | 5 +- src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_command.c | 31 ++- src/qemu/qemu_command.h | 8 + src/qemu/qemu_conf.c | 55 ++++- src/qemu/qemu_conf.h | 3 + src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_driver.c | 24 ++- src/qemu/qemu_hotplug.c | 125 +++++++---- src/qemu/qemu_hotplug.h | 43 ++-- src/qemu/qemu_migration.c | 194 ++++++++++++------ src/qemu/qemu_migration.h | 3 + src/qemu/qemu_migration_params.c | 138 ++++++++++--- src/qemu/qemu_migration_params.h | 28 ++- src/qemu/qemu_postparse.c | 2 +- src/qemu/test_libvirtd_qemu.aug.in | 2 + tests/qemumigparamsdata/tls-enabled.json | 2 +- tests/qemumigparamsdata/tls-enabled.reply | 2 +- tests/qemumigparamsdata/tls-enabled.xml | 2 +- tests/qemumigparamsdata/tls-hostname.json | 2 +- tests/qemumigparamsdata/tls-hostname.reply | 2 +- tests/qemumigparamsdata/tls-hostname.xml | 2 +- tests/qemumonitorjsontest.c | 4 +- tests/qemustatusxml2xmldata/upgrade-out.xml | 2 +- .../chardev-backends-json.x86_64-9.1.0.args | 8 +- .../chardev-backends-json.x86_64-latest.args | 8 +- .../chardev-backends.x86_64-9.1.0.args | 8 +- .../chardev-backends.x86_64-latest.args | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 6 +- ...isk-network-tlsx509-nbd.x86_64-latest.args | 6 +- ...-tlsx509-chardev-verify.x86_64-latest.args | 4 +- ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 4 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 4 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 12 ++ 39 files changed, 623 insertions(+), 209 deletions(-) -- 2.39.3

3 13

Release of libvirt-12.4.0
by Jiri Denemark 01 Jun '26

01 Jun '26

The 12.4.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Bump minimum version to QEMU-7.2 The minimal required version of QEMU was bumped to 7.2.0. * New features * resctrl: Add energy monitoring via resctrl's PERF_PKG_MON Add support for Linux kernel 7.0 feature - energy monitoring via resctrl. This allows to monitor per-VM energy consumption on supported platforms. Implemented via ``energytune`` element in ``cputune`` . * Add channel lifecycle domain event Add support for a new domain event which can be used to track the state of any virtio channel. It is similar to guest agent lifecycle event. * bhyve: Add memory tuning support The bhyve driver now allows setting a domain's memory hard limit using the following syntax:: <memtune> <hard_limit unit='G'>1</hard_limit> </memtune> It also implements the ``virDomainGetMemoryParameters()`` and ``virDomainSetMemoryParameters()`` APIs for controlling the memory hard limit of a running domain. * bhyve: Add virtio-console device support Domain XML can now use ``virtio-console`` devices. Among other things, these devices can be used to configure a QEMU Guest Agent:: <devices> <channel type='unix'> <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> <target type='virtio' name='org.qemu.guest_agent.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> </devices> Additionally, the ``virDomainQemuAgentCommand()`` API which allows running arbitrary guest agent commands is now supported. The ``virDomainGetHostname()`` API, used to query the hostname of a guest, now supports using the guest agent as a source of information. * Improvements * vircgroupv2: Implement freezer controller The CGroupV2 code now supports freezer controller which allows suspending and resuming of LXC domains. * virnetdevbandwidth: Only clear qdisc for defined directions Setting a QoS on a vNIC no longer leads to clearing (preconfigured) root queuing discipline ('qdisc`) in both directions (egress, ingress), only the affected one. * Bug fixes * storage: ZFS: Fix incorrect volsize and refreservation on zvol creation When creating a zvol, the ZFS driver listed all volumes in the pool and updated the new volume's size with data from the last volume in the list rather than the matching one. Now it correctly returns on valid one. * esx/vmware: VMs are tracked under different UUIDs by default The VMWare-related drivers were using allegedly unique IDs for domains, but it turned out they were not completely unique, even for the same host. That caused an issue where a different domain could have been acted upon then requested. Unfortunately, to make this work, the UUIDs of all VMWare-related domains will change from this release. In order to use the pre-v12.4.0 behaviour there is a new URI query parameter ``legacy_uuid`` which, if set to ``1``, will revert to the older way of working. * virsh: Provide no auth callbacks for bash completer The bash completer script calls virsh to provide completions. In some cases the underlying virsh might get stuck waiting on input (e.g. password for SSH session). Not anymore. * virauth: Verify virConnectAuth::cb is set in virAuthGetPasswordPath() A check was missing in ``virAuthGetPasswordPath()`` which might lead to crash of the client library when NULL callback was provided. This is now fixed. Enjoy. Jirka

1 0

[PATCH v8 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 01 Jun '26

01 Jun '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently. Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2864 +++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18845 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.43.0

1 4

[RFC patch 00/17] qemu: Unlock VM object while accessing storage (in certain cases)
by Peter Krempa 29 May '26

29 May '26

If a thread is blocked while holding the VM lock, other operations become impossible. This is due to the fact that both listing domains of a daemon requires locking the objects (for accessing the name/uuid/id, but also for filtering). Similarly even if a user has a virDomainPtr instace already looked up invoking an API results into trying to fetch a locked VM object instance which will simply block. This patchset is a path for being able to identify stuff which colud block and similarly to how monitor is accessed unlocking @vm while doing such operation. To show how it's used, we use it when probing disk size data. The patchset obviously needed to refactor stuff first for this to happen. Peter Krempa (17): storage_source: Don't modify @src in 'virStorageSourceUpdatePhysicalSize' virStorageSourceGetSize: Return also 'allocation' value if needed virStorageFileProbeFormatFromBuf: Allow NULL 'path' argument virStorageFileProbeGetMetadata: Allow NULL 'meta->path' virStorageSourceGetMetadataFromBuf: Refactor cleanup virStorageSourceUpdateCapacity: Factor out size probing to 'virStorageSourceProbeCapacityFromBuf' qemu: domain: Introduce 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainGetStatsOneBlock: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuMigrationDstPrepareStorage: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainBlockResize: Rewrite to 'qemuDomainStorageSourceProbeSize' qemu: domain: Remove 'qemuDomainStorageUpdatePhysical' qemuDomainGetStatsOneBlockFallback: Rewrite using 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite using 'qemuDomainStorageSourceProbeSize' qemu: domain: Fix coding style of domain object locking helpers qemu: domain: Introduce APIs for unlocking domain object during potentially long running operations qemuDomainStorageSourceProbeSize: Yield domain object while accessing storage src/libvirt_private.syms | 3 +- src/qemu/qemu_domain.c | 140 ++++++++++++++++++++++--- src/qemu/qemu_domain.h | 19 +++- src/qemu/qemu_driver.c | 143 +++++++------------------- src/qemu/qemu_migration.c | 5 +- src/storage_file/storage_file_probe.c | 20 +++- src/storage_file/storage_source.c | 98 +++++++++++++----- src/storage_file/storage_source.h | 16 ++- 8 files changed, 279 insertions(+), 165 deletions(-) -- 2.54.0

1 17

KVM Forum 2026: Call For Presentations
by Peter Maydell 29 May '26

29 May '26

#################### KVM Forum 2026 November 12-13, 2026 Vancouver, Canada #################### On behalf of the program committee for the KVM Forum, I am pleased to announce the KVM Forum 2026 Call for Presentations. CALL FOR PRESENTATIONS ====================== We encourage you to submit presentations via Pretalx at https://kvm-forum.qemu.org/2026/cfp/ All presentation slots will be 25 minutes + 5 minutes for questions. Suggested topics: - Scalability and Optimization - Hardening and security - Confidential computing KVM and the Linux Kernel - New Features and Architecture Ports - Device Passthrough: VFIO, mdev, vDPA - Network Virtualization - Virtio and vhost Virtual Machine Monitors and Management - VMM Implementation: APIs, Live Migration, Performance Tuning, etc. - Multi-process VMMs: vhost-user, vfio-user, QEMU Storage Daemon - QEMU without KVM: Hypervisor.framework, Hyper-V, etc. - Managing KVM: Libvirt, KubeVirt, Kata Containers Emulation - New Devices, Boards and Architectures - CPU Emulation and Binary Translation Developer-focused content - Tooling improvements - Enabling Rust - Testing frameworks and strategies Speakers are expected to attend in person. IMPORTANT DATES =============== The deadline for submitting presentations is: 2026-08-01 00:00 (Canada/Pacific) Accepted speakers will be notified on August 21, 2026. ATTENDING KVM FORUM =================== The cost of admission to KVM Forum 2026 is $75. You can get your ticket at https://kvm-forum.qemu.org/2026/register/ Admission is free for accepted speakers. The conference will be held at Coast Coal Harbour Hotel Vancouver by APA in Vancouver, Canada. More details about the location, and about the reduced price rooms available for attendees at the conference hotel, can be found at: https://kvm-forum.qemu.org/location/ If you need a visa invitation letter in order to attend, please reach out to the organizers at kvm-forum-pc(a)redhat.com. We are committed to fostering an open and welcoming environment at our conference. Participants are expected to abide by our code of conduct and media policy: https://kvm-forum.qemu.org/coc/ https://kvm-forum.qemu.org/media-policy/ CONTACTS ======== Reach out to us should you have any questions. The program committee may be contacted as a group via email: kvm-forum-pc(a)redhat.com. -- Peter Maydell

1 0

[PATCH] examples: Improved shell output of showDomains
by Daniel Hora 29 May '26

29 May '26

From: Daniel Hora <dhora(a)redhat.com> Improved formatting of the shell output of the function showDomains based on length of the longest domain. Signed-off-by: Daniel Hora <dhora(a)redhat.com> --- examples/c/misc/hellolibvirt.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/examples/c/misc/hellolibvirt.c b/examples/c/misc/hellolibvirt.c index 39cefe934c..77098d7be3 100644 --- a/examples/c/misc/hellolibvirt.c +++ b/examples/c/misc/hellolibvirt.c @@ -4,6 +4,7 @@ #include <stdio.h> #include <stdlib.h> +#include <string.h> #include <libvirt/libvirt.h> #include <libvirt/virterror.h> @@ -44,11 +45,34 @@ showHypervisorInfo(virConnectPtr conn) return 0; } +static int +longestDomain(virDomainPtr *nameList, int numNames) +{ + int longestDomainLength; + size_t i; + + longestDomainLength = 0; + + for (i = 0; i < numNames; i++) { + const char *currentDomain = virDomainGetName(nameList[i]); + + if (currentDomain != NULL) { + int currentDomainLength = strlen(currentDomain); + + if (currentDomainLength > longestDomainLength) { + longestDomainLength = currentDomainLength; + } + } + } + + return longestDomainLength; + +} static int showDomains(virConnectPtr conn) { - int numNames, numInactiveDomains, numActiveDomains; + int numNames, numInactiveDomains, numActiveDomains, longestDomainLength; ssize_t i; int flags = VIR_CONNECT_LIST_DOMAINS_ACTIVE | VIR_CONNECT_LIST_DOMAINS_INACTIVE; @@ -88,9 +112,12 @@ showDomains(virConnectPtr conn) return 1; } + longestDomainLength = longestDomain(nameList, numNames); + for (i = 0; i < numNames; i++) { int active = virDomainIsActive(nameList[i]); - printf(" %8s (%s)\n", + printf(" %-*s (%s)\n", + longestDomainLength, virDomainGetName(nameList[i]), (active == 1 ? "active" : "non-active")); /* must free the returned named per the API documentation */ -- 2.54.0

2 1

Entering freeze for libvirt-12.4.0
by Jiri Denemark 28 May '26

28 May '26

I have just tagged v12.4.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[PATCH 00/10] qemu: Fix CPU feature reporting on AMD CPUs
by Jiri Denemark 28 May '26

28 May '26

See the last patch for detailed description. Jiri Denemark (10): qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel qemu_capabilities: Cache expanded CPU util: Publish and mock virHostCPUGetMSRFromKVM cpu_x86: Introduce virCPUx86DataAddMSR cpu: Introduce virCPUUpdateFeatures Clarify documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES qemu_capabilities: Fix domain capabilities on AMD CPUs docs/manpages/virsh.rst | 4 +- include/libvirt/libvirt-domain.h | 2 +- src/cpu/cpu.c | 33 +++++ src/cpu/cpu.h | 12 ++ src/cpu/cpu_x86.c | 54 ++++++-- src/cpu/cpu_x86.h | 4 + src/libvirt-domain.c | 7 +- src/libvirt_private.syms | 3 + src/qemu/qemu_capabilities.c | 223 ++++++++++++++++++++++--------- src/qemu/qemu_capabilities.h | 7 +- src/qemu/qemu_conf.c | 6 +- src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_driver.c | 15 +-- src/util/virhostcpu.c | 16 ++- src/util/virhostcpu.h | 3 + tests/domaincapstest.c | 2 +- tests/qemucpumock.c | 22 +++ tools/virsh-host.c | 2 +- 18 files changed, 319 insertions(+), 99 deletions(-) -- 2.54.0

3 12