- Devel - libvirt List Archives

[PATCH] qemuxmlconftest: Paper over test failure at MacOS
by Michal Privoznik 13 Aug '25

13 Aug '25

From: Michal Privoznik <mprivozn(a)redhat.com> MacOS has its own dynamic linker (dyld) which is different to Linux/BSD one. But with a little help (by setting "DYLD_FORCE_FLAT_NAMESPACE" env var) it would behave similarly to Linux/BSD ones. In particular, if a library is preloaded via "DYLD_INSERT_LIBRARIES" on MacOS or "LD_PRELOAD" on Linux/BSD, then dlsym(RTLD_NEXT, ...) considers ALL preloaded libraries. For instance, the virFileCanonicalizePath() is reimplemented in virpcimock and qemuxml2argvmock. Each one of these reimplementations uses dlsym(RTLD_NEXT, ...) to look up and call virFileCanonicalizePath() from next library in the queue and possibly even the actual implementation from libvirt.so. This chaining of mocks allows us to have mock libraries that create stable, reproducible environment for tests. Now, because of unknown reason Apple decided to remove the flat namespace feature [1] (I recommend to just clone the repo and view the commit via 'git show' as github's web interface hides interesting bits away). They did so in 2022. And it wasn't until my commit of v11.6.0-19-g12c35ab161 that we've noticed this, because until that commit no two mock reimplemented the same function. Well, now they do and with flat namespaces gone the dlsym(RLTD_NEXT, ...) returns an address from libvirt.so instead of from next mock on the list. Since reimplementation of virFileCanonicalizePath() in qemuxml2argvmock.c is only to cover a case on some Linux systems and virpcimock.c creates full sysfs imitation of PCI devices, the latter is more important than the former. Therefore, switch order of those mocks. On Linux/BSD this has virtually no effect, but on MacOS it fixes the qemuxmlconftest failure. 1: https://github.com/apple-oss-distributions/dyld/commit/9a9e3e4cfa7de205d61f… Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemuxmlconftest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 0d1804f101..4e8eb18705 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -3052,11 +3052,11 @@ mymain(void) } VIR_TEST_MAIN_PRELOAD(mymain, + VIR_TEST_MOCK("virpci"), VIR_TEST_MOCK("qemuxml2argv"), VIR_TEST_MOCK("domaincaps"), VIR_TEST_MOCK("virrandom"), VIR_TEST_MOCK("qemucpu"), - VIR_TEST_MOCK("virpci"), VIR_TEST_MOCK("virnuma")) #else -- 2.49.1

2 1

[PATCH] docs: storage: fix the "since" tag
by Roman Bogorodskiy 13 Aug '25

13 Aug '25

Trivial :since: tag fix in the ZFS section. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- docs/storage.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/storage.rst b/docs/storage.rst index 344d3a32f8..b77e7ef144 100644 --- a/docs/storage.rst +++ b/docs/storage.rst @@ -719,7 +719,7 @@ FreeBSD, and :since:`since 1.3.2` experimental support for `ZFS on Linux <https://zfsonlinux.org/>`__ version 0.6.4 or newer is available. A pool could either be created manually using the ``zpool create`` command and -its name specified in the source section or :since:` since 1.2.9` source devices +its name specified in the source section or :since:`since 1.2.9` source devices could be specified to create a pool using libvirt. Please refer to the ZFS documentation for details on a pool creation. -- 2.49.0

2 1

[PATCH 0/1] cpu_map: fix vmx-* features wrong bitmaps
by Hector Cao 13 Aug '25

13 Aug '25

Hello, I'm unable to make virsh capabilities to detect the right CPU model on an Intel Granite Rapids platform. I would expect the get the CPU model defined in one of the src/cpu_map/x86_GraniteRapids*.xml files. The cause of the wrong detection is the fact that some vmx-* are not correctly detected and considered missing on this platform. When I take a look at the src/cpu_map/x86_features.xml file, I think that some of the vmx-* are wrongly defined. Taking as an example the vmx-apicv-xapic feature, it is defined as the first bit in the EAX register when we read the MSR 0x0000048b . But in Intel specification, this feature is represented as the first bit in the EDX register (32 higher bits). You can find in this submission the patch that fixes this issue, and this for all the affected MSRs. I tested this fix on my Granite Rapids platform and the CPU model is now correctly detected. Hector Cao (1): cpu_map: fix vmx-* features wrong bitmaps src/cpu_map/x86_features.xml | 136 +++++++++++++++++------------------ 1 file changed, 68 insertions(+), 68 deletions(-) -- 2.45.2

3 5

[PATCH] docs: kbase/tlscerts: mention dropped 'encryption_key'
by Sebastian Mitterle 12 Aug '25

12 Aug '25

Older libvirt versions still only work if 'encryption_key' is enabled in the server and client certificates. Add a note. While at it, also add a note that after setting the certificates up, the TLS ports need to be restarted because I haven't found a mention of it elsewhere. Signed-off-by: Sebastian Mitterle <smitterl(a)redhat.com> --- docs/kbase/tlscerts.rst | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/kbase/tlscerts.rst b/docs/kbase/tlscerts.rst index 215d454998..a1ea4d5f21 100644 --- a/docs/kbase/tlscerts.rst +++ b/docs/kbase/tlscerts.rst @@ -213,6 +213,10 @@ clients to reach the server, both with and without domain name qualifiers. If clients are likely to connect to the server by IP address, then one or more 'ip_address' fields should also be added. +Important: If you're running a libvirt version before 11.6.0 you need to also add +``encryption_key`` to the template. Previous versions required this. + + Use the template file as input to a ``certtool`` command to sign the server certificate: @@ -299,7 +303,11 @@ briefly cover the steps. tls_www_client signing_key - and sign by doing: + + Important: If you're running a libvirt version before 11.6.0 you need to also add + ``encryption_key`` to the template. Previous versions required this. + + Create the certificate by running: :: @@ -317,10 +325,17 @@ briefly cover the steps. Troubleshooting TLS certificate problems ---------------------------------------- -failed to verify client's certificate - On the server side, run the libvirtd server with the '--listen' and - '--verbose' options while the client is connecting. The verbose log messages - should tell you enough to diagnose the problem. +* TLS socket + + After setting up your server certificates you'll have to restart the TLS socket + ``systemctl restart virtproxyd-tls.socket`` for modular daemon setup, or + ``systemctl restart libvirtd-tls.socket`` for the monolithic daemon setup. + +* failed to verify client's certificate + + On the server side, run the libvirtd server with the '--listen' and + '--verbose' options while the client is connecting. The verbose log messages + should tell you enough to diagnose the problem. You can use the virt-pki-validate shell script to analyze the setup on the client or server machines, preferably as root. It will try to point out the -- 2.50.1

2 3

[PATCH] qemu: don't warn about missing SMM for CVM firmware
by Daniel P. Berrangé 12 Aug '25

12 Aug '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Neither Intel TDX / AMD SEV(SNP) allow use of SMM, but the EDK2 firmware none the less supports secureboot. Libvirt currently issues bogus warnings about Fedora firmware warning : qemuFirmwareSanityCheck:1575 : Firmware description '/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json' has invalid set of features: requires-smm = 0, secure-boot = 1, enrolled-keys = 1 This removes the warning if the firmware descriptor indicates use of any confidential VM technology. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_firmware.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index f10137144e..dbec068738 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1540,6 +1540,7 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, bool requiresSMM = false; bool supportsSecureBoot = false; bool hasEnrolledKeys = false; + bool cvm = false; for (i = 0; i < fw->nfeatures; i++) { switch (fw->features[i]) { @@ -1552,13 +1553,15 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: hasEnrolledKeys = true; break; - case QEMU_FIRMWARE_FEATURE_NONE: - case QEMU_FIRMWARE_FEATURE_ACPI_S3: - case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_AMD_SEV: case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES: case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP: case QEMU_FIRMWARE_FEATURE_INTEL_TDX: + cvm = true; + break; + case QEMU_FIRMWARE_FEATURE_NONE: + case QEMU_FIRMWARE_FEATURE_ACPI_S3: + case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: case QEMU_FIRMWARE_FEATURE_LAST: @@ -1566,7 +1569,8 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, } } - if ((supportsSecureBoot != requiresSMM) || + if ((!cvm && + (supportsSecureBoot != requiresSMM)) || (hasEnrolledKeys && !supportsSecureBoot)) { VIR_WARN("Firmware description '%s' has invalid set of features: " "%s = %d, %s = %d, %s = %d", -- 2.50.1

3 4

[PATCH] Storage: ZFS: implement `resizeVol` method to support native resize
by George Melikov 12 Aug '25

12 Aug '25

From: George Melikov <mail(a)gmelikov.ru> ZFS doesn't have thick allocations, every allocation is thin-provisioned, so resize operation is essentially a zvol size limit change (`zfs set volsize=X pool/zvol_name`). Shrink is allowed too (which leads to data destruction), but shrink restriction is already implemented in libvirt, so this function doesn't need to check anything. This patch is posted via PR too and has green test runs https://gitlab.com/libvirt/libvirt/-/merge_requests/495 Signed-off-by: George Melikov <mail(a)gmelikov.ru> --- src/storage/storage_backend_zfs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/storage/storage_backend_zfs.c b/src/storage/storage_backend_zfs.c index 178b505e92..33434d0cac 100644 --- a/src/storage/storage_backend_zfs.c +++ b/src/storage/storage_backend_zfs.c @@ -439,6 +439,25 @@ virStorageBackendZFSDeletePool(virStoragePoolObj *pool, return virCommandRun(cmd, NULL); } +static int +virStorageBackendZFSResizeVol(virStoragePoolObj *pool, + virStorageVolDef *vol, + unsigned long long capacity, + unsigned int flags) +{ + virStoragePoolDef *def = virStoragePoolObjGetDef(pool); + g_autoptr(virCommand) resize_cmd = NULL; + + virCheckFlags(0, -1); + + resize_cmd = virCommandNewArgList(ZFS, "set", NULL); + virCommandAddArgFormat(resize_cmd, "volsize=%llu", capacity); + virCommandAddArgFormat(resize_cmd, "%s/%s", + def->source.name, vol->name); + + return virCommandRun(resize_cmd, NULL); +} + virStorageBackend virStorageBackendZFS = { .type = VIR_STORAGE_POOL_ZFS, @@ -450,6 +469,7 @@ virStorageBackend virStorageBackendZFS = { .deletePool = virStorageBackendZFSDeletePool, .uploadVol = virStorageBackendVolUploadLocal, .downloadVol = virStorageBackendVolDownloadLocal, + .resizeVol = virStorageBackendZFSResizeVol, }; -- 2.47.2

2 1

[PATCH 0/5] Cleanup of callers of virDomainDefGetVcpu
by Peter Krempa 12 Aug '25

12 Aug '25

Fix few issues with how virDomainDefGetVcpu is called and in related code. Peter Krempa (5): Unexport virCHProcessSetupVcpu virDomainVcpuDefPostParse: Remove impossible check qemu: domain: Remove unused qemuDomainGetVcpuHalted virCHDomainRefreshThreadInfo: Don't trust vcpu ID returned by hypervisor virCHDomainRefreshThreadInfo: Remove illusion that caller cares about return value src/ch/ch_domain.c | 17 ++++++++++------- src/ch/ch_domain.h | 2 +- src/ch/ch_process.c | 2 +- src/ch/ch_process.h | 3 --- src/conf/domain_postparse.c | 4 ---- src/qemu/qemu_domain.c | 15 --------------- src/qemu/qemu_domain.h | 1 - 7 files changed, 12 insertions(+), 32 deletions(-) -- 2.50.1

2 7

[PATCH v2 0/2] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 12 Aug '25

12 Aug '25

This series adds support for a new 'edid' attribute to the video model to control whether the EDID is visible to the guest. If the 'edid' attribute is unspecified then it is not generated in the domain XML, so the underlying virtualisation platform will continue to use its default. The 'edid' attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> v2 - Rebase onto master - Remove 2nd sentence from v1 patch 1 commit message - Remove unnecessary video->type check in qemu_command.c - Add patch 2 containing qemuxmlconftest test cases Mark Cave-Ayland (2): conf: add support for 'edid' attribute to video model tests/qemuxmlconfdata: add tests for video model 'edid' attribute docs/formatdomain.rst | 8 ++++ src/conf/domain_conf.c | 5 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++ src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_command.c | 3 ++ .../video-bochs-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-none.xml | 36 ++++++++++++++ .../video-bochs-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-off.xml | 36 ++++++++++++++ .../video-bochs-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-bochs-edid-on.xml | 36 ++++++++++++++ .../video-qxl-edid-off-fail.x86_64-latest.err | 1 + .../video-qxl-edid-off-fail.xml | 29 ++++++++++++ .../video-qxl-edid-on-fail.x86_64-latest.err | 1 + .../video-qxl-edid-on-fail.xml | 29 ++++++++++++ .../video-vga-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-none.xml | 36 ++++++++++++++ .../video-vga-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-off.xml | 36 ++++++++++++++ .../video-vga-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-on.xml | 36 ++++++++++++++ .../video-virtio-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../video-virtio-edid-none.xml | 36 ++++++++++++++ .../video-virtio-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-off.xml | 36 ++++++++++++++ .../video-virtio-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-on.xml | 36 ++++++++++++++ tests/qemuxmlconftest.c | 12 +++++ 38 files changed, 1185 insertions(+) create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.xml -- 2.43.0

2 6

[RFC] x86 Host CPU features detection by MSRs
by Hector Cao 12 Aug '25

12 Aug '25

Hello, This mail is a Request for Comment. On recent Intel CPUs, some of the CPU features (mostly vmx-* subfeatures) are listed and controlled via the MSRs (Model Specific Registers) instead of the traditional CPUID instruction method. Right now, libvirt reads the MSR's values via /dev/cpu/*/cpu populated by the msr kernel module. src/cpu/cpu_x86.c: ... /* This is best effort since there might be no way to read the MSR * when we are not running as root. */ for (i = 0; i < nmsrs; i++) { if (virHostCPUGetMSR(msrs[i], &msr) == 0) { virCPUx86DataItem item = { .type = VIR_CPU_X86_DATA_MSR, .data.msr = { ... There are 2 potential issues: 1) As stated in the source code comment above, MSR values read might fail when libvirt is not run as root. 2) MSR values read might fail if the MSR kernel module is not loaded, this is still the case in some of the Linux distros. The issue 2) has been brought up in Ubuntu/Debian : https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/271 but the feedback was to try to fix the issue in the libvirt source code itself. Indeed, libvirt already loads some kernel modules it depends on. For example the NBD kernel module in src/util/virtfile.c ... static bool virFileNBDLoadDriver(void) { if (virKModIsProhibited(NBD_DRIVER)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module: administratively prohibited")); return false; } else { g_autofree char *errbuf = NULL; if ((errbuf = virKModLoad(NBD_DRIVER))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module")); ... Andrea Bolognani's proposal of an approach that could work: 1. try using the unprivileged KVM API is available (or maybe the necessary information is exposed via QMP too?) like how QEMU does; 2. if that fails, try using the privileged /dev API; 3. if that fails too, load the msr module and try again; I would like to have some feedback from the libvirt community about if that is worth tackling these issues and the right way to do that. If we can end up with an agreement in this mail thread, I can work on the solution implementation and send it in a separate submission. Best regards, Hector

3 15

[PATCH v2 0/2] Remove libnl checks specific to Linux
by Akihiko Odaki 12 Aug '25

12 Aug '25

Supersedes: <20250308-require-v1-1-fe6850bf3f30(a)daynix.com> ("[PATCH] util: Require libnl for Linux") Based on previous discussions, this implements yet another approach to fix builds without libnl for Linux. Signed-off-by: Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp> --- Changes in v2: - Rebased. - Link to v1: https://lore.kernel.org/r/20250312-linux-v1-0-e5531bbe9708@daynix.com --- Akihiko Odaki (2): Remove libnl checks specific to Linux virnetlink: Remove stub functions src/libvirt_libnl.syms | 23 +++++ src/libvirt_private.syms | 19 ---- src/meson.build | 6 ++ src/remote/remote_daemon.c | 10 ++- src/util/meson.build | 5 +- src/util/virarptable.c | 2 +- src/util/virnetdev.c | 44 +-------- src/util/virnetdevbridge.c | 29 +----- src/util/virnetlink.c | 216 +++------------------------------------------ src/util/virnetlink.h | 11 +-- tests/virnetdevtest.c | 10 +-- 11 files changed, 64 insertions(+), 311 deletions(-) --- base-commit: 5085c7fd030ed4322608de1128811fc3bf61e201 change-id: 20250312-linux-30e6e1af51a5 Best regards, -- Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp>

1 2