================ libvirt releases ================ This is the list of official releases for libvirt, along with an overview of the changes introduced by each of them. For a more fine-grained view, use the `git log`_. v10.10.0 (unreleased) ===================== * **Security** * **Removed features** * **New features** * qemu: add multi boot device support on s390x For classical mainframe guests (i.e. LPAR or z/VM installations), you always have to explicitly specify the disk where you want to boot from (or "IPL" from, in s390x-speak -- IPL means "Initial Program Load"). In the past QEMU only used the first device in the boot order to IPL from. With the new multi boot device support on s390x that is available with QEMU version 9.2 and newer, this limitation is lifted. If the IPL fails for the first device with the lowest boot index, the device with the second lowest boot index will be tried and so on until IPL is successful or there are no remaining boot devices to try. Limitation: The s390x BIOS will try to IPL up to 8 total devices, any number of which may be disks or network devices. * **Improvements** * **Bug fixes** v10.9.0 (2024-11-01) ==================== * **New features** * qemu: zero block detection for non-shared-storage migration Users can now request that all-zero blocks are not transferred when migrating non-shared disk data without actually enabling zero detection on the disk itself. This allows sparsifying images during migration where the source has no access to the allocation state of blocks at the cost of CPU overhead. This feature is available via the ``--migrate-disks-detect-zeroes`` option for ``virsh migrate`` or ``VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES`` migration parameter. See the documentation for caveats. * **Improvements** * qemu: internal snapshot improvements The qemu internal snapshot handling code was updated to use modern commands which avoid the problems the old ones had, preventing use of internal snapshots on VMs with UEFI NVRAM. Internal snapshots of VMs using UEFI are now possible provided that the NVRAM is in ``qcow2`` format. The new code also allows better control when deleting snapshots. To prevent possible regressions no strict checking is done, but in case inconsistent state is encountered a log message is added:: warning : qemuSnapshotActiveInternalDeleteGetDevices:3841 : inconsistent internal snapshot state (deletion): VM='snap' snapshot='1727959843' missing='vda ' unexpected='' extra='' Users are encouraged to report any occurence of the above message along with steps they took to the upstream tracker. * qemu: improve documentation of image format settings The documentation of the various ``*_image_format`` settings in ``qemu.conf`` imply they can only be used to control compression of the image. The documentation has been improved to clarify the settings describe the representation of guest memory blocks on disk, which includes compression among other possible layouts. * Report CPU model blockers in domain capabilities When a CPU model is reported as usable='no' an additional ```` element is added for that CPU model listing features required by the CPU model, but not supported on the host. v10.8.0 (2024-10-01) ==================== * **Improvements** * network: make networks with ```` more useful It is now permissable to have a ```` network that has no IP address assigned to the host's port of the bridge. This is the only way to create a libvirt network where guests are unreachable from the host (and vice versa) and also 0 firewall rules are added on the host. It is now also possible for a ```` network to use the ``zone`` attribute of ```` to set the firewalld zone of the bridge interface (normally it would not be set, as is done with other forward modes). * storage: Lessen dependancy on the ``showmount`` program Libvirt now automatically detects presence of ``showmount`` during runtime as we do with other helper programs and also the ``daemon-driver-storage-core`` RPM package now doesn't strongly depend on it if the users wish for a more minimal deployment. * Switch from YAJL to json-c for JSON parsing and formatting The parser and formatter in the libvirt library, as well as the parsers in the nss plugin were rewritten to use json-c instead of YAJL, which is effectively dead upstream. * Relax restrictions for memorytune settings It should now be possible to use resctrl on AMD CPUs as well as Intel CPUs when the resctrl filesystem is mounted with ``mba_MBps`` option. * **Bug fixes** * virsh: Fix script-friedly output of ``virsh list --uuid`` The script-friendly output of just 1 UUID per line was mistakenly replaced by the full human-targetted table view full of redundant information and very hard to parse. Users who wish to see the UUIDs in the tabular output need to use ``virsh list --table --uuid`` as old behaviour was reverted. Note that this also broke the ``libvirt-guests`` script. The bug was introduced in `v10.7.0 (2024-09-02)`_. * network/qemu: fix some cases where ``device-update`` of a network interface was failing: * If the interface was connected to a libvirt network that was providing a pool of VFs to be used with macvtap passthrough mode, then *any* update to the interface would fail, even changing the link state. Updating (the updateable parts of) a macvtap passthrough interface will now succeed. * It previously was not possible to move an interface from a Linux host bridge to an OVS bridge. This (and the opposite direction) now works. * qemu: backup: Fix possible crashes when running monitoring commands during backup job The qemu monitor code was fixed to not crash in specific cases when monitoing APIs are called during a backup job. * Fix various memleaks and overflows Multiple memory leaks and overflows in corner cases were fixed based on upstream issues reported. * network: Better cleanup after disappeared networks If a network disappeared while virtnetworkd was not running not all clean up was done properly once the daemon was started, especially when only the network interface disappeared. This could have in some cases resulted in the network being shown as inactive, but not being able to start. * qemu: Remember memory backing directory for domains If ``memory_backing_dir`` is changed during the lifetime of a domain with file backed memory, files in the old directory would not be cleaned up once the domain is shut down. Now the directory that was used during startup is remembered for each running domain. v10.7.0 (2024-09-02) ==================== * **Security** * CVE-2024-8235: Crash of ``virtinterfaced`` via ``virConnectListInterfaces()`` A refactor of the code fetching the list of interfaces for multiple APIs introduced corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of ``virtinterfaced`` if ``virConnectListInterfaces()`` is called requesting 0 networks to be filled. The bug was introduced in libvirt-10.4.0 * **New features** * qemu: Introduce the ability to disable the built-in PS/2 controller It is now possible to control the state of the ``ps2`` feature in the domain XML for descendants of the generic PC machine type (``i440fx``, ``q35``, ``xenfv`` and ``isapc``). * **Improvements** * ch: support restore with network devices Cloud-Hypervisor starting from V40.0 supports restoring file descriptor backed network devices. So, create new net fds and pass them via SCM_RIGHTS to CH during restore operation. * ch: support basic networking modes Cloud-Hypervisor driver now supports Ethernet, Network (NAT) and Bridge networking modes. v10.6.0 (2024-08-05) ==================== * **Removed features** * qemu: Require QEMU-5.2.0 or newer The minimal required version of QEMU was bumped to 5.2.0. * **New features** * qemu: Add support for the 'pauth' Arm CPU feature * Introduce pstore device The aim of pstore device is to provide a bit of NVRAM storage for guest kernel to record oops/panic logs just before it crashes. Typical usage includes usage in combination with a watchdog so that the logs can be inspected after the watchdog rebooted the machine. * **Improvements** * qemu: Set 'passt' net backend if 'default' is unsupported If QEMU is compiled without SLIRP support, and if domain XML allows it, starting from this release libvirt will use passt as the default backend instead. Also, supported backends are now reported in the domain capabilities XML. * qemu: add a monitor to /proc/$pid when killing times out In cases when a QEMU process takes longer to be killed, libvirt might have skipped cleaning up after it. But now a /proc/$pid watch is installed so this does not happen ever again. * **Bug fixes** * virt-aa-helper: Allow RO access to /usr/share/edk2-ovmf When binary version of edk2 is distributed, the files reside under /usr/share/edk2-ovmf. Allow virt-aa-helper to generate paths under that directory. * virt-host-validate: Allow longer list of CPU flags During its run, virt-host-validate parses /proc/cpuinfo to learn about CPU flags. But due to a bug it parsed only the first 1024 bytes worth of CPU flags leading to unexpected results. The file is now parsed properly. * capabilities: Be more forgiving when decoding OEM strings On some systems, OEM strings are scattered in multiple sections. This confused libvirt when generating capabilities XML. Not anymore. v10.5.0 (2024-07-01) ==================== * **New features** * Introduce SEV-SNP support SEV-SNP is introduced as another type of ````. Its support is reported in both domain capabilities and ``virt-host-validate``. * **Improvements** * tools: virt-pki-validate has been rewritten in C The ``virt-pki-validate`` shell script has been rewritten as a C program, providing an output format that matches ``virt-host-validate``, removing the dependency on ``certtool`` and providing more comprehensive checks of the certificate properties. * qemu: implement iommu coldplug/unplug The ```` device can be now cold plugged and/or cold unplugged. * Pass shutoff reason to release hook Sometimes in release hook it is useful to know if the VM shutdown was graceful or not. This is especially useful to do cleanup based on the VM shutdown failure reason in release hook. Starting with this release the last argument 'extra' is used to pass VM shutoff reason in the call to release hook. * nodedev: improve DASD detection In newer DASD driver versions the ID_TYPE tag is supported. This tag is missing after a system reboot but when the ccw device is set offline and online the tag is included. To fix this version independently we need to check if a device detected as type disk is actually a DASD to maintain the node object consistency and not end up with multiple node objects for DASDs. * **Bug fixes** * remote_daemon_dispatch: Unref sasl session when closing client connection A memory leak was identified when a client started SASL but then suddenly closed connection. This is now fixed. * qemu: Fix migration with disabled vmx-* CPU features Migrating a domain with some vmx-* CPU features marked as disabled could have failed as the destination would incorrectly expect those features to be enabled after starting QEMU. * qemu: Fix ``libvirtd``/``virtqemud`` crash when VM shuts down during migration The libvirt daemon could crash when a VM was shut down while being migrated to another host. v10.4.0 (2024-06-03) ==================== * **New features** * qemu: Support for ras feature for virt machine type It is now possible to set on/off ``ras`` feature in the domain XML for virt (Arm) machine type as ````. * SSH proxy for VM Libvirt now installs a binary helper that allows connecting to QEMU domains via SSH using the following scheme: ``ssh user@qemu/virtualMachine``. * qemu: Support for ``virtio`` sound model Sound devices can now be configured to use the virtio model with ````. This model is available from QEMU 8.2.0 onwards. * network: use nftables to setup virtual network firewall rules The network driver can now use nftables rules for the virtual network firewalls, rather than iptables. With the standard build options, nftables is preferred over iptables (with fallback to iptables if nftables isn't installed), but this can be modified at build time, or at runtime via the firewall_backend setting in network.conf. (NB: the nwfilter driver still uses ebtables/iptables). * **Improvements** * qemu: add zstd to supported compression formats Extend the list of supported formats of QEMU save image by adding zstd compression. * qemu: Implement support for hotplugging evdev input devices As of this release, hotplug and hotunplug of evdev ```` devices is supported. * **Bug fixes** * virsh/virt-admin: Fix ``--help`` option for all commands A bug introduced in `v10.3.0 (2024-05-02)`_ caused that the attempt to print help for any command by using the ``--help`` option in ``virsh`` and ``virt-admin`` would print:: $ virsh list --help error: command 'list' doesn't support option --help instead of the help output. A workaround for the affected version is to use the help command:: $ virsh help list * qemu: Fix ``virsh save`` and migration when storage in question is root_squashed NFS Attempting to save a VM to a root_squash NFS mount or migrating with disks hosted on such mount could, in some scenarios, result in error stating:: 'Unknown error 255' The bug was introduced in `v10.1.0 (2024-03-01)`_. * qemu: Don't set affinity for isolcpus unless explicitly requested When starting a domain, by default libvirt sets affinity of QEMU process to all online CPUs. This also included isolated CPUs (``isolcpus=``) which is wrong. As of this release, isolated CPUs are left untouched, unless explicitly configured in domain XML. * qemu_hotplug: Properly assign USB address to hotplugged usb-net device Previously, the network device hotplug logic would try to ensure only CCW or PCI addresses. With recent support for the usb-net model, USB addresses for usb-net network devices are assigned automatically. * qemu: Fix hotplug of ``virtiofs`` filesystem device with `` Some PCI devices have large non-prefetchable memory. This can be a problem in case when such device needs to be hotplugged as the firmware can't foresee such situation. The user thus can override the value calculated at start to accomodate for such devices. * **Improvements** * Improve validation of USB devices Certain USB device types ('sound', 'fs', 'chr', 'ccid' and 'net') were not properly handled in the check whether the VM config supports USB and thus would result in poor error messages. * virsh: Fix behaviour of ``--name`` and ``--parent`` used together when listing checkpoint and snapshots The ``checkpoint-list`` and ``snapshot-list`` commands would ignore the ``--name`` option to print only the name when used with ``--parent``. * Extend libvirt-guests to shutdown only persistent VMs Users can now choose to shutdown only persistent VMs when the host is being shut down. * **Bug fixes** * qemu: Fix migration with custom XML Libvirt 10.2.0 would sometimes complain about incompatible CPU definition when trying to migrate or save a domain and passing a custom XML even though such XML was properly generated as migratable. Hitting this bug depends on the guest CPU definition and the host on which a particular domain was running. * qemu: Fix TLS hostname verification failure in certain non-shared storage migration scenarios In certain scenarios (parallel migration, newly also post-copy migration) libvirt would wrongly pass an empty hostname to QEMU to be used for TLS certificate hostname validation, which would result into failure of the non-shared storage migration step:: error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname * Create OVS ports as transient Libvirt now creates OVS ports as transient which prevents them from reappearing or going stale on sudden reboots. * Clear OVS QoS settings when domain shuts down Libvirt now clears QoS settings on domain shutdown, so they no longer pile up in OVS database. v10.2.0 (2024-04-02) ==================== * **New features** * ch: Basic save and restore support for ch driver The ch driver now supports basic save and restore operations. This is functional on domains without any network, host device config defined. The ``path`` parameter for save and restore should be a directory. * qemu: Support for driver type ``mtp`` in ```` devices The ``mtp`` driver type exposes the ``usb-mtp`` device in QEMU. The guest can access files on this driver through the Media Transfer Protocol (MTP). * qemu: Added support for the loongarch64 architecture It is now possible for libvirt to run loongarch64 guests, including on other architectures via TCG. For the best results, it is recommended to use the upcoming QEMU 9.0.0 release together with the development version of edk2. * qemu: Introduce virDomainGraphicsReload API Reloading the graphics display is now supported for QEMU guests using VNC. This is useful to make QEMU reload the TLS certificates without restarting the guest. Available via the ``virDomainGraphicsReload`` API and the ``domdisplay-reload`` virsh command. * **Bug fixes** * qemu: Fix migration from libvirt older than 9.10.0 when vmx is enabled A domain with vmx feature enabled (which may be even done automatically with ``mode='host-model'``) started by libvirt 9.9.0 or older cannot be migrated to libvirt 9.10.0, 10.0.0, and 10.1.0 as the target host would complain about a lot of extra ``vmx-*`` features. Migration of similar domains started by the affected releases to libvirt 9.9.0 and older does not work either. Since libvirt 10.2.0 migration works again with libvirt 9.9.0 and older in both directions. Migration from the affected releases to 10.2.0 works as well, but the other direction remains broken unless the fix is backported. * node_device: Don't report spurious errors from PCI VPD parsing In last release the PCI Vital Product Data parser was enhanced to report errors but that effort failed as some kernels have the file but don't allow reading it causing logs to be spammed with:: libvirtd[21055]: operation failed: failed to read the PCI VPD data Since the data is used only in the node device XML and errors are ignored if the parsing failed, this release removes all the error reporting. * qemu: set correct SELinux label for unprivileged virtiofsd It is now possible to use virtiofsd-based ```` shares even if the guest is confined using SELinux. * qemu: fix a crash on unprivileged virtiofsd hotplug Hotplugging virtiofsd-based filesystems works now. * virt-admin: Fix segfault when libvirtd dies ``virt-admin`` no longer crashes when ``libvirtd`` unexpectedly closes the connection. v10.1.0 (2024-03-01) ==================== * **Security** * ``CVE-2024-1441``: Fix off-by-one error leading to a crash In **libvirt-1.0.0** there were couple of interface listing APIs introduced which had an off-by-one error. That error could lead to a very rare crash if an array was passed to those functions which did not fit all the interfaces. In **libvirt-5.10** a check for non-NULL arrays has been adjusted to allow for NULL arrays with size 0 instead of rejecting all NULL arrays. However that made the above issue significantly worse since that off-by-one error now did not write beyond an array, but dereferenced said NULL pointer making the crash certain in a specific scenario in which a NULL array of size 0 was passed to the aforementioned functions. * **New features** * nodedev: Support updating mdevs The node device driver has been extended to allow updating mediated node devices. Options are available to target the update against the persistent, active or both configurations of a mediated device. **Note:** The support is only available with at least mdevctl v1.3.0 installed. * qemu: Add support for /dev/userfaultfd On hosts with new enough kernel which supports /dev/userfaultfd libvirt will now automatically grant QEMU access to this device. It's no longer needed to set vm.unprivileged_userfaultfd sysctl. * qemu: Support clusters in CPU topology It is now possible to configure the guest CPU topology to use clusters. Additionally, if CPU clusters are present in the host topology, they will be reported as part of the capabilities XML. * network: Make virtual domains resolvable from the host When starting a virtual network with a new ``register='yes'`` attribute in the ```` element, libvirt will configure ``systemd-resolved`` to resolve names of the connected guests using the name server started for this network. * qemu: Introduce dynamicMemslots attribute for virtio-mem QEMU now allows setting ``.dynamic-memslots`` attribute for virtio-mem-pci devices. When turned on, it allows memory exposed to guest to be split into multiple memory slots and thus smaller memory footprint (see the original commit for detailed explanation). * **Improvements** * nodedev: Add ability to update persistent mediated devices by defining them Existing persistent mediated devices can now also be updated by ``virNodeDeviceDefineXML()`` as long as parent and UUID remain unchanged. * ch: Enable ``ethernet`` interface mode support ```` can now be used for CH domains. * viraccessdriverpolkit: Add missing vtpm case Secrets with ```` were left unable to be checked for in the access driver, i.e. in ACL rules. Missing code was provided. * virt-admin: Notify users to use explicit URI if connection fails ``virt-admin`` doesn't try to guess the URI of the daemon to manage so a failure to connect may be confusing for users if modular daemons are used. Add a hint to use the URI of the dameon to manage. * **Bug fixes** * qemu_process: Skip over non-virtio non-TAP NIC models when refreshing rx-filter If ``trustGuestRxFilters`` is enabled for a vNIC that doesn't support it, libvirt may throw an error when such domain is being started, loaded from a saved state, migrated, etc. These errors are now silenced, but make sure to fix such configurations (after previous release it is even possible to change ``trustGuestRxFilters`` value on live domains via ``virDomainUpdateDeviceFlags()`` or ``virsh device-update``). * domain: Fix check for overlapping ```` devices A bug was identified which caused libvirt to report two NVDIMMs as overlapping even though they weren't. This now fixed. * vmx: Accept empty fileName for cdrom-image Turns out, ``fileName`` attribute (which contains path to CDROM image) can be set to an empty string (``""``) to denote a state in which the CDROM has no medium in it. Libvirt used to reject such configuration file, but not anymore. * qemu_hotplug: Don't lose 'created' flag in qemuDomainChangeNet() When starting a domain, libvirt tracks what resources it created for it and which were pre-existing and uses this information to preserve pre-existing resources when cleaning up after said domain is shut off. But for macvtaps this information was lost after the macvtap device was changed (e.g. via ``virsh update-device``). * Fix virStream hole handling When a client sent multiple holes into a virStream it may have caused daemon hangup as the daemon stopped processing RPC from the client temporarily. This is now fixed. * nodedev: Don't generate broken XML with certain hardware A broken node device XML would be generated in a rare case when a hardware device had certain characters in the VPD fields. * qemu: Fix reservation of manually specified port for disk migration A manually specified port would not be relased after disk migration making it impossible to use it again. v10.0.0 (2024-01-15) ==================== * **New features** * qemu: Enable ``postcopy-preempt`` migration capability Post-copy migrations are now started with ``postcopy-preempt`` capability enabled as long as it is supported by both sides of migration. This should enable faster migration of memory pages that the destination tries to read before they are migrated from the source. * qemu: Add support for mapping iothreads to virtqueues of ``virtio-blk`` devices QEMU added the possibility to map multiple ``iothreads`` to a single ``virtio-blk`` device and map them even to specific virtqueues. Libvirt adds a ```` subelement of the `` `` element that users can use to configure the mapping. * qemu: Allow automatic resize of block-device-backed disk to full size of the device The new flag ``VIR_DOMAIN_BLOCK_RESIZE_CAPACITY`` for ``virDomainBlockResize`` allows resizing a block-device backed ``raw`` disk of a VM without the need to specify the full size of the block device. * qemu: automatic selection/binding of VFIO variant drivers When a device is assigned to a guest using VFIO with ````, libvirt will now search the running kernel's modules.alias file for the most specific match to that device for a VFIO driver, and bind that driver to the device rather than vfio-pci. A specific driver can also be forced, using the ```` attribute. * qemu: add runtime configuration option for nbdkit Since the new nbdkit support requires a recent selinux policy that is not widely available yet, it is now possible to build libvirt with nbdkit support for remote disks but disabled at runtime. This behavior is controlled via the storage_use_nbdkit option of the qemu driver configuration file. The option will default to being disabled, but this may change in a future release and can be customized with the nbdkit_config_default build option. * qemu: add ID mapping support for virtiofsd New ```` element was added for virtiofsd-based ```` devices. It can be used to set up UID and GID mapping between host and guest, making running virtiofsd unprivileged much more useful. * **Improvements** * qemu: Improve migration XML use when persisting VM on destination When migrating a VM with a custom migration XML, use it as a base for persisting it on the destination as users could have changed non-ABI breaking facts which would prevent subsequent start if the old XML were used. * qemu: Simplify non-shared storage migration to ``raw`` block devices The phase of copying storage during migration without shared storage requires that both the source and destination image are identical in size. This may not be possible if the destination is backed by a block device and the source image size is not a multiple of the block device block size. Libvirt aleviates this by automatically adding a ```` to match the size of the source image rather than failing the migration. * test driver: Support for hotplug/hotunplug of PCI devices The test driver now supports basic hotplug and hotunplug of PCI devices. * qemu: allow virtiofsd to run unprivileged Nowadays virtiofsd no longer requires to run with root privileges, so the restriction to always run as root is now removed from libvirt too. * **Bug fixes** * qemu: Various migration bug fixes and debuggability improvement This release fixes multiple bugs in virsh and libvirt in handling of migration arguments and XMLs and modifies error reporting for better debugging. * conf: Restore setting default bus for input devices Because of a regression, starting from 9.3.0 libvirt did not autofill bus for input devices. With this release the regression was identified and fixed. * qemu: Relax check for memory device coldplug Because of a check that was too aggressive, a virtio-mem memory device could not be cold plugged. This is now fixed. * qemu: Be less aggressive when dropping channel source paths Another regression is resolved, (introduced in 9.7.0) when libvirt was too aggressive when dropping parsed paths for sources * qemuDomainChangeNet: Reflect trustGuestRxFilters change On device-update, when a user requested change of trustGuestRxFilters for a domain's libvirt did nothing. It did not throw an error nor did it reflect the change. Starting with this release, the change is reflected. v9.10.0 (2023-12-01) ==================== * **New features** * Introduce pipewire audio backend The QEMU hypervisor driver now allows setting ``pipewire`` backend for ``