rpms/libvirt
7
0
Fork 1
Code Issues Pull Requests Releases Activity

libvirt-12.5.0-2.el10

Browse Source 
- tools: virsh: fix crash on error (RHEL-234911)
- conf: Include check for pci_bus in virDomainIOMMUDefEquals() (RHEL-138901)
- qemu: introduce QEMU_CAPS_DEVICE_ARM_SMMUV3 (RHEL-138901)
- qemu: introduce QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS (RHEL-138901)
- qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL (RHEL-138901)
- qemu: Add support for HW-accelerated nested SMMUv3 (RHEL-138901)
- tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args (RHEL-138901)
- conf: schemas: Allow '.' in schema for CPU flag name (RHEL-222549)
- tests: capabilityschemadata: Add a real test example (RHEL-222549)
- util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)

Resolves: RHEL-138901, RHEL-222549, RHEL-234911, RHEL-235931
This commit is contained in:
Jiri Denemark 2026-08-14 15:20:44 +02:00
parent 9362cfb791
commit f016a8e322
11 changed files with 4506 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
libvirt-conf-Include-check-for-pci_bus-in-virDomainIOMMUDefEquals.patch Normal file
View File

@ -0,0 +1,33 @@
From 1191669a769e280a77107804c6cdbab08e972a1e Mon Sep 17 00:00:00 2001
Message-ID: <1191669a769e280a77107804c6cdbab08e972a1e.1786713643.git.jdenemar@redhat.com>
From: Nathan Chen <nathanc@nvidia.com>
Date: Wed, 5 Aug 2026 15:12:55 -0700
Subject: [PATCH] conf: Include check for pci_bus in virDomainIOMMUDefEquals()
virDomainIOMMUDefEquals() should check for pci_bus being equal
across two virDomainIOMMUDef being compared.
Fixes: 4d6419b286af ("qemu: Implement pluggable-device smmuv3")
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
(cherry picked from commit b2bfc6b4c8b7243840750e1e95514a8646482cd4)
Resolves: https://redhat.atlassian.net/browse/RHEL-138901
---
src/conf/domain_conf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 17c4a57cd8..94cfb27c1d 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -16849,6 +16849,7 @@ virDomainIOMMUDefEquals(const virDomainIOMMUDef *a,
a->iotlb != b->iotlb ||
a->aw_bits != b->aw_bits ||
a->dma_translation != b->dma_translation ||
+ a->pci_bus != b->pci_bus ||
a->xtsup != b->xtsup ||
a->pt != b->pt ||
a->granule != b->granule)
--
2.55.0

38
libvirt-conf-schemas-Allow-.-in-schema-for-CPU-flag-name.patch Normal file
View File

@ -0,0 +1,38 @@
From 9cf23fdd0cf7d5b39a1f51cfc61826b4da431db2 Mon Sep 17 00:00:00 2001
Message-ID: <9cf23fdd0cf7d5b39a1f51cfc61826b4da431db2.1786713644.git.jdenemar@redhat.com>
From: Peter Krempa <pkrempa@redhat.com>
Date: Mon, 3 Aug 2026 14:53:25 +0200
Subject: [PATCH] conf: schemas: Allow '.' in schema for CPU flag name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Allow '.' so that CPU features such as:
<feature name='sse4.1'/>
pass schema validation.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
(cherry picked from commit 5225c1cb688170bb2748f2f23455da4a7cb8a1bf)
https://redhat.atlassian.net/browse/RHEL-222549
---
src/conf/schemas/cputypes.rng | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/conf/schemas/cputypes.rng b/src/conf/schemas/cputypes.rng
index 8edf1d14e3..eef3807f1a 100644
--- a/src/conf/schemas/cputypes.rng
+++ b/src/conf/schemas/cputypes.rng
@@ -406,7 +406,7 @@
<element name="feature">
<attribute name="name">
<data type="string">
- <param name="pattern">[a-zA-Z0-9\-_]+</param>
+ <param name="pattern">[a-zA-Z0-9\-_.]+</param>
</data>
</attribute>
<empty/>
--
2.55.0

371
libvirt-qemu-Add-support-for-HW-accelerated-nested-SMMUv3.patch Normal file
View File

@ -0,0 +1,371 @@
From 311945c34f1188283be6c71b5c2ddd9e967977ff Mon Sep 17 00:00:00 2001
Message-ID: <311945c34f1188283be6c71b5c2ddd9e967977ff.1786713644.git.jdenemar@redhat.com>
From: Nathan Chen <nathanc@nvidia.com>
Date: Wed, 5 Aug 2026 15:13:00 -0700
Subject: [PATCH] qemu: Add support for HW-accelerated nested SMMUv3
Add support for enabling HW-accelerated nested SMMUv3 via <accel>
attribute and its additional attributes for ATS, SSID, RIL, and OAS
configuration.
Validate the domain iommu accel attribute in qemu_validate.c when
QEMU lacks this capability. Checking accel is sufficient because ats,
ril, ssidsize, and oas were introduced in the same QEMU release, and
it only makes sense to backport accel, ats, ril, ssidsize, and oas
all together.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
(cherry picked from commit d4605d8279d73bf8d2b8031d49f453529738ef34)
Resolves: https://redhat.atlassian.net/browse/RHEL-138901
---
docs/formatdomain.rst | 38 +++++++++++++++
src/conf/domain_conf.c | 79 +++++++++++++++++++++++++++++++
src/conf/domain_conf.h | 5 ++
src/conf/domain_validate.c | 27 ++++++++++-
src/conf/schemas/domaincommon.rng | 25 ++++++++++
src/qemu/qemu_command.c | 15 ++++++
src/qemu/qemu_validate.c | 12 +++++
7 files changed, 200 insertions(+), 1 deletion(-)
diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index a861f9f177..1e8c81c3a5 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -9426,6 +9426,44 @@ Examples:
The ``pciBus`` attribute notes the index of the controller that an
IOMMU device is attached to. (QEMU/KVM and ``smmuv3`` model only)
+ ``accel``
+ The ``accel`` attribute with possible values ``on`` and ``off`` can
+ be used to enable hardware acceleration support for smmuv3 IOMMU
+ devices.
+ :since:`Since 12.7.0` (QEMU/KVM and ``smmuv3`` model only)
+
+ ``ats``
+ The ``ats`` attribute with possible values ``on`` and ``off`` can be
+ used to enable reporting Address Translation Services capability to
+ the guest for smmuv3 IOMMU devices with ``accel`` set to ``on``, if
+ the host SMMUv3 supports ATS and the associated passthrough device
+ supports ATS. If ``accel`` is enabled and ``ats`` is not configured,
+ the hypervisor default value is used.
+ :since:`Since 12.7.0` (QEMU/KVM and ``smmuv3`` model only)
+
+ ``ril``
+ The ``ril`` attribute with possible values ``on`` and ``off`` can be
+ used to report whether Range Invalidation for IOMMU devices with
+ ``accel`` set to ``on`` is compatible with host SMMUv3 support. If
+ ``accel`` is enabled and ``ril`` is not configured, the hypervisor
+ default value is used.
+ :since:`Since 12.7.0` (QEMU/KVM and ``smmuv3`` model only)
+
+ ``ssidsize``
+ The ``ssidsize`` attribute sets the number of bits used to
+ represent SubstreamIDs. A value of N allows SSIDs in the range
+ [0 .. 2^N - 1]. The valid range is 0-20, and a value greater than 0
+ is required for enabling PASID support, as doing so advertises PASID
+ capability to the vIOMMU. If ``accel`` is enabled and ``ssidsize`` is
+ not configured, the hypervisor default value is used.
+ :since:`Since 12.7.0` (QEMU/KVM and ``smmuv3`` model only)
+
+ ``oas``
+ The ``oas`` attribute sets the output address size in units of bits.
+ If ``accel`` is enabled and ``oas`` is not configured, the hypervisor
+ default value is used.
+ :since:`Since 12.7.0` (QEMU/KVM and ``smmuv3`` model only)
+
In case of ``virtio`` IOMMU device, the ``driver`` element can optionally
contain ``granule`` subelement that allows to choose which granule will be
used by default. It is useful when running guests with different page size
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 94cfb27c1d..db44ba9a72 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -2863,6 +2863,10 @@ virDomainIOMMUDefNew(void)
iommu->pci_bus = -1;
+ iommu->ssid_size = -1;
+
+ iommu->oas = -1;
+
return g_steal_pointer(&iommu);
}
@@ -14746,6 +14750,26 @@ virDomainIOMMUDefParseXML(virDomainXMLOption *xmlopt,
&iommu->pci_bus, -1) < 0)
return NULL;
+ if (virXMLPropTristateSwitch(driver, "accel", VIR_XML_PROP_NONE,
+ &iommu->accel) < 0)
+ return NULL;
+
+ if (virXMLPropTristateSwitch(driver, "ats", VIR_XML_PROP_NONE,
+ &iommu->ats) < 0)
+ return NULL;
+
+ if (virXMLPropTristateSwitch(driver, "ril", VIR_XML_PROP_NONE,
+ &iommu->ril) < 0)
+ return NULL;
+
+ if (virXMLPropInt(driver, "ssidsize", 10, VIR_XML_PROP_NONE,
+ &iommu->ssid_size, -1) < 0)
+ return NULL;
+
+ if (virXMLPropInt(driver, "oas", 10, VIR_XML_PROP_NONE,
+ &iommu->oas, -1) < 0)
+ return NULL;
+
if ((granule = virXPathNode("./driver/granule", ctxt))) {
g_autofree char *mode = virXMLPropString(granule, "mode");
unsigned long long size;
@@ -16850,6 +16874,11 @@ virDomainIOMMUDefEquals(const virDomainIOMMUDef *a,
a->aw_bits != b->aw_bits ||
a->dma_translation != b->dma_translation ||
a->pci_bus != b->pci_bus ||
+ a->accel != b->accel ||
+ a->ats != b->ats ||
+ a->ril != b->ril ||
+ a->ssid_size != b->ssid_size ||
+ a->oas != b->oas ||
a->xtsup != b->xtsup ||
a->pt != b->pt ||
a->granule != b->granule)
@@ -22734,6 +22763,36 @@ virDomainIOMMUDefCheckABIStability(virDomainIOMMUDef *src,
dst->pci_bus, src->pci_bus);
return false;
}
+ if (src->accel != dst->accel) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target domain IOMMU device accel value '%1$d' does not match source '%2$d'"),
+ dst->accel, src->accel);
+ return false;
+ }
+ if (src->ats != dst->ats) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target domain IOMMU device ATS value '%1$d' does not match source '%2$d'"),
+ dst->ats, src->ats);
+ return false;
+ }
+ if (src->ril != dst->ril) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target domain IOMMU device ril value '%1$d' does not match source '%2$d'"),
+ dst->ril, src->ril);
+ return false;
+ }
+ if (src->ssid_size != dst->ssid_size) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target domain IOMMU device ssid_size value '%1$d' does not match source '%2$d'"),
+ dst->ssid_size, src->ssid_size);
+ return false;
+ }
+ if (src->oas != dst->oas) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target domain IOMMU device oas value '%1$d' does not match source '%2$d'"),
+ dst->oas, src->oas);
+ return false;
+ }
if (src->dma_translation != dst->dma_translation) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Target domain IOMMU device dma translation '%1$s' does not match source '%2$s'"),
@@ -29204,6 +29263,26 @@ virDomainIOMMUDefFormat(virBuffer *buf,
virBufferAsprintf(&driverAttrBuf, " pciBus='%d'",
iommu->pci_bus);
}
+ if (iommu->accel != VIR_TRISTATE_SWITCH_ABSENT) {
+ virBufferAsprintf(&driverAttrBuf, " accel='%s'",
+ virTristateSwitchTypeToString(iommu->accel));
+ }
+ if (iommu->ats != VIR_TRISTATE_SWITCH_ABSENT) {
+ virBufferAsprintf(&driverAttrBuf, " ats='%s'",
+ virTristateSwitchTypeToString(iommu->ats));
+ }
+ if (iommu->ril != VIR_TRISTATE_SWITCH_ABSENT) {
+ virBufferAsprintf(&driverAttrBuf, " ril='%s'",
+ virTristateSwitchTypeToString(iommu->ril));
+ }
+ if (iommu->ssid_size >= 0) {
+ virBufferAsprintf(&driverAttrBuf, " ssidsize='%d'",
+ iommu->ssid_size);
+ }
+ if (iommu->oas >= 0) {
+ virBufferAsprintf(&driverAttrBuf, " oas='%d'",
+ iommu->oas);
+ }
if (iommu->granule != 0) {
if (iommu->granule == -1) {
virBufferAddLit(&driverChildBuf, "<granule mode='host'/>\n");
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 0c6c79c413..40ea6090f8 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -3105,6 +3105,11 @@ struct _virDomainIOMMUDef {
virTristateSwitch xtsup;
virTristateSwitch pt;
int granule; /* -1 means 'host', 0 unset, page size in KiB otherwise */
+ virTristateSwitch accel;
+ virTristateSwitch ats;
+ virTristateSwitch ril;
+ int ssid_size;
+ int oas;
};
typedef enum {
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 3946f92182..710a891904 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -3203,6 +3203,16 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
virDomainIOMMUModelTypeToString(iommu->model));
return -1;
}
+ if (iommu->accel != VIR_TRISTATE_SWITCH_ON &&
+ (iommu->ats != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ril != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ssid_size >= 0 ||
+ iommu->oas >= 0)) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("accel must be enabled for iommu model '%1$s' when setting ats, ril, ssidsize, or oas"),
+ virDomainIOMMUModelTypeToString(iommu->model));
+ return -1;
+ }
break;
case VIR_DOMAIN_IOMMU_MODEL_VIRTIO:
if (iommu->intremap != VIR_TRISTATE_SWITCH_ABSENT ||
@@ -3210,7 +3220,12 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
iommu->eim != VIR_TRISTATE_SWITCH_ABSENT ||
iommu->iotlb != VIR_TRISTATE_SWITCH_ABSENT ||
iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
- iommu->pci_bus >= 0) {
+ iommu->pci_bus >= 0 ||
+ iommu->accel != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ats != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ril != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ssid_size >= 0 ||
+ iommu->oas >= 0) {
virReportError(VIR_ERR_XML_ERROR,
_("iommu model '%1$s' doesn't support some additional attributes"),
virDomainIOMMUModelTypeToString(iommu->model));
@@ -3233,6 +3248,11 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
iommu->aw_bits != 0 ||
iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
iommu->pci_bus >= 0 ||
+ iommu->accel != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ats != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ril != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ssid_size >= 0 ||
+ iommu->oas >= 0 ||
iommu->granule != 0) {
virReportError(VIR_ERR_XML_ERROR,
_("iommu model '%1$s' doesn't support some additional attributes"),
@@ -3245,6 +3265,11 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
if (iommu->pt != VIR_TRISTATE_SWITCH_ABSENT ||
iommu->xtsup != VIR_TRISTATE_SWITCH_ABSENT ||
iommu->pci_bus >= 0 ||
+ iommu->accel != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ats != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ril != VIR_TRISTATE_SWITCH_ABSENT ||
+ iommu->ssid_size >= 0 ||
+ iommu->oas >= 0 ||
iommu->granule != 0) {
virReportError(VIR_ERR_XML_ERROR,
_("iommu model '%1$s' doesn't support some additional attributes"),
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index 121e4e06a6..c7d7ebc876 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -6454,6 +6454,31 @@
<empty/>
</element>
</optional>
+ <optional>
+ <attribute name="accel">
+ <ref name="virOnOff"/>
+ </attribute>
+ </optional>
+ <optional>
+ <attribute name="ats">
+ <ref name="virOnOff"/>
+ </attribute>
+ </optional>
+ <optional>
+ <attribute name="ril">
+ <ref name="virOnOff"/>
+ </attribute>
+ </optional>
+ <optional>
+ <attribute name="ssidsize">
+ <data type="int"/>
+ </attribute>
+ </optional>
+ <optional>
+ <attribute name="oas">
+ <data type="int"/>
+ </attribute>
+ </optional>
</element>
</optional>
<optional>
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index e726dc661c..2d5eaa1e80 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -6276,6 +6276,8 @@ qemuBuildPCINestedSmmuv3DevProps(const virDomainDef *def,
{
g_autoptr(virJSONValue) props = NULL;
g_autofree char *bus = NULL;
+ g_autofree char *ssidsizeStr = NULL;
+ g_autofree char *oasStr = NULL;
virPCIDeviceAddress addr = { .bus = iommu->pci_bus };
bus = qemuBuildDeviceAddressPCIGetBus(def, &addr);
@@ -6286,10 +6288,23 @@ qemuBuildPCINestedSmmuv3DevProps(const virDomainDef *def,
return NULL;
}
+ if (iommu->ssid_size >= 0) {
+ ssidsizeStr = g_strdup_printf("%u", iommu->ssid_size);
+ }
+
+ if (iommu->oas >= 0) {
+ oasStr = g_strdup_printf("%u", iommu->oas);
+ }
+
if (virJSONValueObjectAdd(&props,
"s:driver", "arm-smmuv3",
"s:primary-bus", bus,
"s:id", iommu->info.alias,
+ "T:accel", iommu->accel,
+ "S:ats", qemuOnOffAuto(iommu->ats),
+ "S:ril", qemuOnOffAuto(iommu->ril),
+ "S:ssidsize", ssidsizeStr,
+ "S:oas", oasStr,
NULL) < 0)
return NULL;
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 2da99329c5..1093eb8363 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -5827,6 +5827,18 @@ qemuValidateDomainDeviceDefIOMMU(const virDomainIOMMUDef *iommu,
return -1;
}
+ /* While QEMU_CAPS_ARM_SMMUV3_ACCEL tracks the .accel attribute of
+ * arm-smmuv3 it is also a good indicator of .ats, .ril, .ssidsize, and
+ * .oas attributes as all of them were introduced in the same release,
+ * and these features are meant to be backported all together. */
+ if (iommu->model == VIR_DOMAIN_IOMMU_MODEL_SMMUV3 &&
+ iommu->accel != VIR_TRISTATE_SWITCH_ABSENT &&
+ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_ARM_SMMUV3_ACCEL)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("iommu: accel is not supported with this QEMU binary"));
+ return -1;
+ }
+
if (iommu->granule > 0) {
/* QEMU supports only 4KiB, 8KiB, 16KiB and 64KiB granule size */
if (!(iommu->granule == 4 ||
--
2.55.0

81
libvirt-qemu-introduce-QEMU_CAPS_ARM_SMMUV3_ACCEL.patch Normal file
View File

@ -0,0 +1,81 @@
From 613935cded2347bf61e0461ac8f72f2f99ceb18f Mon Sep 17 00:00:00 2001
Message-ID: <613935cded2347bf61e0461ac8f72f2f99ceb18f.1786713644.git.jdenemar@redhat.com>
From: Nathan Chen <nathanc@nvidia.com>
Date: Wed, 5 Aug 2026 15:12:59 -0700
Subject: [PATCH] qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL
The arm-smmuv3 accel device property, used for HW-accelerated nested
SMMUv3, was added in QEMU 11.0.0 on top of the pluggable device
introduced in 10.2. Probe it alongside smmu_per_bus via
device-list-properties.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
(cherry picked from commit 90b01b9d3e3b684837190e92257eba15511515b0)
Resolves: https://redhat.atlassian.net/browse/RHEL-138901
---
src/qemu/qemu_capabilities.c | 2 ++
src/qemu/qemu_capabilities.h | 1 +
tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml | 1 +
4 files changed, 5 insertions(+)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index a7d121f917..c60ca02d97 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -769,6 +769,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
"blockdev-mirror.target-is-zero", /* QEMU_CAPS_BLOCKDEV_MIRROR_TARGET_IS_ZERO */
"arm-smmuv3", /* QEMU_CAPS_DEVICE_ARM_SMMUV3 */
"arm-smmuv3.smmu_per_bus", /* QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS */
+ "arm-smmuv3.accel", /* QEMU_CAPS_ARM_SMMUV3_ACCEL */
);
@@ -1648,6 +1649,7 @@ static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsAMDIOMMU[] = {
static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsArmSmmuv3[] = {
{ "smmu_per_bus", QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS, NULL },
+ { "accel", QEMU_CAPS_ARM_SMMUV3_ACCEL, NULL },
};
/* see documentation for virQEMUQAPISchemaPathGet for the query format */
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index 0dc9836ca9..28085144a2 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -743,6 +743,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
QEMU_CAPS_BLOCKDEV_MIRROR_TARGET_IS_ZERO, /* 'blockdev-mirror' supports 'target-is-zero' */
QEMU_CAPS_DEVICE_ARM_SMMUV3, /* -device arm-smmuv3 */
QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS, /* arm-smmuv3.smmu_per_bus */
+ QEMU_CAPS_ARM_SMMUV3_ACCEL, /* arm-smmuv3.accel */
QEMU_CAPS_LAST /* this must always be the last item */
} virQEMUCapsFlags;
diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
index 2280800fca..ca6def23dc 100644
--- a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
@@ -190,6 +190,7 @@
<flag name='blockdev-mirror.target-is-zero'/>
<flag name='arm-smmuv3'/>
<flag name='arm-smmuv3.smmu_per_bus'/>
+ <flag name='arm-smmuv3.accel'/>
<version>11000000</version>
<microcodeVersion>61700286</microcodeVersion>
<package>v11.0.0</package>
diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
index b4200f35bb..306f2981c1 100644
--- a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
@@ -190,6 +190,7 @@
<flag name='blockdev-mirror.target-is-zero'/>
<flag name='arm-smmuv3'/>
<flag name='arm-smmuv3.smmu_per_bus'/>
+ <flag name='arm-smmuv3.accel'/>
<version>11000050</version>
<microcodeVersion>61700287</microcodeVersion>
<package>v11.0.0-1600-g5611a9268d</package>
--
2.55.0

2225
libvirt-qemu-introduce-QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS.patch Normal file
View File

File diff suppressed because it is too large Load Diff

152
libvirt-qemu-introduce-QEMU_CAPS_DEVICE_ARM_SMMUV3.patch Normal file
View File

@ -0,0 +1,152 @@
From 59f9683dd189584af437b03fec40006c03be581e Mon Sep 17 00:00:00 2001
Message-ID: <59f9683dd189584af437b03fec40006c03be581e.1786713643.git.jdenemar@redhat.com>
From: Nathan Chen <nathanc@nvidia.com>
Date: Wed, 5 Aug 2026 15:12:57 -0700
Subject: [PATCH] qemu: introduce QEMU_CAPS_DEVICE_ARM_SMMUV3
The arm-smmuv3 QOM type is reported by qom-list-types on ARM QEMU.
Register it as QEMU_CAPS_DEVICE_ARM_SMMUV3 so later device-list-properties
probing for arm-smmuv3 properties can be gated on this capability
instead of an architecture check.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
(cherry picked from commit 93e0d7845585fd42fc770991e5eb9f365c96d6bb)
Conflicts:
src/qemu/qemu_capabilities.c
src/qemu/qemu_capabilities.h
tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
- missing upstream commit 248981ff51116e06d3b7be7dbd33559a45261e24
Resolves: https://redhat.atlassian.net/browse/RHEL-138901
---
src/qemu/qemu_capabilities.c | 2 ++
src/qemu/qemu_capabilities.h | 1 +
tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml | 1 +
tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml | 1 +
tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml | 1 +
9 files changed, 10 insertions(+)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index be57dcad8e..33efc6651b 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -767,6 +767,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
/* 495 */
"blockdev-mirror.target-is-zero", /* QEMU_CAPS_BLOCKDEV_MIRROR_TARGET_IS_ZERO */
+ "arm-smmuv3", /* QEMU_CAPS_DEVICE_ARM_SMMUV3 */
);
@@ -1480,6 +1481,7 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[] = {
{ "iommufd", QEMU_CAPS_OBJECT_IOMMUFD },
{ "uefi-vars-x64", QEMU_CAPS_DEVICE_UEFI_VARS },
{ "uefi-vars-sysbus", QEMU_CAPS_DEVICE_UEFI_VARS },
+ { "arm-smmuv3", QEMU_CAPS_DEVICE_ARM_SMMUV3 },
};
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index 3014f3dc5e..e5d589b0c4 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -741,6 +741,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
/* 495 */
QEMU_CAPS_BLOCKDEV_MIRROR_TARGET_IS_ZERO, /* 'blockdev-mirror' supports 'target-is-zero' */
+ QEMU_CAPS_DEVICE_ARM_SMMUV3, /* -device arm-smmuv3 */
QEMU_CAPS_LAST /* this must always be the last item */
} virQEMUCapsFlags;
diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
index b6434e6019..b2a0872853 100644
--- a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
@@ -166,6 +166,7 @@
<flag name='virtio-iommu.aw-bits'/>
<flag name='iommufd'/>
<flag name='uefi-vars'/>
+ <flag name='arm-smmuv3'/>
<version>10000000</version>
<microcodeVersion>61700285</microcodeVersion>
<package>v10.0.0</package>
diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml
index df3e2a8275..449f2f65c7 100644
--- a/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml
@@ -186,6 +186,7 @@
<flag name='iommufd'/>
<flag name='uefi-vars'/>
<flag name='blockdev-mirror.target-is-zero'/>
+ <flag name='arm-smmuv3'/>
<version>10002000</version>
<microcodeVersion>61700287</microcodeVersion>
<package>v10.2.0</package>
diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
index 3fdc0d6621..b9acf8ac67 100644
--- a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
@@ -188,6 +188,7 @@
<flag name='uefi-vars'/>
<flag name='query-block-flat'/>
<flag name='blockdev-mirror.target-is-zero'/>
+ <flag name='arm-smmuv3'/>
<version>11000000</version>
<microcodeVersion>61700286</microcodeVersion>
<package>v11.0.0</package>
diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
index f7dd14a1ad..0595e5f88c 100644
--- a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml
@@ -188,6 +188,7 @@
<flag name='uefi-vars'/>
<flag name='query-block-flat'/>
<flag name='blockdev-mirror.target-is-zero'/>
+ <flag name='arm-smmuv3'/>
<version>11000050</version>
<microcodeVersion>61700287</microcodeVersion>
<package>v11.0.0-1600-g5611a9268d</package>
diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml
index bb70bcaf1f..e026abfd96 100644
--- a/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml
@@ -161,6 +161,7 @@
<flag name='nvme'/>
<flag name='nvme-ns'/>
<flag name='usb-bot'/>
+ <flag name='arm-smmuv3'/>
<version>8002000</version>
<microcodeVersion>61700246</microcodeVersion>
<package>v8.2.0</package>
diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml b/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml
index 9590bc464a..d3af74bcb3 100644
--- a/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml
+++ b/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml
@@ -168,6 +168,7 @@
<flag name='nvme'/>
<flag name='nvme-ns'/>
<flag name='usb-bot'/>
+ <flag name='arm-smmuv3'/>
<version>8002000</version>
<microcodeVersion>0</microcodeVersion>
<package>qemu-8.2.0-7.fc39</package>
diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml b/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml
index 9c843f9e5c..8c777c121e 100644
--- a/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml
+++ b/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml
@@ -136,6 +136,7 @@
<flag name='usb-bot'/>
<flag name='acpi-generic-initiator'/>
<flag name='virtio-iommu.aw-bits'/>
+ <flag name='arm-smmuv3'/>
<version>9002002</version>
<microcodeVersion>61700247</microcodeVersion>
<package></package>
--
2.55.0

1063
libvirt-tests-capabilityschemadata-Add-a-real-test-example.patch Normal file
View File

File diff suppressed because it is too large Load Diff

395
libvirt-tests-qemuxmlconfdata-provide-HW-accel-smmuv3-sample-XML-and-CLI-args.patch Normal file
View File

@ -0,0 +1,395 @@
From d07415461c5105075aca563fdc4595df8443a9e1 Mon Sep 17 00:00:00 2001
Message-ID: <d07415461c5105075aca563fdc4595df8443a9e1.1786713644.git.jdenemar@redhat.com>
From: Nathan Chen <nathanc@nvidia.com>
Date: Wed, 5 Aug 2026 15:13:01 -0700
Subject: [PATCH] tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML
and CLI args
Provide sample XML and CLI args for the HW-accel smmuv3 XML schema
for virt machine types.
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
(cherry picked from commit 6fcebd5bbbc7c31b732b8fe4c8019ced78fce0de)
Conflicts:
tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args
tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args
- missing upstream commit d071782577a83fcd5a8c6730838e853699439f1a
Resolves: https://redhat.atlassian.net/browse/RHEL-138901
---
...uv3-pci-bus-accel-auto.aarch64-latest.args | 38 +++++++++++
...muv3-pci-bus-accel-auto.aarch64-latest.xml | 63 +++++++++++++++++++
.../iommu-smmuv3-pci-bus-accel-auto.xml | 53 ++++++++++++++++
...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++++++++
...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 63 +++++++++++++++++++
.../iommu-smmuv3-pci-bus-accel.xml | 53 ++++++++++++++++
tests/qemuxmlconftest.c | 2 +
7 files changed, 310 insertions(+)
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml
create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args
new file mode 100644
index 0000000000..40423e505d
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args
@@ -0,0 +1,38 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/var/lib/libvirt/qemu/domain--1-guest \
+USER=test \
+LOGNAME=test \
+XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
+XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
+XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
+/usr/bin/qemu-system-aarch64 \
+-name guest=guest,debug-threads=on \
+-S \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
+-machine virt,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=off \
+-accel tcg \
+-m size=1048576k \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
+-overcommit mem-lock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid 1ccfd97d-5eb4-478a-bbe6-88d254c16db7 \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot strict=on \
+-device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \
+-device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \
+-device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.3","bus":"pci.1","addr":"0x0"}' \
+-device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.4","bus":"pci.2","addr":"0x0"}' \
+-device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true}' \
+-device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true}' \
+-audiodev '{"id":"audio1","driver":"none"}' \
+-device '{"driver":"vfio-pci","host":"0000:06:00.0","id":"hostdev0","bus":"pci.3","addr":"0x0"}' \
+-device '{"driver":"vfio-pci","host":"0000:06:01.0","id":"hostdev1","bus":"pci.4","addr":"0x0"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
+-msg timestamp=on
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml
new file mode 100644
index 0000000000..08fb17fb6f
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml
@@ -0,0 +1,63 @@
+<domain type='qemu'>
+ <name>guest</name>
+ <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid>
+ <memory unit='KiB'>1048576</memory>
+ <currentMemory unit='KiB'>1048576</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='aarch64' machine='virt'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <gic version='2'/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-aarch64</emulator>
+ <controller type='usb' index='0' model='none'/>
+ <controller type='pci' index='0' model='pcie-root'/>
+ <controller type='pci' index='1' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='252'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
+ </controller>
+ <controller type='pci' index='2' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='248'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </controller>
+ <controller type='pci' index='3' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='21' port='0x0'/>
+ <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+ </controller>
+ <controller type='pci' index='4' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='22' port='0xa8'/>
+ <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+ </controller>
+ <audio id='1' type='none'/>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+ </hostdev>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x01' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+ </hostdev>
+ <memballoon model='none'/>
+ <iommu model='smmuv3'>
+ <driver pciBus='1' accel='on'/>
+ </iommu>
+ <iommu model='smmuv3'>
+ <driver pciBus='2' accel='on'/>
+ </iommu>
+ </devices>
+</domain>
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml
new file mode 100644
index 0000000000..abbc22e291
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml
@@ -0,0 +1,53 @@
+<domain type='qemu'>
+ <name>guest</name>
+ <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid>
+ <memory unit='KiB'>1048576</memory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='aarch64' machine='virt'>hvm</type>
+ </os>
+ <devices>
+ <emulator>/usr/bin/qemu-system-aarch64</emulator>
+ <controller type='usb' model='none'/>
+ <memballoon model='none'/>
+ <controller type='pci' index='0' model='pcie-root'/>
+ <controller type='pci' index='1' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='252'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
+ </controller>
+ <controller type='pci' index='2' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='248'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </controller>
+ <controller type='pci' index='3' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='21' port='0x0'/>
+ <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+ </controller>
+ <controller type='pci' index='4' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='22' port='0xa8'/>
+ <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+ </controller>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+ </hostdev>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x01' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+ </hostdev>
+ <iommu model='smmuv3'>
+ <driver pciBus='1' accel='on'/>
+ </iommu>
+ <iommu model='smmuv3'>
+ <driver pciBus='2' accel='on'/>
+ </iommu>
+ </devices>
+</domain>
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args
new file mode 100644
index 0000000000..69ec53784e
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args
@@ -0,0 +1,38 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/var/lib/libvirt/qemu/domain--1-guest \
+USER=test \
+LOGNAME=test \
+XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
+XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
+XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
+/usr/bin/qemu-system-aarch64 \
+-name guest=guest,debug-threads=on \
+-S \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
+-machine virt,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=off \
+-accel tcg \
+-m size=1048576k \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
+-overcommit mem-lock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid 1ccfd97d-5eb4-478a-bbe6-88d254c16db7 \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot strict=on \
+-device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \
+-device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \
+-device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.3","bus":"pci.1","addr":"0x0"}' \
+-device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.4","bus":"pci.2","addr":"0x0"}' \
+-device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \
+-device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \
+-audiodev '{"id":"audio1","driver":"none"}' \
+-device '{"driver":"vfio-pci","host":"0000:06:00.0","id":"hostdev0","bus":"pci.3","addr":"0x0"}' \
+-device '{"driver":"vfio-pci","host":"0000:06:01.0","id":"hostdev1","bus":"pci.4","addr":"0x0"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
+-msg timestamp=on
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml
new file mode 100644
index 0000000000..221a4185e5
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml
@@ -0,0 +1,63 @@
+<domain type='qemu'>
+ <name>guest</name>
+ <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid>
+ <memory unit='KiB'>1048576</memory>
+ <currentMemory unit='KiB'>1048576</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='aarch64' machine='virt'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <gic version='2'/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-aarch64</emulator>
+ <controller type='usb' index='0' model='none'/>
+ <controller type='pci' index='0' model='pcie-root'/>
+ <controller type='pci' index='1' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='252'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
+ </controller>
+ <controller type='pci' index='2' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='248'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </controller>
+ <controller type='pci' index='3' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='21' port='0x0'/>
+ <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+ </controller>
+ <controller type='pci' index='4' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='22' port='0xa8'/>
+ <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+ </controller>
+ <audio id='1' type='none'/>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+ </hostdev>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x01' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+ </hostdev>
+ <memballoon model='none'/>
+ <iommu model='smmuv3'>
+ <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/>
+ </iommu>
+ <iommu model='smmuv3'>
+ <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/>
+ </iommu>
+ </devices>
+</domain>
diff --git a/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml
new file mode 100644
index 0000000000..8dbae00540
--- /dev/null
+++ b/tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml
@@ -0,0 +1,53 @@
+<domain type='qemu'>
+ <name>guest</name>
+ <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid>
+ <memory unit='KiB'>1048576</memory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='aarch64' machine='virt'>hvm</type>
+ </os>
+ <devices>
+ <emulator>/usr/bin/qemu-system-aarch64</emulator>
+ <controller type='usb' model='none'/>
+ <memballoon model='none'/>
+ <controller type='pci' index='0' model='pcie-root'/>
+ <controller type='pci' index='1' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='252'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
+ </controller>
+ <controller type='pci' index='2' model='pcie-expander-bus'>
+ <model name='pxb-pcie'/>
+ <target busNr='248'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </controller>
+ <controller type='pci' index='3' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='21' port='0x0'/>
+ <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+ </controller>
+ <controller type='pci' index='4' model='pcie-root-port'>
+ <model name='pcie-root-port'/>
+ <target chassis='22' port='0xa8'/>
+ <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+ </controller>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+ </hostdev>
+ <hostdev mode='subsystem' type='pci' managed='no'>
+ <source>
+ <address domain='0x0000' bus='0x06' slot='0x01' function='0x0'/>
+ </source>
+ <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+ </hostdev>
+ <iommu model='smmuv3'>
+ <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/>
+ </iommu>
+ <iommu model='smmuv3'>
+ <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/>
+ </iommu>
+ </devices>
+</domain>
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index a1389775b9..99925e6241 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -2988,6 +2988,8 @@ mymain(void)
DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3", "aarch64");
DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3-pci-bus", "aarch64");
DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3-pci-bus-single", "aarch64");
+ DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3-pci-bus-accel", "aarch64");
+ DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3-pci-bus-accel-auto", "aarch64");
DO_TEST_CAPS_LATEST("virtio-iommu-x86_64");
DO_TEST_CAPS_ARCH_LATEST("virtio-iommu-aarch64", "aarch64");
DO_TEST_CAPS_LATEST_PARSE_ERROR("virtio-iommu-wrong-machine");
--
2.55.0

50
libvirt-tools-virsh-fix-crash-on-error.patch Normal file
View File

@ -0,0 +1,50 @@
From 90450dd1485b7c9412492d375d92bb578dc5a7f9 Mon Sep 17 00:00:00 2001
Message-ID: <90450dd1485b7c9412492d375d92bb578dc5a7f9.1786713643.git.jdenemar@redhat.com>
From: Jim Fehlig <jfehlig@suse.com>
Date: Tue, 4 Aug 2026 11:27:59 -0600
Subject: [PATCH] tools: virsh: fix crash on error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Commit 9899c91515 introduced the potential for a NULL pointer dereference
crash when the 'ctl' parameter to vshPrintStderr() is NULL. Below is an
example backtrace of the crash when attempting to detach a non-existent
disk with 'virsh detach-disk test vdz'
#0 vshPrintStderr (ctl=0x0, level=4, format=<optimized out>, ap=<optimized out>) at ../tools/vsh.c:2148
#1 0x00005555555e6b2c in vshError (ctl=ctl@entry=0x0, format=<optimized out>) at ../tools/vsh.c:2170
#2 0x00005555555afec7 in virshFindDisk
(doc=doc@entry=0x555555696ee0 "<domain type='kvm' id='1'>\n <name>test</name>\n <uuid>9b27a21e-dfa2-4c1e-9d11-2de275aefb03</uuid>\n <metadata>\n <libosinfo:libosinfo xmlns:libosinfo=\"http://libosinfo.org/xmlns/libvirt/domain/1."..., path=0x555555651240 "vdz", type=type@entry=0) at ../tools/virsh-domain.c:13055
#3 0x00005555555b0151 in cmdDetachDisk (ctl=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/virsh-domain.c:13231
#4 0x00005555555e6ddb in vshCommandRun (ctl=ctl@entry=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/vsh.c:1383
#5 0x000055555559347a in main (argc=<optimized out>, argv=0x7fffffffdeb8) at ../tools/virsh.c:908
Ensure 'ctl' is valid before dereferencing it.
Fixes: 9899c91515d79595d19800ccc895df18eb7bb3f7
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit c6560a7223927e1e5fa249572750bc376bba67fa)
https://redhat.atlassian.net/browse/RHEL-234911
Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
tools/vsh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/vsh.c b/tools/vsh.c
index ccf2f21d64..667cc1a0d2 100644
--- a/tools/vsh.c
+++ b/tools/vsh.c
@@ -2145,7 +2145,7 @@ vshPrintStderr(vshControl *ctl,
if (ctl)
vshOutputLogFile(ctl, level, str);
- if (ctl->stderr_closed)
+ if (ctl && ctl->stderr_closed)
return;
/* Most output is to stdout, but if someone ran virsh 2>&1, then
--
2.55.0

71
libvirt-util-virFileChownFiles-do-not-follow-symlinks.patch Normal file
View File

@ -0,0 +1,71 @@
From d8f7346b329f6594eeb32318c37fadde391c19b2 Mon Sep 17 00:00:00 2001
Message-ID: <d8f7346b329f6594eeb32318c37fadde391c19b2.1786713644.git.jdenemar@redhat.com>
From: =?UTF-8?q?HE=20WEI=EF=BC=88=E3=82=AE=E3=82=AB=E3=82=AF=EF=BC=89?=
<skyexpoc@gmail.com>
Date: Tue, 28 Jul 2026 17:49:02 +0100
Subject: [PATCH] util: virFileChownFiles: do not follow symlinks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows
symlinks) and changed ownership with chown() (follows symlinks). A component
that owns the target directory at a lower privilege (e.g. the swtpm/tss state
directory) can plant a symlink to an arbitrary regular file and have the root
caller chown that file. Use lstat() to skip non-regular entries and
fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never
followed.
Fixes: CVE-2026-63622
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
[DB: use g_lstat instead of stat; use lchown instead of
fchownat for portability; added comment]
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b)
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
---
src/util/virfile.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/util/virfile.c b/src/util/virfile.c
index a0c6cb8048..c9d838eeeb 100644
--- a/src/util/virfile.c
+++ b/src/util/virfile.c
@@ -3306,6 +3306,12 @@ int virDirIsEmpty(const char *path,
*
* Change ownership of all regular files in a directory.
*
+ * This will NOT follow any symlinks, to avoid security risks.
+ * It is assumed the process using content under @name will
+ * be unprivileged, thus less trusted than libvirt. If it is
+ * compromised it might attempt to create symlinks in @name to
+ * escalate privileges on a subsequent call to virFileChownFiles.
+ *
* Returns -1 on error, with error already reported, 0 on success.
*/
#ifndef WIN32
@@ -3322,13 +3328,19 @@ int virFileChownFiles(const char *name,
while ((direrr = virDirRead(dir, &ent, name)) > 0) {
g_autofree char *path = NULL;
+ struct stat sb;
path = g_build_filename(name, ent->d_name, NULL);
- if (!virFileIsRegular(path))
+ if (g_lstat(path, &sb) < 0) {
+ virReportSystemError(errno, _("cannot stat '%1$s'"), path);
+ return -1;
+ }
+
+ if (!S_ISREG(sb.st_mode))
continue;
- if (chown(path, uid, gid) < 0) {
+ if (lchown(path, uid, gid) < 0) {
virReportSystemError(errno,
_("cannot chown '%1$s' to (%2$u, %3$u)"),
ent->d_name, (unsigned int) uid,
--
2.55.0

28
libvirt.spec
View File

@ -294,7 +294,7 @@
Summary: Library providing a simple virtualization API
Name: libvirt
Version: 12.5.0
Release: 1%{?dist}%{?extra_release}
Release: 2%{?dist}%{?extra_release}
License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
URL: https://libvirt.org/
@ -302,6 +302,17 @@ URL: https://libvirt.org/
%define mainturl stable_updates/
%endif
Source: https://download.libvirt.org/%{?mainturl}libvirt-%{version}.tar.xz
Patch1: libvirt-tools-virsh-fix-crash-on-error.patch
Patch2: libvirt-conf-Include-check-for-pci_bus-in-virDomainIOMMUDefEquals.patch
Patch3: libvirt-qemu-introduce-QEMU_CAPS_DEVICE_ARM_SMMUV3.patch
Patch4: libvirt-qemu-introduce-QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS.patch
Patch5: libvirt-qemu-introduce-QEMU_CAPS_ARM_SMMUV3_ACCEL.patch
Patch6: libvirt-qemu-Add-support-for-HW-accelerated-nested-SMMUv3.patch
Patch7: libvirt-tests-qemuxmlconfdata-provide-HW-accel-smmuv3-sample-XML-and-CLI-args.patch
Patch8: libvirt-conf-schemas-Allow-.-in-schema-for-CPU-flag-name.patch
Patch9: libvirt-tests-capabilityschemadata-Add-a-real-test-example.patch
Patch10: libvirt-util-virFileChownFiles-do-not-follow-symlinks.patch
Requires: libvirt-daemon = %{version}-%{release}
Requires: libvirt-daemon-config-network = %{version}-%{release}
@ -1168,6 +1179,9 @@ MinGW Windows libvirt virtualization library.
%prep
%autosetup -S git_am -N
%autopatch
%build
%if 0%{?fedora} >= %{min_fedora} || 0%{?rhel} >= %{min_rhel}
%define supported_platform 1
@ -2700,6 +2714,18 @@ exit 0
%endif
%changelog
* Fri Aug 14 2026 Jiri Denemark <jdenemar@redhat.com> - 12.5.0-2
- tools: virsh: fix crash on error (RHEL-234911)
- conf: Include check for pci_bus in virDomainIOMMUDefEquals() (RHEL-138901)
- qemu: introduce QEMU_CAPS_DEVICE_ARM_SMMUV3 (RHEL-138901)
- qemu: introduce QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS (RHEL-138901)
- qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL (RHEL-138901)
- qemu: Add support for HW-accelerated nested SMMUv3 (RHEL-138901)
- tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args (RHEL-138901)
- conf: schemas: Allow '.' in schema for CPU flag name (RHEL-222549)
- tests: capabilityschemadata: Add a real test example (RHEL-222549)
- util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)
* Wed Jul 1 2026 Jiri Denemark <jdenemar@redhat.com> - 12.5.0-1
- Rebased to libvirt-12.5.0 (RHEL-156861)
- The rebase also fixes the following bugs: