July 2025 - Devel - libvirt List Archives

Question about SEV* guests and automatic firmware selection
by Jim Fehlig 31 Jul '25

31 Jul '25

Hi All, While investigating an internal bug report, we noticed that a minimal firmware auto-selection configuration along with SEV* fails to find a match. E.g. the following config <domain type="kvm"> <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <boot dev="hd"/> </os> <launchSecurity type="sev"> <policy>0x07</policy> </launchSecurity> ... </domain> Fails with "Unable to find 'efi' firmware that is compatible with the current configuration". A firmware that should match has the following json description { "description": "UEFI firmware for x86_64, with AMD SEV", "interface-types": [ "uefi" ], "mapping": { "device": "flash", "mode": "stateless", "executable": { "filename": "/usr/share/qemu/ovmf-x86_64-sev.bin", "format": "raw" } }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "acpi-s4", "amd-sev", "amd-sev-es", "amd-sev-snp", "verbose-dynamic" ], "tags": [ ] } Auto-selection works fine if I specify a 'stateless' firmware, e.g. amend the above config with <os firmware="efi"> <type arch="x86_64" machine="q35">hvm</type> <loader stateless="yes"/> <boot dev="hd"/> </os> Being unfamiliar with the firmware auto-selection code, I tried the below naive hack, which only led to test failures and the subsequent runtime error "unable to find any master var store for loader: /usr/share/qemu/ovmf-x86_64-sev.bin". Should auto-selection work with the minimal config, or is it expected that user also specify a stateless firmware? Regards, Jim diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 2d0ec0b4fa..660b74141a 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1293,15 +1293,17 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } - if (loader && loader->stateless == VIR_TRISTATE_BOOL_YES) { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { - VIR_DEBUG("Discarding loader without stateless flash"); - return false; - } - } else { - if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { - VIR_DEBUG("Discarding loader without split flash"); - return false; + if (loader) { + if (loader->stateless == VIR_TRISTATE_BOOL_YES) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) { + VIR_DEBUG("Discarding loader without stateless flash"); + return false; + } + } else if (loader->stateless == VIR_TRISTATE_BOOL_NO) { + if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + VIR_DEBUG("Discarding loader without split flash"); + return false; + } } }

3 6

[PATCH] news: document fixed nwfilter driver base chain creation
by Daniel P. Berrangé 30 Jul '25

30 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e5e8626729..c7bfac1db4 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -48,6 +48,14 @@ v11.6.0 (unreleased) * **Bug fixes** + * The nwfilter driver no longer recreates the base iptable/ip6tables chains + + The nwfilter driver had a impl mistake causing it to recreate the + base chains for iptables/ip6tables every time a VM was started. + This allowed a small window where traffic might not be fully + filtered. It now handles iptables/ip6tables the same way as + ebtables, creating the base chains only if they did not already + exist. v11.5.0 (2025-07-01) ==================== -- 2.50.1

2 1

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 30 Jul '25

30 Jul '25

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7f08e45537..d6919bdf4c 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -59,6 +59,12 @@ v11.6.0 (unreleased) This can be used to tell some guest operating systems (notably Windows) to not trim the disk. + * nss: Improve debugging + + Debugging printings from NSS modules can be now enabled by setting the + ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special + meaning to its value. + * **Bug fixes** -- 2.49.1

2 1

[PATCH] NEWS: document bhyve changes for the release
by Roman Bogorodskiy 30 Jul '25

30 Jul '25

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225..447259d66e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -40,6 +40,17 @@ v11.6.0 (unreleased) be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. + * bhyve: Add TCP console support + + TCP serial devices can now be configured with ``<serial type='tcp'>``:: + + <serial type='tcp'> + <source mode='bind' host='127.0.0.1' service='12345'/> + <target type='serial' port='0'/> + </serial> + + Additionally, number of supported consoles increased to 4. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V @@ -54,8 +65,16 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * bhyve: Add timeout handling for bhyveload + + It is now possible to run ``bhyveload`` with the ``timeout`` tool, which + can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. + Timeout values are set using the ``bhyveload_timeout`` and + ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. + * **Bug fixes** + * bhyve: Fix resetting of the autostart flag of the domain on destroy. v11.5.0 (2025-07-01) ==================== -- 2.49.0

2 2

Plans for 11.6.0 release (freeze on 2025-07-28)
by Jiri Denemark 30 Jul '25

30 Jul '25

We are getting close to 11.6.0 release of libvirt. To aim for the release on Friday 01 Aug I suggest entering the freeze on Monday 28 Jul and tagging RC2 on Wednesday 30 Jul. I hope this works for everyone. Jirka

1 1

[PATCH 0/2] qemu: Match firmware with fully resolved and canonicalized paths
by James Le Cuirot 29 Jul '25

29 Jul '25

From: James Le Cuirot <jlecuirot(a)microsoft.com> Distros may provide compatibility symlinks after moving firmware files around, but they won't work for existing VMs when doing a straight string comparison. virFileComparePaths has been used to do this, but it was previously only resolving the last path component, despite what the description says. James Le Cuirot (2): util: Fully resolve paths with virFileComparePaths qemu: Match firmware with fully resolved and canonicalized paths src/qemu/qemu_firmware.c | 11 ++++++----- src/util/virfile.c | 4 ++-- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.49.0

4 6

[PATCH 0/2] Revert recent patches causing test dependance on host state
by Peter Krempa 29 Jul '25

29 Jul '25

Revert the patches as we're in code freeze. Peter Krempa (2): Revert "qemuxmlconfdata: Regenerate outputs after last commit" Revert "qemu: Match firmware with fully resolved and canonicalized paths" src/qemu/qemu_firmware.c | 11 +++++------ ...anual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++------- ...i-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++------- ...ual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- ...l-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++------- 10 files changed, 22 insertions(+), 39 deletions(-) -- 2.50.0

2 3

[PATCH pushed] qemuxmlconfdata: Regenerate outputs after last commit
by Peter Krempa 29 Jul '25

29 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Commit 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 modified how the EFI paths are detected but didn't update the outputs. Fixes: 4efea21ae8709c6741a1800bd26ae6b49c8a77f5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed as build fix. ...manual-efi-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...-manual-efi-aarch64-legacy-paths.aarch64-latest.xml | 10 +++++++--- ...fi-no-enrolled-keys-legacy-paths.x86_64-latest.args | 2 +- ...efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...nual-efi-no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...anual-efi-no-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- ...al-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +- ...-manual-efi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...e-manual-efi-secboot-legacy-paths.x86_64-latest.xml | 10 +++++++--- 9 files changed, 33 insertions(+), 17 deletions(-) diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args index 83b1ce46ab..7bf2aeb570 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/AAVMF/AAVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml index 2e5c4fe584..0ee421fe6f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-aarch64-legacy-paths.aarch64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader> + <nvram template='/usr/share/edk2/aarch64/vars-template-pflash.raw' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml index b452ebaca2..4bfc7cdd0c 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-enrolled-keys-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args index 2113a46e80..d1b0377986 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml index 83623f1de2..490e298f7f 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-no-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml index cbadd0f0c8..beb146d35a 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> - <nvram template='/path/to/OVMF_VARS.fd' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram template='/path/to/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args index 1bbba7e99f..3718373af1 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -name guest=guest,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ --blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \ -machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \ diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml index 44d200134b..41e5742c21 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> -- 2.50.0

1 0

[PATCH] include: fix version for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST
by Daniel P. Berrangé 28 Jul '25

28 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- include/libvirt/libvirt-host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-host.h b/include/libvirt/libvirt-host.h index 19043235b2..8922d00e0c 100644 --- a/include/libvirt/libvirt-host.h +++ b/include/libvirt/libvirt-host.h @@ -975,7 +975,7 @@ typedef enum { /* filter out non-migratable features (Since: 1.2.14) */ VIR_CONNECT_BASELINE_CPU_MIGRATABLE = (1 << 1), /* when computing a baseline from several CPUs, do not make the result - * dependent on the current host (Since: 11.5.0) */ + * dependent on the current host (Since: 11.6.0) */ VIR_CONNECT_BASELINE_CPU_IGNORE_HOST = (1 << 2), } virConnectBaselineCPUFlags; -- 2.50.1

2 1

[PATCH] NEWS: Mention zero discard_granularity option
by Martin Kletzander 28 Jul '25

28 Jul '25

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6cc8f23225a6..7f08e455377b 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -54,6 +54,11 @@ v11.6.0 (unreleased) supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. + * Allow specifying zero discard granularity for block devices + + This can be used to tell some guest operating systems (notably Windows) to + not trim the disk. + * **Bug fixes** -- 2.50.1

2 1