February 2026 - Devel - libvirt List Archives

[PATCH] fdstream: don't report error on EOF if we read some data
by Daniel P. Berrangé 24 Feb '26

24 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> Since e23fd0b7fd36c41e6db49df4f4962762d3ef6ab0 the stream read code will repeatedly try to read a message from the background thread until it has filled its buffer. When hitting EOF, there will be no message left on the queue, and if the read buffer was non-zero length an error will be raised. This should only be done if there was no data previously read off the stream. Fixes: e23fd0b7fd36c41e6db49df4f4962762d3ef6ab0 Reported-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virfdstream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virfdstream.c b/src/util/virfdstream.c index 4c974ba5d7..efda768ef3 100644 --- a/src/util/virfdstream.c +++ b/src/util/virfdstream.c @@ -911,7 +911,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) more: while (!(msg = fdst->msg)) { if (fdst->threadQuit || fdst->threadErr) { - if (nbytes) { + if (nbytes && !got) { /* virStreamRecv will virResetLastError possibly set * by virFDStreamEvent */ if (fdst->threadErr && !virGetLastError()) -- 2.53.0

4 4

[PATCH v10 0/8] blockdev-replace
by Vladimir Sementsov-Ogievskiy 24 Feb '26

24 Feb '26

Hi all! This series presents a new command blockdev-replace, which helps to insert/remove filters anywhere in the block graph. It can: - replace qdev block-node by qdev-id - replace export block-node by export-id - replace any child of parent block-node by node-name and child name So insertions is done in two steps: 1. blockdev_add (create filter node, unparented) [some parent] [new filter] | | V V [ some child ] 2. blockdev-replace (replace child by the filter) [some parent] | V [new filter] | V [some child] And removal is done in reverse order: 1. blockdev-replace (go back to picture 1) 2. blockdev_del (remove filter node) Ideally, we should do both operations (add + replace or replace + del) in a transaction, but that should be another series. v10: reabsed on master. 02: change exp-blk check into assert 04: rewrite to simpler API (on unique parent id) 07: switch to new API 08: new Vladimir Sementsov-Ogievskiy (8): block-backend: blk_root(): drop const specifier on return type block/export: add blk_by_export_id() block: make bdrv_find_child() function public qapi: add blockdev-replace command block: bdrv_get_xdbg_block_graph(): report export ids iotests.py: introduce VM.assert_edges_list() method iotests: add filter-insertion deprecate names duplication between qdev, block-node and block-export block.c | 29 +++ block/block-backend.c | 2 +- block/export/export.c | 41 ++++ blockdev.c | 82 +++++-- docs/about/deprecated.rst | 10 + include/block/block-global-state.h | 1 + include/block/block_int-io.h | 2 + include/block/export.h | 1 + include/system/block-backend-global-state.h | 5 +- qapi/block-core.json | 24 ++ stubs/blk-by-qdev-id.c | 18 ++ stubs/blk-exp-find-by-blk.c | 13 + stubs/meson.build | 2 + system/qdev-monitor.c | 16 ++ tests/qemu-iotests/iotests.py | 17 ++ tests/qemu-iotests/tests/filter-insertion | 222 ++++++++++++++++++ tests/qemu-iotests/tests/filter-insertion.out | 5 + 17 files changed, 474 insertions(+), 16 deletions(-) create mode 100644 stubs/blk-by-qdev-id.c create mode 100644 stubs/blk-exp-find-by-blk.c create mode 100755 tests/qemu-iotests/tests/filter-insertion create mode 100644 tests/qemu-iotests/tests/filter-insertion.out -- 2.52.0

4 24

Plans for 12.1.0 release (freeze on 2026-02-24)
by Jiri Denemark 24 Feb '26

24 Feb '26

We are getting close to 12.1.0 release of libvirt. To aim for the release on Monday 02 Mar I suggest entering the freeze on Tuesday 24 Feb and tagging RC2 on Thursday 26 Feb. I hope this works for everyone. Jirka

2 3

[PATCH] bhyve: Default to ROM type for loader
by Andrea Bolognani 24 Feb '26

24 Feb '26

A previous commit had moved this logic from the generic postparse code to drivers but failed to update the bhyve driver accordingly in the process. Fixes: 1504b7f687bdfc679377e605d076776b18533468 Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Pushed under the build breaker rule. src/bhyve/bhyve_domain.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 8fc9733756..85960c6e12 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -135,6 +135,12 @@ bhyveDomainDefPostParse(virDomainDef *def, } } + if (def->os.loader && + def->os.loader->path && + !def->os.loader->type) { + def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM; + } + return 0; } -- 2.53.0

1 0

[PATCH 0/8] Several related cleanup patches
by Laine Stump 24 Feb '26

24 Feb '26

These patches were all the result of a failed attempt to provide more useful error messages when libvirt is started with an insufficiently setup environment (e.g. $HOME isn't set and/or the XDG_* environment variables aren't set) which currently results in unhelpful log messages (for an example see https://issues.redhat.com/browse/RHEL-105490) The way I was trying to improve the log messages didn't work out the way I'd hoped (long story), but these patches are generally good (or, for the last two, at least are fodder for discussion). You can put them into 3 categories: 1) reducing the scope of some autofree strings / renaming functions 2) consistently use g_getenv/g_setenv 3) stop mocking virGetUserRuntimeDirectory in tests, and instead point the environment at a properly initialiazed test directory tree. (I suppose I could have sent them in separate threads, but they were all in a single branch so sending them together created less "local bureacracy") Laine Stump (8): util: reduce scope/autofree-ify rundir in virDaemonUnixSocketPaths() util: reduce scope of rundir in virPidFileConstructPath() remote: reduce scope of userdir in remoteGetUNIXSocketHelper() util: rename virGetUserDirectory(ByUID) to virGetUserHomeDirectory(ByUID) util: make completely separate functions for WIN32 versions of virGetUser*Directory() consistently use glib g_getenv() instead of libc getenv() tests: point $HOME and $XDG_* into usable fake root directory tests: stop mocking virGetUserRuntimeDirectory() scripts/rpcgen/tests/test_demo.c | 2 +- src/admin/libvirt-admin.c | 2 +- src/hyperv/hyperv_driver.c | 2 +- src/libvirt.c | 2 +- src/libvirt_private.syms | 4 +-- src/network/leaseshelper.c | 14 ++++---- src/qemu/qemu_command.c | 2 +- src/qemu/qemu_interop_config.c | 4 +-- src/remote/remote_sockets.c | 7 ++-- src/rpc/virnetclient.c | 4 +-- src/rpc/virnetlibsshsession.c | 2 +- src/rpc/virnettlsconfig.c | 2 +- src/rpc/virnettlscontext.c | 2 +- src/util/virauth.c | 2 +- src/util/vircommand.c | 2 +- src/util/virdaemon.c | 13 ++------ src/util/virfile.c | 4 +-- src/util/virlease.c | 4 +-- src/util/virlog.c | 6 ++-- src/util/virpidfile.c | 4 +-- src/util/virsystemd.c | 8 ++--- src/util/virutil.c | 55 +++++++++++++++++++++---------- src/util/virutil.h | 4 +-- src/vbox/vbox_XPCOMCGlue.c | 2 +- src/vbox/vbox_common.c | 2 +- src/vbox/vbox_storage.c | 2 +- tests/eventtest.c | 2 +- tests/fdstreamtest.c | 2 +- tests/meson.build | 1 - tests/qemucpumock.c | 2 +- tests/qemuhotplugtest.c | 1 - tests/qemusecuritymock.c | 16 ++++----- tests/securityselinuxhelper.c | 10 +++--- tests/testutils.c | 56 +++++++++++++++++++++++--------- tests/testutils.h | 2 +- tests/testutilsqemu.c | 2 +- tests/vircgroupmock.c | 10 +++--- tests/virfilemock.c | 8 ++--- tests/virhostdevmock.c | 15 --------- tests/virhostdevtest.c | 3 +- tests/virmockstathelpers.c | 2 +- tests/virnetdaemontest.c | 2 +- tests/virnettlshelpers.c | 2 +- tests/virpcimock.c | 2 +- tests/virportallocatormock.c | 4 +-- tests/virscsitest.c | 2 +- tests/virsystemdtest.c | 14 ++++---- tests/virtestmock.c | 6 ++-- tools/virsh.c | 2 +- tools/virt-login-shell-helper.c | 4 +-- tools/vsh.c | 14 ++++---- 51 files changed, 179 insertions(+), 162 deletions(-) delete mode 100644 tests/virhostdevmock.c -- 2.52.0

2 11

[PATCH v4 00/36] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 24 Feb '26

24 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Changes from [v3]: * changes to JSON firmware descriptors shipped by the edk2 package have been merged in Fedora, so the corresponding patch is no longer marked as DONOTMERGE; * drop new varstore-specific flags from virsh, the existing NVRAM-related flags will work for varstore too; * drop some changes to firmware selection that were not related to varstore support, to be reworked and submitted again at a later date; * split, join and shuffle around patches; * tweak things according to review feedback. Changes from [v2]: * changes to the schema for JSON firmware descriptors have been queued for merge in QEMU, so the corresponding patch is no longer marked as DONOTMERGE; * improve documentation; * rebase on top of master, addressing conflicts that I have caused with some recent changes related to this work. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [v3] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5JTQ… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (36): docs: Rename "BIOS bootloader" section to "guest firmware" docs: Improvement related to firmware selection qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers tests: Rename custom JSON firmware descriptors schema: Introduce osnvram define conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate include: Mention varstore where applicable virsh: Update for varstore handling news: Document support for uefi-vars device and firmwares NEWS.rst | 17 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 85 +++++---- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 23 +-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 74 +++++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 29 ++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 26 ++- src/qemu/qemu_firmware.c | 177 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++--- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 ++++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 3 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 .../90-edk2-aarch64-qemuvars-sb-enrolled.json | 29 +++ ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 14 +- ...combined.json => 90-libvirt-combined.json} | 0 .../firmware/91-edk2-aarch64-qemuvars-sb.json | 28 +++ ...json => 91-edk2-ovmf-qemuvars-x64-sb.json} | 15 +- .../{91-bios.json => 91-libvirt-bios.json} | 0 ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 63 +++++-- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...-auto-bios-not-stateless.x86_64-latest.xml | 35 ++++ ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...-enrolled-keys-aarch64.aarch64-latest.args | 32 ++++ ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 ++++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...o-efi-varstore-aarch64.aarch64-latest.args | 32 ++++ ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 ++++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...e-auto-efi-varstore-q35.x86_64-latest.args | 35 ++++ ...re-auto-efi-varstore-q35.x86_64-latest.xml | 40 ++++ .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...nual-bios-not-stateless.x86_64-latest.args | 32 ++++ ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...anual-bios-not-stateless.x86_64-latest.xml | 28 +++ ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...l-efi-varstore-aarch64.aarch64-latest.args | 32 ++++ ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 ++++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...manual-efi-varstore-q35.x86_64-latest.args | 35 ++++ ...-manual-efi-varstore-q35.x86_64-latest.xml | 40 ++++ .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 10 +- tools/virsh-snapshot.c | 2 +- 173 files changed, 1546 insertions(+), 307 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/90-edk2-aarch64-qemuvars-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/91-edk2-aarch64-qemuvars-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 91-edk2-ovmf-qemuvars-x64-sb.json} (52%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

3 45

[PATCH 0/2] storage: fix pool refresh failure during async jobs
by Lucas Amaral 23 Feb '26

23 Feb '26

When creating multiple VMs in parallel using virt-install, pool refresh fails with: error: internal error: pool 'default' has asynchronous jobs running. This happens because a concurrent volume creation holds an async job on the pool. The storagePoolRefresh() function immediately returns VIR_ERR_INTERNAL_ERROR instead of waiting for the async job to finish. Patch 1 fixes the error code from VIR_ERR_INTERNAL_ERROR to VIR_ERR_OPERATION_INVALID in all 4 affected operations (pool-refresh, pool-destroy, pool-undefine, pool-delete), consistent with the adjacent "pool is not active" and "pool is starting up" checks. Patch 2 adds a condition variable to virStoragePoolObj so that storagePoolRefresh() waits up to 30 seconds for async jobs to drain instead of failing immediately. The other three operations keep the immediate error since waiting to destroy/delete/undefine a pool during volume creation is not a sensible user workflow. Reproducing the bug requires artificially widening the race window since fallocate() completes in microseconds on local filesystems. I used LD_PRELOAD to inject a 15-second delay into fallocate64() for files in the pool directory. Details and validation results are in the individual patch notes below the '---' line. https://issues.redhat.com/browse/RHEL-150758 Lucas Amaral (2): storage: fix error code for async jobs check in pool operations storage: wait for async jobs to drain during pool refresh src/conf/virstorageobj.c | 39 ++++++++++++++++++++++++++++++++++++ src/conf/virstorageobj.h | 3 +++ src/libvirt_private.syms | 1 + src/storage/storage_driver.c | 25 ++++++++++++++++------- 4 files changed, 61 insertions(+), 7 deletions(-) -- 2.52.0

1 2

[PATCH] qemu: add automatic port allocation for pull-mode backup NBD servers
by Lucas Amaral 23 Feb '26

23 Feb '26

Previously, users had to manually specify a TCP port when starting a pull-mode backup with an NBD server. A TODO comment in qemuBackupPrepare() noted this limitation and pointed toward using virPortAllocator, as done for migration, VNC, and SPICE ports. Add backup_port_min and backup_port_max configuration options to qemu.conf, defaulting to 10809-10872 (10809 is the IANA-assigned NBD port; range of 64 matches the migration port pattern). When a pull-mode backup is started without specifying a TCP port, a port is now acquired automatically from the configured range via virPortAllocatorAcquire(). The port is released when the backup ends or if startup fails. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- Build-tested and passed full test suite on CentOS Stream 9 (298 OK, 0 failures). Runtime-validated against an actual patched virtqemud instance running inside a privileged container (CentOS Stream 9, QEMU 10.1.0) with a live aarch64/virt guest. Config parsing validation: - Default config (no backup_port_* set): daemon starts OK - Custom range (backup_port_min=20000, backup_port_max=20010): daemon starts OK - Invalid (min > max): daemon correctly refuses to start - Invalid (min = 0): daemon correctly refuses to start - Invalid (max > 65535): daemon correctly refuses to start Port auto-allocation (live VM backup): - Pull-mode backup WITHOUT port specified: backup-begin succeeds, backup-dumpxml shows auto-allocated port='10809' from default range. Previously this would fail with: "<domainbackup> must specify TCP port for now" - Pull-mode backup WITH explicit port=10809: backup-begin succeeds, backup-dumpxml shows port='10809'. Behavior unchanged from before the patch. Port conflict and exhaustion (range set to 10809-10810, 3 VMs): - Auto-allocate on vm1 (got 10809), then manual port=10809 on vm2: QEMU correctly rejects with "Address already in use" - Auto-allocate vm1=10809, vm2=10810 (range full), vm3 attempt: "Unable to find an unused port in range 'backup' (10809-10810)" - After aborting vm1 backup (releasing 10809), vm3 retries and gets 10809: port release and reuse works correctly docs/formatbackup.rst | 3 ++- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf.in | 9 ++++++++ src/qemu/qemu_backup.c | 33 +++++++++++++++++++++--------- src/qemu/qemu_conf.c | 25 ++++++++++++++++++++++ src/qemu/qemu_conf.h | 6 ++++++ src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++++++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ 9 files changed, 76 insertions(+), 11 deletions(-) diff --git a/docs/formatbackup.rst b/docs/formatbackup.rst index df6392e3bd..24857eaf72 100644 --- a/docs/formatbackup.rst +++ b/docs/formatbackup.rst @@ -42,7 +42,8 @@ were supplied). The following child elements and attributes are supported: ```protocol`` element of a disk <formatdomain.html#hard-drives-floppy-disks-cdroms>`__ attached via NBD in the domain (such as transport, socket, name, port, or tls), necessary to set up an NBD server that exposes the content of each disk at - the time the backup is started. + the time the backup is started. For TCP transport, if ``port`` is omitted, a + port is allocated automatically from the range configured in ``/etc/libvirt/qemu.conf``. In addition to the above the NBD server used for backups allows using ``transport='fd' fdgroup='NAME'`` where ``NAME`` is the name used with diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index 0286582169..eb790d48be 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -146,6 +146,8 @@ module Libvirtd_qemu = | int_entry "migration_port_min" | int_entry "migration_port_max" | str_entry "migration_host" + | int_entry "backup_port_min" + | int_entry "backup_port_max" let log_entry = bool_entry "log_timestamp" diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index 2d1c67034d..5eacd70022 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -969,6 +969,15 @@ #migration_port_max = 49215 +# Port range used for automatic allocation of NBD backup server ports. +# When a pull-mode backup is started without specifying a TCP port, a +# port from this range will be assigned automatically. The NBD standard +# port is 10809. +# +#backup_port_min = 10809 +#backup_port_max = 10872 + + # Timestamp QEMU's log messages (if QEMU supports it) # # Defaults to 1. diff --git a/src/qemu/qemu_backup.c b/src/qemu/qemu_backup.c index 44514d08fc..12ef64b14e 100644 --- a/src/qemu/qemu_backup.c +++ b/src/qemu/qemu_backup.c @@ -32,6 +32,7 @@ #include "storage_source.h" #include "storage_source_conf.h" #include "virerror.h" +#include "virportallocator.h" #include "virlog.h" #include "virbuffer.h" #include "backup_conf.h" @@ -71,16 +72,7 @@ qemuBackupPrepare(virDomainBackupDef *def) switch (def->server->transport) { case VIR_STORAGE_NET_HOST_TRANS_TCP: - /* TODO: Update qemu.conf to provide a port range, - * probably starting at 10809, for obtaining automatic - * port via virPortAllocatorAcquire, as well as store - * somewhere if we need to call virPortAllocatorRelease - * during BackupEnd. Until then, user must provide port */ - if (!def->server->port) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("<domainbackup> must specify TCP port for now")); - return -1; - } + /* port is auto-allocated if not set */ break; case VIR_STORAGE_NET_HOST_TRANS_UNIX: @@ -841,6 +833,16 @@ qemuBackupBegin(virDomainObj *vm, if (qemuBackupPrepare(def) < 0) goto endjob; + if (pull && def->server && + def->server->transport == VIR_STORAGE_NET_HOST_TRANS_TCP && + !def->server->port) { + unsigned short port = 0; + if (virPortAllocatorAcquire(priv->driver->backupPorts, &port) < 0) + goto endjob; + def->server->port = port; + priv->backupNBDPort = port; + } + if (qemuBackupBeginPrepareTLS(vm, cfg, def, &tlsProps, &tlsSecretProps) < 0) goto endjob; @@ -969,6 +971,11 @@ qemuBackupBegin(virDomainObj *vm, qemuDomainObjExitMonitor(vm); } + if (ret < 0 && priv->backupNBDPort) { + virPortAllocatorRelease(priv->backupNBDPort); + priv->backupNBDPort = 0; + } + if (ret < 0 && !job_started && priv->backup) def = g_steal_pointer(&priv->backup); @@ -1026,6 +1033,12 @@ qemuBackupNotifyBlockjobEndStopNBD(virDomainObj *vm, qemuDomainObjExitMonitor(vm); backup->nbdStopped = true; + + if (priv->backupNBDPort) { + virPortAllocatorRelease(priv->backupNBDPort); + priv->backupNBDPort = 0; + backup->server->port = 0; + } } diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index de6e51177a..99e6a29148 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -74,6 +74,9 @@ VIR_LOG_INIT("qemu.qemu_conf"); #define QEMU_MIGRATION_PORT_MIN 49152 #define QEMU_MIGRATION_PORT_MAX 49215 +#define QEMU_BACKUP_PORT_MIN 10809 +#define QEMU_BACKUP_PORT_MAX 10872 + VIR_ENUM_IMPL(virQEMUSchedCore, QEMU_SCHED_CORE_LAST, "none", @@ -265,6 +268,9 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged, cfg->migrationPortMin = QEMU_MIGRATION_PORT_MIN; cfg->migrationPortMax = QEMU_MIGRATION_PORT_MAX; + cfg->backupPortMin = QEMU_BACKUP_PORT_MIN; + cfg->backupPortMax = QEMU_BACKUP_PORT_MAX; + /* For privileged driver, try and find hugetlbfs mounts automatically. * Non-privileged driver requires admin to create a dir for the * user, chown it, and then let user configure it manually. */ @@ -985,6 +991,25 @@ virQEMUDriverConfigLoadNetworkEntry(virQEMUDriverConfig *cfg, return -1; } + if (virConfGetValueUInt(conf, "backup_port_min", &cfg->backupPortMin) < 0) + return -1; + if (cfg->backupPortMin <= 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%1$s: backup_port_min: port must be greater than 0"), + filename); + return -1; + } + + if (virConfGetValueUInt(conf, "backup_port_max", &cfg->backupPortMax) < 0) + return -1; + if (cfg->backupPortMax > 65535 || + cfg->backupPortMax < cfg->backupPortMin) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%1$s: backup_port_max: port must be between the minimal port %2$d and 65535"), + filename, cfg->backupPortMin); + return -1; + } + if (virConfGetValueString(conf, "migration_host", &cfg->migrateHost) < 0) return -1; virStringStripIPv6Brackets(cfg->migrateHost); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index c284e108a1..2e68f1de14 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -240,6 +240,9 @@ struct _virQEMUDriverConfig { unsigned int migrationPortMin; unsigned int migrationPortMax; + unsigned int backupPortMin; + unsigned int backupPortMax; + bool logTimestamp; bool stdioLogD; @@ -338,6 +341,9 @@ struct _virQEMUDriver { /* Immutable pointer, immutable object */ virPortAllocatorRange *migrationPorts; + /* Immutable pointer, immutable object */ + virPortAllocatorRange *backupPorts; + /* Immutable pointer, lockless APIs */ virSysinfoDef *hostsysinfo; diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 5755d2adb0..1153d8c6e0 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -147,6 +147,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in case it was changed for the current diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c5eedeedfa..a8034b4f26 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -714,6 +714,12 @@ qemuStateInitialize(bool privileged, cfg->migrationPortMax)) == NULL) goto error; + if ((qemu_driver->backupPorts = + virPortAllocatorRangeNew(_("backup"), + cfg->backupPortMin, + cfg->backupPortMax)) == NULL) + goto error; + if (qemuSecurityInit(qemu_driver) < 0) goto error; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index 82cfec3b4b..2582c6a09c 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -110,6 +110,8 @@ module Test_libvirtd_qemu = { "migration_host" = "host.example.com" } { "migration_port_min" = "49152" } { "migration_port_max" = "49215" } +{ "backup_port_min" = "10809" } +{ "backup_port_max" = "10872" } { "log_timestamp" = "0" } { "nvram" { "1" = "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd" } -- 2.52.0

1 0

[PATCH resend] In virFDStreamRead(), fill buffer from this and next messages
by Erik Huelsmann 23 Feb '26

23 Feb '26

Before this change, buffers returned from virFDStreamRead() would alternate in size (262120 and 24), because it only consumed the bytes remaining from the current background thread message. As the background thread reads 262144 bytes (256kB) of data in each chunk, where the maximum size returned from virFDStreamRead() to be transferred over the remote protocol is only 262120, 24 bytes would be left in the buffer on each iteration. The next iteration leaves 24 bytes, which used to be returned without considering messages waiting in the queue. Signed-off-by: Erik Huelsmann <ehuels(a)gmail.com> --- src/util/virfdstream.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/util/virfdstream.c b/src/util/virfdstream.c index 26a1f00..4c974ba 100644 --- a/src/util/virfdstream.c +++ b/src/util/virfdstream.c @@ -905,7 +905,10 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) if (fdst->thread) { virFDStreamMsg *msg = NULL; + size_t got = 0; + size_t bsz = 0; + more: while (!(msg = fdst->msg)) { if (fdst->threadQuit || fdst->threadErr) { if (nbytes) { @@ -917,7 +920,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) virReportSystemError(EBADF, "%s", _("stream is not open")); } else { - ret = 0; + ret = got; } goto cleanup; } else { @@ -931,7 +934,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) * return 0 immediately. */ if (msg->type == VIR_FDSTREAM_MSG_TYPE_HOLE && msg->stream.hole.len == 0) { - ret = 0; + ret = got; goto cleanup; } @@ -942,21 +945,26 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) goto cleanup; } - if (nbytes > msg->stream.data.len - msg->stream.data.offset) - nbytes = msg->stream.data.len - msg->stream.data.offset; + bsz = msg->stream.data.len - msg->stream.data.offset; + if (nbytes < bsz) + bsz = nbytes; - memcpy(bytes, + memcpy(bytes + got, msg->stream.data.buf + msg->stream.data.offset, - nbytes); + bsz); + got += bsz; + nbytes -= bsz; - msg->stream.data.offset += nbytes; + msg->stream.data.offset += bsz; if (msg->stream.data.offset == msg->stream.data.len) { virFDStreamMsgQueuePop(fdst, fdst->fd, "pipe"); virFDStreamMsgFree(msg); } - ret = nbytes; - + ret = got; + if (nbytes > 0) { + goto more; + } } else { retry: ret = read(fdst->fd, bytes, nbytes); -- 2.43.0

4 9

[PATCH v3 00/38] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 23 Feb '26

23 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Note that, while I consider the entire series to be ready for review, there is one patch that is marked as DONOTMERGE: that's because it imports into the tree firmware descriptor that are not yet part of the Fedora edk2 package. Changes from [v2]: * changes to the schema for JSON firmware descriptors have been queued for merge in QEMU, so the corresponding patch is no longer marked as DONOTMERGE; * improve documentation; * rebase on top of master, addressing conflicts that I have caused with some recent changes related to this work. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (38): qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers qemu_firmware: Improve matching when loader.type is absent tests: Rename custom JSON firmware descriptors tests: Update JSON firmware descriptor for BIOS schema: Add varstore element conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs schema: Add varstore element for domcaps conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file include: Mention varstore where applicable virsh: Update for varstore handling docs: Update for varstore and improve news: Document support for uefi-vars device and firmwares NEWS.rst | 16 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 85 +++++--- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 44 +++-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 64 +++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 29 ++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 27 ++- src/qemu/qemu_firmware.c | 182 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++-- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 +++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 3 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 15 +- .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 28 +++ ...json => 71-edk2-ovmf-qemuvars-x64-sb.json} | 16 +- .../firmware/71-edk2-qemuvars-aarch64-sb.json | 27 +++ ...combined.json => 90-libvirt-combined.json} | 0 .../{91-bios.json => 91-libvirt-bios.json} | 2 +- ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 71 ++++--- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...auto-bios-not-stateless.x86_64-latest.xml} | 6 +- ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...enrolled-keys-aarch64.aarch64-latest.args} | 12 +- ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 +++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...-auto-efi-varstore-q35.x86_64-latest.args} | 5 +- ...e-auto-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...ual-bios-not-stateless.x86_64-latest.args} | 8 +- ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...nual-bios-not-stateless.x86_64-latest.xml} | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-manual-bios.x86_64-latest.xml | 6 +- ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...anual-efi-varstore-q35.x86_64-latest.args} | 5 +- ...manual-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 55 ++++-- tools/virsh-snapshot.c | 9 +- 179 files changed, 1314 insertions(+), 380 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 70-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 71-edk2-ovmf-qemuvars-x64-sb.json} (51%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/71-edk2-qemuvars-aarch64-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (90%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-auto-bios-not-stateless.x86_64-latest.xml} (84%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-varstore-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.args => firmware-auto-efi-varstore-q35.x86_64-latest.args} (83%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-varstore-q35.x86_64-latest.xml} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-bios-not-stateless.x86_64-latest.args} (84%) delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err copy tests/qemuxmlconfdata/{firmware-manual-bios.x86_64-latest.xml => firmware-manual-bios-not-stateless.x86_64-latest.xml} (90%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-aarch64.aarch64-latest.args} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-q35.x86_64-latest.args} (85%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-varstore-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

4 87