- Devel - libvirt List Archives

[PATCH v2 0/2] allow migrations with the ext transport
by Sergey Dyasli 10 Feb '26

10 Feb '26

Hello, I have a use case for live-migration where the socket of the destination libvirtd is proxied by an mTLS WebSocket proxy. Since there is no WebSocket support in Libvirt, I've decided to use the existing ext transport and point it to a proxy binary on the source host of live-migration. While doing that, I've discovered a couple of roadblocks: 1. There is no way of passing cmdline arguments to the ext program 2. Live-migrations using ext transport fail localhost checks This short series addresses those limitations. Sergey Dyasli (2): remote: allow passing argv to the ext transport remote: allow migrations with the ext transport v1 -> v2: - new way of passing argv src/libvirt-domain.c | 8 +++++--- src/remote/remote_driver.c | 30 ++++++++++++++++++++++++++---- src/util/viruri.c | 32 ++++++++++++++++++++++++++++++++ src/util/viruri.h | 2 ++ 4 files changed, 65 insertions(+), 7 deletions(-) -- 2.43.7

2 3

[PATCH v2 00/21] qom: introduce property flags to track external user input
by Zhao Liu 10 Feb '26

10 Feb '26

Hi, This is the v2 trying to introduce property flags to detect user's property setting (from CLI/QMP/HMP). I dropped RFC tag since previous RFC v1 [1]. Though this work the follow-up of v2.6 & v2.7 machines' removal [2], now it is decoupled from [2] totally since v2 doesn't detect compat property and only focuses on external user setting, so this series is based on master branch at the commit 28a6ca268c2c ("Merge tag 'single- binary-20260203' of https://github.com/philmd/qemu into staging"). And you can also find the code here: https://gitlab.com/zhao.liu/qemu/-/tree/prop-flags-v2.3-02-08-2026 This series introduces 3 property flags: * USER_SET: Any external user property setting (from CLI/HMP/QMP) is marked as USER_SET. * DEPRECATED: Once a property is marked as DEPRECATED, any external user property setting will trigger a warning. * INTERNAL: Once a property is marked as INTERNAL, any external user property setting will cause an error. More details or document for these 3 flags, you can refer patch 7. Compared with RFC v1, v2 mainly: * introduce USER_SET property flag to identify all user's setting. - patch 7 for document. * construct DEPRECATED & INTERNAL flag on USER_SET. - patch 7 for document. * cover more comprehensive user set cases. - patch 8-13. * provide examples about new flags (USER_SET/DEPRECATED/INTELNAL). - patch 15/16/17 are examples for DEPRECATED flag. - patch 18 is the example for INTERNAL flag. - patch 20 is the example for USER_SET flag. I think v2 should now cover "nearly" all cases (patch 8-13) where users set properties: one approach is to trace the call chain of object_property_set(). Even if there are cases that were missed, they can be easily addressed based on this series: object_property_set(obj, ...); /* Insert this call after object_property_set(). */ object_property_set_flags(obj, ..., OBJ_PROP_FLAG_USER_SET, ...); [1]: RFC v1: https://lore.kernel.org/qemu-devel/20251202170502.3228625-1-zhao1.liu@intel… [2]: hw/i386/pc: Remove deprecated 2.6 and 2.7 PC machines https://lore.kernel.org/qemu-devel/20260108033051.777361-1-zhao1.liu@intel.… Thanks and Best Regards, Zhao --- Zhao Liu (21): qom/object: use BIT macro for ObjectPropertyFlags qom/object: cache ObjectPropertyFlags in ObjectProperty qom/object: factor out object_class_property_try_add() qom/object: add flags argument in object_{class_}property_try_add() qom/object: rename object_{class_}property_try_add() to object_{class_}property_add_full() qom/object: add helpers to set/get/clear property flags qom/object: introduce user interaction flags for properties qom/object: add from_user argument in object_property_parse() qom/object: mark global property set from CLI as USER_SET qom/qom-hmp-cmd: mark properties set from HMP (non-JSON) "qom-set" as USER_SET qom/qom-qmp-cmd: mark properties set from QMP/HMP (JSON) "qom-set" as USER_SET qom/object_interfaces: mark properties set from qdict & keyval as USER_SET system/vl: mark property set in object_parse_property_opt() as USER_SET hw/core/qdev-properties: allow qdev properties accept flags target/i386: deprecate fill-mtrr-mask property target/i386: deprecate cpuid-0xb property hw/intc/ioapic: deprecate version property target/i386: mark x-consistent-cache property as internal-only target/i386: remove redundant validation for lbr-fmt property target/i386: detect user provided lbr-fmt via property flag hw/core/qdev-properties: support valid default value for DEFINE_PROP_UINT64_CHECKMASK docs/about/deprecated.rst | 31 +++++ hw/core/qdev-properties.c | 29 ++-- hw/i386/sgx.c | 2 +- hw/intc/ioapic.c | 3 +- include/hw/core/qdev-properties.h | 38 +++--- include/qom/object.h | 215 +++++++++++++++++++++++++++--- qom/object.c | 177 ++++++++++++++++++++---- qom/object_interfaces.c | 5 + qom/qom-hmp-cmds.c | 2 +- qom/qom-qmp-cmds.c | 7 +- system/vl.c | 6 +- target/i386/cpu.c | 28 ++-- 12 files changed, 448 insertions(+), 95 deletions(-) -- 2.34.1

5 31

[RFC PATCH v5 0/7] riscv: add initial sdext support
by Chao Liu 10 Feb '26

10 Feb '26

Hi, Per Daniel's review feedback, this v5 series is based on Alistair's riscv-to-apply.next branch [3]. It depends on patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series (not included; apply them first) [2]. It is based on RISC-V Debug Specification 1.0 [1]. It introduces the sdext/sdtrig config bits, DCSR/DPC/DSCRATCH state, Debug Mode enter/leave helpers, DRET, EBREAK entry, single-step, and trigger action=debug mode. To reduce review load, this series focuses on the Sdext features first. The Debug Module (DM) and related flows will follow in a later series. Changes in v5: - Patch 2: removed redundant `cpu->cfg.ext_sdext = false;` in riscv_cpu_init() since it's already set to false in MULTI_EXT_CFG_BOOL. (Daniel) - Patch 7: changed LOG_UNIMP to LOG_GUEST_ERROR for invalid trigger action=debug mode when Sdext is not enabled. LOG_UNIMP is reserved for unimplemented features, while LOG_GUEST_ERROR is for invalid guest actions. (Daniel) Changes in v4: - Fixed linux-user build errors: moved debug_mode/dcsr/dpc/dscratch fields inside #ifndef CONFIG_USER_ONLY block in cpu.h, and wrapped all code using these fields with proper guards. (Daniel) - Updated dependency from single patch (patch 5 only) to patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series to avoid compilation errors. Changes in v3: - Rebase onto Alistair's riscv-to-apply.next branch. - Depend on Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." (not included; apply it first) [2]. - Patch 2: default sdext to false in riscv_cpu_extensions[]. Changes in v2: - Drop the RHCT expected AML update from this series. - Replace the split sdext/sdtrig config bits patch with deprecating the 'debug' CPU property. - Rebase and update patch subjects to target/riscv prefix. Changes in v1: - Debug Mode entry/exit updates DCSR/DPC and restores execution via DRET. - EBREAK honors DCSR ebreak bits and enters Debug Mode when enabled. - Single-step uses DCSR.STEP with a TB flag and a helper at TB exit. It references Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." [2]. - Sdtrig supports action=debug mode for mcontrol/mcontrol6 and reports inst-count triggers in tinfo. Differences vs Debug Spec (known gaps): - No Debug Module (no DMI, dmcontrol/dmstatus, haltreq/resumereq). - No debug ROM, program buffer, abstract commands, or SBA. - Resume is modeled by leaving Debug Mode at cpu_exec_enter. - Step/exception ordering is simplified: if the stepped instruction traps, the normal exception is taken and Debug Mode is not forced. - Several DCSR fields are not fully modeled (stopcount/stoptime, etc). Roadmap (next stage, DM focus): 1) Add a DM core with DMI access and hart state tracking. 2) Implement halt/resume handshake and move Debug Mode transitions under DM control. 3) Add debug ROM, program buffer, and abstract commands for GPR/CSR and memory access. 4) Add SBA if required by tooling. 5) Tighten ordering rules for step/exception/trigger priorities. References: [1] https://github.com/riscv/riscv-debug-spec/releases/tag/1.0 [2] https://lore.kernel.org/qemu-devel/20260108132631.9429-1-max.chou@sifive.co… [3] https://github.com/alistair23/qemu/tree/riscv-to-apply.next Thanks, Chao Chao Liu (6): target/riscv: add sdext debug CSRs state target/riscv: add sdext Debug Mode helpers target/riscv: add dret instruction target/riscv: add sdext enter Debug Mode on ebreak target/riscv: add sdext single-step support target/riscv: add sdtrig trigger action=debug mode Daniel Henrique Barboza (1): target/riscv: deprecate 'debug' CPU property docs/about/deprecated.rst | 7 + include/exec/translation-block.h | 4 +- target/riscv/cpu.c | 59 +++++++- target/riscv/cpu.h | 9 ++ target/riscv/cpu_bits.h | 33 +++++ target/riscv/cpu_cfg_fields.h.inc | 3 +- target/riscv/cpu_helper.c | 90 ++++++++++++ target/riscv/csr.c | 128 +++++++++++++++++- target/riscv/debug.c | 58 +++++++- target/riscv/helper.h | 3 + target/riscv/insn32.decode | 1 + .../riscv/insn_trans/trans_privileged.c.inc | 24 ++++ target/riscv/machine.c | 44 ++++-- target/riscv/op_helper.c | 70 ++++++++++ target/riscv/tcg/tcg-cpu.c | 21 ++- target/riscv/translate.c | 16 ++- 16 files changed, 545 insertions(+), 25 deletions(-) -- 2.53.0

2 10

[PATCH 0/4] qemu: Automatically add USB controller if USB devices are present
by Andrea Bolognani 09 Feb '26

09 Feb '26

Makes things more user-friendly for those machine types where a default USB controller is normally not automatically added. https://issues.redhat.com/browse/RHEL-2455 Andrea Bolognani (4): tests: Add usb-controller-automatic-with-devices-virt-aarch64 conf: Rename virDomainDefHasUSB() to virDomainDefHasUSBControllers() conf: Introduce virDomainDefHasUSBDevices() qemu: Automatically add USB controller if USB devices are present src/conf/domain_conf.c | 31 +++++++++++++- src/conf/domain_conf.h | 3 +- src/conf/domain_validate.c | 2 +- src/libvirt_private.syms | 3 +- src/qemu/qemu_domain_address.c | 2 +- src/qemu/qemu_postparse.c | 11 +++++ ...h-devices-virt-aarch64.aarch64-latest.args | 36 ++++++++++++++++ ...th-devices-virt-aarch64.aarch64-latest.xml | 41 +++++++++++++++++++ ...er-automatic-with-devices-virt-aarch64.xml | 14 +++++++ tests/qemuxmlconftest.c | 2 + 10 files changed, 139 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.xml -- 2.52.0

2 9

[PATCH v3 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 09 Feb '26

09 Feb '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename generic names to virNWFilter* and CamelCase nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 671 +-- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2496 ++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 55 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 304 ++ .../ah-linux.nftables.args | 298 ++ .../all-ipv6-linux.nftables.args | 286 ++ .../all-linux.nftables.args | 280 ++ .../arp-linux.nftables.args | 215 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 483 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 304 ++ .../esp-linux.nftables.args | 298 ++ .../example-1-linux.nftables.args | 266 ++ .../example-2-linux.nftables.args | 348 ++ .../hex-data-linux.nftables.args | 357 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 252 ++ .../icmpv6-linux.nftables.args | 322 ++ .../igmp-linux.nftables.args | 298 ++ .../ip-linux.nftables.args | 198 + .../ipt-no-macspoof-linux.nftables.args | 169 + .../ipv6-linux.nftables.args | 474 +++ .../iter1-linux.nftables.args | 298 ++ .../iter2-linux.nftables.args | 3598 +++++++++++++++++ .../iter3-linux.nftables.args | 418 ++ .../mac-linux.nftables.args | 180 + .../rarp-linux.nftables.args | 215 + .../sctp-ipv6-linux.nftables.args | 314 ++ .../sctp-linux.nftables.args | 314 ++ .../target-linux.nftables.args | 452 +++ .../target2-linux.nftables.args | 316 ++ .../tcp-ipv6-linux.nftables.args | 314 ++ .../tcp-linux.nftables.args | 468 +++ .../udp-ipv6-linux.nftables.args | 314 ++ .../udp-linux.nftables.args | 314 ++ .../udplite-ipv6-linux.nftables.args | 304 ++ .../udplite-linux.nftables.args | 298 ++ .../vlan-linux.nftables.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 59 files changed, 18806 insertions(+), 569 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

1 5

[PATCH v2 00/38] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 09 Feb '26

09 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Note that, while I consider the entire series to be ready for review, there are two patches that are marked as DONOTMERGE: that's because they respectively implement support for a JSON firmware descriptor syntax extension that has not yet been approved, and import into the tree firmware descriptor that are not yet part of the Fedora edk2 package. The latter depends on the former, of course, for which patches have been posted[1] to the QEMU mailing list. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [1] https://mail.gnu.org/archive/html/qemu-devel/2026-02/msg02498.html [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (38): qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers qemu_firmware: Improve matching when loader.type is absent tests: Rename custom JSON firmware descriptors tests: Update JSON firmware descriptor for BIOS schema: Add varstore element conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check DONOTMERGE: qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs schema: Add varstore element for domcaps conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file include: Mention varstore where applicable virsh: Update for varstore handling docs: Update for varstore and improve news: Document support for uefi-vars device and firmwares NEWS.rst | 16 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 81 +++++--- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 44 +++-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 64 +++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 31 ++- src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 27 ++- src/qemu/qemu_firmware.c | 182 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++-- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 +++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 1 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 1 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 1 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 15 +- .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 28 +++ ...json => 71-edk2-ovmf-qemuvars-x64-sb.json} | 16 +- .../firmware/71-edk2-qemuvars-aarch64-sb.json | 27 +++ ...combined.json => 90-libvirt-combined.json} | 0 .../{91-bios.json => 91-libvirt-bios.json} | 2 +- ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 71 ++++--- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...auto-bios-not-stateless.x86_64-latest.xml} | 6 +- ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...enrolled-keys-aarch64.aarch64-latest.args} | 12 +- ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 +++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...-auto-efi-varstore-q35.x86_64-latest.args} | 5 +- ...e-auto-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...ual-bios-not-stateless.x86_64-latest.args} | 8 +- ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...nual-bios-not-stateless.x86_64-latest.xml} | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-manual-bios.x86_64-latest.xml | 6 +- ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...anual-efi-varstore-q35.x86_64-latest.args} | 5 +- ...manual-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 55 ++++-- tools/virsh-snapshot.c | 9 +- 179 files changed, 1296 insertions(+), 380 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 70-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 71-edk2-ovmf-qemuvars-x64-sb.json} (51%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/71-edk2-qemuvars-aarch64-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (90%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-auto-bios-not-stateless.x86_64-latest.xml} (84%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-varstore-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.args => firmware-auto-efi-varstore-q35.x86_64-latest.args} (83%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-varstore-q35.x86_64-latest.xml} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-bios-not-stateless.x86_64-latest.args} (84%) delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err copy tests/qemuxmlconfdata/{firmware-manual-bios.x86_64-latest.xml => firmware-manual-bios-not-stateless.x86_64-latest.xml} (90%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-aarch64.aarch64-latest.args} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-q35.x86_64-latest.args} (85%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-varstore-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

1 38

[PATCH] virsh: Switch cmdDomIfAddr() to vshTable
by Michal Privoznik 09 Feb '26

09 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> The aim of cmdDomIfAddr() is to obtain IP addresses for given domain and then print (ifName, MAC, type, IP Address) tuple. Preferably in an aligned table. This is hard to do with printf style of spacing ("%-NNs") since the interface name (ifName) can vary a lot in length. Fortunately, we have vshTable which is designed to handle this case. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-domain-monitor.c | 53 ++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index f4274f2721..c0db30cb11 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -2279,6 +2279,7 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) bool full = vshCommandOptBool(cmd, "full"); const char *sourcestr = NULL; int source = VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE; + g_autoptr(vshTable) table = NULL; if (vshCommandOptString(ctl, cmd, "interface", &ifacestr) < 0) return false; @@ -2299,28 +2300,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) goto cleanup; } - vshPrintExtra(ctl, " %-10s %-20s %-8s %s\n%s%s\n", _("Name"), - _("MAC address"), _("Protocol"), _("Address"), - _("-------------------------------------------------"), - _("------------------------------")); + table = vshTableNew(_("Name"), _("MAC address"), _("Protocol"), _("Address"), NULL); + if (!table) + return false; for (i = 0; i < ifaces_count; i++) { virDomainInterfacePtr iface = ifaces[i]; const char *type = NULL; + const char *hwaddr = "N/A"; if (ifacestr && STRNEQ(ifacestr, iface->name)) continue; + if (iface->hwaddr) + hwaddr = iface->hwaddr; + /* When the interface has no IP address */ if (!iface->naddrs) { - vshPrint(ctl, " %-10s %-17s %-12s %s\n", - iface->name, - iface->hwaddr ? iface->hwaddr : "N/A", "N/A", "N/A"); + if (vshTableRowAppend(table, + iface->name, hwaddr, "N/A", "N/A", NULL) < 0) + goto cleanup; continue; } for (j = 0; j < iface->naddrs; j++) { - g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_autofree char *ip_addr_str = NULL; switch (iface->addrs[j].type) { @@ -2332,26 +2335,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) break; } - virBufferAsprintf(&buf, "%-12s %s/%d", - type, iface->addrs[j].addr, - iface->addrs[j].prefix); - - ip_addr_str = virBufferContentAndReset(&buf); - - if (!ip_addr_str) - ip_addr_str = g_strdup(""); + ip_addr_str = g_strdup_printf("%s/%d", + iface->addrs[j].addr, + iface->addrs[j].prefix); /* Don't repeat interface name */ - if (full || !j) - vshPrint(ctl, " %-10s %-17s %s\n", - iface->name, - NULLSTR_EMPTY(iface->hwaddr), ip_addr_str); - else - vshPrint(ctl, " %-10s %-17s %s\n", - "-", "-", ip_addr_str); + if (full || !j) { + if (vshTableRowAppend(table, + iface->name, + NULLSTR_EMPTY(iface->hwaddr), + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } else { + if (vshTableRowAppend(table, + "-", "-", + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } } } + vshTablePrintToStdout(table, ctl); + ret = true; cleanup: -- 2.52.0

2 1

[PATCH] qapi/net: deprecate TAP fd and vhostfd options
by Vladimir Sementsov-Ogievskiy 09 Feb '26

09 Feb '26

They are the same as fds and vhostfds, except they accept only one fd. Let's deprecate redundant options. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- Hi all! after "[PATCH v2 00/12] net: refactoring and fixes" options fd and vhostfd becomes redundant, fds and vhostfds may be used instead. this patch also based on "[PATCH v6] qapi: net: deprecate vhostforce option", that's why it's sent separately. Based-on: <20260129213215.1405459-1-vsementsov(a)yandex-team.ru> Based-on: <20251113071711.349651-1-vsementsov(a)yandex-team.ru> docs/about/deprecated.rst | 6 ++++++ qapi/net.json | 9 +++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index e8ff478583..9010f8ab07 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -451,6 +451,12 @@ TAP ``vhostforce`` (since 11.0) The ``vhostforce`` option is redundant with the ``vhost`` option. If they conflict, ``vhost`` takes precedence. Just use ``vhost``. +TAP ``fd`` and ``vhostfd`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Use ``fds`` and ``vhostfds`` correspondingly, each set with one fd +instead of ``fd`` and ``vhsotfd``. + Vhost-user ``vhostforce`` (since 11.0) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/qapi/net.json b/qapi/net.json index 9a00d578e9..2d5aed3ef8 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -326,8 +326,7 @@ # # @fd: file descriptor of an already opened tap # -# @fds: multiple file descriptors of already opened multiqueue capable -# tap +# @fds: multiple file descriptors of already opened tap # # @script: script to initialize the interface # @@ -359,13 +358,15 @@ # Features: # # @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# Member @fd is deprecated. Use @fds instead. +# Member @vhostfd is deprecated. Use @vhostfds instead. # # Since: 1.2 ## { 'struct': 'NetdevTapOptions', 'data': { '*ifname': 'str', - '*fd': 'str', + '*fd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*fds': 'str', '*script': 'str', '*downscript': 'str', @@ -374,7 +375,7 @@ '*sndbuf': 'size', '*vnet_hdr': 'bool', '*vhost': 'bool', - '*vhostfd': 'str', + '*vhostfd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*vhostfds': 'str', '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', -- 2.52.0

3 6

[PATCH v2 0/2] Adding support for client-based FD migrations.
by Tejus GK 09 Feb '26

09 Feb '26

Libvirt supports FD-based live migrations in the form of tunnelled migrations. However, this isn't as performant as of now, since it involves extra copies.· This patchset proposes adding support for externally provided file descriptors for live migration. By allowing the client to supply the migration FD directly, the extra copy can be avoided, improving overall migration performance. The intent is to gather early feedback on the approach and its feasibility. Comments, concerns, and suggestions are very welcome :) V2: 1. Removed the approach of introducing a new FD passing API and instead reuse the virDomainFDAssociate API along with a dummy VM on the destination host. 2. Introduced a new virDomainMigrate parameter, VIR_MIGRATE_PARAM_FD_SET. Tejus GK (2): qemu: support incoming "fd" uri qemu: add support for fd based live migrations include/libvirt/libvirt-domain.h | 14 +++ src/qemu/qemu_driver.c | 24 +++-- src/qemu/qemu_migration.c | 174 +++++++++++++++++++++++++------ src/qemu/qemu_migration.h | 3 + 4 files changed, 178 insertions(+), 37 deletions(-) -- 2.43.7

1 3

[PATCH v6 00/27] hw/i386/pc: Remove deprecated 2.6 and 2.7 PC machines
by Zhao Liu 07 Feb '26

07 Feb '26

Hi, This v6 is based on the master branch at the commit 0fc482b73d8e ("Merge tag 'pull-aspeed-20260105' of https://github.com/legoater/qemu into staging"). Since there's the discussion around fw_cfg_init_io_nodma() [*], v6 doesn't include that cleanups. Therefore, comparing v5, v6 has *very* minimal changes and most of patches have been reviewed (except patch 15 - I think it needs an additianl review :-) ). Thanks for your patience and review! Introduction ============ A brief introduction from Philippe's v4: The versioned 'pc' and 'q35' machines up to 2.12 been marked as deprecated three releases ago, and are older than 6 years, so according to our support policy we can remove them. This series only includes the 2.6 and 2.7 machines removal, as it is a big enough number of LoC removed. Rest will follow. Change Log ========== (Main) changes since v5: * Merge pc & q35 changes for testing DSDT tables into one patch and simplify the commit message. * Reorganize S-o-b and collect review tags from Igor. (Main) changes since v4: * Completely remove the legacy CPU hotplug approach. - New patch 2-8. - Test CPU hot-plug & hot-unplug via qmp. * Keep "dma_enabled" property in fw_cfg_io_properties[] since Sun4u & Sun4v are still using it. - About more details, please see commit message of patch 15. * Temporarily keep these properties: "cpuid-0xb" (of X86CPU), "fill-mtrr-mask" (of X86CPU), "version" (of IOAPICCommonState). - These properties will be deprecated first before removal, in another series. * Keep "l3-cache" (of X86CPU) and "page-per-vq" (of VirtIOPCIProxy), since they are still in use (e.g., libvirt). Reference ========= [*]: https://lore.kernel.org/qemu-devel/20251203060942.57851-1-philmd@linaro.org/ Best Regards, Zhao --- Igor Mammedov (1): tests/acpi: Allow DSDT table change for x86 machines Philippe Mathieu-Daudé (22): hw/i386/pc: Remove deprecated pc-q35-2.6 and pc-i440fx-2.6 machines hw/i386/pc: Remove PCMachineClass::legacy_cpu_hotplug field hw/nvram/fw_cfg: Rename fw_cfg_init_mem() with '_nodma' suffix hw/mips/loongson3_virt: Prefer using fw_cfg_init_mem_nodma() hw/nvram/fw_cfg: Factor fw_cfg_init_mem_internal() out hw/nvram/fw_cfg: Rename fw_cfg_init_mem_wide() -> fw_cfg_init_mem_dma() hw/i386/x86: Remove X86MachineClass::fwcfg_dma_enabled field hw/i386/pc: Remove multiboot.bin hw/i386: Assume fw_cfg DMA is always enabled hw/i386: Remove linuxboot.bin hw/i386/pc: Remove pc_compat_2_6[] array hw/intc/apic: Remove APICCommonState::legacy_instance_id field hw/core/machine: Remove hw_compat_2_6[] array hw/virtio/virtio-mmio: Remove VirtIOMMIOProxy::format_transport_address field hw/i386/pc: Remove deprecated pc-q35-2.7 and pc-i440fx-2.7 machines hw/i386/pc: Remove pc_compat_2_7[] array target/i386/cpu: Remove CPUX86State::full_cpuid_auto_level field hw/audio/pcspk: Remove PCSpkState::migrate field hw/core/machine: Remove hw_compat_2_7[] array hw/i386/intel_iommu: Remove IntelIOMMUState::buggy_eim field hw/virtio/virtio-pci: Remove VirtIOPCIProxy::ignore_backend_features field hw/char/virtio-serial: Do not expose the 'emergency-write' property Zhao Liu (4): pc: Start with modern CPU hotplug interface by default acpi: Remove legacy cpu hotplug utilities docs/specs/acpi_cpu_hotplug: Remove legacy cpu hotplug descriptions tests/acpi: Update DSDT tables for pc & q35 machines docs/specs/acpi_cpu_hotplug.rst | 28 +- hw/acpi/acpi-cpu-hotplug-stub.c | 19 +- hw/acpi/cpu.c | 10 - hw/acpi/cpu_hotplug.c | 348 ------------------ hw/acpi/generic_event_device.c | 1 + hw/acpi/ich9.c | 61 +-- hw/acpi/meson.build | 2 +- hw/acpi/piix4.c | 61 +-- hw/arm/virt.c | 2 +- hw/audio/pcspk.c | 10 - hw/char/virtio-serial-bus.c | 9 +- hw/core/machine.c | 17 - hw/hppa/machine.c | 2 +- hw/i386/acpi-build.c | 7 +- hw/i386/fw_cfg.c | 16 +- hw/i386/intel_iommu.c | 5 +- hw/i386/microvm.c | 3 - hw/i386/multiboot.c | 7 +- hw/i386/pc.c | 25 +- hw/i386/pc_piix.c | 23 -- hw/i386/pc_q35.c | 24 -- hw/i386/x86-common.c | 8 +- hw/i386/x86.c | 2 - hw/intc/apic_common.c | 5 - hw/loongarch/fw_cfg.c | 4 +- hw/loongarch/virt-acpi-build.c | 1 - hw/mips/loongson3_virt.c | 2 +- hw/nvram/fw_cfg.c | 22 +- hw/riscv/virt.c | 4 +- hw/virtio/virtio-mmio.c | 15 - hw/virtio/virtio-pci.c | 5 +- include/hw/acpi/cpu.h | 1 - include/hw/acpi/ich9.h | 4 +- include/hw/acpi/piix4.h | 4 +- include/hw/core/boards.h | 6 - include/hw/i386/apic_internal.h | 1 - include/hw/i386/intel_iommu.h | 1 - include/hw/i386/pc.h | 9 - include/hw/i386/x86.h | 2 - include/hw/nvram/fw_cfg.h | 9 +- include/hw/virtio/virtio-mmio.h | 1 - include/hw/virtio/virtio-pci.h | 1 - include/hw/virtio/virtio-serial.h | 2 - pc-bios/meson.build | 2 - pc-bios/multiboot.bin | Bin 1024 -> 0 bytes pc-bios/optionrom/Makefile | 2 +- pc-bios/optionrom/linuxboot.S | 195 ---------- pc-bios/optionrom/multiboot.S | 232 ------------ pc-bios/optionrom/multiboot_dma.S | 234 +++++++++++- pc-bios/optionrom/optionrom.h | 4 - target/i386/cpu.c | 119 +++--- target/i386/cpu.h | 3 - tests/data/acpi/x86/pc/DSDT | Bin 8611 -> 8598 bytes tests/data/acpi/x86/pc/DSDT.acpierst | Bin 8522 -> 8509 bytes tests/data/acpi/x86/pc/DSDT.acpihmat | Bin 9936 -> 9923 bytes tests/data/acpi/x86/pc/DSDT.bridge | Bin 15482 -> 15469 bytes tests/data/acpi/x86/pc/DSDT.cphp | Bin 9075 -> 9062 bytes tests/data/acpi/x86/pc/DSDT.dimmpxm | Bin 10265 -> 10252 bytes tests/data/acpi/x86/pc/DSDT.hpbridge | Bin 8562 -> 8549 bytes tests/data/acpi/x86/pc/DSDT.hpbrroot | Bin 5100 -> 5087 bytes tests/data/acpi/x86/pc/DSDT.ipmikcs | Bin 8683 -> 8670 bytes tests/data/acpi/x86/pc/DSDT.memhp | Bin 9970 -> 9957 bytes tests/data/acpi/x86/pc/DSDT.nohpet | Bin 8469 -> 8456 bytes tests/data/acpi/x86/pc/DSDT.numamem | Bin 8617 -> 8604 bytes tests/data/acpi/x86/pc/DSDT.roothp | Bin 12404 -> 12391 bytes tests/data/acpi/x86/q35/DSDT | Bin 8440 -> 8427 bytes tests/data/acpi/x86/q35/DSDT.acpierst | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.acpihmat | Bin 9765 -> 9752 bytes .../data/acpi/x86/q35/DSDT.acpihmat-generic-x | Bin 12650 -> 12637 bytes .../acpi/x86/q35/DSDT.acpihmat-noinitiator | Bin 8719 -> 8706 bytes tests/data/acpi/x86/q35/DSDT.applesmc | Bin 8486 -> 8473 bytes tests/data/acpi/x86/q35/DSDT.bridge | Bin 12053 -> 12040 bytes tests/data/acpi/x86/q35/DSDT.core-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.core-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.cphp | Bin 8904 -> 8891 bytes tests/data/acpi/x86/q35/DSDT.cxl | Bin 13231 -> 13218 bytes tests/data/acpi/x86/q35/DSDT.dimmpxm | Bin 10094 -> 10081 bytes tests/data/acpi/x86/q35/DSDT.ipmibt | Bin 8515 -> 8502 bytes tests/data/acpi/x86/q35/DSDT.ipmismbus | Bin 8528 -> 8515 bytes tests/data/acpi/x86/q35/DSDT.ivrs | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.memhp | Bin 9799 -> 9786 bytes tests/data/acpi/x86/q35/DSDT.mmio64 | Bin 9570 -> 9557 bytes tests/data/acpi/x86/q35/DSDT.multi-bridge | Bin 13293 -> 13280 bytes tests/data/acpi/x86/q35/DSDT.noacpihp | Bin 8302 -> 8289 bytes tests/data/acpi/x86/q35/DSDT.nohpet | Bin 8298 -> 8285 bytes tests/data/acpi/x86/q35/DSDT.numamem | Bin 8446 -> 8433 bytes tests/data/acpi/x86/q35/DSDT.pvpanic-isa | Bin 8541 -> 8528 bytes tests/data/acpi/x86/q35/DSDT.thread-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.thread-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm12 | Bin 9046 -> 9033 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm2 | Bin 9072 -> 9059 bytes tests/data/acpi/x86/q35/DSDT.type4-count | Bin 18674 -> 18661 bytes tests/data/acpi/x86/q35/DSDT.viot | Bin 14697 -> 14684 bytes tests/data/acpi/x86/q35/DSDT.xapic | Bin 35803 -> 35790 bytes tests/qtest/test-x86-cpuid-compat.c | 11 - 95 files changed, 363 insertions(+), 1228 deletions(-) delete mode 100644 hw/acpi/cpu_hotplug.c delete mode 100644 pc-bios/multiboot.bin delete mode 100644 pc-bios/optionrom/linuxboot.S delete mode 100644 pc-bios/optionrom/multiboot.S -- 2.34.1

3 30