- Devel - libvirt List Archives

[PATCH 1/2] hyperv: improve error message when redefining domain
by Jonathon Jongsma 04 Mar '26

04 Mar '26

The current error message results in something like the following when running `virsh define` for an existing domain: `domain Domain already exists with UUID '$UUID' exists already` Improve the error message and make it behave like the esx driver and indicate that we do not yet support redefining existing domains in hyperv. Also avoid using the public LookupByUUID() API to check for existance, which requires unnecessarily allocating and de-allocating a virDomainPtr object. Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_driver.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index b01b4919fe..6e9917f92a 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -2933,6 +2933,8 @@ hypervDomainDefineXML(virConnectPtr conn, const char *xml) virDomainPtr domain = NULL; g_autoptr(hypervInvokeParamsList) params = NULL; g_autoptr(GHashTable) defineSystemParam = NULL; + g_autoptr(Msvm_ComputerSystem) existing = NULL; + char uuid_string[VIR_UUID_STRING_BUFLEN]; size_t i = 0; /* parse xml */ @@ -2943,13 +2945,10 @@ hypervDomainDefineXML(virConnectPtr conn, const char *xml) goto error; /* abort if a domain with this UUID already exists */ - if ((domain = hypervDomainLookupByUUID(conn, def->uuid))) { - char uuid_string[VIR_UUID_STRING_BUFLEN]; - virUUIDFormat(domain->uuid, uuid_string); - virReportError(VIR_ERR_DOM_EXIST, _("Domain already exists with UUID '%1$s'"), uuid_string); - - // Don't use the 'exit' label, since we don't want to delete the existing domain. - virObjectUnref(domain); + virUUIDFormat(def->uuid, uuid_string); + if (hypervMsvmComputerSystemFromUUID(priv, uuid_string, &existing) == 0 && existing != NULL) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("Domain already exists, editing existing domains is not supported yet")); return NULL; } -- 2.53.0

3 4

[libvirt PATCH 0/3] qemu: IOMMUFD security label fix
by Pavel Hrdina 03 Mar '26

03 Mar '26

Pavel Hrdina (3): security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel security: Cleanup hostdev label error logic qemu: Fix IOMMUFD and VFIO security labels src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_process.c | 16 +++-- src/qemu/qemu_process.h | 3 +- src/security/security_apparmor.c | 76 +++++++++-------------- src/security/security_dac.c | 102 ++++++++++++++----------------- src/security/security_selinux.c | 90 ++++++++++++--------------- 6 files changed, 130 insertions(+), 159 deletions(-) -- 2.53.0

3 7

[RFC 0/2] Fix build with libvirtd disabled
by Jim Fehlig 03 Mar '26

03 Mar '26

I'm considering dropping the monolithic libvirtd in future versions of SUSE distros, which got me to checking the usability of -Ddriver_libvirtd=disabled. I found it's not very usable :-). This series if an RFC attempt to rectify the situation. I'm not sure if we should build the various "common" components unconditionally as this change does, or only if the monolithic libvirtd and/or one or more modular daemons are also being built. Thanks for any comments! Jim Fehlig (2): build: Fix build with libvirtd disabled spec: Add option to enable/disable libvirtd docs/manpages/meson.build | 10 +- libvirt.spec.in | 25 +++- meson.build | 209 +++++++++++++--------------- meson_options.txt | 14 +- src/access/meson.build | 3 - src/locking/meson.build | 281 +++++++++++++++++++------------------- src/logging/meson.build | 104 +++++++------- src/meson.build | 200 +++++++++++++-------------- src/remote/meson.build | 174 +++++++++++------------ src/security/meson.build | 2 +- src/util/meson.build | 24 ++-- tools/meson.build | 26 ++-- 12 files changed, 526 insertions(+), 546 deletions(-) -- 2.51.0

3 5

[PATCH] secret: install service file only if init_script is 'systemd'
by Roman Bogorodskiy 03 Mar '26

03 Mar '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/secret/meson.build | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/secret/meson.build b/src/secret/meson.build index cfcc861f4f..32105dad9f 100644 --- a/src/secret/meson.build +++ b/src/secret/meson.build @@ -54,13 +54,15 @@ if conf.has('WITH_SECRETS') virt_secret_init_encryption_conf.set('localstatedir', localstatedir) - configure_file( - input: 'virt-secret-init-encryption.service.in', - output: '@0@.service'.format('virt-secret-init-encryption'), - configuration: virt_secret_init_encryption_conf, - install: true, - install_dir: unitdir, - ) + if init_script == 'systemd' + configure_file( + input: 'virt-secret-init-encryption.service.in', + output: '@0@.service'.format('virt-secret-init-encryption'), + configuration: virt_secret_init_encryption_conf, + install: true, + install_dir: unitdir, + ) + endif virt_daemon_units += { 'service': 'virtsecretd', -- 2.52.0

2 1

Release of libvirt-12.1.0
by Jiri Denemark 02 Mar '26

02 Mar '26

The 12.1.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * qemu: Advertise firmware features in domain capabilities XML The contents of the ``<firmwareFeatures/>`` element can be used to determine ahead of time whether a firmware matching certain characteristics, for example Secure Boot support, is available for the selected architecture and machine type. * qemu: Add support for uefi-vars device and firmware builds using it This is particularly noteworthy for people running aarch64 VMs with the 'virt' machine type, as it makes it finally possible to use Secure Boot with that combination. In most cases, no special steps are needed to take advantage of this: assuming that you have installed a recent version of QEMU, as well as a build of edk2 that includes the necessary binaries, you can just `enable Secure Boot <kbase/secureboot.html>`__ as you normally would. To explicitly request that the uefi-vars device is used even for scenarios where that would normally not be the case, it's enough to add an empty ``<varstore/>`` element in the domain XML. More details are available in the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. * hyperv: improve API coverage for the hyperv driver The `virDomainInterfaceAddresses()` and `virDomainGetBlockInfo()` APIs are now supported by the hyperv driver. In addition, the domain xml for hyperv domains will indicate via firmware features whether secure boot is enabled. It also honors these firmware features when creating new domains. * bhyve: Add support for vCPU pinning configuration Bhyve guests can now have vCPU pinning configured:: <cputune> <vcpupin vcpu="0" cpuset="1,2,3"/> </cputune> Additionally, the ``domainGetVcpuPinInfo`` API is implemented for querying vCPU pinning information. * qemu: Support block operation latency histograms Libvirt now allows configuring qemu's block latency histogram collection as well as returns them via the bulk stats API. * Improvements * Introduce granule attribute for virtio-iommu In case when guest page size doesn't match the host page size (typically aarch64) the ``virtio-iommu`` needs to know the guest page size so it can allocate memory aligned to guest page size. * Parse hyperv features even for host-model Two releases ago, in v11.9.0 new ``host-model`` mode for Hyper-V enlightenments was introduced. Starting with this release, users can additionally override the defaults that are picked when domain is started and features are expanded. * bhyve: Improve loader configuration for arm64 guests If loader is not explicitly configured, use the loader from the ``sysutils/u-boot-bhyve-arm64`` port/package for the arm64 guests. * Bug fixes * Fix build with remote driver disabled Some parts of code were wrongly annotated as depended on remote driver. But they were used even from client side drivers. This is now fixed and libvirt builds properly even with remote driver disabled. * Various fixes to libvirt-guests.sh Firstly, the exit code of various commands was ignored (which may lead the script to wrongly determine persistent/transient domain state, for instance). Secondly, due to logical error, the script might have incorrectly asses state a domain is in. * AppArmor: Ask for no deny rule for readonly disk elements For read only disks, libvirt created an AppArmor profile which disallowed any future write rules. But when doing a blockcommit, libvirt needs to allow hypervisor to write to even readonly disks. The rule in the profile was changed so that future write rules can be added, temporarily. * esx: Allow connecting to IPv6 server Due to a bug in our code, if an IPv6 address was provided in connection URI, libvirt would fail to connect to VMWare server. This is now fixed. * qemu: Use device alias if interface has no name The ``virDomainInterfaceAddresses()`` API (or ``virsh domifaddr``) returns an array interfaces among with their addresses. But some interface names might be unknown, for instance if the API is told to parse host's ARP table then PCI assigned NICs or slirp/passt lack interface name. If that's the case, let the API return domain's ``<interface/>`` alias. * bhyve: hyperv: Various memory leak fixes * qemu: Fix failures when restoring save/managed-save images with upcoming qemu versions Current git version of qemu would return an error when attempting to load an existing (managed) save image as we relied on deprecated features that were now removed. Enjoy. Jirka

1 0

[PATCH] news: Mention latency histogram support and (managed) save fixes
by Peter Krempa 02 Mar '26

02 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 8597febe28..800c4acb59 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -59,6 +59,11 @@ v12.1.0 (unreleased) Additionally, the ``domainGetVcpuPinInfo`` API is implemented for querying vCPU pinning information. + * qemu: Support block operation latency histograms + + Libvirt now allows configuring qemu's block latency histogram collection + as well as returns them via the bulk stats API. + * **Improvements** * Introduce granule attribute for virtio-iommu @@ -117,6 +122,12 @@ v12.1.0 (unreleased) * bhyve: hyperv: Various memory leak fixes + * qemu: Fix failures when restoring save/managed-save images with upcoming qemu versions + + Current git version of qemu would return an error when attempting to load + an existing (managed) save image as we relied on deprecated features that + were now removed. + v12.0.0 (2026-01-15) ==================== -- 2.53.0

2 1

[PULL 02/18] deprecation: don't enable TCG plugins by default with TCI
by Alex Bennée 28 Feb '26

28 Feb '26

The softmmu memory instrumentation test sees so many more accesses than a normal translated host and its really not worth fixing up. Lets deprecate this odd configuration and save on the CI cycles. Reviewed-by: Pierrick Bouvier <pierrick.bouvier(a)linaro.org> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> Message-Id: <20240916085400.1046925-3-alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 809b2b9b81..c0aa52def5 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -196,6 +196,14 @@ benefits from having plenty of host memory it seems reasonable to encourage users to use 64 bit builds of QEMU for analysis work whatever targets they are instrumenting. +TCG Plugin support not enabled by default with TCI (since 9.2) +'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +While the TCG interpreter can interpret the TCG ops used by plugins it +is going to be so much slower it wouldn't make sense for any serious +instrumentation. Due to implementation differences there will also be +anomalies in things like memory instrumentation. + System emulator CPUs -------------------- diff --git a/configure b/configure index cc8e1ed5b8..aa7aae70fa 100755 --- a/configure +++ b/configure @@ -629,6 +629,9 @@ meson_option_parse() { exit 1 fi } +has_meson_option() { + test "${meson_options#*"$1"}" != "$meson_options" +} meson_add_machine_file() { if test "$cross_compile" = "yes"; then @@ -1048,8 +1051,12 @@ if test "$static" = "yes" ; then plugins="no" fi if test "$plugins" != "no" && test $host_bits -eq 64; then - plugins=yes - subdirs="$subdirs contrib/plugins" + if has_meson_option "-Dtcg_interpreter=true"; then + plugins="no" + else + plugins=yes + subdirs="$subdirs contrib/plugins" + fi fi cat > $TMPC << EOF -- 2.39.5

2 1

Entering freeze for libvirt-12.1.0
by Jiri Denemark 27 Feb '26

27 Feb '26

I have just tagged v12.1.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

3 3

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 27 Feb '26

27 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..11d0ebf28b 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -43,8 +43,61 @@ v12.1.0 (unreleased) * **Improvements** + * Introduce granule attribute for virtio-iommu + + In case when guest page size doesn't match the host page size (typically + aarch64) the ``virtio-iommu`` needs to know the guest page size so it can + allocate memory aligned to guest page size. + + * hyperv: Implement virDomainInterfaceAddresses() + + Libvirt can now report IP address of domains running under Hyper-V + hypervisor. + + * Parse hyperv features even for host-model + + Two releases ago, in v11.9.0 new ``host-model`` mode for Hyper-V + enlightenments was introduced. Starting with this release, users can + additionally override the defaults that are picked when domain is started + and features are expanded. + * **Bug fixes** + * Fix build with remote driver disabled + + Some parts of code were wrongly annotated as depended on remote driver. + But they were used even from client side drivers. This is now fixed and + libvirt builds properly even with remote driver disabled. + + * Various fixes to libvirt-guests.sh + + Firstly, the exit code of various commands was ignored (which may lead the + script to wrongly determine persistent/transient domain state, for + instance). Secondly, due to logical error, the script might have + incorrectly asses state a domain is in. + + * AppArmor: Ask for no deny rule for readonly disk elements + + For read only disks, libvirt created an AppArmor profile which disallowed + any future write rules. But when doing a blockcommit, libvirt needs to + allow hypervisor to write to even readonly disks. The rule in the profile + was changed so that future write rules can be added, temporarily. + + * esx: Allow connecting to IPv6 server + + Due to a bug in our code, if an IPv6 address was provided in connection + URI, libvirt would fail to connect to VMWare server. This is now fixed. + + * qemu: Use device alias if interface has no name + + The ``virDomainInterfaceAddresses()`` API (or ``virsh domifaddr``) returns + an array interfaces among with their addresses. But some interface names + might be unknown, for instance if the API is told to parse host's ARP table + then PCI assigned NICs or slirp/passt lack interface name. If that's the + case, let the API return domain's ``<interface/>`` alias. + + * bhyve: hyperv: Various memory leak fixes + v12.0.0 (2026-01-15) ==================== -- 2.52.0

3 2

[PATCH] news: document bhyve changes for 12.1.0
by Roman Bogorodskiy 27 Feb '26

27 Feb '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..92f6d07e04 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -41,8 +41,25 @@ v12.1.0 (unreleased) the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. + * bhyve: Add support for vCPU pinning configuration + + Bhyve guests can now have vCPU pinning configured:: + + <cputune> + <vcpupin vcpu="0" cpuset="1,2,3"/> + </cputune> + + Additionally, the ``domainGetVcpuPinInfo`` API is implemented for + querying vCPU pinning information. + * **Improvements** + * bhyve: improve loader configuration for arm64 guests + + If loader is not explicitly configured, use the loader + from the ``sysutils/u-boot-bhyve-arm64`` port/package for the + arm64 guests. + * **Bug fixes** -- 2.52.0

2 1

[PATCH] news: document new hyperv features
by Jonathon Jongsma 27 Feb '26

27 Feb '26

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..a581d2e840 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -41,6 +41,13 @@ v12.1.0 (unreleased) the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. + * hyperv: improve API coverage for the hyperv driver + + The `virDomainInterfaceAddresses()` and `virDomainGetBlockInfo()` APIs are + now supported by the hyperv driver. In addition, the domain xml for hyperv + domains will indicate via firmware features whether secure boot is enabled. + It also honors these firmware features when creating new domains. + * **Improvements** * **Bug fixes** -- 2.53.0

2 1

[PATCH 0/2] fdstream: attempt to fix EOF handling (again)
by Daniel P. Berrangé 27 Feb '26

27 Feb '26

Daniel P. Berrangé (2): fdstream: don't set return value if looping to read more data fdstream: fix EOF handling when reading data src/util/virfdstream.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.53.0

4 8

[libvirt PATCH] qemu_hotplug: enter monitor in order to rollback passed FD
by Pavel Hrdina 26 Feb '26

26 Feb '26

From: Pavel Hrdina <phrdina(a)redhat.com> Reported-by: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_hotplug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index bede4e3ccd..93cbaf1d91 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1680,8 +1680,10 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver, qemuDomainObjExitMonitor(vm); } + qemuDomainObjEnterMonitor(vm); qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon); qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon); + qemuDomainObjExitMonitor(vm); if (releaseaddr) qemuDomainReleaseDeviceAddress(vm, info); -- 2.53.0

3 2

[PATCH v6 00/27] util: sync error_report & qemu_log output more closely
by Daniel P. Berrangé 26 Feb '26

26 Feb '26

This series is a tangent that came out of discussion in https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00903.html In thinking about adding thread info to error_report, I came to realize we should likely make qemu_log behave consistently with error_report & friends. We already honour '-msg timestamp=on', but don't honour 'guest-name=on' and also don't include the binary name. As an example of the current state, consider mixing error and log output today: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55ac6d97f700 dir=fish qcrypto_tls_creds_get_path TLS creds path creds=0x55ac6d97f700 filename=ca-cert.pem path=<none> qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:14:16.791413Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55e9a3458d10 dir=fish 2025-08-19T20:14:16.791429Z qcrypto_tls_creds_get_path TLS creds path creds=0x55e9a3458d10 filename=ca-cert.pem path=<none> 2025-08-19T20:14:16.791433Z fish food qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory And after this series is complete: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qemu-system-x86_64(1184284:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55a24ad5cb30 dir=fish qemu-system-x86_64(1184284:main): qcrypto_tls_creds_get_path TLS creds path creds=0x55a24ad5cb30 filename=ca-cert.pem path=<none> qemu-system-x86_64(1184284:main): Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:12:50.211823Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x5582183d8760 dir=fish 2025-08-19T20:12:50.211842Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_get_path TLS creds path creds=0x5582183d8760 filename=ca-cert.pem +path=<none> 2025-08-19T20:12:50.211846Z [fish food] qemu-system-x86_64(1168876:main): Unable to access credentials fish/ca-cert.pem: No such file or directory The main things to note: * error_report/warn_report/qemu_log share the same output format and -msg applies to both * -msg debug-threads=on is now unconditionally enabled and thus the param is deprecated & ignored * Thread ID and name are unconditionally enabled * Guest name is surrounded in [...] brackets * The default output lines are typically 15 chars wider given that we always include the thread ID + name now * This takes the liberty of assigning the new file to the existing error-report.c maintainer (Markus) Since splitting it off into message.c instead of putting it all in error-report.c felt slightly nicer. One thing I didn't tackle is making the location info get reported for qemu_log. This is used to give context for error messages when parsing some CLI args, and could be interesting for log messages associated with those same CLI args. Changes in v6: - Don't use pthread API to set main thread name, as this affects visibility in 'top' and 'ps' - Split off Win32 thread naming race fix intoseparate patch - Tweaks to wording in API docs for logging - Improve VNC auth error messages - Don't relpace monitor_cur_is_qmp with monitor_cur_is_hmp, change code approach instead Changes in v5: - Use g_strlcpy instead of strlcpy - Remove redundant !! around a value that was already bool - Improve the qemu_lock_trylock() API docs to encourage use of fprintf() instead of further qemu_log() calls - Add a qemu_log_trylock_context() counterpart for qemu_log_trylock that includes the message context - Don't scan for \n to determine whether we can output a message context prefix or not. Instead track call depth on qemu_log_trylock() and only output it when the depth was initially zero. This fixes linux-user -strace output formatting which was mangled by v4 - Use fprintf(stderr) instead of error_printf_mon in cases where mon would be NULL - Use fputs/fputc in simple cases where we don't need the full power of fprintf - Use qemu_f{un}lockfile instead of f{un}lockfile - Add -msg thread-info=on|off,program-name=on|off args to allow default message prefixes to be optionally disabled Changes in v4: - Re-architected the way error_vprintf() operates to simplify monitor dependency - Fixed the move of error_vprintf from monitor.c to error-report.c so that unit tests can still get a stub to capture messages to g_test_message - Simplify changes to vreport() to avoid passing around function pointers - Add locking of stderr to vreport() to serialize incremental output - Fix thread naming logic changes on Windows - Change deprecation warning messages Changes in v3: - Stop formatting a string in qmessage_context, instead output directly to a "FILE *" stream - Fix pre-existing bug interleaving qemu_log and vreport when the trace 'log' backend has mutex probes enabled Changes in v2: - Re-use existing qemu_get_thread_id rather than re-inventing it as qemu_thread_get_id. - Expose qemu_thread_set_name and use it from all locations needing to set thread names - Fix qemu_log() to skip context prefix when emitting a log message in fragments across multiple calls - Skip allocating memory for empty context messages - Fix leak in win32 impl of qemu_thread_get_name - Use g_strlcpy where possible Daniel P. Berrangé (27): meson: don't access 'cxx' object without checking cpp lang qemu-options: remove extraneous [] around arg values include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: fix race setting thread name on Win32 util: expose qemu_thread_set_name audio: make jackaudio use qemu_thread_set_name util: set the name for the 'main' thread on Windows util: add API to fetch the current thread name util: introduce some API docs for logging APIs util: avoid repeated prefix on incremental qemu_log calls util/log: add missing error reporting in qemu_log_trylock_with_err ui: add proper error reporting for password changes ui: remove redundant use of error_printf_unless_qmp() monitor: remove redundant error_[v]printf_unless_qmp monitor: refactor error_vprintf() monitor: move error_vprintf back to error-report.c util: fix interleaving of error & trace output util: don't skip error prefixes when QMP is active util: fix interleaving of error prefixes util: introduce common helper for error-report & log code util: convert error-report & log to message API for timestamp util: add support for formatting a workload name in messages util: add support for formatting a program name in messages util: add support for formatting thread info in messages util: add brackets around guest name in message context MAINTAINERS | 2 + audio/jackaudio.c | 30 +++++-- docs/about/deprecated.rst | 7 ++ include/monitor/monitor.h | 3 - include/qemu/compiler.h | 8 ++ include/qemu/error-report.h | 4 - include/qemu/log-for-trace.h | 17 +++- include/qemu/log.h | 39 +++++++++ include/qemu/message.h | 40 +++++++++ include/qemu/thread.h | 3 +- include/ui/console.h | 2 +- include/ui/qemu-spice-module.h | 3 +- meson.build | 23 ++++- monitor/monitor.c | 51 ++--------- qemu-options.hx | 121 ++++++++++++++------------- rust/util/src/log.rs | 6 ++ storage-daemon/qemu-storage-daemon.c | 6 ++ stubs/error-printf.c | 23 ----- stubs/meson.build | 1 - stubs/monitor-core.c | 19 ++++- system/vl.c | 49 +++++++++-- tests/functional/generic/test_vnc.py | 4 +- tests/qemu-iotests/041 | 2 +- tests/qemu-iotests/common.filter | 2 +- tests/unit/test-error-report.c | 6 +- tests/unit/test-util-sockets.c | 1 + ui/spice-core.c | 25 ++++-- ui/spice-module.c | 7 +- ui/ui-qmp-cmds.c | 19 ++--- ui/vnc-stubs.c | 6 +- ui/vnc.c | 16 ++-- util/error-report.c | 103 +++++++++++++++-------- util/log.c | 48 ++++++----- util/meson.build | 1 + util/message.c | 51 +++++++++++ util/qemu-thread-posix.c | 89 ++++++++++++++------ util/qemu-thread-win32.c | 87 +++++++++++++------ 37 files changed, 628 insertions(+), 296 deletions(-) create mode 100644 include/qemu/message.h delete mode 100644 stubs/error-printf.c create mode 100644 util/message.c -- 2.53.0

3 57

[libvirt PATCH for 12.1.0] domain_conf: initialize network hostdev private data
by Pavel Hrdina 26 Feb '26

26 Feb '26

From: Pavel Hrdina <phrdina(a)redhat.com> Currently virDomainNetDef and virDomainActualNetDef use virDomainHostdevDef directly as structure and the code doesn't call virDomainHostdevDefNew() that would initialize private data. This is hackish quick fix to solve a crash that happens in two scenarios: 1. attaching any interface with hostdev backend 0x0000fffbfc0e2a90 in qemuDomainAttachHostPCIDevice (driver=0xfffbb4006750, vm=0xfffbf001f790, hostdev=0xfffbf400b150) at ../src/qemu/qemu_hotplug.c:1652 1652 if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0) 2. starting VM with interface with hostdev backend using iommufd 0x00007f6638d5b9ca in qemuProcessOpenVfioDeviceFd (hostdev=hostdev@entry=0x7f6634425ee0) at ../src/qemu/qemu_process.c:7719 7719 hostdevPriv->vfioDeviceFd = qemuFDPassDirectNew(name, &vfioDeviceFd); Proper fix for this issue is to refactor network code to use pointer and to use virDomainHostdevDefNew(). Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/conf/domain_conf.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 3528b90742..8090becdcf 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3517,6 +3517,20 @@ void virDomainVideoDefFree(virDomainVideoDef *def) } +static int +virDomainHostdevDefPrivateDataNew(virDomainHostdevDef *def, + virDomainXMLOption *xmlopt) +{ + if (!xmlopt || !xmlopt->privateData.hostdevNew) + return 0; + + if (!(def->privateData = xmlopt->privateData.hostdevNew())) + return -1; + + return 0; +} + + virDomainHostdevDef * virDomainHostdevDefNew(virDomainXMLOption *xmlopt) { @@ -3526,8 +3540,7 @@ virDomainHostdevDefNew(virDomainXMLOption *xmlopt) def->info = g_new0(virDomainDeviceInfo, 1); - if (xmlopt && xmlopt->privateData.hostdevNew && - !(def->privateData = xmlopt->privateData.hostdevNew())) { + if (virDomainHostdevDefPrivateDataNew(def, xmlopt) < 0) { VIR_FREE(def->info); VIR_FREE(def); return NULL; @@ -9739,6 +9752,9 @@ virDomainActualNetDefParseXML(xmlNodePtr node, virDomainHostdevDef *hostdev = &actual->data.hostdev.def; int type; + if (virDomainHostdevDefPrivateDataNew(hostdev, xmlopt) < 0) + goto error; + hostdev->parentnet = parent; hostdev->info = &parent->info; /* The helper function expects type to already be found and @@ -10432,6 +10448,9 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, g_autofree char *addrtype = virXPathString("string(./source/address/@type)", ctxt); int type; + if (virDomainHostdevDefPrivateDataNew(&def->data.hostdev.def, xmlopt) < 0) + return NULL; + def->data.hostdev.def.parentnet = def; def->data.hostdev.def.info = &def->info; def->data.hostdev.def.mode = VIR_DOMAIN_HOSTDEV_MODE_SUBSYS; -- 2.53.0

2 1

[PATCH v2] util: fix use-after-free in virIdentityGetSystem
by Stefan Kober 26 Feb '26

26 Feb '26

We have a g_autoptr ret in the virIdentityGetSystem function. In the happy path it is properly returned by doing: return g_steal_pointer(&ret); There are 2 early return paths, were we do the following: "return ret;" This leads to the g_autoptr being cleaned up after we leave the function, as we do not properly "steal" it. When later using the return value we have a use-after-free, which has led to segfaults in some cases. As this is a regression introduced in 1280a631ef488aeaab905eb30a55899ef8ba97be, we change the behavior to properly return NULL in those cases. On-behalf-of: SAP stefan.kober(a)sap.com Signed-off-by: Stefan Kober <stefan.kober(a)cyberus-technology.de> --- src/util/viridentity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/viridentity.c b/src/util/viridentity.c index b7b88056ac..8e59179a20 100644 --- a/src/util/viridentity.c +++ b/src/util/viridentity.c @@ -328,14 +328,14 @@ virIdentity *virIdentityGetSystem(void) return NULL; if (!(username = virGetUserName(geteuid()))) - return ret; + return NULL; if (virIdentitySetUserName(ret, username) < 0) return NULL; if (virIdentitySetUNIXUserID(ret, getuid()) < 0) return NULL; if (!(groupname = virGetGroupName(getegid()))) - return ret; + return NULL; if (virIdentitySetGroupName(ret, groupname) < 0) return NULL; if (virIdentitySetUNIXGroupID(ret, getgid()) < 0) -- 2.53.0

3 2

[PATCH 0/4] Remove deprecated qemu-system-microblazeel from the build
by Thomas Huth 25 Feb '26

25 Feb '26

The qemu-system-microblazeel binary has been marked as deprecated since two releases, and there were no complaints (as far as I know), so it should be fine to remove this now. Users can use the qemu-system-microblaze binary (without the -el suffix) instead that can handle both endiannesses. Thomas Huth (4): tests/functional: Remove the microblazeel test tests/qtest: Remove the microblazeel target from the qtests gitlab-ci: Remove the microblazeel target from the CI jobs Remove the qemu-system-microblazeel target from the build MAINTAINERS | 4 +-- docs/about/deprecated.rst | 13 ---------- docs/about/removed-features.rst | 14 ++++++++++ .../devices/microblazeel-softmmu/default.mak | 6 ----- configs/targets/microblazeel-softmmu.mak | 6 ----- qapi/machine.json | 2 +- tests/qtest/boot-serial-test.c | 2 +- tests/qtest/machine-none-test.c | 1 - tests/tcg/plugins/syscall.c | 1 - .gitlab-ci.d/buildtest.yml | 6 ++--- .gitlab-ci.d/cirrus.yml | 4 +-- .gitlab-ci.d/crossbuilds.yml | 2 +- tests/functional/meson.build | 1 - .../functional/microblaze/test_s3adsp1800.py | 23 +++------------- tests/functional/microblazeel/meson.build | 5 ---- .../microblazeel/test_s3adsp1800.py | 26 ------------------- tests/qtest/meson.build | 2 -- 17 files changed, 27 insertions(+), 91 deletions(-) delete mode 100644 configs/devices/microblazeel-softmmu/default.mak delete mode 100644 configs/targets/microblazeel-softmmu.mak delete mode 100644 tests/functional/microblazeel/meson.build delete mode 100755 tests/functional/microblazeel/test_s3adsp1800.py -- 2.53.0

3 7

[PATCH] hyperv: report whether guests have TPM enabled
by Jonathon Jongsma 25 Feb '26

25 Feb '26

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_driver.c | 32 +++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 26 ++++++++++++++++++++++ src/hyperv/hyperv_wmi.h | 4 ++++ src/hyperv/hyperv_wmi_generator.input | 9 ++++++++ 4 files changed, 71 insertions(+) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index b01b4919fe..7cc67129cd 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -200,6 +200,22 @@ hypervGetOperatingSystem(hypervPrivate *priv, Win32_OperatingSystem **operatingS } +static int +hypervDomainGetTPMEnabled(hypervPrivate *priv, + const char *id, + bool *enabled) +{ + g_autoptr(Msvm_SecuritySettingData) securitySD = NULL; + + if (hypervGetSecuritySD(priv, id, &securitySD) < 0) + return -1; + + VIR_DEBUG("Getting TPM state for '%s': %u", id, securitySD->data->TpmEnabled); + *enabled = securitySD->data->TpmEnabled; + return 0; +} + + static int hypervRequestStateChange(virDomainPtr domain, int state) { @@ -2651,6 +2667,7 @@ hypervDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) g_autoptr(Msvm_SerialPortSettingData) spsd = NULL; Msvm_ResourceAllocationSettingData *serialDevices = NULL; g_autoptr(Msvm_EthernetPortAllocationSettingData) nets = NULL; + bool tpmEnabled = false; virCheckFlags(VIR_DOMAIN_XML_COMMON_FLAGS, NULL); @@ -2791,6 +2808,21 @@ hypervDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) if (hypervDomainDefParseEthernet(domain, def, nets) < 0) return NULL; + if (hypervDomainGetTPMEnabled(priv, virtualSystemSettingData->data->InstanceID, &tpmEnabled) == 0 + && tpmEnabled) { + virDomainTPMDef* tpm = NULL; + + if (!def->tpms) { + def->tpms = g_new0(virDomainTPMDef *, 1); + } + + tpm = g_new0(virDomainTPMDef, 1); + tpm->model = VIR_DOMAIN_TPM_MODEL_DEFAULT; + tpm->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + + def->tpms[def->ntpms++] = tpm; + } + /* XXX xmlopts must be non-NULL */ return virDomainDefFormat(def, NULL, virDomainDefFormatConvertXMLFlags(flags)); } diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index 7ae3afc40a..1cf442dad3 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -1625,3 +1625,29 @@ hypervMsvmVSMSModifyResourceSettings(hypervPrivate *priv, return 0; } + + +int +hypervGetSecuritySD(hypervPrivate *priv, + const char *vssd_instanceid, + Msvm_SecuritySettingData **data) +{ + g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; + + virBufferEscapeSQL(&query, + "ASSOCIATORS OF {Msvm_VirtualSystemSettingData.InstanceID='%s'} " + "WHERE ResultClass = Msvm_SecuritySettingData", + vssd_instanceid); + + if (hypervGetWmiClass(Msvm_SecuritySettingData, data) < 0) + return -1; + + if (!*data) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not look up security setting data with virtual system instance ID '%1$s'"), + vssd_instanceid); + return -1; + } + + return 0; +} diff --git a/src/hyperv/hyperv_wmi.h b/src/hyperv/hyperv_wmi.h index 65b1211b89..0f8cfb30bc 100644 --- a/src/hyperv/hyperv_wmi.h +++ b/src/hyperv/hyperv_wmi.h @@ -269,6 +269,10 @@ int hypervImageManagementServiceGetVHDSD(hypervPrivate *priv, const char *vhdPath, WsXmlDocH *settingDataDoc); +int hypervGetSecuritySD(hypervPrivate *priv, + const char *vssd_instanceid, + Msvm_SecuritySettingData **data); + /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Msvm_VirtualSystemManagementService */ diff --git a/src/hyperv/hyperv_wmi_generator.input b/src/hyperv/hyperv_wmi_generator.input index 017b7a0fa5..b3cd9d19fb 100644 --- a/src/hyperv/hyperv_wmi_generator.input +++ b/src/hyperv/hyperv_wmi_generator.input @@ -1252,3 +1252,12 @@ class Win32_DiskDrive uint64 TotalTracks uint32 TracksPerCylinder end + +class Msvm_SecuritySettingData + boolean TpmEnabled + boolean KsdEnabled + boolean ShieldingRequested + boolean DataProtectionRequested + boolean EncryptStateAndVmMigrationTraffic + boolean VirtualizationBasedSecurityOptOut +end -- 2.53.0

2 1

[PATCH] util: fix use-after-free in virIdentityGetSystem
by Stefan Kober 25 Feb '26

25 Feb '26

We have a g_autoptr ret in the virIdentityGetSystem function. In the happy path it is properly returned by doing: return g_steal_pointer(&ret); There are 2 early return paths, were we do the following: "return ret;" This leads to the g_autoptr being cleaned up after we leave the function, as we do not properly "steal" it. When later using the return value we have a use-after-free, which has led to segfaults in our case. We fix the early returns by doing the same as in the happy path. On-behalf-of: SAP stefan.kober(a)sap.com Signed-off-by: Stefan Kober <stefan.kober(a)cyberus-technology.de> --- src/util/viridentity.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/util/viridentity.c b/src/util/viridentity.c index b7b88056ac..10935fba60 100644 --- a/src/util/viridentity.c +++ b/src/util/viridentity.c @@ -327,15 +327,19 @@ virIdentity *virIdentityGetSystem(void) virIdentitySetProcessTime(ret, startTime) < 0) return NULL; - if (!(username = virGetUserName(geteuid()))) - return ret; + if (!(username = virGetUserName(geteuid()))) { + VIR_WARN("virGetUserName failed, returning partial identity"); + return g_steal_pointer(&ret); + } if (virIdentitySetUserName(ret, username) < 0) return NULL; if (virIdentitySetUNIXUserID(ret, getuid()) < 0) return NULL; - if (!(groupname = virGetGroupName(getegid()))) - return ret; + if (!(groupname = virGetGroupName(getegid()))) { + VIR_WARN("virGetGroupName failed, returning partial identity"); + return g_steal_pointer(&ret); + } if (virIdentitySetGroupName(ret, groupname) < 0) return NULL; if (virIdentitySetUNIXGroupID(ret, getgid()) < 0) -- 2.53.0

2 2

[PATCH] qemu: Fix job handling when domain dies in post-copy migration
by Jiri Denemark 25 Feb '26

25 Feb '26

From: Jiri Denemark <jdenemar(a)redhat.com> When a domain is in post-copy migration phase, we need to keep the job active if something fails to protect the domain from changes. Unfortunately, there is a race between migration code and qemuProcessStop that can cause the job to stay active even when the domain is gone and thus preventing the domain from being started again (until virtqemud is restarted). The race is caused by unlocking the vm object when calling virConnectUnregisterCloseCallback. While the domain is unlocked qemuProcessStop can finish its work and the domain may no longer be active when we get the lock back. The post-copy path does not properly check if a domain is still active. Instead of adding the virDomainObjIsActive check in all places where this could happen, we can add it in virDomainObjIsPostcopy and virDomainObjIsFailedPostcopy and let the code take the pre-copy cleanup path. Clearly an inactive domain can never be in (failed) post-copy migration. https://issues.redhat.com/browse/RHEL-145179 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/conf/domain_conf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 998b333c74..3528b90742 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -30723,6 +30723,9 @@ bool virDomainObjIsFailedPostcopy(virDomainObj *dom, virDomainJobObj *job) { + if (!virDomainObjIsActive(dom)) + return false; + if (job && job->asyncPaused && (job->asyncJob == VIR_ASYNC_JOB_MIGRATION_IN || job->asyncJob == VIR_ASYNC_JOB_MIGRATION_OUT)) @@ -30739,6 +30742,9 @@ bool virDomainObjIsPostcopy(virDomainObj *dom, virDomainJobObj *job) { + if (!virDomainObjIsActive(dom)) + return false; + if (virDomainObjIsFailedPostcopy(dom, job)) return true; -- 2.53.0

2 1

[PATCH] util: Fix secondary bus reset check for multi-root PCI systems
by ehanoc 25 Feb '26

25 Feb '26

The virPCIDeviceReset() function was using a hardcoded check for bus != 0 to determine if a device is on a root bus before attempting a secondary bus reset. This breaks on multi-root systems like Intel Arrow Lake where devices can be on non-zero root buses (e.g., Bus 0x80 for the PCH root complex). Update the logic to use virPCIDeviceIsOnRootBus() which detects root bus attachment via sysfs topology, making it work correctly on any PCI-compliant system regardless of bus numbers. This ensures secondary bus reset is never attempted on ANY root bus (0x00, 0x80, etc.), only on devices behind PCI bridges where it's safe. Signed-off-by: Bruno Martins <ehanoc(a)protonmail.com> --- src/util/virpci.c | 106 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 99 insertions(+), 7 deletions(-) diff --git a/src/util/virpci.c b/src/util/virpci.c index 2348a98003..f2ce24e6aa 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -1081,6 +1081,81 @@ virPCIDeviceInit(virPCIDevice *dev, int cfgfd) return 0; } +/* + * Check if a PCI device is directly attached to a root bus (no parent bridge). + * + * Modern systems like Intel Arrow Lake (Core Ultra 200) can have multiple + * root buses (e.g., bus 0x00 for CPU devices and bus 0x80 for PCH devices). + * We detect root bus attachment by examining the sysfs topology: a device + * is on a root bus if its sysfs path is a direct child of a pciXXXX:YY + * directory (e.g., /sys/devices/pci0000:80/0000:80:14.0). + * + * Returns 1 if on root bus, 0 if not, -1 on error. + */ +static int +virPCIDeviceIsOnRootBus(virPCIDevice *dev) +{ + unsigned int domain, bus; + g_autofree char *devPath = NULL; + g_autofree char *realPath = NULL; + g_autofree char *parentDir = NULL; + const char *parentName; + + /* Get the sysfs symlink path for this device */ + devPath = g_strdup_printf(PCI_SYSFS "devices/%s", dev->name); + + /* Resolve the symlink to get the real path in /sys/devices/... */ + if (virFileResolveLink(devPath, &realPath) < 0) { + VIR_DEBUG("%s %s: failed to resolve sysfs path %s", + dev->id, dev->name, devPath); + return -1; + } + + parentDir = g_path_get_dirname(realPath); + if (!parentDir) + return -1; + + parentName = strrchr(parentDir, '/'); + if (!parentName) + return -1; + parentName++; // skip the '/' + + /* + * Detect root bus by parsing the parent directory name using sscanf. + * + * PCI root buses in sysfs follow the naming convention: + * pci<domain>:<bus> + * + * - <domain>: number (0000-ffff, hex) + * - <bus>: number within the domain (00-ff, hex) + * + * This format is defined in: + * https://www.kernel.org/doc/html/latest/PCI/sysfs-pci.html + * + * Examples from Intel Arrow Lake systems: + * - pci0000:00 (CPU root bus) + * - pci0000:80 (PCH root bus - the problematic case on Arrow Lake) + * + * sscanf pattern "pci%x:%x" matches: + * - "pci" : literal prefix + * - "%x" : hex domain (stops at ':') + * - ":" : literal separator + * - "%x" : hex bus (must reach end of string) + * + * Returns 2 if both domain and bus were successfully parsed, + * confirming the device is a direct child of a root bus. + */ + if (sscanf(parentName, "pci%x:%x", &domain, &bus) == 2) { + VIR_DEBUG("%s %s: device is on root bus (parent=%s)", + dev->id, dev->name, parentName); + return 1; + } + + VIR_DEBUG("%s %s: device is not on root bus (parent=%s)", + dev->id, dev->name, parentName); + return 0; +} + int virPCIDeviceReset(virPCIDevice *dev, virPCIDeviceList *activeDevs, @@ -1146,9 +1221,17 @@ virPCIDeviceReset(virPCIDevice *dev, if (dev->has_pm_reset) ret = virPCIDeviceTryPowerManagementReset(dev, fd); - /* Bus reset is not an option with the root bus */ - if (ret < 0 && dev->address.bus != 0) - ret = virPCIDeviceTrySecondaryBusReset(dev, fd, inactiveDevs); + /* Bus reset is not an option with the root bus. On multi-root + * systems like Intel Arrow Lake, root buses can be non-zero (e.g., 0x80), + * so we use sysfs topology detection instead of checking bus == 0. + */ + if (ret < 0) { + int onRootBus = virPCIDeviceIsOnRootBus(dev); + if (onRootBus < 0) + goto cleanup; + if (!onRootBus) + ret = virPCIDeviceTrySecondaryBusReset(dev, fd, inactiveDevs); + } if (ret < 0) { virErrorPtr err = virGetLastError(); @@ -2531,15 +2614,24 @@ static int virPCIDeviceIsBehindSwitchLackingACS(virPCIDevice *dev) { g_autoptr(virPCIDevice) parent = NULL; + int onRootBus; if (virPCIDeviceGetParent(dev, &parent) < 0) return -1; if (!parent) { - /* if we have no parent, and this is the root bus, ACS doesn't come - * into play since devices on the root bus can't P2P without going - * through the root IOMMU. + /* If we have no parent bridge, check if the device is directly + * attached to a root bus. Systems like Intel Arrow Lake can have + * multiple root buses (e.g., 0x00 and 0x80), so we can't just + * check for bus == 0. Instead, use sysfs topology to detect + * root bus attachment. + * + * ACS doesn't come into play for devices on root buses since + * they can't P2P without going through the root IOMMU. */ - if (dev->address.bus == 0) { + onRootBus = virPCIDeviceIsOnRootBus(dev); + if (onRootBus < 0) + return -1; + if (onRootBus) { return 0; } else { virReportError(VIR_ERR_INTERNAL_ERROR, -- 2.47.3

1 0

[PATCH] vmx: log full .vmx content
by Cole Robinson 25 Feb '26

25 Feb '26

We can kinda triangulate it from virConf debugging lines, but this is nicer IMO Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/vmx/vmx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 47eabe33c6..57dfd57cfc 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -1423,6 +1423,8 @@ virVMXParseConfig(virVMXContext *ctx, return NULL; } + VIR_DEBUG("VMX config:\n%s", vmx); + conf = virConfReadString(vmx, VIR_CONF_FLAG_VMX_FORMAT); if (conf == NULL) -- 2.53.0

2 1

[PATCH] fdstream: don't report error on EOF if we read some data
by Daniel P. Berrangé 24 Feb '26

24 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> Since e23fd0b7fd36c41e6db49df4f4962762d3ef6ab0 the stream read code will repeatedly try to read a message from the background thread until it has filled its buffer. When hitting EOF, there will be no message left on the queue, and if the read buffer was non-zero length an error will be raised. This should only be done if there was no data previously read off the stream. Fixes: e23fd0b7fd36c41e6db49df4f4962762d3ef6ab0 Reported-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virfdstream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virfdstream.c b/src/util/virfdstream.c index 4c974ba5d7..efda768ef3 100644 --- a/src/util/virfdstream.c +++ b/src/util/virfdstream.c @@ -911,7 +911,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) more: while (!(msg = fdst->msg)) { if (fdst->threadQuit || fdst->threadErr) { - if (nbytes) { + if (nbytes && !got) { /* virStreamRecv will virResetLastError possibly set * by virFDStreamEvent */ if (fdst->threadErr && !virGetLastError()) -- 2.53.0

4 4

[PATCH v10 0/8] blockdev-replace
by Vladimir Sementsov-Ogievskiy 24 Feb '26

24 Feb '26

Hi all! This series presents a new command blockdev-replace, which helps to insert/remove filters anywhere in the block graph. It can: - replace qdev block-node by qdev-id - replace export block-node by export-id - replace any child of parent block-node by node-name and child name So insertions is done in two steps: 1. blockdev_add (create filter node, unparented) [some parent] [new filter] | | V V [ some child ] 2. blockdev-replace (replace child by the filter) [some parent] | V [new filter] | V [some child] And removal is done in reverse order: 1. blockdev-replace (go back to picture 1) 2. blockdev_del (remove filter node) Ideally, we should do both operations (add + replace or replace + del) in a transaction, but that should be another series. v10: reabsed on master. 02: change exp-blk check into assert 04: rewrite to simpler API (on unique parent id) 07: switch to new API 08: new Vladimir Sementsov-Ogievskiy (8): block-backend: blk_root(): drop const specifier on return type block/export: add blk_by_export_id() block: make bdrv_find_child() function public qapi: add blockdev-replace command block: bdrv_get_xdbg_block_graph(): report export ids iotests.py: introduce VM.assert_edges_list() method iotests: add filter-insertion deprecate names duplication between qdev, block-node and block-export block.c | 29 +++ block/block-backend.c | 2 +- block/export/export.c | 41 ++++ blockdev.c | 82 +++++-- docs/about/deprecated.rst | 10 + include/block/block-global-state.h | 1 + include/block/block_int-io.h | 2 + include/block/export.h | 1 + include/system/block-backend-global-state.h | 5 +- qapi/block-core.json | 24 ++ stubs/blk-by-qdev-id.c | 18 ++ stubs/blk-exp-find-by-blk.c | 13 + stubs/meson.build | 2 + system/qdev-monitor.c | 16 ++ tests/qemu-iotests/iotests.py | 17 ++ tests/qemu-iotests/tests/filter-insertion | 222 ++++++++++++++++++ tests/qemu-iotests/tests/filter-insertion.out | 5 + 17 files changed, 474 insertions(+), 16 deletions(-) create mode 100644 stubs/blk-by-qdev-id.c create mode 100644 stubs/blk-exp-find-by-blk.c create mode 100755 tests/qemu-iotests/tests/filter-insertion create mode 100644 tests/qemu-iotests/tests/filter-insertion.out -- 2.52.0

4 24

Plans for 12.1.0 release (freeze on 2026-02-24)
by Jiri Denemark 24 Feb '26

24 Feb '26

We are getting close to 12.1.0 release of libvirt. To aim for the release on Monday 02 Mar I suggest entering the freeze on Tuesday 24 Feb and tagging RC2 on Thursday 26 Feb. I hope this works for everyone. Jirka

2 3

[PATCH] bhyve: Default to ROM type for loader
by Andrea Bolognani 24 Feb '26

24 Feb '26

A previous commit had moved this logic from the generic postparse code to drivers but failed to update the bhyve driver accordingly in the process. Fixes: 1504b7f687bdfc679377e605d076776b18533468 Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Pushed under the build breaker rule. src/bhyve/bhyve_domain.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 8fc9733756..85960c6e12 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -135,6 +135,12 @@ bhyveDomainDefPostParse(virDomainDef *def, } } + if (def->os.loader && + def->os.loader->path && + !def->os.loader->type) { + def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM; + } + return 0; } -- 2.53.0

1 0

[PATCH 0/8] Several related cleanup patches
by Laine Stump 24 Feb '26

24 Feb '26

These patches were all the result of a failed attempt to provide more useful error messages when libvirt is started with an insufficiently setup environment (e.g. $HOME isn't set and/or the XDG_* environment variables aren't set) which currently results in unhelpful log messages (for an example see https://issues.redhat.com/browse/RHEL-105490) The way I was trying to improve the log messages didn't work out the way I'd hoped (long story), but these patches are generally good (or, for the last two, at least are fodder for discussion). You can put them into 3 categories: 1) reducing the scope of some autofree strings / renaming functions 2) consistently use g_getenv/g_setenv 3) stop mocking virGetUserRuntimeDirectory in tests, and instead point the environment at a properly initialiazed test directory tree. (I suppose I could have sent them in separate threads, but they were all in a single branch so sending them together created less "local bureacracy") Laine Stump (8): util: reduce scope/autofree-ify rundir in virDaemonUnixSocketPaths() util: reduce scope of rundir in virPidFileConstructPath() remote: reduce scope of userdir in remoteGetUNIXSocketHelper() util: rename virGetUserDirectory(ByUID) to virGetUserHomeDirectory(ByUID) util: make completely separate functions for WIN32 versions of virGetUser*Directory() consistently use glib g_getenv() instead of libc getenv() tests: point $HOME and $XDG_* into usable fake root directory tests: stop mocking virGetUserRuntimeDirectory() scripts/rpcgen/tests/test_demo.c | 2 +- src/admin/libvirt-admin.c | 2 +- src/hyperv/hyperv_driver.c | 2 +- src/libvirt.c | 2 +- src/libvirt_private.syms | 4 +-- src/network/leaseshelper.c | 14 ++++---- src/qemu/qemu_command.c | 2 +- src/qemu/qemu_interop_config.c | 4 +-- src/remote/remote_sockets.c | 7 ++-- src/rpc/virnetclient.c | 4 +-- src/rpc/virnetlibsshsession.c | 2 +- src/rpc/virnettlsconfig.c | 2 +- src/rpc/virnettlscontext.c | 2 +- src/util/virauth.c | 2 +- src/util/vircommand.c | 2 +- src/util/virdaemon.c | 13 ++------ src/util/virfile.c | 4 +-- src/util/virlease.c | 4 +-- src/util/virlog.c | 6 ++-- src/util/virpidfile.c | 4 +-- src/util/virsystemd.c | 8 ++--- src/util/virutil.c | 55 +++++++++++++++++++++---------- src/util/virutil.h | 4 +-- src/vbox/vbox_XPCOMCGlue.c | 2 +- src/vbox/vbox_common.c | 2 +- src/vbox/vbox_storage.c | 2 +- tests/eventtest.c | 2 +- tests/fdstreamtest.c | 2 +- tests/meson.build | 1 - tests/qemucpumock.c | 2 +- tests/qemuhotplugtest.c | 1 - tests/qemusecuritymock.c | 16 ++++----- tests/securityselinuxhelper.c | 10 +++--- tests/testutils.c | 56 +++++++++++++++++++++++--------- tests/testutils.h | 2 +- tests/testutilsqemu.c | 2 +- tests/vircgroupmock.c | 10 +++--- tests/virfilemock.c | 8 ++--- tests/virhostdevmock.c | 15 --------- tests/virhostdevtest.c | 3 +- tests/virmockstathelpers.c | 2 +- tests/virnetdaemontest.c | 2 +- tests/virnettlshelpers.c | 2 +- tests/virpcimock.c | 2 +- tests/virportallocatormock.c | 4 +-- tests/virscsitest.c | 2 +- tests/virsystemdtest.c | 14 ++++---- tests/virtestmock.c | 6 ++-- tools/virsh.c | 2 +- tools/virt-login-shell-helper.c | 4 +-- tools/vsh.c | 14 ++++---- 51 files changed, 179 insertions(+), 162 deletions(-) delete mode 100644 tests/virhostdevmock.c -- 2.52.0

2 11

[PATCH v4 00/36] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 24 Feb '26

24 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Changes from [v3]: * changes to JSON firmware descriptors shipped by the edk2 package have been merged in Fedora, so the corresponding patch is no longer marked as DONOTMERGE; * drop new varstore-specific flags from virsh, the existing NVRAM-related flags will work for varstore too; * drop some changes to firmware selection that were not related to varstore support, to be reworked and submitted again at a later date; * split, join and shuffle around patches; * tweak things according to review feedback. Changes from [v2]: * changes to the schema for JSON firmware descriptors have been queued for merge in QEMU, so the corresponding patch is no longer marked as DONOTMERGE; * improve documentation; * rebase on top of master, addressing conflicts that I have caused with some recent changes related to this work. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [v3] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5JTQ… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (36): docs: Rename "BIOS bootloader" section to "guest firmware" docs: Improvement related to firmware selection qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers tests: Rename custom JSON firmware descriptors schema: Introduce osnvram define conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate include: Mention varstore where applicable virsh: Update for varstore handling news: Document support for uefi-vars device and firmwares NEWS.rst | 17 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 85 +++++---- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 23 +-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 74 +++++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 29 ++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 26 ++- src/qemu/qemu_firmware.c | 177 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++--- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 ++++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 3 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 .../90-edk2-aarch64-qemuvars-sb-enrolled.json | 29 +++ ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 14 +- ...combined.json => 90-libvirt-combined.json} | 0 .../firmware/91-edk2-aarch64-qemuvars-sb.json | 28 +++ ...json => 91-edk2-ovmf-qemuvars-x64-sb.json} | 15 +- .../{91-bios.json => 91-libvirt-bios.json} | 0 ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 63 +++++-- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...-auto-bios-not-stateless.x86_64-latest.xml | 35 ++++ ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...-enrolled-keys-aarch64.aarch64-latest.args | 32 ++++ ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 ++++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...o-efi-varstore-aarch64.aarch64-latest.args | 32 ++++ ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 ++++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...e-auto-efi-varstore-q35.x86_64-latest.args | 35 ++++ ...re-auto-efi-varstore-q35.x86_64-latest.xml | 40 ++++ .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...nual-bios-not-stateless.x86_64-latest.args | 32 ++++ ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...anual-bios-not-stateless.x86_64-latest.xml | 28 +++ ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...l-efi-varstore-aarch64.aarch64-latest.args | 32 ++++ ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 ++++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...manual-efi-varstore-q35.x86_64-latest.args | 35 ++++ ...-manual-efi-varstore-q35.x86_64-latest.xml | 40 ++++ .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 10 +- tools/virsh-snapshot.c | 2 +- 173 files changed, 1546 insertions(+), 307 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/90-edk2-aarch64-qemuvars-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/91-edk2-aarch64-qemuvars-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 91-edk2-ovmf-qemuvars-x64-sb.json} (52%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

3 45

[PATCH resend] In virFDStreamRead(), fill buffer from this and next messages
by Erik Huelsmann 23 Feb '26

23 Feb '26

Before this change, buffers returned from virFDStreamRead() would alternate in size (262120 and 24), because it only consumed the bytes remaining from the current background thread message. As the background thread reads 262144 bytes (256kB) of data in each chunk, where the maximum size returned from virFDStreamRead() to be transferred over the remote protocol is only 262120, 24 bytes would be left in the buffer on each iteration. The next iteration leaves 24 bytes, which used to be returned without considering messages waiting in the queue. Signed-off-by: Erik Huelsmann <ehuels(a)gmail.com> --- src/util/virfdstream.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/util/virfdstream.c b/src/util/virfdstream.c index 26a1f00..4c974ba 100644 --- a/src/util/virfdstream.c +++ b/src/util/virfdstream.c @@ -905,7 +905,10 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) if (fdst->thread) { virFDStreamMsg *msg = NULL; + size_t got = 0; + size_t bsz = 0; + more: while (!(msg = fdst->msg)) { if (fdst->threadQuit || fdst->threadErr) { if (nbytes) { @@ -917,7 +920,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) virReportSystemError(EBADF, "%s", _("stream is not open")); } else { - ret = 0; + ret = got; } goto cleanup; } else { @@ -931,7 +934,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) * return 0 immediately. */ if (msg->type == VIR_FDSTREAM_MSG_TYPE_HOLE && msg->stream.hole.len == 0) { - ret = 0; + ret = got; goto cleanup; } @@ -942,21 +945,26 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) goto cleanup; } - if (nbytes > msg->stream.data.len - msg->stream.data.offset) - nbytes = msg->stream.data.len - msg->stream.data.offset; + bsz = msg->stream.data.len - msg->stream.data.offset; + if (nbytes < bsz) + bsz = nbytes; - memcpy(bytes, + memcpy(bytes + got, msg->stream.data.buf + msg->stream.data.offset, - nbytes); + bsz); + got += bsz; + nbytes -= bsz; - msg->stream.data.offset += nbytes; + msg->stream.data.offset += bsz; if (msg->stream.data.offset == msg->stream.data.len) { virFDStreamMsgQueuePop(fdst, fdst->fd, "pipe"); virFDStreamMsgFree(msg); } - ret = nbytes; - + ret = got; + if (nbytes > 0) { + goto more; + } } else { retry: ret = read(fdst->fd, bytes, nbytes); -- 2.43.0

4 9

[PATCH v3 00/38] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 23 Feb '26

23 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Note that, while I consider the entire series to be ready for review, there is one patch that is marked as DONOTMERGE: that's because it imports into the tree firmware descriptor that are not yet part of the Fedora edk2 package. Changes from [v2]: * changes to the schema for JSON firmware descriptors have been queued for merge in QEMU, so the corresponding patch is no longer marked as DONOTMERGE; * improve documentation; * rebase on top of master, addressing conflicts that I have caused with some recent changes related to this work. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (38): qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers qemu_firmware: Improve matching when loader.type is absent tests: Rename custom JSON firmware descriptors tests: Update JSON firmware descriptor for BIOS schema: Add varstore element conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs schema: Add varstore element for domcaps conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file include: Mention varstore where applicable virsh: Update for varstore handling docs: Update for varstore and improve news: Document support for uefi-vars device and firmwares NEWS.rst | 16 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 85 +++++--- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 44 +++-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 64 +++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 29 ++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 27 ++- src/qemu/qemu_firmware.c | 182 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++-- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 +++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 3 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 15 +- .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 28 +++ ...json => 71-edk2-ovmf-qemuvars-x64-sb.json} | 16 +- .../firmware/71-edk2-qemuvars-aarch64-sb.json | 27 +++ ...combined.json => 90-libvirt-combined.json} | 0 .../{91-bios.json => 91-libvirt-bios.json} | 2 +- ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 71 ++++--- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...auto-bios-not-stateless.x86_64-latest.xml} | 6 +- ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...enrolled-keys-aarch64.aarch64-latest.args} | 12 +- ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 +++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...-auto-efi-varstore-q35.x86_64-latest.args} | 5 +- ...e-auto-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...ual-bios-not-stateless.x86_64-latest.args} | 8 +- ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...nual-bios-not-stateless.x86_64-latest.xml} | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-manual-bios.x86_64-latest.xml | 6 +- ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...anual-efi-varstore-q35.x86_64-latest.args} | 5 +- ...manual-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 55 ++++-- tools/virsh-snapshot.c | 9 +- 179 files changed, 1314 insertions(+), 380 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 70-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 71-edk2-ovmf-qemuvars-x64-sb.json} (51%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/71-edk2-qemuvars-aarch64-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (90%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-auto-bios-not-stateless.x86_64-latest.xml} (84%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-varstore-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.args => firmware-auto-efi-varstore-q35.x86_64-latest.args} (83%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-varstore-q35.x86_64-latest.xml} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-bios-not-stateless.x86_64-latest.args} (84%) delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err copy tests/qemuxmlconfdata/{firmware-manual-bios.x86_64-latest.xml => firmware-manual-bios-not-stateless.x86_64-latest.xml} (90%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-aarch64.aarch64-latest.args} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-q35.x86_64-latest.args} (85%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-varstore-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

4 87

[PATCH] storage: mpath: use device-mapper UUID for volume key
by Lucas Amaral 23 Feb '26

23 Feb '26

The multipath storage backend used the device path (e.g., /dev/mapper/mpathX) as the volume key. Device paths can change across reboots when devices are enumerated in a different order. Use dm_task_get_uuid() to retrieve the device-mapper UUID, which is derived from the underlying hardware identifier and remains stable. Fall back to the device path when a UUID is not available. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- Build-tested and passed full test suite on CentOS Stream 9 (226 OK, 0 failures). Verified dm_task_get_uuid() behavior using a standalone C program that mimics the patched vol->key logic, run against simulated device-mapper devices in a privileged container: $ dmsetup create testmpath0 \ -u "mpath-3600508b4000c4a5d0000300000490000" \ --table "0 1000 zero" $ dmsetup create testmpath1 --table "0 1000 zero" Results: Device: testmpath0 vol->key = mpath-3600508b4000c4a5d0000300000490000 (UUID) Device: testmpath1 (no UUID set) vol->key = /dev/mapper/testmpath1 (path fallback) Device: nonexistent vol->key = /dev/mapper/nonexistent (path fallback) All three cases (UUID present, UUID absent, device missing) behave correctly. Not tested with a running libvirtd and a real mpath pool. --- src/storage/storage_backend_mpath.c | 48 +++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/src/storage/storage_backend_mpath.c b/src/storage/storage_backend_mpath.c index 9fc3983c52..a36400502f 100644 --- a/src/storage/storage_backend_mpath.c +++ b/src/storage/storage_backend_mpath.c @@ -40,13 +40,43 @@ VIR_LOG_INIT("storage.storage_backend_mpath"); +static int +virStorageBackendGetDeviceUUID(const char *dev_name, char **uuid) +{ + int ret = -1; + struct dm_task *dmt; + const char *dm_uuid; + + if (!(dmt = dm_task_create(DM_DEVICE_INFO))) + goto out; + + if (!dm_task_set_name(dmt, dev_name)) + goto out; + + if (!dm_task_run(dmt)) + goto out; + + if (!(dm_uuid = dm_task_get_uuid(dmt)) || !*dm_uuid) + goto out; + + *uuid = g_strdup(dm_uuid); + ret = 0; + + out: + if (dmt != NULL) + dm_task_destroy(dmt); + return ret; +} + + static int virStorageBackendMpathNewVol(virStoragePoolObj *pool, const int devnum, - const char *dev) + const char *dev_name) { virStoragePoolDef *def = virStoragePoolObjGetDef(pool); g_autoptr(virStorageVolDef) vol = NULL; + g_autofree char *dev_uuid = NULL; vol = g_new0(virStorageVolDef, 1); @@ -54,15 +84,18 @@ virStorageBackendMpathNewVol(virStoragePoolObj *pool, (vol->name) = g_strdup_printf("dm-%u", devnum); - vol->target.path = g_strdup_printf("/dev/%s", dev); + vol->target.path = g_strdup_printf("/dev/mapper/%s", dev_name); if (virStorageBackendUpdateVolInfo(vol, true, VIR_STORAGE_VOL_OPEN_DEFAULT, 0) < 0) { return -1; } - /* XXX should use logical unit's UUID instead */ - vol->key = g_strdup(vol->target.path); + virStorageBackendGetDeviceUUID(dev_name, &dev_uuid); + if (dev_uuid) + vol->key = g_steal_pointer(&dev_uuid); + else + vol->key = g_strdup(vol->target.path); if (virStoragePoolObjAddVol(pool, vol) < 0) return -1; @@ -151,7 +184,6 @@ virStorageBackendCreateVols(virStoragePoolObj *pool, { uint32_t minor = -1; uint32_t next; - g_autofree char *map_device = NULL; do { int is_mpath = virStorageBackendIsMultipath(names->name); @@ -161,8 +193,6 @@ virStorageBackendCreateVols(virStoragePoolObj *pool, if (is_mpath == 1) { - map_device = g_strdup_printf("mapper/%s", names->name); - if (virStorageBackendGetMinorNumber(names->name, &minor) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Failed to get %1$s minor number"), @@ -170,10 +200,8 @@ virStorageBackendCreateVols(virStoragePoolObj *pool, return -1; } - if (virStorageBackendMpathNewVol(pool, minor, map_device) < 0) + if (virStorageBackendMpathNewVol(pool, minor, names->name) < 0) return -1; - - VIR_FREE(map_device); } /* Given the way libdevmapper returns its data, I don't see -- 2.52.0

1 1

[PATCH 0/3] Add virDomainBlockInfo() support to hyperv driver
by Jonathon Jongsma 20 Feb '26

20 Feb '26

Feature requested by MTV project. See patches for more details Jonathon Jongsma (3): conf: support windows paths in virDomainDiskByName() hyperv: Add resource subtype definitions hyperv: Add basic domainGetBlockInfo() API implementation src/conf/domain_conf.c | 6 +- src/hyperv/hyperv_driver.c | 234 ++++++++++++++++++++++++-- src/hyperv/hyperv_driver.h | 11 ++ src/hyperv/hyperv_wmi.c | 41 +++++ src/hyperv/hyperv_wmi.h | 7 + src/hyperv/hyperv_wmi_generator.input | 109 ++++++++++++ 6 files changed, 392 insertions(+), 16 deletions(-) -- 2.53.0

2 5

[PATCH] virpci: Report an error if virPCIGetVirtualFunctionIndex() fails
by Michal Privoznik 20 Feb '26

20 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> Either an error should be returned in all error paths in a function or in none (leaving it up to caller). Well, virPCIGetVirtualFunctionIndex() breaks this pattern. Fix it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virpci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/util/virpci.c b/src/util/virpci.c index 78c47869ef..ca6f2e8210 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2870,6 +2870,9 @@ virPCIGetVirtualFunctionIndex(const char *pf_sysfs_device_link, } } + virReportError(VIR_ERR_INTERNAL_ERROR, + _("No virtual function index found for '%1$s'"), + pf_sysfs_device_link); return -1; } -- 2.52.0

3 2

[PATCH v2 0/2] allow migrations with the ext transport
by Sergey Dyasli 19 Feb '26

19 Feb '26

Hello, I have a use case for live-migration where the socket of the destination libvirtd is proxied by an mTLS WebSocket proxy. Since there is no WebSocket support in Libvirt, I've decided to use the existing ext transport and point it to a proxy binary on the source host of live-migration. While doing that, I've discovered a couple of roadblocks: 1. There is no way of passing cmdline arguments to the ext program 2. Live-migrations using ext transport fail localhost checks This short series addresses those limitations. Sergey Dyasli (2): remote: allow passing argv to the ext transport remote: allow migrations with the ext transport v1 -> v2: - new way of passing argv src/libvirt-domain.c | 8 +++++--- src/remote/remote_driver.c | 30 ++++++++++++++++++++++++++---- src/util/viruri.c | 32 ++++++++++++++++++++++++++++++++ src/util/viruri.h | 2 ++ 4 files changed, 65 insertions(+), 7 deletions(-) -- 2.43.7

3 5

[PATCH 0/2] bhyve: support vcpu pinning
by Roman Bogorodskiy 19 Feb '26

19 Feb '26

Roman Bogorodskiy (2): bhyve: support vcpu pinning bhyve: implement domainGetVcpuPinInfo docs/drvbhyve.rst | 20 +++++ src/bhyve/bhyve_command.c | 15 ++++ src/bhyve/bhyve_driver.c | 74 +++++++++++++++++++ .../x86_64/bhyvexml2argv-vcpupin.args | 15 ++++ .../x86_64/bhyvexml2argv-vcpupin.ldargs | 4 + .../x86_64/bhyvexml2argv-vcpupin.xml | 27 +++++++ tests/bhyvexml2argvtest.c | 1 + 7 files changed, 156 insertions(+) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-vcpupin.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-vcpupin.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-vcpupin.xml -- 2.52.0

2 4

[PATCH] qemu: Report error aborting stopped postcopy migration
by Jiri Denemark 19 Feb '26

19 Feb '26

From: Jiri Denemark <jdenemar(a)redhat.com> When virDomainAbortJob is called with VIR_DOMAIN_ABORT_JOB_POSTCOPY flag and the post-copy migration of the domain is already stopped (either because of a failure or previous call to virDomainAbortJob), the migrate-pause QMP command fails with "migrate-pause is currently only supported during postcopy-active or postcopy-recover state". Such error might be confusing to end users especially when we mark it as an internal error. Let's not call the QMP command at all and report a clear error message instead. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_driver.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7f08fd05e9..c5eedeedfa 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -12318,6 +12318,12 @@ qemuDomainAbortJobPostcopy(virDomainObj *vm, return -1; } + if (virDomainObjIsFailedPostcopy(vm, vm->job)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("post-copy migration already stopped")); + return -1; + } + VIR_DEBUG("Suspending post-copy migration at client request"); qemuDomainObjAbortAsyncJob(vm); -- 2.53.0

2 1

[PATCH] virstorageobj: Make virStoragePoolObjAddVol() report an error on failure
by Michal Privoznik 19 Feb '26

19 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> Adding a storage volume into a pool is done by calling virStoragePoolObjAddVol(). This function may fail if another volume already exists with the same key/name/target. In some cases the storage driver does check for duplicates before calling the function. But in some cases (e.g. when refreshing an RBD pool in virStorageBackendRBDRefreshPool()) it doesn't. The problem here is that the function reports no error upon failure and leaves it as an exercise for caller. Well, no caller does that. Therefore, make the function report an error. The advantage of this approach is - the function can report more accurate error message than any caller ever could. NB¸ this stems from a discussion on the users list [1], and while this does NOT solve the original issue, it fixes one of the symptoms. 1: https://lists.libvirt.org/archives/list/users@lists.libvirt.org/message/BAL… Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- This can be very easily reproduced with test driver. No need for ceph. Just duplicate a volume in a custom test driver XML. Before this patch you'd get: error: failed to connect to the hypervisor error: An error occurred, but the cause is unknown After: error: failed to connect to the hypervisor error: operation failed: volume with target path '/dev/disk/by-path/pci-0000:00:17.0-ata-30' already exist src/conf/virstorageobj.c | 45 +++++++++++++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c index 59fa5da372..ac79ff4c26 100644 --- a/src/conf/virstorageobj.c +++ b/src/conf/virstorageobj.c @@ -621,19 +621,44 @@ virStoragePoolObjAddVol(virStoragePoolObj *obj, virStorageVolObj *volobj = NULL; virStorageVolObjList *volumes = obj->volumes; + if (!voldef->key) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("volume is missing key")); + return -1; + } + if (!voldef->name) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("volume is missing name")); + return -1; + } + if (!voldef->target.path) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("volume is missing target path")); + return -1; + } + virObjectRWLockWrite(volumes); - if (!voldef->key || !voldef->name || !voldef->target.path || - g_hash_table_contains(volumes->objsKey, voldef->key) || - g_hash_table_contains(volumes->objsName, voldef->name) || - g_hash_table_contains(volumes->objsPath, voldef->target.path)) { - virObjectRWUnlock(volumes); - return -1; + if (g_hash_table_contains(volumes->objsKey, voldef->key)) { + virReportError(VIR_ERR_OPERATION_FAILED, + _("volume with key '%1$s' already exist"), + voldef->key); + goto error; + } + if (g_hash_table_contains(volumes->objsName, voldef->name)) { + virReportError(VIR_ERR_STORAGE_VOL_EXIST, + _("'%1$s'"), voldef->name); + goto error; + } + if (g_hash_table_contains(volumes->objsPath, voldef->target.path)) { + virReportError(VIR_ERR_OPERATION_FAILED, + _("volume with target path '%1$s' already exist"), + voldef->target.path); + goto error; } if (!(volobj = virStorageVolObjNew())) { - virObjectRWUnlock(volumes); - return -1; + goto error; } VIR_WITH_OBJECT_LOCK_GUARD(volobj) { @@ -652,6 +677,10 @@ virStoragePoolObjAddVol(virStoragePoolObj *obj, virObjectUnref(volobj); virObjectRWUnlock(volumes); return 0; + + error: + virObjectRWUnlock(volumes); + return -1; } -- 2.52.0

2 1

[PATCH 0/6] qemu: Avoid use of regular file FDs with qemu's 'fd:' migration backend
by Peter Krempa 19 Feb '26

19 Feb '26

When reverting a save image in the most naive case libvirt would still try to use a regular file FD with the 'fd:' migration backend in qemu which will no longer work as of qemu-11.0. This patchet addresses it by using the filewrapper for all cases to pass pipes to 'fd' instead. In addition this patchset also adds a check that if 'sparse' save image format is used which requires the 'file' backend in qemu that a regular file FD is indeed passed to qemu. Peter Krempa (6): qemuSaveImageOpen: Remove wrong ATTRIBUTE_NONNULL qemuMonitorMigrateToFdSet: Drop 'flags' argument virfile: Introduce 'virFileFDIsRegular' qemuSaveImageCreateFd: Handle case when 'virQEMUFileOpenAs' doesn't return a file fd for 'sparse' format qemu: driver: Merge 'qemuDomainRestoreInternal' and 'qemuDomainObjRestore' qemu: saveimage: Use 'virFileWrapperFd' when loading non-sparse saveimage src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 254 +++++++++++++++++++------------------- src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_monitor.c | 6 +- src/qemu/qemu_monitor.h | 1 - src/qemu/qemu_saveimage.c | 48 +++++-- src/qemu/qemu_saveimage.h | 6 +- src/qemu/qemu_snapshot.c | 12 +- src/util/virfile.c | 8 ++ src/util/virfile.h | 1 + 10 files changed, 191 insertions(+), 148 deletions(-) -- 2.53.0

2 7

[RFC PATCH 0/3] qemu: Support vCMDQ
by Nathan Chen 18 Feb '26

18 Feb '26

Hi, This is a follow up to the previous RFC patchset [0] for supporting Tegra241 vCMDQ, separated out from the series for accelerated SMMUv3. This patchset is tested with Shameer's v2 qemu series [1] for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt [2] are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. An additional 'identifier' <iommu> driver attribute is introduced to specify an enumeration-independent SMMUv3 device identifier. This identifier is used so that both Tegra DSDT and SMMUv3 IORT use the same identifier. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidSize='20' oas='44' cmdqv='on' identifier='0'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidSize='20' oas='44' cmdqv='on' identifier='1'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"tegra241-cmdqv":true,"identifier":0,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"tegra241-cmdqv":true,"identifier":1,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-02-26/ Thanks, Nathan Changes: - Support 'identifier' attribute for SMMUv3 [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/VRS… [1] https://lore.kernel.org/qemu-devel/20260206144823.80655-1-skolothumtho@nvid… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5GG7… Nathan Chen (3): qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3 qemu: Support enumeration-independent SMMUv3 identifier tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 13 ++++ src/conf/domain_conf.c | 32 ++++++++++ src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 8 ++- src/conf/schemas/domaincommon.rng | 10 ++++ src/qemu/qemu_command.c | 2 + ...u-smmuv3-pci-bus-cmdqv.aarch64-latest.args | 40 +++++++++++++ ...mu-smmuv3-pci-bus-cmdqv.aarch64-latest.xml | 59 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-cmdqv.xml | 49 +++++++++++++++ tests/qemuxmlconftest.c | 1 + 10 files changed, 215 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.xml -- 2.43.0

2 6

[PATCH v6] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 18 Feb '26

18 Feb '26

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> --- v6: - update numbers 10.2 -> 11.0 - add r-b by Markus docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 03e29915f0..3f97392a45 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -498,6 +498,17 @@ Backend ``memory`` (since 9.0) ``memory`` is a deprecated synonym for ``ringbuf``. +TAP ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 118bd34965..9a00d578e9 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -348,13 +348,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -371,7 +376,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -610,17 +615,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index fca2b7bc74..414b762743 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index d2bb21d5b9..f977f50baf 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

2 4

[PATCH] virsh: report "unknown" for autostart when API query fails
by Lucas Amaral 18 Feb '26

18 Feb '26

When virStoragePoolGetAutostart(), virNetworkGetAutostart(), or virNodeDeviceGetAutostart() fails, the respective info commands report "no autostart". This is incorrect: the API failure means we cannot determine the autostart state, not that autostart is disabled. The persistent field in the same functions already correctly reports "unknown" on API failure. Apply the same pattern to the autostart field for consistency and correctness. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- Found by code audit. The inconsistency dates back to c2160b137d (Jun 2010), which introduced both the "Persistent" and "Autostart" fields for pool-info. The persistent field used _("unknown") on failure while the autostart field used _("no autostart") — the mismatch was then copied into net-info, pool-list, net-list, and nodedev-info as those were added. All 5 instances across 3 files (virsh-pool.c, virsh-network.c, virsh-nodedev.c) are fixed in this patch. Tested on CentOS Stream 9 — full test suite passes (307 OK, 1 Expected Fail, 0 Fail). tools/virsh-network.c | 4 ++-- tools/virsh-nodedev.c | 2 +- tools/virsh-pool.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/virsh-network.c b/tools/virsh-network.c index 2e9613e01b..eb7de3da85 100644 --- a/tools/virsh-network.c +++ b/tools/virsh-network.c @@ -715,7 +715,7 @@ cmdNetworkInfo(vshControl *ctl, const vshCmd *cmd) vshPrint(ctl, "%-15s %s\n", _("Persistent:"), persistent ? _("yes") : _("no")); if (virNetworkGetAutostart(network, &autostart) < 0) - vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("no autostart")); + vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("unknown")); else vshPrint(ctl, "%-15s %s\n", _("Autostart:"), autostart ? _("yes") : _("no")); @@ -1055,7 +1055,7 @@ cmdNetworkList(vshControl *ctl, const vshCmd *cmd G_GNUC_UNUSED) if (optTable) { if (virNetworkGetAutostart(network, &is_autostart) < 0) - autostartStr = _("no autostart"); + autostartStr = _("unknown"); else autostartStr = is_autostart ? _("yes") : _("no"); diff --git a/tools/virsh-nodedev.c b/tools/virsh-nodedev.c index 2ce0c1411f..e78fc24897 100644 --- a/tools/virsh-nodedev.c +++ b/tools/virsh-nodedev.c @@ -1245,7 +1245,7 @@ cmdNodeDeviceInfo(vshControl *ctl, const vshCmd *cmd) vshPrint(ctl, "%-15s %s\n", _("Persistent:"), virNodeDeviceIsPersistent(device) ? _("yes") : _("no")); if (virNodeDeviceGetAutostart(device, &autostart) < 0) - vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("no autostart")); + vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("unknown")); else vshPrint(ctl, "%-15s %s\n", _("Autostart:"), autostart ? _("yes") : _("no")); diff --git a/tools/virsh-pool.c b/tools/virsh-pool.c index 2010ef1356..2db2cf6893 100644 --- a/tools/virsh-pool.c +++ b/tools/virsh-pool.c @@ -1204,7 +1204,7 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd G_GNUC_UNUSED) /* Retrieve the autostart status of the pool */ if (virStoragePoolGetAutostart(list->pools[i], &autostart) < 0) - poolInfoTexts[i].autostart = g_strdup(_("no autostart")); + poolInfoTexts[i].autostart = g_strdup(_("unknown")); else poolInfoTexts[i].autostart = g_strdup(autostart ? _("yes") : _("no")); @@ -1554,7 +1554,7 @@ cmdPoolInfo(vshControl *ctl, const vshCmd *cmd) /* Check and display whether the pool is autostarted or not */ if (virStoragePoolGetAutostart(pool, &autostart) < 0) - vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("no autostart")); + vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("unknown")); else vshPrint(ctl, "%-15s %s\n", _("Autostart:"), autostart ? _("yes") : _("no")); -- 2.52.0

2 1

[PATCH] virsh: return failure exit code when UUID fetch fails
by Lucas Amaral 18 Feb '26

18 Feb '26

The domuuid, net-uuid, and pool-uuid commands call vshError() when GetUUIDString() fails, but unconditionally return true, which vshCommandRun() maps to EXIT_SUCCESS. This means scripts checking $? see success despite the error. Return false on failure so the exit code correctly reflects the error, consistent with other virsh commands. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- Found by code audit. The bug dates back to the original cmdDomuuid implementation in d47ddf5b67 (May 2006) and was replicated in cmdNetworkUuid and cmdPoolUuid when those were added later. In practice GetUUIDString() is unlikely to fail from virsh (the UUID is populated during the preceding lookup), so this is a defensive correctness fix rather than a user-visible regression. The restructuring uses the early-return-on-error pattern already used by the adjacent object lookup (e.g., virshCommandOptDomainBy a few lines above). Tested on CentOS Stream 9 — full test suite passes (307 OK, 1 Expected Fail, 0 Fail). tools/virsh-domain.c | 7 ++++--- tools/virsh-network.c | 7 ++++--- tools/virsh-pool.c | 7 ++++--- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index cb9dd069b6..a7f6a97dd7 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -11041,11 +11041,12 @@ cmdDomuuid(vshControl *ctl, const vshCmd *cmd) VIRSH_BYNAME|VIRSH_BYID))) return false; - if (virDomainGetUUIDString(dom, uuid) != -1) - vshPrint(ctl, "%s\n", uuid); - else + if (virDomainGetUUIDString(dom, uuid) == -1) { vshError(ctl, "%s", _("failed to get domain UUID")); + return false; + } + vshPrint(ctl, "%s\n", uuid); return true; } diff --git a/tools/virsh-network.c b/tools/virsh-network.c index 2e9613e01b..a725be289f 100644 --- a/tools/virsh-network.c +++ b/tools/virsh-network.c @@ -1389,11 +1389,12 @@ cmdNetworkUuid(vshControl *ctl, const vshCmd *cmd) VIRSH_BYNAME))) return false; - if (virNetworkGetUUIDString(network, uuid) != -1) - vshPrint(ctl, "%s\n", uuid); - else + if (virNetworkGetUUIDString(network, uuid) == -1) { vshError(ctl, "%s", _("failed to get network UUID")); + return false; + } + vshPrint(ctl, "%s\n", uuid); return true; } diff --git a/tools/virsh-pool.c b/tools/virsh-pool.c index 2010ef1356..e06a6cf7c8 100644 --- a/tools/virsh-pool.c +++ b/tools/virsh-pool.c @@ -1720,11 +1720,12 @@ cmdPoolUuid(vshControl *ctl, const vshCmd *cmd) if (!(pool = virshCommandOptPoolBy(ctl, cmd, "pool", NULL, VIRSH_BYNAME))) return false; - if (virStoragePoolGetUUIDString(pool, uuid) != -1) - vshPrint(ctl, "%s\n", uuid); - else + if (virStoragePoolGetUUIDString(pool, uuid) == -1) { vshError(ctl, "%s", _("failed to get pool UUID")); + return false; + } + vshPrint(ctl, "%s\n", uuid); return true; } -- 2.52.0

2 1

[PATCH] hyperv: add support for secure boot configuration
by Jonathon Jongsma 18 Feb '26

18 Feb '26

When getting the xml description of a guest, check if secure boot is enabled and set firmware features accordingly. Also support firmware autoselection and honor the secure boot setting when defining new vms from xml. Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_driver.c | 33 ++++++++++++++++++++++++++++++++- src/hyperv/hyperv_driver.h | 3 +++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index eb28093028..ae9502404c 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -2743,6 +2743,22 @@ hypervDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) def->os.type = VIR_DOMAIN_OSTYPE_HVM; + /* Generation 2 VMs use UEFI firmware */ + if (STREQ_NULLABLE(virtualSystemSettingData->data->VirtualSystemSubType, HYPERV_VM_GEN2)) { + def->os.firmware = VIR_DOMAIN_OS_DEF_FIRMWARE_EFI; + + if (virtualSystemSettingData->data->SecureBootEnabled) { + int *features = g_new0(int, VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_LAST); + + /* Hyper-V doesn't distinguish between secure-boot and enrolled-keys, + * so set both when SecureBootEnabled is true */ + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] = VIR_TRISTATE_BOOL_YES; + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] = VIR_TRISTATE_BOOL_YES; + + def->os.firmwareFeatures = features; + } + } + /* Allocate space for all potential devices */ /* 256 scsi drives + 4 ide drives */ @@ -2948,6 +2964,20 @@ hypervDomainDefineXML(virConnectPtr conn, const char *xml) if (hypervSetEmbeddedProperty(defineSystemParam, "ElementName", def->name) < 0) goto error; + /* Set firmware settings */ + if (def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) { + /* Generation 2 VM (UEFI) */ + if (hypervSetEmbeddedProperty(defineSystemParam, "VirtualSystemSubType", HYPERV_VM_GEN2) < 0) + goto error; + + if (def->os.firmwareFeatures && + (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_YES || + def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES)) { + if (hypervSetEmbeddedProperty(defineSystemParam, "SecureBootEnabled", "true") < 0) + goto error; + } + } + if (hypervAddEmbeddedParam(params, "SystemSettings", &defineSystemParam, Msvm_VirtualSystemSettingData_WmiInfo) < 0) goto error; @@ -3889,7 +3919,8 @@ static virHypervisorDriver hypervHypervisorDriver = { virDomainDefParserConfig hypervDomainDefParserConfig = { - .features = VIR_DOMAIN_DEF_FEATURE_MEMORY_HOTPLUG, + .features = VIR_DOMAIN_DEF_FEATURE_MEMORY_HOTPLUG | + VIR_DOMAIN_DEF_FEATURE_FW_AUTOSELECT, }; diff --git a/src/hyperv/hyperv_driver.h b/src/hyperv/hyperv_driver.h index 3764844494..aa2a820830 100644 --- a/src/hyperv/hyperv_driver.h +++ b/src/hyperv/hyperv_driver.h @@ -27,4 +27,7 @@ #define HYPERV_MAX_IDE_CHANNELS 2 #define HYPERV_MAX_DRIVES_PER_IDE_CHANNEL 2 +#define HYPERV_VM_GEN1 "Microsoft:Hyper-V:SubType:1" +#define HYPERV_VM_GEN2 "Microsoft:Hyper-V:SubType:2" + int hypervRegister(void); -- 2.53.0

2 1

[PATCH] hyperv: Clean up unnecessary header includes
by Jonathon Jongsma 18 Feb '26

18 Feb '26

Remove some unused or over-broad includes from headers, push some includes down to .c files when the only user is the implementation. Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_util.c | 2 +- src/hyperv/hyperv_wmi.c | 2 +- src/hyperv/hyperv_wmi.h | 1 - 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/hyperv/hyperv_util.c b/src/hyperv/hyperv_util.c index 37a1b1a249..120c0b1bdb 100644 --- a/src/hyperv/hyperv_util.c +++ b/src/hyperv/hyperv_util.c @@ -23,8 +23,8 @@ #include "internal.h" #include "viralloc.h" +#include "virerror.h" #include "virlog.h" -#include "hyperv_private.h" #include "hyperv_util.h" #define VIR_FROM_THIS VIR_FROM_HYPERV diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index eee42b5c70..1ca1e0b5db 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -40,7 +40,7 @@ #include "hyperv_wmi.h" #include "virstring.h" #include "virlog.h" -#include "virxml.h" +#include "virhash.h" #define VIR_FROM_THIS VIR_FROM_HYPERV diff --git a/src/hyperv/hyperv_wmi.h b/src/hyperv/hyperv_wmi.h index 9093aec455..9fad0712a2 100644 --- a/src/hyperv/hyperv_wmi.h +++ b/src/hyperv/hyperv_wmi.h @@ -26,7 +26,6 @@ #include "virbuffer.h" #include "hyperv_private.h" #include "hyperv_wmi_classes.h" -#include "virhash.h" #define HYPERV_WQL_QUERY_INITIALIZER { NULL, NULL } -- 2.53.0

2 1

[libvirt PATCH] tests: fix mocking on macOS
by Pavel Hrdina 17 Feb '26

17 Feb '26

On macOS we use flat namespace so we cannot have multiple mocks for the same function. Fixes: 63434db800b921e96fec424a667b7161af1f02de Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- tests/domaincapsmock.c | 4 ++++ tests/qemuhotplugmock.c | 23 ----------------------- 2 files changed, 4 insertions(+), 23 deletions(-) diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c index aa13deb324..4fb44f7244 100644 --- a/tests/domaincapsmock.c +++ b/tests/domaincapsmock.c @@ -95,6 +95,10 @@ virFileExists(const char *path) if (STREQ(path, "/dev/vfio/vfio")) return true; + /* required by qemuhotplugtest */ + if (STREQ(path, "/dev/mapper/virt")) + return true; + return real_virFileExists(path); } diff --git a/tests/qemuhotplugmock.c b/tests/qemuhotplugmock.c index dd7e2c67e0..79e9bdd8a8 100644 --- a/tests/qemuhotplugmock.c +++ b/tests/qemuhotplugmock.c @@ -24,22 +24,11 @@ #include "testutilsqemu.h" #include "conf/domain_conf.h" #include "virdevmapper.h" -#include "virmock.h" #include <fcntl.h> #define LIBVIRT_QEMU_MONITOR_PRIV_H_ALLOW #include "qemu/qemu_monitor_priv.h" -static bool (*real_virFileExists)(const char *path); - -static void -init_syms(void) -{ - if (real_virFileExists) - return; - - VIR_MOCK_REAL_INIT(virFileExists); -} unsigned long long qemuDomainGetUnplugTimeout(virDomainObj *vm) @@ -69,18 +58,6 @@ virDevMapperGetTargets(const char *path, } -bool -virFileExists(const char *path) -{ - init_syms(); - - if (STREQ(path, "/dev/mapper/virt")) - return true; - - return real_virFileExists(path); -} - - int qemuProcessStartManagedPRDaemon(virDomainObj *vm G_GNUC_UNUSED) { -- 2.53.0

2 1

[libvirt PATCH] iommufd: fix FD leak in case of error
by Pavel Hrdina 17 Feb '26

17 Feb '26

Reported-by: coverity Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/util/viriommufd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c index 1f3353eab4..b62d59241d 100644 --- a/src/util/viriommufd.c +++ b/src/util/viriommufd.c @@ -87,8 +87,10 @@ virIOMMUFDOpenDevice(void) if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0) virReportSystemError(errno, "%s", _("cannot open IOMMUFD device")); - if (virIOMMUFDSetRLimitMode(fd, true) < 0) + if (virIOMMUFDSetRLimitMode(fd, true) < 0) { + VIR_FORCE_CLOSE(fd); return -1; + } return fd; } -- 2.53.0

2 1

[PATCH v2] qemu: Store tapfd path in domstatus XML
by Wesley Hershberger 16 Feb '26

16 Feb '26

Introduce a read-only `tapfd` element for direct interfaces (macvtap), which contains the path to the backing tapfd for that interface (e.g. `/dev/tapXX`). The element is only included when the domain is being formatted for internal consumption (VIR_DOMAIN_DEF_FORMAT_STATUS) and is not accepted in user-provided XML (!VIR_DOMAIN_DEF_PARSE_INACTIVE). This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: #692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger <wesley.hershberger(a)canonical.com> --- This submission is a partial revision of a previous series with a fix for the macvtap component of gitlab#692 [1][2]. I haven't had bandwidth to resolve the blockcommit component since the complexity there is somewhat higher (and is also lower priority for us). I kept the separate `tapfd` element rather than reusing the existing `backend` element (virDomainNetBackend.tap) to avoid making a user-visible change [3]. I'd be happy to use the existing field instead if you think that would make more sense. I opted not to introduce/modify a security driver API for FD+path as the patch here is sufficient to resolve the bug, but would be willing to do so if that would make this change more palatable. I've opened a MR to libvirt-tck with test cases that demonstrate the bugs that this fixes [4]. apparmor/110-macvtap.t passes with this patch applied. Thanks for the reviews and continued consideration. ~Wesley [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… [2] https://gitlab.com/libvirt/libvirt/-/issues/692 [3] https://libvirt.org/formatdomain.html#setting-network-backend-specific-opti… [4] https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/73 --- Changes in v2: - Drop `virt-aa-helper: Ask for no deny rule...` as it was applied - Drop `qemu: Store blockcommit permissions...` due to unresolved concerns - Pass tapfd path through netdef instead of resolving from fd - Link to v1: https://lore.kernel.org/r/20260105-apparmor-races-v1-0-932cf0e990b7@canonic… --- src/conf/domain_conf.c | 8 ++++++++ src/conf/domain_conf.h | 1 + src/hypervisor/domain_interface.c | 2 +- src/lxc/lxc_process.c | 1 + src/qemu/qemu_interface.c | 1 + src/security/security_apparmor.c | 1 + src/security/virt-aa-helper.c | 5 +++++ src/util/virnetdevmacvlan.c | 18 +++++++++++------- src/util/virnetdevmacvlan.h | 4 +++- 9 files changed, 32 insertions(+), 9 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 02e23f78667a775637c710b651ba5fc7a127226f..1d7921e0de6f097ffaf86a9197d629e67dc213d7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2939,6 +2939,7 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->virtio); g_free(def->coalesce); g_free(def->sourceDev); + g_free(def->tapfdpath); virNetDevIPInfoClear(&def->guestIP); virNetDevIPInfoClear(&def->hostIP); @@ -10440,6 +10441,10 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, return NULL; } + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) { + def->tapfdpath = virXPathString("string(./tapfd/@path)", ctxt); + } + if (virNetworkPortOptionsParseXML(ctxt, &def->isolatedPort) < 0) return NULL; @@ -25664,6 +25669,9 @@ virDomainNetDefFormat(virBuffer *buf, if (def->mtu) virBufferAsprintf(buf, "<mtu size='%u'/>\n", def->mtu); + if (def->tapfdpath && (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)) + virBufferAsprintf(buf, "<tapfd path='%s'/>\n", def->tapfdpath); + virDomainNetDefCoalesceFormatXML(buf, def->coalesce); virDomainDeviceInfoFormat(buf, &def->info, flags | VIR_DOMAIN_DEF_FORMAT_ALLOW_BOOT diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 66dc4e3417b8cb5bce60217a4e529add61149962..ba2bf1f750dcd7f4f25ef3bf55fd63629d3b5222 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1203,6 +1203,7 @@ struct _virDomainNetDef { char *downscript; char *domain_name; /* backend domain name */ char *ifname; /* interface name on the host (<target dev='x'/>) */ + char *tapfdpath; /* Path in /dev for macvtap (<tapfd path="/dev/tapXX">) */ virTristateBool managed_tap; virNetDevIPInfo hostIP; char *ifname_guest_actual; diff --git a/src/hypervisor/domain_interface.c b/src/hypervisor/domain_interface.c index 5bc698d2727e1142e9c5dc30ac00975f268f98e8..37e3d453a03943ee5729ad2d4b087b5e0ca37408 100644 --- a/src/hypervisor/domain_interface.c +++ b/src/hypervisor/domain_interface.c @@ -111,7 +111,7 @@ virDomainInterfaceEthernetConnect(virDomainDef *def, if (virNetDevMacVLanIsMacvtap(net->ifname)) { auditdev = net->ifname; - if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize, &net->tapfdpath) < 0) goto cleanup; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, virDomainInterfaceIsVnetCompatModel(net)) < 0) { diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 1bca9e8daea2cb8f63bcf5c0a735252ff57af6f1..c731b28871b18329e633c42f2141d22063208d9f 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -379,6 +379,7 @@ virLXCProcessSetupInterfaceDirect(virLXCDriver *driver, VIR_NETDEV_VPORT_PROFILE_OP_CREATE, cfg->stateDir, NULL, 0, + &net->tapfdpath, macvlan_create_flags) < 0) return NULL; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 23a23d201aec31a36431646551ae03a233606e30..edc53d53b3b34afbfb8662e809bc0898076fdfc5 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -81,6 +81,7 @@ qemuInterfaceDirectConnect(virDomainDef *def, &res_ifname, vmop, cfg->stateDir, tapfd, tapfdSize, + &net->tapfdpath, macvlan_create_flags) < 0) goto cleanup; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 934acfb46198401d84d47cc6266a9403eda5a3b0..dec271721641c811944f98464cebebca6ed6a159 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -157,6 +157,7 @@ load_profile(virSecurityManager *mgr G_GNUC_UNUSED, if (virDomainDefFormatInternal(def, NULL, &buf, VIR_DOMAIN_DEF_FORMAT_SECURE | + VIR_DOMAIN_DEF_FORMAT_STATUS | VIR_DOMAIN_DEF_FORMAT_VOLUME_TRANSLATED) < 0) return -1; diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index f4ec6b7826ba532f0dbac2dcd4ed89f7f98e6be6..e904d5e8292ae5e7d4acbec2062a91861a9535f5 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1176,6 +1176,11 @@ get_files(vahControl * ctl) vhu->type) != 0) return -1; } + + if (net->tapfdpath) { + if (vah_add_file(&buf, net->tapfdpath, "rwk") != 0) + return -1; + } } for (i = 0; i < ctl->def->nmems; i++) { diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c index cde9d70eefd047dc5c16056f6697cf4d05bc0795..fcf63e08ff07eca22a122a2532cea1b0c9a95c9e 100644 --- a/src/util/virnetdevmacvlan.c +++ b/src/util/virnetdevmacvlan.c @@ -152,24 +152,24 @@ int virNetDevMacVLanDelete(const char *ifname) int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) { int retries = 10; int ret = -1; int ifindex; size_t i = 0; - g_autofree char *tapname = NULL; if (virNetDevGetIndex(ifname, &ifindex) < 0) return -1; - tapname = g_strdup_printf("/dev/tap%d", ifindex); + *tapname = g_strdup_printf("/dev/tap%d", ifindex); for (i = 0; i < tapfdSize; i++) { int fd = -1; while (fd < 0) { - if ((fd = open(tapname, O_RDWR)) >= 0) { + if ((fd = open(*tapname, O_RDWR)) >= 0) { tapfd[i] = fd; } else if (retries-- > 0) { /* may need to wait for udev to be done */ @@ -178,7 +178,7 @@ virNetDevMacVLanTapOpen(const char *ifname, /* However, if haven't succeeded, quit. */ virReportSystemError(errno, _("cannot open macvtap tap device %1$s"), - tapname); + *tapname); goto cleanup; } } @@ -188,6 +188,7 @@ virNetDevMacVLanTapOpen(const char *ifname, cleanup: if (ret < 0) { + g_free(*tapname); while (i--) VIR_FORCE_CLOSE(tapfd[i]); } @@ -659,6 +660,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) { g_autofree char *ifname = NULL; @@ -729,7 +731,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, } if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { - if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize, tapfdpath) < 0) goto disassociate_exit; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, vnet_hdr) < 0) @@ -888,7 +890,8 @@ int virNetDevMacVLanDelete(const char *ifname G_GNUC_UNUSED) int virNetDevMacVLanTapOpen(const char *ifname G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, - size_t tapfdSize G_GNUC_UNUSED) + size_t tapfdSize G_GNUC_UNUSED, + char **tapname G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Cannot create macvlan devices on this platform")); @@ -917,6 +920,7 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname G_GNUC_UNUSED, char *stateDir G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, size_t tapfdSize G_GNUC_UNUSED, + char **tapfdpath G_GNUC_UNUSED, unsigned int unused_flags G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h index 31e4804cdc0d7c4beb74ba66d204d0ff7ad83151..7424b8796529d6c6d1909eee81c88e8ded0ea84b 100644 --- a/src/util/virnetdevmacvlan.h +++ b/src/util/virnetdevmacvlan.h @@ -72,13 +72,15 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(6) ATTRIBUTE_NONNULL(8) ATTRIBUTE_NONNULL(10) G_GNUC_WARN_UNUSED_RESULT; int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; --- base-commit: 74fc02d792f7ee55d2e0a7b9ad4e6d751c36ceb8 change-id: 20260105-apparmor-races-d03238ee4d93 Best regards, -- Wesley Hershberger <wesley.hershberger(a)canonical.com>

1 1

[libvirt PATCH] tests: properly mock VFIO and IOMMU checks
by Pavel Hrdina 16 Feb '26

16 Feb '26

Fixes: 63434db800b921e96fec424a667b7161af1f02de Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- Pushed as tests breaker. src/util/virutil.h | 2 +- tests/domaincapsdata/qemu_9.0.0.sparc.xml | 5 +---- tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml | 5 +---- tests/domaincapsmock.c | 10 ++++++++++ tests/domaincapstest.c | 8 -------- 5 files changed, 13 insertions(+), 17 deletions(-) diff --git a/src/util/virutil.h b/src/util/virutil.h index ca6fd95363..7e1705e7ce 100644 --- a/src/util/virutil.h +++ b/src/util/virutil.h @@ -141,7 +141,7 @@ unsigned long long virMemoryLimitTruncate(unsigned long long value); bool virMemoryLimitIsSet(unsigned long long value); unsigned long long virMemoryMaxValue(bool ulong) ATTRIBUTE_MOCKABLE; -bool virHostHasIOMMU(void); +bool virHostHasIOMMU(void) ATTRIBUTE_MOCKABLE; char *virHostGetDRMRenderNode(void) ATTRIBUTE_MOCKABLE; diff --git a/tests/domaincapsdata/qemu_9.0.0.sparc.xml b/tests/domaincapsdata/qemu_9.0.0.sparc.xml index 062e55718b..93d8d40c2c 100644 --- a/tests/domaincapsdata/qemu_9.0.0.sparc.xml +++ b/tests/domaincapsdata/qemu_9.0.0.sparc.xml @@ -86,10 +86,7 @@ <value>scsi</value> </enum> <enum name='capsType'/> - <enum name='pciBackend'> - <value>default</value> - <value>vfio</value> - </enum> + <enum name='pciBackend'/> <enum name='iommufd'> <value>no</value> </enum> diff --git a/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml b/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml index db51e7b120..a65d9d36fd 100644 --- a/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml +++ b/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml @@ -147,10 +147,7 @@ <value>scsi</value> </enum> <enum name='capsType'/> - <enum name='pciBackend'> - <value>default</value> - <value>vfio</value> - </enum> + <enum name='pciBackend'/> <enum name='iommufd'> <value>no</value> </enum> diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c index 370ce35709..aa13deb324 100644 --- a/tests/domaincapsmock.c +++ b/tests/domaincapsmock.c @@ -21,6 +21,7 @@ #include "virhostmem.h" #include "viriommufd.h" #include "virmock.h" +#include "virutil.h" #if WITH_QEMU # include "qemu/qemu_capabilities.h" @@ -91,5 +92,14 @@ virFileExists(const char *path) if (STREQ(path, VIR_IOMMU_DEV_PATH)) return true; + if (STREQ(path, "/dev/vfio/vfio")) + return true; + return real_virFileExists(path); } + +bool +virHostHasIOMMU(void) +{ + return true; +} diff --git a/tests/domaincapstest.c b/tests/domaincapstest.c index 71e181d179..5b2fc80f0a 100644 --- a/tests/domaincapstest.c +++ b/tests/domaincapstest.c @@ -104,14 +104,6 @@ fillQemuCaps(virDomainCaps *domCaps, false) < 0) return -1; - /* The function above tries to query host's VFIO capabilities by calling - * virHostdevHostSupportsPassthroughVFIO() which, however, can't be - * successfully mocked as they are not exposed as internal APIs. Therefore, - * instead of mocking set the expected values here by hand. */ - VIR_DOMAIN_CAPS_ENUM_SET(domCaps->hostdev.pciBackend, - VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_DEFAULT, - VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO); - /* As of f05b6a918e28 we are expecting to see OVMF_CODE.fd file which * may not exists everywhere. */ while (loader->values.nvalues) -- 2.53.0

1 0

[libvirt PATCH 00/24] IOMMUFD fixes and hotplug support
by Pavel Hrdina 16 Feb '26

16 Feb '26

Fix some FD leaks in the code, code refactor and improvements as preparation for implementing hotplug support. Add domain capability to report if IOMMUFD is supported. Pavel Hrdina (24): qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD qemu: Move IOMMUFD validation to qemu_validate util: Move openning IOMMU device to viriommufd qemu_process: Refactor qemuProcessOpenIommuFd util: Move openning VFIO device to virpci qemu_process: Refactor qemuProcessOpenVfioDeviceFd util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD qemu_domain: Add missing IOMMUFD cleanup qemu_process: Fix FD leak with multiple host devices using IOMMUFD qemu_process: Refactor qemuProcessOpenVfioFds qemuxmlconftest: Refactor host device preparation qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData qemuxmlconftest: Set fake FD for IOMMUFD qemu: Convert IOMMUFD to qemuFDPassDirect qemu: Convert vfioDeviceFd to qemuFDPassDirect qemu_command: Don't use host property if IOMMUFD is used qemu: Save IOMMUFD state into status XML qemu_hotplug: Remove iommufd object if no longer needed qemu_command: Extract building IOMMUFD props to function qemu_hotplug: Add support to hotplug host device with IOMMUFD conf: Introduce iommufd enum for domaincaps qemu: Fill iommufd domain capability docs/formatdomaincaps.rst | 7 ++ src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 29 +++++ src/conf/domain_conf.h | 6 + src/libvirt_private.syms | 6 +- src/qemu/qemu_capabilities.c | 23 +++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 86 ++++++-------- src/qemu/qemu_command.h | 3 + src/qemu/qemu_domain.c | 14 ++- src/qemu/qemu_domain.h | 5 +- src/qemu/qemu_hotplug.c | 47 ++++++++ src/qemu/qemu_process.c | 111 ++++++------------ src/qemu/qemu_process.h | 3 + src/qemu/qemu_validate.c | 15 +++ src/security/security_apparmor.c | 2 +- src/security/security_dac.c | 4 +- src/security/security_selinux.c | 4 +- src/util/viriommufd.c | 35 +++++- src/util/viriommufd.h | 4 +- src/util/virpci.c | 40 ++++++- src/util/virpci.h | 4 +- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 4 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 4 + .../qemu_10.0.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 4 + .../qemu_10.0.0.x86_64+amdsev.xml | 4 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 4 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 4 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 4 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 4 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 4 + .../qemu_10.1.0.x86_64+inteltdx.xml | 4 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 4 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 4 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 4 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 4 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 4 + .../qemu_10.2.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 4 + .../qemu_10.2.0.x86_64+mshv.xml | 4 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 4 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 4 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 4 + .../qemu_11.0.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 4 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 4 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 3 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 3 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 3 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 3 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 3 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 3 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 3 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 3 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 3 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 3 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 3 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 3 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 4 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 3 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 4 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 4 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 3 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 4 + .../qemu_9.1.0-virt.riscv64.xml | 3 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 4 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 4 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 4 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 4 + .../qemu_9.2.0.x86_64+amdsev.xml | 4 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 4 + tests/domaincapsmock.c | 17 ++- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + .../iommufd-q35.x86_64-latest.args | 4 +- ...fd-virt-pci-bus-single.aarch64-latest.args | 4 +- .../iommufd-virt.aarch64-latest.args | 6 +- .../iommufd.x86_64-latest.args | 4 +- tests/qemuxmlconftest.c | 100 +++++++++------- 129 files changed, 694 insertions(+), 199 deletions(-) -- 2.53.0

2 25

[PATCH] scripts: avoid matching 'char **' as string for systemtap
by Daniel P. Berrangé 16 Feb '26

16 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> When a probe argument is declared "char *" we reference the userspace string value using 'user_string(...)' for systemtap. Unfortunately our code generator also matches on args declared "char **" and generates bogus code *cert = user_string($arg4); which is a syntax error for systemtap. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- scripts/dtrace2systemtap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/dtrace2systemtap.py b/scripts/dtrace2systemtap.py index 506db9c503..361dab1075 100755 --- a/scripts/dtrace2systemtap.py +++ b/scripts/dtrace2systemtap.py @@ -124,7 +124,7 @@ for file in filelist: for idx in range(len(argbits)): arg = argbits[idx] isstr = False - if 'char *' in arg: + if re.match(r'''.*char\s\*[^\*].*''', arg) is not None: isstr = True m = re.search(r'''^.*\s\*?(\S+)$''', arg) -- 2.53.0

2 1

[PATCH v4 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 16 Feb '26

16 Feb '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename generic names to virNWFilter* and CamelCase nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 671 +-- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2518 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 55 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 310 ++ .../ah-linux.nftables.args | 304 ++ .../all-ipv6-linux.nftables.args | 292 ++ .../all-linux.nftables.args | 286 ++ .../arp-linux.nftables.args | 231 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 510 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 310 ++ .../esp-linux.nftables.args | 304 ++ .../example-1-linux.nftables.args | 268 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 384 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 256 ++ .../icmpv6-linux.nftables.args | 328 ++ .../igmp-linux.nftables.args | 304 ++ .../ip-linux.nftables.args | 205 + .../ipt-no-macspoof-linux.nftables.args | 172 + .../ipv6-linux.nftables.args | 511 +++ .../iter1-linux.nftables.args | 304 ++ .../iter2-linux.nftables.args | 3760 +++++++++++++++++ .../iter3-linux.nftables.args | 430 ++ .../mac-linux.nftables.args | 184 + .../rarp-linux.nftables.args | 231 + .../sctp-ipv6-linux.nftables.args | 328 ++ .../sctp-linux.nftables.args | 328 ++ .../target-linux.nftables.args | 466 ++ .../target2-linux.nftables.args | 322 ++ .../tcp-ipv6-linux.nftables.args | 328 ++ .../tcp-linux.nftables.args | 476 +++ .../udp-ipv6-linux.nftables.args | 328 ++ .../udp-linux.nftables.args | 328 ++ .../udplite-ipv6-linux.nftables.args | 310 ++ .../udplite-linux.nftables.args | 304 ++ .../vlan-linux.nftables.args | 271 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 59 files changed, 19320 insertions(+), 569 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 15

[PATCH 0/5] conf: Add firmwareFeatures element for domaincaps
by Andrea Bolognani 13 Feb '26

13 Feb '26

This is primarily intended to as a companion to my series that makes it possible to use Secure Boot on aarch64[1], but I'm posting it separately because it's independently useful and could be pushed before it. Depending on which one of the two series is merged first, some minor conflict resolution will need to be applied to the other. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… Andrea Bolognani (5): schema: Add firmwareFeatures element for domaincaps conf: Add firmwareFeatures element for domaincaps qemu: Fill in firmwareFeature element for domaincaps docs: Document firmwareFeature element for domaincaps news: Mention firmwareFeatures element for domaincaps NEWS.rst | 7 +++ docs/formatdomaincaps.rst | 51 +++++++++++++++++++ src/conf/domain_capabilities.c | 15 ++++++ src/conf/domain_capabilities.h | 8 +++ src/conf/schemas/domaincaps.rng | 12 +++++ src/qemu/qemu_capabilities.c | 21 +++++++- src/qemu/qemu_firmware.c | 28 +++++++++- src/qemu/qemu_firmware.h | 2 + .../qemu_10.0.0-q35.x86_64+amdsev.xml | 10 ++++ .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 10 ++++ .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 8 +++ .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 8 +++ .../qemu_10.0.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 4 ++ .../qemu_10.0.0.x86_64+amdsev.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 8 +++ .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 10 ++++ .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 10 ++++ .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 8 +++ .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_10.1.0.s390x.xml | 4 ++ .../qemu_10.1.0.x86_64+inteltdx.xml | 8 +++ tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 8 +++ .../qemu_10.2.0-q35.x86_64+mshv.xml | 10 ++++ .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 10 ++++ .../qemu_10.2.0-tcg.x86_64+mshv.xml | 8 +++ .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 8 +++ .../qemu_10.2.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 8 +++ .../qemu_10.2.0.x86_64+mshv.xml | 8 +++ tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 8 +++ .../qemu_11.0.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 8 +++ .../qemu_7.2.0-hvf.x86_64+hvf.xml | 8 +++ .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 10 ++++ .../qemu_7.2.0-tcg.x86_64+hvf.xml | 8 +++ .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.2.0.ppc.xml | 4 ++ tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_8.1.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 10 ++++ .../qemu_8.2.0-tcg-virt.loongarch64.xml | 8 +++ .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 8 +++ .../qemu_8.2.0-virt.aarch64.xml | 8 +++ .../qemu_8.2.0-virt.loongarch64.xml | 8 +++ tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 4 ++ tests/domaincapsdata/qemu_8.2.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_9.0.0.sparc.xml | 4 ++ tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 10 ++++ .../qemu_9.1.0-tcg-virt.riscv64.xml | 8 +++ .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 8 +++ .../qemu_9.1.0-virt.riscv64.xml | 8 +++ tests/domaincapsdata/qemu_9.1.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 8 +++ .../qemu_9.2.0-hvf.aarch64+hvf.xml | 8 +++ .../qemu_9.2.0-q35.x86_64+amdsev.xml | 10 ++++ .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 10 ++++ .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 8 +++ .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_9.2.0.s390x.xml | 4 ++ .../qemu_9.2.0.x86_64+amdsev.xml | 8 +++ tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 8 +++ tests/qemufirmwaretest.c | 7 ++- 91 files changed, 786 insertions(+), 5 deletions(-) -- 2.53.0

2 6

[PATCH 0/9] qemu: add support for block latency histogram collection
by Peter Krempa 13 Feb '26

13 Feb '26

This patchset introduces configuration of the block latency histogram feature in qemu as well as exposes the histograms via bulk domain stats. The feature was in qemu for a long time so no capabilities are needed. Peter Krempa (9): qemu: Extract disk setup done via QMP into a separate helper qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' Expose latency histograms via 'virConnectGetAllDomainStats' qemu: monitor: Add handlers for 'block-latency-histogram-set' docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element docs: formatdomain: Reword section about the '<statistics>' element under disk driver Introduce support for disk operation latency histogram collection qemu: Setup disk latency histograms on startup/hotplug/update docs/formatdomain.rst | 77 ++++++++-- docs/manpages/virsh.rst | 7 + include/libvirt/libvirt-domain.h | 113 +++++++++++++++ src/conf/domain_conf.c | 133 +++++++++++++++++- src/conf/domain_conf.h | 7 + src/conf/schemas/domaincommon.rng | 37 ++++- src/qemu/qemu_domain.c | 17 +++ src/qemu/qemu_domain.h | 3 + src/qemu/qemu_driver.c | 43 ++++++ src/qemu/qemu_hotplug.c | 52 ++++--- src/qemu/qemu_monitor.c | 41 ++++++ src/qemu/qemu_monitor.h | 27 ++++ src/qemu/qemu_monitor_json.c | 115 +++++++++++++++ src/qemu/qemu_monitor_json.h | 9 ++ src/qemu/qemu_process.c | 63 ++++++--- src/qemu/qemu_process.h | 3 + tests/qemumonitorjsontest.c | 9 ++ ...isk-statistics-intervals.x86_64-latest.xml | 29 ++++ .../disk-statistics-intervals.xml | 25 ++++ 19 files changed, 748 insertions(+), 62 deletions(-) -- 2.52.0

2 11

[PATCH 0/2] Extend hyperv host-model mode
by Michal Privoznik 13 Feb '26

13 Feb '26

Turns out, KubeVirt wants host-model mode for hyperv enlightenments to allow finer control over each enlightenment. For instance, set different number of spinlock than QEMU's default. Fair enough. Michal Prívozník (2): conf: Parse hyperv features even for host-model qemu: Wire up new hyperv host-model mode behavior docs/formatdomain.rst | 3 +++ src/conf/domain_conf.c | 3 +-- src/conf/schemas/domaincommon.rng | 8 +++---- src/qemu/qemu_process.c | 24 ++++++++++++------- .../hyperv-host-model.x86_64-latest.args | 2 +- .../hyperv-host-model.x86_64-latest.xml | 6 ++++- tests/qemuxmlconfdata/hyperv-host-model.xml | 6 ++++- 7 files changed, 35 insertions(+), 17 deletions(-) -- 2.52.0

3 6

[PATCH] util: remove duplicate logging of firewall command
by Daniel P. Berrangé 12 Feb '26

12 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> The vircommand.c code will always log the argv about to be run, so logging it again in virfirewall.c is redundant. Removing the dupe avoids the repeated memory allocation from the array -> string conversion. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virfirewall.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c index 69521e2b46..a64f8b69c7 100644 --- a/src/util/virfirewall.c +++ b/src/util/virfirewall.c @@ -571,7 +571,6 @@ virFirewallCmdIptablesApply(virFirewall *firewall, VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK); bool needRollback = false; g_autoptr(virCommand) cmd = NULL; - g_autofree char *cmdStr = NULL; g_autofree char *error = NULL; size_t i; int status; @@ -607,9 +606,6 @@ virFirewallCmdIptablesApply(virFirewall *firewall, virCommandAddArg(cmd, fwCmd->args[i]); } - cmdStr = virCommandToString(cmd, false); - VIR_INFO("Running firewall command '%s'", NULLSTR(cmdStr)); - virCommandSetOutputBuffer(cmd, output); virCommandSetErrorBuffer(cmd, &error); @@ -622,6 +618,7 @@ virFirewallCmdIptablesApply(virFirewall *firewall, VIR_DEBUG("Ignoring error running command"); return 0; } else { + g_autofree char *cmdStr = virCommandToString(cmd, false); virReportError(VIR_ERR_INTERNAL_ERROR, _("Failed to run firewall command %1$s: %2$s"), NULLSTR(cmdStr), NULLSTR(error)); @@ -671,7 +668,6 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED, size_t cmdIdx = 0; const char *objectType = NULL; g_autoptr(virCommand) cmd = NULL; - g_autofree char *cmdStr = NULL; g_autofree char *error = NULL; size_t i; int status; @@ -727,9 +723,6 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED, for (i = 0; i < fwCmd->argsLen; i++) virCommandAddArg(cmd, fwCmd->args[i]); - cmdStr = virCommandToString(cmd, false); - VIR_INFO("Applying '%s'", NULLSTR(cmdStr)); - virCommandSetOutputBuffer(cmd, output); virCommandSetErrorBuffer(cmd, &error); @@ -745,6 +738,7 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED, } else if (fwCmd->ignoreErrors) { VIR_DEBUG("Ignoring error running command"); } else { + g_autofree char *cmdStr = virCommandToString(cmd, false); virReportError(VIR_ERR_INTERNAL_ERROR, _("Failed to apply firewall command '%1$s': %2$s"), NULLSTR(cmdStr), NULLSTR(error)); @@ -776,6 +770,7 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED, } if (!handleLen) { + g_autofree char *cmdStr = virCommandToString(cmd, false); virReportError(VIR_ERR_INTERNAL_ERROR, _("couldn't register rollback command - command '%1$s' had no valid handle in output ('%2$s')"), NULLSTR(cmdStr), NULLSTR(*output)); -- 2.53.0

3 6

[PATCH v2 0/4] hyperv: Implement virDomainInterfaceAddresses()
by Michal Privoznik 12 Feb '26

12 Feb '26

v2 of: diff to v1: - In 2/4 document corner case behavior of virSocketAddrSubnetToPrefix, - In 2/4 make the test report actual and expected values, - In 4/4 fix a possible mem leak if hypervDomainInterfaceAddressesParseOne() fails Michal Prívozník (4): datatypes: Declare autofree func for virDomainInterface type virsocketaddr: Introduce virSocketAddrSubnetToPrefix() hyperv: Move MAC parsing into a separate function hyperv: Implement virDomainInterfaceAddresses() src/datatypes.h | 2 + src/hyperv/hyperv_driver.c | 226 +++++++++++++++++++++++--- src/hyperv/hyperv_wmi_generator.input | 12 ++ src/libvirt_private.syms | 1 + src/util/virsocketaddr.c | 53 ++++++ src/util/virsocketaddr.h | 2 + tests/sockettest.c | 33 ++++ 7 files changed, 304 insertions(+), 25 deletions(-) -- 2.52.0

2 5

Re: [PATCH v2 00/21] qom: introduce property flags to track external user input
by BALATON Zoltan 12 Feb '26

12 Feb '26

On Wed, 11 Feb 2026, Zhao Liu wrote: >> So another way could be to not use properties for internal settings but add >> another set of internal properties for those. These could be set the same >> way but stored in a different hash table and not get mixed with >> introspectable and user changable properties. But maybe that would be too >> much refactoring. > > Yes, it may require adding interfaces similar to object_property_add/get/ > set, which would need significant changes. Maybe not that part needs significant changes as you could still use a flag the same way adding a parameter to object_property_add/get/set to tell it should put the propery in the internal hash but then you need to add the other hash and maybe related changes. I don't know how much would those be but no new interface is needed just extending existing one as you did already. Regards, BALATON Zoltan

2 1

[PATCH 00/20] qemu: Optimize calls to 'query-block'
by Peter Krempa 12 Feb '26

12 Feb '26

We call query-block on each start of a VM but as it turns out there isn't much information that we actually probe from it. This series: - refactors 'query-block' use - removes unneeded calls - adds support for upcoming more optimal mode (RFC) Patches 19 and 20 are RFC as the qemu patches weren't accepted yet. I'll post them also separately with a capability dump update once that hits upstream. Peter Krempa (20): qemuDomainDiskInfo: Drop 'nodename' field qemu: Remove 'removable' field from 'qemuDomainDiskPrivate' qemuProcessRefreshDiskProps: Drop code to remove disk source qemu: Drop 'empty' filed from 'qemuDomainDiskInfo' qemuMigrationSrcBegin: Drop disk refresh step qemu: process: Unexport 'qemuProcessRefreshDisks' qemu: Drop 'removable' field from 'qemuDomainDiskInfo' qemuMonitorJSONHandleMigrationStatus: Simplify error case qemu: monitor: Add test validating that 'eventHandlers' are properly sorted qemuMonitorJSONHandleMemoryFailure: Simplify error case and value extraction qemuMonitorJSONGetBlockInfo: Don't fail if 'io-status' field gets new values qemuDomainDiskInfo: Use proper type for 'io_status' conf: domain: Add VIR_DOMAIN_DISK_TRAY_NONE state for devices without tray qemuDomainDiskPrivate: Remove unused 'tray' field qemuDomainAttachDiskGeneric: Avoid unneeded disk property refresh after hotplug qemu: Refactor tray_status handling qemuProcessUpdateVideoRamSize: Remove 'driver' argument and adjust callers qemuProcessRefreshDisks: Don't bother to refresh disks on cold boot qemu: capabilities: Introduce QEMU_CAPS_QUERY_BLOCK_FLAT qemu: monitor: Use 'flat' mode of 'query-block' src/conf/domain_conf.c | 17 +++- src/conf/domain_conf.h | 3 +- src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_domain.h | 12 +-- src/qemu/qemu_driver.c | 10 +-- src/qemu/qemu_hotplug.c | 18 ++-- src/qemu/qemu_migration.c | 12 +-- src/qemu/qemu_monitor.c | 44 +-------- src/qemu/qemu_monitor.h | 3 - src/qemu/qemu_monitor_json.c | 149 ++++++++++++++++++++----------- src/qemu/qemu_monitor_json.h | 3 + src/qemu/qemu_monitor_priv.h | 3 + src/qemu/qemu_process.c | 167 +++++++++++++++++------------------ src/qemu/qemu_process.h | 9 +- src/qemu/qemu_saveimage.c | 2 +- tests/qemuhotplugtest.c | 38 +++----- tests/qemumonitorjsontest.c | 31 +++++-- 18 files changed, 254 insertions(+), 270 deletions(-) -- 2.53.0

2 28

[PATCH] In virFDStreamRead(), fill buffer from this and next messages
by Erik Hulsmann 12 Feb '26

12 Feb '26

Before this change, buffers returned from virFDStreamRead() would alternate in size (262120 and 24), because it only consumed the bytes remaining from the current background thread message. As the background thread reads 262144 bytes (256kB) of data in each chunk, where the maximum size returned from virFDStreamRead() to be transferred over the remote protocol is only 262120, 24 bytes would be left in the buffer on each iteration. The next iteration leaves 24 bytes, which used to be returned without considering messages waiting in the queue. Signed-off-by: Erik Huelsmann <ehuels(a)gmail.com> --- src/util/virfdstream.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/util/virfdstream.c b/src/util/virfdstream.c index 26a1f00..4c974ba 100644 --- a/src/util/virfdstream.c +++ b/src/util/virfdstream.c @@ -905,7 +905,10 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) if (fdst->thread) { virFDStreamMsg *msg = NULL; + size_t got = 0; + size_t bsz = 0; + more: while (!(msg = fdst->msg)) { if (fdst->threadQuit || fdst->threadErr) { if (nbytes) { @@ -917,7 +920,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) virReportSystemError(EBADF, "%s", _("stream is not open")); } else { - ret = 0; + ret = got; } goto cleanup; } else { @@ -931,7 +934,7 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) * return 0 immediately. */ if (msg->type == VIR_FDSTREAM_MSG_TYPE_HOLE && msg->stream.hole.len == 0) { - ret = 0; + ret = got; goto cleanup; } @@ -942,21 +945,26 @@ static int virFDStreamRead(virStreamPtr st, char *bytes, size_t nbytes) goto cleanup; } - if (nbytes > msg->stream.data.len - msg->stream.data.offset) - nbytes = msg->stream.data.len - msg->stream.data.offset; + bsz = msg->stream.data.len - msg->stream.data.offset; + if (nbytes < bsz) + bsz = nbytes; - memcpy(bytes, + memcpy(bytes + got, msg->stream.data.buf + msg->stream.data.offset, - nbytes); + bsz); + got += bsz; + nbytes -= bsz; - msg->stream.data.offset += nbytes; + msg->stream.data.offset += bsz; if (msg->stream.data.offset == msg->stream.data.len) { virFDStreamMsgQueuePop(fdst, fdst->fd, "pipe"); virFDStreamMsgFree(msg); } - ret = nbytes; - + ret = got; + if (nbytes > 0) { + goto more; + } } else { retry: ret = read(fdst->fd, bytes, nbytes); -- 2.43.0

2 3

[PATCH] network: add comment to table that it belongs to libvirt
by Daniel P. Berrangé 12 Feb '26

12 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> The result looks like $ nft list ruleset ...snip... table ip6 libvirt_network { comment "Managed by libvirt for virtual networks: https://libvirt.org/firewall.html#the-virtual-network-driver" chain forward { ...snip... This should reduce the number of people wondering why these rules exists. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/network/network_nftables.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c index cffe8072f5..cd46ff8d83 100644 --- a/src/network/network_nftables.c +++ b/src/network/network_nftables.c @@ -61,6 +61,10 @@ VIR_LOG_INIT("network.nftables"); #define VIR_NFTABLES_PRIVATE_TABLE "libvirt_network" +#define VIR_NFTABLES_COMMENT \ + "{ comment \"Managed by libvirt for virtual networks: " \ + "https://libvirt.org/firewall.html#the-virtual-network-driver\"; }" + /* nftables backend uses the same binary (nft) for all layers, but * IPv4 and IPv6 have their rules in separate classes of tables, * either "ip" or "ip6". (there is also an "inet" class of tables that @@ -165,7 +169,9 @@ nftablesPrivateChainCreate(virFirewall *fw, if (!tableMatch) { virFirewallAddCmd(fw, layer, "add", "table", - layerStr, VIR_NFTABLES_PRIVATE_TABLE, NULL); + layerStr, VIR_NFTABLES_PRIVATE_TABLE, + VIR_NFTABLES_COMMENT, + NULL); } for (i = 0; i < data->nchains; i++) { -- 2.53.0

3 2

[PATCH v3 0/1] bhyve: improve loader handling on arm64
by Roman Bogorodskiy 12 Feb '26

12 Feb '26

Changes from v2: - Incorporate changes from Michal - Update *.aug{.in} files - Drop patch 2/2 with DATADIR substitution in bhyve.conf Roman Bogorodskiy (1): bhyve: improve loader handling on arm64 src/bhyve/bhyve.conf | 5 ++++ src/bhyve/bhyve_conf.c | 8 +++++++ src/bhyve/bhyve_domain.c | 23 +++++++++++++++++++ src/bhyve/bhyve_utils.h | 2 ++ src/bhyve/libvirtd_bhyve.aug | 3 ++- src/bhyve/test_libvirtd_bhyve.aug.in | 1 + .../aarch64/bhyvexml2argv-base.args | 1 + .../aarch64/bhyvexml2argv-base.ldargs | 8 +------ .../aarch64/bhyvexml2argv-console.args | 1 + .../aarch64/bhyvexml2argv-console.ldargs | 8 +------ tests/bhyvexml2argvmock.c | 20 +++++++++++++++- tests/bhyvexml2argvtest.c | 2 ++ .../aarch64/bhyvexml2xmlout-base.xml | 1 + .../aarch64/bhyvexml2xmlout-console.xml | 1 + tests/bhyvexml2xmltest.c | 7 ++++++ 15 files changed, 75 insertions(+), 16 deletions(-) -- 2.52.0

2 2

[PATCH 1/2] bhyve: do not use deprecated IOAPIC option
by Roman Bogorodskiy 12 Feb '26

12 Feb '26

The '-I' flag for enabling IOAPIC was deprecated long ago in bhyve: https://cgit.freebsd.org/src/commit/?id=a1a4cbea587a6e201e07dc121268f3e559e… And IOAPIC is provided unconditionally since then. As no supported FreeBSD versions require that now, simply drop this flag. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index a45a5d1c33..97a483d9a5 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -953,8 +953,6 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, /* Options */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON) virCommandAddArg(cmd, "-A"); /* Create an ACPI table */ - if (def->features[VIR_DOMAIN_FEATURE_APIC] == VIR_TRISTATE_SWITCH_ON) - virCommandAddArg(cmd, "-I"); /* Present ioapic to the guest */ if (def->features[VIR_DOMAIN_FEATURE_MSRS] == VIR_TRISTATE_SWITCH_ON) { if (def->msrs_features[VIR_DOMAIN_MSRS_UNKNOWN] == VIR_DOMAIN_MSRS_UNKNOWN_IGNORE) virCommandAddArg(cmd, "-w"); -- 2.52.0

2 4

[PATCH v2 0/4] qemu: Add support for control of persistent reservation migration
by Peter Krempa 12 Feb '26

12 Feb '26

Add support for migration of persistent reservations. The qemu support was just merged in. Patches 1 and 2 are new, patch 3 is rebased on top of new capability, patch 4 is identical to the RFC version. Peter Krempa (4): qemucapabilitiestest: Update 'caps_11.0.0_x86_64' to 'v10.2.0-1114-gb3abdfa486' qemucapabilitiestest: Update 'caps_11.0.0_aarch64' to t'v10.2.0-1114-gb3abdfa486' qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR qemu: Implement support for persistent reservation migration control docs/formatdomain.rst | 3 + src/conf/domain_conf.c | 21 + src/conf/schemas/storagecommon.rng | 5 + src/conf/storage_source_conf.c | 10 + src/conf/storage_source_conf.h | 2 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 4 + src/qemu/qemu_validate.c | 16 + .../caps_11.0.0_aarch64.replies | 3631 +++++++++-------- .../caps_11.0.0_aarch64.xml | 9 +- .../caps_11.0.0_x86_64.replies | 3557 ++++++++-------- .../caps_11.0.0_x86_64.xml | 11 +- ...irtio-scsi-reservations.x86_64-latest.args | 2 +- .../disk-virtio-scsi-reservations.xml | 2 +- 15 files changed, 3681 insertions(+), 3599 deletions(-) -- 2.53.0

2 5

[PATCH v3 0/4] Add multitouch input device support
by Julio Faracco 12 Feb '26

12 Feb '26

This patch series implements support for multitouch input devices in libvirt, addressing the multitouch feature request in [1]. In this third version, all the commits compile and have the test passed independently. This version includes docs updates too. They are logically separated in: 1. Domain enums, qemu, security, and capabilities updates. 2. Domain schema update. 3. Domain format doc update. 4. Test cases updates for multitouch support. [1] https://gitlab.com/libvirt/libvirt/-/issues/808 Julio Faracco (4): Add support for virtio-multitouch input devices conf: Add multitouch to domain schema docs: Add multitouch input type information tests: Add multitouch support to virtio-input tests docs/formatdomain.rst | 13 ++++++++----- src/conf/domain_audit.c | 1 + src/conf/domain_conf.c | 2 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 9 +++++++++ src/conf/schemas/domaincommon.rng | 1 + src/qemu/qemu_capabilities.c | 5 +++++ src/qemu/qemu_capabilities.h | 3 +++ src/qemu/qemu_command.c | 5 +++++ src/qemu/qemu_validate.c | 5 +++++ src/security/security_dac.c | 2 ++ src/security/security_selinux.c | 2 ++ tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_10.0.0_ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml | 1 + tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml | 1 + .../qemucapabilitiesdata/caps_8.2.0_loongarch64.xml | 1 + tests/qemucapabilitiesdata/caps_8.2.0_s390x.xml | 1 + tests/qemucapabilitiesdata/caps_8.2.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml | 1 + tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml | 1 + .../qemuxmlconfdata/virtio-input.x86_64-latest.args | 1 + .../qemuxmlconfdata/virtio-input.x86_64-latest.xml | 3 +++ tests/qemuxmlconfdata/virtio-input.xml | 1 + 43 files changed, 77 insertions(+), 5 deletions(-) -- 2.52.0

1 4

[PATCH 0/4] hyperv: Implement virDomainInterfaceAddresses()
by Michal Privoznik 12 Feb '26

12 Feb '26

*** BLURB HERE *** Michal Prívozník (4): datatypes: Declare autofree func for virDomainInterface type virsocketaddr: Introduce virSocketAddrSubnetToPrefix() hyperv: Move MAC parsing into a separate function hyperv: Implement virDomainInterfaceAddresses() src/datatypes.h | 2 + src/hyperv/hyperv_driver.c | 228 +++++++++++++++++++++++--- src/hyperv/hyperv_wmi_generator.input | 12 ++ src/libvirt_private.syms | 1 + src/util/virsocketaddr.c | 51 ++++++ src/util/virsocketaddr.h | 2 + tests/sockettest.c | 29 ++++ 7 files changed, 300 insertions(+), 25 deletions(-) -- 2.52.0

4 14

[PATCH v5 00/24] util: sync error_report & qemu_log output more closely
by Daniel P. Berrangé 12 Feb '26

12 Feb '26

This series is a tangent that came out of discussion in https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00903.html In thinking about adding thread info to error_report, I came to realize we should likely make qemu_log behave consistently with error_report & friends. We already honour '-msg timestamp=on', but don't honour 'guest-name=on' and also don't include the binary name. As an example of the current state, consider mixing error and log output today: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55ac6d97f700 dir=fish qcrypto_tls_creds_get_path TLS creds path creds=0x55ac6d97f700 filename=ca-cert.pem path=<none> qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:14:16.791413Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55e9a3458d10 dir=fish 2025-08-19T20:14:16.791429Z qcrypto_tls_creds_get_path TLS creds path creds=0x55e9a3458d10 filename=ca-cert.pem path=<none> 2025-08-19T20:14:16.791433Z fish food qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory And after this series is complete: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qemu-system-x86_64(1184284:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55a24ad5cb30 dir=fish qemu-system-x86_64(1184284:main): qcrypto_tls_creds_get_path TLS creds path creds=0x55a24ad5cb30 filename=ca-cert.pem path=<none> qemu-system-x86_64(1184284:main): Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:12:50.211823Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x5582183d8760 dir=fish 2025-08-19T20:12:50.211842Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_get_path TLS creds path creds=0x5582183d8760 filename=ca-cert.pem +path=<none> 2025-08-19T20:12:50.211846Z [fish food] qemu-system-x86_64(1168876:main): Unable to access credentials fish/ca-cert.pem: No such file or directory The main things to note: * error_report/warn_report/qemu_log share the same output format and -msg applies to both * -msg debug-threads=on is now unconditionally enabled and thus the param is deprecated & ignored * Thread ID and name are unconditionally enabled * Guest name is surrounded in [...] brackets * The default output lines are typically 15 chars wider given that we always include the thread ID + name now * This takes the liberty of assigning the new file to the existing error-report.c maintainer (Markus) Since splitting it off into message.c instead of putting it all in error-report.c felt slightly nicer. One thing I didn't tackle is making the location info get reported for qemu_log. This is used to give context for error messages when parsing some CLI args, and could be interesting for log messages associated with those same CLI args. Changes in v5: - Remove redundant [] around values in qemu-options.hx - Use g_strlcpy instead of strlcpy - Remove redundant !! around a value that was already bool - Improve the qemu_lock_trylock() API docs to encourage use of fprintf() instead of further qemu_log() calls - Add a qemu_log_trylock_context() counterpart for qemu_log_trylock that includes the message context - Don't scan for \n to determine whether we can output a message context prefix or not. Instead track call depth on qemu_log_trylock() and only output it when the depth was initially zero. This fixes linux-user -strace output formatting which was mangled by v4 - Use fprintf(stderr) instead of error_printf_mon in cases where mon would be NULL - Use fputs/fputc in simple cases where we don't need the full power of fprintf - Use qemu_f{un}lockfile instead of f{un}lockfile - Add -msg thread-info=on|off,program-name=on|off args to allow default message prefixes to be optionally disabled Changes in v4: - Re-architected the way error_vprintf() operates to simplify monitor dependency - Fixed the move of error_vprintf from monitor.c to error-report.c so that unit tests can still get a stub to capture messages to g_test_message - Simplify changes to vreport() to avoid passing around function pointers - Add locking of stderr to vreport() to serialize incremental output - Fix thread naming logic changes on Windows - Change deprecation warning messages Changes in v3: - Stop formatting a string in qmessage_context, instead output directly to a "FILE *" stream - Fix pre-existing bug interleaving qemu_log and vreport when the trace 'log' backend has mutex probes enabled Changes in v2: - Re-use existing qemu_get_thread_id rather than re-inventing it as qemu_thread_get_id. - Expose qemu_thread_set_name and use it from all locations needing to set thread names - Fix qemu_log() to skip context prefix when emitting a log message in fragments across multiple calls - Skip allocating memory for empty context messages - Fix leak in win32 impl of qemu_thread_get_name - Use g_strlcpy where possible Daniel P. Berrangé (24): qemu-options: remove extraneous [] around arg values include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: expose qemu_thread_set_name audio: make jackaudio use qemu_thread_set_name util: set the name for the 'main' thread util: add API to fetch the current thread name util: introduce some API docs for logging APIs util: avoid repeated prefix on incremental qemu_log calls ui/vnc: remove use of error_printf_unless_qmp() monitor: remove redundant error_[v]printf_unless_qmp monitor: refactor error_vprintf() monitor: move error_vprintf back to error-report.c monitor: introduce monitor_cur_is_hmp() helper util: don't skip error prefixes when QMP is active util: fix interleaving of error & trace output util: fix interleaving of error prefixes util: introduce common helper for error-report & log code util: convert error-report & log to message API for timestamp util: add support for formatting a workload name in messages util: add support for formatting a program name in messages util: add support for formatting thread info in messages util: add brackets around guest name in message context MAINTAINERS | 2 + audio/jackaudio.c | 30 +++++-- docs/about/deprecated.rst | 7 ++ include/monitor/monitor.h | 4 +- include/qemu/compiler.h | 8 ++ include/qemu/error-report.h | 4 - include/qemu/log-for-trace.h | 17 +++- include/qemu/log.h | 38 +++++++++ include/qemu/message.h | 40 +++++++++ include/qemu/thread.h | 3 +- meson.build | 21 +++++ monitor/monitor.c | 61 +++++--------- qemu-options.hx | 121 ++++++++++++++------------- rust/util/src/log.rs | 6 ++ storage-daemon/qemu-storage-daemon.c | 6 ++ stubs/error-printf.c | 23 ----- stubs/meson.build | 1 - stubs/monitor-core.c | 20 ++++- system/vl.c | 49 +++++++++-- tests/qemu-iotests/041 | 2 +- tests/qemu-iotests/common.filter | 2 +- tests/unit/test-error-report.c | 6 +- tests/unit/test-util-sockets.c | 1 + ui/vnc.c | 14 ++-- util/error-report.c | 97 ++++++++++++--------- util/log.c | 47 ++++++----- util/meson.build | 1 + util/message.c | 51 +++++++++++ util/qemu-thread-posix.c | 77 +++++++++++------ util/qemu-thread-win32.c | 87 +++++++++++++------ 30 files changed, 580 insertions(+), 266 deletions(-) create mode 100644 include/qemu/message.h delete mode 100644 stubs/error-printf.c create mode 100644 util/message.c -- 2.52.0

4 71

[PATCH v5 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 12 Feb '26

12 Feb '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v5: - Fix the bug of updating old secrets, prior to 12.1.0. Old secrets, when updated, now are stored with the latest encryption scheme if encryption is on. - Remove any logic in setting the secretValueFile in virSecretObjListAdd. Move it to virSecretLoadValue and virSecretObjSetValue. - Change urandom to random. Change default permission bits to 0077. - Update the documentation. Changes in v4: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 105 +++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 259 +++++++++++++----- src/conf/virsecretobj.h | 16 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 +++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 + src/secret/secret_config.c | 179 ++++++++++++ src/secret/secret_config.h | 40 +++ src/secret/secret_driver.c | 31 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 ++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 +++++ 24 files changed, 892 insertions(+), 69 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 11

Re: [PATCH v2 00/21] qom: introduce property flags to track external user input
by Daniel P. Berrangé 12 Feb '26

12 Feb '26

On Wed, Feb 11, 2026 at 03:06:23PM +0800, Zhao Liu wrote: > > So the main thing that pushes us into using QOM for internal properties > > is the machine type compatibility code. eg where we bulk set stuff using > > > > compat_props_add(m->compat_props, hw_compat_7_0, hw_compat_7_0_len); > > compat_props_add(m->compat_props, pc_compat_7_0, pc_compat_7_0_len); > > > > That logic is all QOM based. Using QOM isn't our exclusive approach, as > > we have machine types sometimes setting object fields directly. eg > > > > static void pc_i440fx_machine_7_0_options(MachineClass *m) > > { > > PCMachineClass *pcmc = PC_MACHINE_CLASS(m); > > pc_i440fx_machine_7_1_options(m); > > pcmc->enforce_amd_1tb_hole = false; > > compat_props_add(m->compat_props, hw_compat_7_0, hw_compat_7_0_len); > > compat_props_add(m->compat_props, pc_compat_7_0, pc_compat_7_0_len); > > } > > > > but that only works for properties against the machine type, not compat > > properties against devices, since we have no direct access to the other > > classes/instances. > > Right, and setting fields directly is only possible for machine-level > state, not for device properties created dynamically during > realize/init. So QOM-based compat properties are indeed inescapable > for devices. > > > If we want to be able to control hardware compat, without exposing > > something as a user facing tunable, then internal-only QOM props seems > > inescapable. > > Agreed. > > > I do still wonder if we genuinely need internal-only QOM props for > > machine type compat ? > > > > Whether using a public 'x-' prefixed property or an internal only > > property, we're constrained by the need to retain the behaviour > > semantics for as long as the machine type exists. I don't see an > > internal only property giving us significantly more freedom here. > > We can already rename a 'x-' property however we want with no > > notice, as long as the machine type doesn't change behaviour. > > Hmm, I think x- prefix is already semantically overloaded. Looking at > the current codebase, x- carries two very different meanings: > > - "unstable but user-facing feature" - e.g. x-vga, x-igd-opregion > (documented in docs/igd-assign.rst with user-facing examples), > x-migration-multifd-transfer (documented in > docs/devel/vfio-migration.rst). > > - "internal compat switch to fix bug" - e.g. x-buggy-eim, > x-pci-express-writeable-slt-bug. > > These two categories have fundamentally different contracts - the > former should be settable by users, the latter should not. But today, > nothing prevents a user from writing something like: > > "-device intel-iommu,x-buggy-eim=false" > > QEMU will happily accept it. I don't see that as a bug neccessarily, but rather a feature. It has let users enable bug fixes, without changing their machine type. It has been useful when users report that a guest OS is broken after a given machine type version, to be able to toggle fixes individually. > > I don't think it does. Code evolution is painful as long as the machine > > type using the prop needs to exist with fixed semantics, whether it is > > internal or public with x- prefix. > > I agree the machine type lifetime constraint doesn't change. > > But experimental x- or normal (external) properties are by default > exposed to users, allowing them to set values via -device or other > entry points. This effectively treats the property as an API. > > Once it becomes an API, any modification to the property must consider > whether there are external dependencies. When a property is exposed with a "x-" prefix, that is saying we do *NOT* need to consider external dependencies. We can remove it at all any time, if QEMU has no internal usage left. We might *choose* to consider external usage, but that is not requird. Our only hard constraint is that the machine type version must remain with the fixed behaviour. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

Re: [PATCH v2 00/21] qom: introduce property flags to track external user input
by Daniel P. Berrangé 12 Feb '26

12 Feb '26

On Tue, Feb 10, 2026 at 11:28:07PM +0800, Zhao Liu wrote: > Hi Daniel, > > On Tue, Feb 10, 2026 at 10:12:38AM +0000, Daniel P. Berrangé wrote: > > Date: Tue, 10 Feb 2026 10:12:38 +0000 > > From: "Daniel P. Berrangé" <berrange(a)redhat.com> > > Subject: Re: [PATCH v2 00/21] qom: introduce property flags to track > > external user input > > > > On Tue, Feb 10, 2026 at 11:23:27AM +0800, Zhao Liu wrote: > > > Hi, > > > > > > This is the v2 trying to introduce property flags to detect user's > > > property setting (from CLI/QMP/HMP). I dropped RFC tag since previous > > > RFC v1 [1]. > > > > This says what the series is proposing, but IMHO what is more important > > here is explaining why this either desirable or appropriate to add as > > general facility in QOM. > > Yes, sorry this cover letter I wrote is overly simplified. > > This series tries to control the property access against external user. > USER_SET is the base to track external user's behavior, and DEPRECATED & > INTERNAL flags provide different levels of access control. > > Though the DEPRECATED flag does not inherently restrict access, I think > such a warning also serves as a form of control. > > The idea of restricting external access to properties is from previous > discussions [*] about internal properties. > > [*]: How to mark internal properties: > https://lore.kernel.org/qemu-devel/2f526570-7ab0-479c-967c-b3f95f9f19e3@red… > > Since that disscussion, currently all properties expected to be > "internal" have an “x-” prefix — while this approach can work, it clearly > confuses the original meaning of “x-”, which actually means "unstable". > > Therefore, I think the optimal approach is to provide the capability to > restrict external access to the property — that is, to implement the > "true" internal property. > > Based on this, it seems impossible to implement an internal property > without tracking user input in the QOM? So the main thing that pushes us into using QOM for internal properties is the machine type compatibility code. eg where we bulk set stuff using compat_props_add(m->compat_props, hw_compat_7_0, hw_compat_7_0_len); compat_props_add(m->compat_props, pc_compat_7_0, pc_compat_7_0_len); That logic is all QOM based. Using QOM isn't our exclusive approach, as we have machine types sometimes setting object fields directly. eg static void pc_i440fx_machine_7_0_options(MachineClass *m) { PCMachineClass *pcmc = PC_MACHINE_CLASS(m); pc_i440fx_machine_7_1_options(m); pcmc->enforce_amd_1tb_hole = false; compat_props_add(m->compat_props, hw_compat_7_0, hw_compat_7_0_len); compat_props_add(m->compat_props, pc_compat_7_0, pc_compat_7_0_len); } but that only works for properties against the machine type, not compat properties against devices, since we have no direct access to the other classes/instances. If we want to be able to control hardware compat, without exposing something as a user facing tunable, then internal-only QOM props seems inescapable. I do still wonder if we genuinely need internal-only QOM props for machine type compat ? Whether using a public 'x-' prefixed property or an internal only property, we're constrained by the need to retain the behaviour semantics for as long as the machine type exists. I don't see an internal only property giving us significantly more freedom here. We can already rename a 'x-' property however we want with no notice, as long as the machine type doesn't change behaviour. > > The idea that code should take different action for a given fixed value, > > based on whether the value was set by the user, or left on the default, > > makes me very uncomfortable. > > > > There have been a number of situations where something that was initially > > a boolean flag, actually needed to be a tri-state instead, to provide > > semantics like "On", "Off", "Auto". > > > > This "user set" flag could support such behaviour indirectly, but since > > "user set" is an internal concept we'd still be only exposing a boolean > > externally, while using a tri-state internally. That does not give the > > full flexibility of a tri-state, because internally if we wanted to > > have the default to be "yes", it offers no way for the mgmt app to > > put it back to "auto". > > > > For properties that are not booleans, it is much less obvious to me > > whether we actually need a distinct "not set" concept at all. > > USER_SET primarily serves the INTERNAL and DEPRECATED flags. However, > its another function is to indicates whether the external user has > touched the property. > > But, Hmm, I think "auto" and USER_SET don't have conflict? > > IIUC, "auto" means the user requests that QEMU make the decision itself. > However, just like my patch 19 cleanup of “lbr-fmt”, that property > explicitly requires users to provide a valid value. Even we have "auto" > for uint64, "auto" can't address this case. I just meant "auto" as one possible "default" behaviour where a traditional boolean was in use, not for all possible types. The right answer for a default is contextually dependent. For a uint64, a default value would involve some sentinal value, or it could involve a pair of related properties. For example, we have host-phys-bits=on phys-bits=NNN as a pair that work together, so you don't need a magic phys-bits value to represent "use host value". > Similarly, the x86 CPU's topology IDs (used for hotplug) - "thread-id"/ > "core-id"/"module-id"..., also require the user to set valid and accurate > values; they cannot be replaced with "auto". Again I wasn't suggestnig an "auto" value for every scenario, that was just an example in a "bool" context. An ID value of "0" is a traditional default for numeric values, which is fine assuming you don't need to dinstinguish 0 as a valid value, from 0 as an invalid value needing user input. > I also think the ideal situation is not to distinguish between external > and internal - however, exposing properties to external users makes code > evolution painful... I don't think it does. Code evolution is painful as long as the machine type using the prop needs to exist with fixed semantics, whether it is internal or public with x- prefix. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH] qemu: Ignore cmp_legacy CPU flag
by Jean-Louis Dupond 12 Feb '26

12 Feb '26

Since commit 99a637a8 in qemu 10.0, the way the cmp_legacy flag is reported changed. The same way as happend with the 'ht' flag in commit c6bd2dd634208, which was fixed in libvirt since commit ba16113c. This causes migrations from a hypervisor running a qemu version before that commit to a hypervisor running qemu after that commit fails with the following error: guest CPU doesn't match specification: extra features: cmp_legacy We can just ignore this flag, just like we did with the 'ht' flag. Signed-off-by: Jean-Louis Dupond <jean-louis(a)dupond.be> --- src/qemu/qemu_capabilities.c | 1 + .../cpu-host-model-fallback-kvm.x86_64-10.0.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-10.1.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-6.2.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-7.0.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-7.1.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-7.2.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-8.0.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-8.1.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-8.2.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-9.0.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-9.1.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-9.2.0.args | 2 +- .../cpu-host-model-fallback-kvm.x86_64-latest.args | 2 +- .../cpu-host-model-fallback-tcg.x86_64-10.1.0.args | 2 +- .../cpu-host-model-fallback-tcg.x86_64-latest.args | 2 +- .../qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-10.0.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-10.1.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-6.2.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-7.0.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-7.1.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-7.2.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-8.0.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-8.1.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-8.2.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-9.0.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-9.1.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-9.2.0.args | 2 +- .../cpu-host-model-nofallback-kvm.x86_64-latest.args | 2 +- .../cpu-host-model-nofallback-tcg.x86_64-10.1.0.args | 2 +- .../cpu-host-model-nofallback-tcg.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args | 2 +- tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args | 2 +- .../memory-hotplug-numa-preferred.x86_64-latest.args | 2 +- 49 files changed, 49 insertions(+), 48 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index f456e8a378..1efb77d03b 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -3784,6 +3784,7 @@ const char *ignoredFeatures[] = { "vmx-ept-uc", "vmx-ept-wb", /* never supported by QEMU */ "vmx-invvpid-single-context", /* never supported by QEMU */ "ht", /* ignored by QEMU, set according to topology */ + "cmp_legacy", /* ignored by QEMU, set according to topology */ }; bool diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args index edd334dd8b..08f37274b2 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args index 57982574eb..e4044a0c64 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args index 4aa9011fe8..e8a9aceb4a 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args index e944e69cfd..0df6ce9e3d 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args index d9edda2733..b4a91fa921 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args index 1d1839b7fa..5d69199876 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args index 8278629ee7..e7b424819e 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args index 3b733a3c5d..58ad565dba 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args index 73296c7df0..fa1b674fa5 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args index 8f8b74fa56..fc9985f901 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args index c2f394bf09..1db86cb31e 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args index 35c8d397c4..4dcd9332cb 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args index 1a9eb5fe06..ed23d2bec4 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args index 3b93ed510d..0b67c7f158 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args index 01cf90bb67..443de62f69 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args index 57834779e3..1c8f99c8d5 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \ +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args index a1c034ec51..7dd5723b98 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args index ddf940f75c..987baa9b30 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args index f65444948e..4402bad82d 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args index 8f8b1645d5..d6dfadc3b2 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args index df03bafab3..09e220487d 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args index 7a796812fa..7e90b309a9 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args index d63438e81c..fc02c9a7e0 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args index 901f279a02..8360dc02ef 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args index d141aca9f0..b00138933c 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args index 49575ff4d9..3b42130bd2 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args index fd25e4cd23..c451426cdd 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args index 4b69f59064..1da6e508ff 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args index 574efe40f5..df7407e32b 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args index edd334dd8b..08f37274b2 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args index 57982574eb..e4044a0c64 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args index 4aa9011fe8..e8a9aceb4a 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args index e944e69cfd..0df6ce9e3d 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args index d9edda2733..b4a91fa921 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args index 1d1839b7fa..5d69199876 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args index 8278629ee7..e7b424819e 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args index 3b733a3c5d..58ad565dba 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args index 73296c7df0..fa1b674fa5 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args index 8f8b74fa56..fc9985f901 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args index c2f394bf09..1db86cb31e 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args index 35c8d397c4..4dcd9332cb 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args index 1a9eb5fe06..ed23d2bec4 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel kvm \ --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args index 3b93ed510d..0b67c7f158 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args index 01cf90bb67..443de62f69 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args index 4defeceac3..d12cb96786 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args +++ b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc-q35-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args index 479266659a..688a217c3c 100644 --- a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args index 49e1b590dd..d425866c67 100644 --- a/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args +++ b/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ -accel tcg \ --cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \ +-cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args b/tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args index cc318977b3..8c20b3ba5d 100644 --- a/tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args +++ b/tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine q35,usb=off,dump-guest-core=off,acpi=off \ -accel tcg \ --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \ -m size=2097152k,slots=16,maxmem=15243264k \ -overcommit mem-lock=off \ -smp 4,sockets=4,cores=1,threads=1 \ -- 2.53.0

2 1

Re: [PATCH v2 00/21] qom: introduce property flags to track external user input
by BALATON Zoltan 12 Feb '26

12 Feb '26

On Tue, 10 Feb 2026, Zhao Liu wrote: > On Tue, Feb 10, 2026 at 10:12:38AM +0000, Daniel P. Berrangé wrote: >> Date: Tue, 10 Feb 2026 10:12:38 +0000 >> From: "Daniel P. Berrangé" <berrange(a)redhat.com> >> Subject: Re: [PATCH v2 00/21] qom: introduce property flags to track >> external user input >> >> On Tue, Feb 10, 2026 at 11:23:27AM +0800, Zhao Liu wrote: >>> Hi, >>> >>> This is the v2 trying to introduce property flags to detect user's >>> property setting (from CLI/QMP/HMP). I dropped RFC tag since previous >>> RFC v1 [1]. >> >> This says what the series is proposing, but IMHO what is more important >> here is explaining why this either desirable or appropriate to add as >> general facility in QOM. > > Yes, sorry this cover letter I wrote is overly simplified. > > This series tries to control the property access against external user. > USER_SET is the base to track external user's behavior, and DEPRECATED & > INTERNAL flags provide different levels of access control. > > Though the DEPRECATED flag does not inherently restrict access, I think > such a warning also serves as a form of control. > > The idea of restricting external access to properties is from previous > discussions [*] about internal properties. > > [*]: How to mark internal properties: > https://lore.kernel.org/qemu-devel/2f526570-7ab0-479c-967c-b3f95f9f19e3@red… > > Since that disscussion, currently all properties expected to be > "internal" have an “x-” prefix — while this approach can work, it clearly > confuses the original meaning of “x-”, which actually means "unstable". > > Therefore, I think the optimal approach is to provide the capability to > restrict external access to the property — that is, to implement the > "true" internal property. > > Based on this, it seems impossible to implement an internal property > without tracking user input in the QOM? > >> The idea that code should take different action for a given fixed value, >> based on whether the value was set by the user, or left on the default, >> makes me very uncomfortable. >> >> There have been a number of situations where something that was initially >> a boolean flag, actually needed to be a tri-state instead, to provide >> semantics like "On", "Off", "Auto". >> >> This "user set" flag could support such behaviour indirectly, but since >> "user set" is an internal concept we'd still be only exposing a boolean >> externally, while using a tri-state internally. That does not give the >> full flexibility of a tri-state, because internally if we wanted to >> have the default to be "yes", it offers no way for the mgmt app to >> put it back to "auto". >> >> For properties that are not booleans, it is much less obvious to me >> whether we actually need a distinct "not set" concept at all. > > USER_SET primarily serves the INTERNAL and DEPRECATED flags. However, > its another function is to indicates whether the external user has > touched the property. > > But, Hmm, I think "auto" and USER_SET don't have conflict? > > IIUC, "auto" means the user requests that QEMU make the decision itself. > However, just like my patch 19 cleanup of “lbr-fmt”, that property > explicitly requires users to provide a valid value. Even we have "auto" > for uint64, "auto" can't address this case. > > Similarly, the x86 CPU's topology IDs (used for hotplug) - "thread-id"/ > "core-id"/"module-id"..., also require the user to set valid and accurate > values; they cannot be replaced with "auto". > > These existing cases all check user input for magic numbers. I hope to > simplify these existing logic using USER_SET. > >> So overall, at a conceptual level, I don't think that QOM should care >> about /how/ a value came to be set. It should have no direct awareness >> of the "user input", rather it just represents the configuration of the >> system at a given point in time, however that came to pass. > > I also think the ideal situation is not to distinguish between external > and internal - however, exposing properties to external users makes code > evolution painful... So another way could be to not use properties for internal settings but add another set of internal properties for those. These could be set the same way but stored in a different hash table and not get mixed with introspectable and user changable properties. But maybe that would be too much refactoring. Regards, BALATON Zoltan

1 0

[PATCH v3 0/7] USB hostdev: allow addressing by port
by Maximilian Martin 11 Feb '26

11 Feb '26

Currently, only vendor/product and bus/device matching are supported for USB host devices. Neither of these provide a stable and persistent way of assigning a guest a specific host device. Vendor/product can be ambiguous. Device numbers change on every enumeration. This patch adds a bus/port matching, which allows a specific port on the host to be specified using the dotted notation found in Linux's "devpath" sysfs attribute. The path series is based on the previous work of Thomas Hebb: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/7U3… This resubmission includes Daniel's patch which extends the USB hostdev test logic. Maximilian Martin (7): tests: validate an XML config with USB vendor/product set virusb test data: add devpath files for port addressing domain_conf, virhostdev, virusb, virusb test: add bus/port matching schema: add USB port attribute tests: validate an XML config with USB bus/port set nodedev: add USB port to nodedev XML docs: add description for USB port matching docs/formatdomain.rst | 29 ++-- src/conf/domain_conf.c | 58 ++++++- src/conf/domain_conf.h | 1 + src/conf/node_device_conf.c | 5 + src/conf/node_device_conf.h | 1 + src/conf/schemas/basictypes.rng | 31 ++++ src/conf/schemas/domaincommon.rng | 41 +---- src/conf/schemas/nodedev.rng | 3 + src/hypervisor/virhostdev.c | 131 ++++++++------ src/libvirt_private.syms | 2 - src/node_device/node_device_udev.c | 4 + src/util/virusb.c | 160 ++++++------------ src/util/virusb.h | 22 +-- .../usb_device_1d6b_1_0000_00_1d_0.xml | 1 + ...ostdev-usb-address-port.x86_64-latest.args | 36 ++++ ...hostdev-usb-address-port.x86_64-latest.xml | 45 +++++ .../hostdev-usb-address-port.xml | 28 +++ ...tdev-usb-vendor-product.x86_64-latest.args | 35 ++++ ...stdev-usb-vendor-product.x86_64-latest.xml | 44 +++++ .../hostdev-usb-vendor-product.xml | 36 ++++ tests/qemuxmlconftest.c | 25 +++ tests/virusbtest.c | 149 +++++++++++----- .../sys_bus_usb/devices/1-1.5.3.1/devpath | 1 + .../sys_bus_usb/devices/1-1.5.3.3/devpath | 1 + .../sys_bus_usb/devices/1-1.5.3/devpath | 1 + .../sys_bus_usb/devices/1-1.5.4/devpath | 1 + .../sys_bus_usb/devices/1-1.5.5/devpath | 1 + .../sys_bus_usb/devices/1-1.5.6/devpath | 1 + .../sys_bus_usb/devices/1-1.5/devpath | 1 + .../sys_bus_usb/devices/1-1.6/devpath | 1 + .../sys_bus_usb/devices/1-1/devpath | 1 + .../sys_bus_usb/devices/2-1.2/devpath | 1 + .../sys_bus_usb/devices/2-1/devpath | 1 + .../sys_bus_usb/devices/usb1/devpath | 1 + .../sys_bus_usb/devices/usb2/devpath | 1 + .../sys_bus_usb/devices/usb3/devpath | 1 + .../sys_bus_usb/devices/usb4/devpath | 1 + 37 files changed, 631 insertions(+), 271 deletions(-) create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3.1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3.3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.4/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.5/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.6/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.6/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/2-1.2/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/2-1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb2/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb4/devpath -- 2.39.5

3 13

[PATCH v4 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 10 Feb '26

10 Feb '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v3: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 86 ++++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 193 ++++++++++++++---- src/conf/virsecretobj.h | 18 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 179 ++++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 34 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 +++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 ++++++ 24 files changed, 831 insertions(+), 50 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 15

[RFC PATCH v5 0/7] riscv: add initial sdext support
by Chao Liu 10 Feb '26

10 Feb '26

Hi, Per Daniel's review feedback, this v5 series is based on Alistair's riscv-to-apply.next branch [3]. It depends on patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series (not included; apply them first) [2]. It is based on RISC-V Debug Specification 1.0 [1]. It introduces the sdext/sdtrig config bits, DCSR/DPC/DSCRATCH state, Debug Mode enter/leave helpers, DRET, EBREAK entry, single-step, and trigger action=debug mode. To reduce review load, this series focuses on the Sdext features first. The Debug Module (DM) and related flows will follow in a later series. Changes in v5: - Patch 2: removed redundant `cpu->cfg.ext_sdext = false;` in riscv_cpu_init() since it's already set to false in MULTI_EXT_CFG_BOOL. (Daniel) - Patch 7: changed LOG_UNIMP to LOG_GUEST_ERROR for invalid trigger action=debug mode when Sdext is not enabled. LOG_UNIMP is reserved for unimplemented features, while LOG_GUEST_ERROR is for invalid guest actions. (Daniel) Changes in v4: - Fixed linux-user build errors: moved debug_mode/dcsr/dpc/dscratch fields inside #ifndef CONFIG_USER_ONLY block in cpu.h, and wrapped all code using these fields with proper guards. (Daniel) - Updated dependency from single patch (patch 5 only) to patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series to avoid compilation errors. Changes in v3: - Rebase onto Alistair's riscv-to-apply.next branch. - Depend on Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." (not included; apply it first) [2]. - Patch 2: default sdext to false in riscv_cpu_extensions[]. Changes in v2: - Drop the RHCT expected AML update from this series. - Replace the split sdext/sdtrig config bits patch with deprecating the 'debug' CPU property. - Rebase and update patch subjects to target/riscv prefix. Changes in v1: - Debug Mode entry/exit updates DCSR/DPC and restores execution via DRET. - EBREAK honors DCSR ebreak bits and enters Debug Mode when enabled. - Single-step uses DCSR.STEP with a TB flag and a helper at TB exit. It references Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." [2]. - Sdtrig supports action=debug mode for mcontrol/mcontrol6 and reports inst-count triggers in tinfo. Differences vs Debug Spec (known gaps): - No Debug Module (no DMI, dmcontrol/dmstatus, haltreq/resumereq). - No debug ROM, program buffer, abstract commands, or SBA. - Resume is modeled by leaving Debug Mode at cpu_exec_enter. - Step/exception ordering is simplified: if the stepped instruction traps, the normal exception is taken and Debug Mode is not forced. - Several DCSR fields are not fully modeled (stopcount/stoptime, etc). Roadmap (next stage, DM focus): 1) Add a DM core with DMI access and hart state tracking. 2) Implement halt/resume handshake and move Debug Mode transitions under DM control. 3) Add debug ROM, program buffer, and abstract commands for GPR/CSR and memory access. 4) Add SBA if required by tooling. 5) Tighten ordering rules for step/exception/trigger priorities. References: [1] https://github.com/riscv/riscv-debug-spec/releases/tag/1.0 [2] https://lore.kernel.org/qemu-devel/20260108132631.9429-1-max.chou@sifive.co… [3] https://github.com/alistair23/qemu/tree/riscv-to-apply.next Thanks, Chao Chao Liu (6): target/riscv: add sdext debug CSRs state target/riscv: add sdext Debug Mode helpers target/riscv: add dret instruction target/riscv: add sdext enter Debug Mode on ebreak target/riscv: add sdext single-step support target/riscv: add sdtrig trigger action=debug mode Daniel Henrique Barboza (1): target/riscv: deprecate 'debug' CPU property docs/about/deprecated.rst | 7 + include/exec/translation-block.h | 4 +- target/riscv/cpu.c | 59 +++++++- target/riscv/cpu.h | 9 ++ target/riscv/cpu_bits.h | 33 +++++ target/riscv/cpu_cfg_fields.h.inc | 3 +- target/riscv/cpu_helper.c | 90 ++++++++++++ target/riscv/csr.c | 128 +++++++++++++++++- target/riscv/debug.c | 58 +++++++- target/riscv/helper.h | 3 + target/riscv/insn32.decode | 1 + .../riscv/insn_trans/trans_privileged.c.inc | 24 ++++ target/riscv/machine.c | 44 ++++-- target/riscv/op_helper.c | 70 ++++++++++ target/riscv/tcg/tcg-cpu.c | 21 ++- target/riscv/translate.c | 16 ++- 16 files changed, 545 insertions(+), 25 deletions(-) -- 2.53.0

2 10

[PATCH 0/4] qemu: Automatically add USB controller if USB devices are present
by Andrea Bolognani 09 Feb '26

09 Feb '26

Makes things more user-friendly for those machine types where a default USB controller is normally not automatically added. https://issues.redhat.com/browse/RHEL-2455 Andrea Bolognani (4): tests: Add usb-controller-automatic-with-devices-virt-aarch64 conf: Rename virDomainDefHasUSB() to virDomainDefHasUSBControllers() conf: Introduce virDomainDefHasUSBDevices() qemu: Automatically add USB controller if USB devices are present src/conf/domain_conf.c | 31 +++++++++++++- src/conf/domain_conf.h | 3 +- src/conf/domain_validate.c | 2 +- src/libvirt_private.syms | 3 +- src/qemu/qemu_domain_address.c | 2 +- src/qemu/qemu_postparse.c | 11 +++++ ...h-devices-virt-aarch64.aarch64-latest.args | 36 ++++++++++++++++ ...th-devices-virt-aarch64.aarch64-latest.xml | 41 +++++++++++++++++++ ...er-automatic-with-devices-virt-aarch64.xml | 14 +++++++ tests/qemuxmlconftest.c | 2 + 10 files changed, 139 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.xml -- 2.52.0

2 9

[PATCH v3 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 09 Feb '26

09 Feb '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename generic names to virNWFilter* and CamelCase nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 671 +-- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2496 ++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 55 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 304 ++ .../ah-linux.nftables.args | 298 ++ .../all-ipv6-linux.nftables.args | 286 ++ .../all-linux.nftables.args | 280 ++ .../arp-linux.nftables.args | 215 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 483 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 304 ++ .../esp-linux.nftables.args | 298 ++ .../example-1-linux.nftables.args | 266 ++ .../example-2-linux.nftables.args | 348 ++ .../hex-data-linux.nftables.args | 357 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 252 ++ .../icmpv6-linux.nftables.args | 322 ++ .../igmp-linux.nftables.args | 298 ++ .../ip-linux.nftables.args | 198 + .../ipt-no-macspoof-linux.nftables.args | 169 + .../ipv6-linux.nftables.args | 474 +++ .../iter1-linux.nftables.args | 298 ++ .../iter2-linux.nftables.args | 3598 +++++++++++++++++ .../iter3-linux.nftables.args | 418 ++ .../mac-linux.nftables.args | 180 + .../rarp-linux.nftables.args | 215 + .../sctp-ipv6-linux.nftables.args | 314 ++ .../sctp-linux.nftables.args | 314 ++ .../target-linux.nftables.args | 452 +++ .../target2-linux.nftables.args | 316 ++ .../tcp-ipv6-linux.nftables.args | 314 ++ .../tcp-linux.nftables.args | 468 +++ .../udp-ipv6-linux.nftables.args | 314 ++ .../udp-linux.nftables.args | 314 ++ .../udplite-ipv6-linux.nftables.args | 304 ++ .../udplite-linux.nftables.args | 298 ++ .../vlan-linux.nftables.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 59 files changed, 18806 insertions(+), 569 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

1 5

[PATCH v2 00/38] qemu: Implement support for uefi-vars device (varstore element)
by Andrea Bolognani 09 Feb '26

09 Feb '26

This series makes it possible to use Secure Boot with aarch64 VMs. https://issues.redhat.com/browse/RHEL-82645 Note that, while I consider the entire series to be ready for review, there are two patches that are marked as DONOTMERGE: that's because they respectively implement support for a JSON firmware descriptor syntax extension that has not yet been approved, and import into the tree firmware descriptor that are not yet part of the Fedora edk2 package. The latter depends on the former, of course, for which patches have been posted[1] to the QEMU mailing list. Changes from [v1]: * rewrite based on review feedback: the <nvram> element is no longer used, and a dedicated <varstore> element is introduced instead; * additional test coverage, as well as fixes and improvements related to firmware selection and its documentation, are present as well. [1] https://mail.gnu.org/archive/html/qemu-devel/2026-02/msg02498.html [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TGLF… Andrea Bolognani (38): qemu_firmware: Only set format for custom loader if path is present conf: Move type=rom default for loader to drivers qemu_firmware: Improve matching when loader.type is absent tests: Rename custom JSON firmware descriptors tests: Update JSON firmware descriptor for BIOS schema: Add varstore element conf: Parse and format varstore element conf: Update validation to consider varstore element qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS qemu: Validate presence of uefi-vars device tests: Add firmware-manual-efi-varstore-q35 tests: Add firmware-manual-efi-varstore-aarch64 tests: Add firmware-auto-efi-varstore-q35 tests: Add firmware-auto-efi-varstore-aarch64 tests: Add firmware-auto-efi-enrolled-keys-aarch64 qemu_firmware: Parse host-uefi-vars firmware feature qemu_firmware: Split sanity check qemu_firmware: Consider host-uefi-vars feature in sanity check DONOTMERGE: qemu_firmware: Support extended syntax for ROM firmware descriptors qemu_firmware: Report NVRAM template path for ROMs schema: Add varstore element for domcaps conf: Include varstore element in domcaps qemu: Fill in varstore element in domcaps qemu_firmware: Use of NVRAM implies stateful firmware qemu_firmware: Allow matching stateful ROMs qemu_firmware: Fill in varstore information qemu: Introduce varstoreDir qemu_firmware: Generate varstore path when necessary DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds qemu_command: Use uefi-vars device where appropriate qemu: Introduce qemuPrepareNVRAMFileCommon() qemu: Create and delete varstore file security: Mark ROMs as read only when using AppArmor security: Handle varstore file include: Mention varstore where applicable virsh: Update for varstore handling docs: Update for varstore and improve news: Document support for uefi-vars device and firmwares NEWS.rst | 16 ++ docs/formatcaps.rst | 2 +- docs/formatdomain.rst | 47 +++-- docs/formatdomaincaps.rst | 81 +++++--- docs/kbase/secureboot.rst | 46 +++-- docs/manpages/virsh.rst | 44 +++-- include/libvirt/libvirt-domain-snapshot.h | 2 +- include/libvirt/libvirt-domain.h | 4 +- libvirt.spec.in | 1 + src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 79 +++++++- src/conf/domain_conf.h | 9 + src/conf/domain_postparse.c | 19 -- src/conf/domain_validate.c | 82 +++----- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 64 +++--- src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 2 + src/libxl/libxl_domain.c | 6 + src/qemu/meson.build | 1 + src/qemu/qemu_capabilities.c | 31 ++- src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 34 ++++ src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 27 ++- src/qemu/qemu_firmware.c | 182 ++++++++++++++++-- src/qemu/qemu_firmware.h | 1 + src/qemu/qemu_process.c | 84 ++++++-- src/qemu/qemu_validate.c | 20 ++ src/security/security_dac.c | 22 ++- src/security/security_selinux.c | 53 +++-- src/security/virt-aa-helper.c | 36 +++- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../qemu_10.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 1 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 + .../qemu_11.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + .../qemu_8.2.0-virt.aarch64.xml | 1 + .../qemu_8.2.0-virt.loongarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + .../qemu_9.1.0-virt.riscv64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 1 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../etc/qemu/firmware/20-bios.json | 1 - .../etc/qemu/firmware/20-libvirt-bios.json | 1 + .../etc/qemu/firmware/59-combined.json | 1 - .../qemu/firmware/59-libvirt-combined.json | 1 + ...{92-masked.json => 92-libvirt-masked.json} | 0 .../{10-bios.json => 10-libvirt-bios.json} | 0 ...0-edk2-ovmf-qemuvars-x64-sb-enrolled.json} | 15 +- .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 28 +++ ...json => 71-edk2-ovmf-qemuvars-x64-sb.json} | 16 +- .../firmware/71-edk2-qemuvars-aarch64-sb.json | 27 +++ ...combined.json => 90-libvirt-combined.json} | 0 .../{91-bios.json => 91-libvirt-bios.json} | 2 +- ...{92-masked.json => 92-libvirt-masked.json} | 0 ...3-invalid.json => 93-libvirt-invalid.json} | 0 tests/qemufirmwaretest.c | 71 ++++--- ...-auto-bios-not-stateless.x86_64-latest.err | 2 +- ...auto-bios-not-stateless.x86_64-latest.xml} | 6 +- ...firmware-auto-bios-nvram.x86_64-latest.err | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.xml | 2 +- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...enrolled-keys-aarch64.aarch64-latest.args} | 12 +- ...i-enrolled-keys-aarch64.aarch64-latest.xml | 32 +++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 ++ ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...to-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-auto-efi-varstore-aarch64.xml | 18 ++ ...-auto-efi-varstore-q35.x86_64-latest.args} | 5 +- ...e-auto-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-auto-efi-varstore-q35.xml | 18 ++ ...ual-bios-not-stateless.x86_64-latest.args} | 8 +- ...anual-bios-not-stateless.x86_64-latest.err | 1 - ...nual-bios-not-stateless.x86_64-latest.xml} | 2 +- ...re-manual-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-manual-bios.x86_64-latest.xml | 6 +- ...nual-efi-nvram-stateless.x86_64-latest.err | 2 +- ...nvram-template-stateless.x86_64-latest.err | 2 +- ...ware-manual-efi-rw-nvram.x86_64-latest.err | 2 +- ...ual-efi-varstore-aarch64.aarch64-8.2.0.err | 1 + ...-efi-varstore-aarch64.aarch64-latest.args} | 12 +- ...al-efi-varstore-aarch64.aarch64-latest.xml | 32 +++ .../firmware-manual-efi-varstore-aarch64.xml | 19 ++ ...e-manual-efi-varstore-q35.x86_64-8.2.0.err | 1 + ...anual-efi-varstore-q35.x86_64-latest.args} | 5 +- ...manual-efi-varstore-q35.x86_64-latest.xml} | 11 +- .../firmware-manual-efi-varstore-q35.xml | 19 ++ tests/qemuxmlconftest.c | 16 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 55 ++++-- tools/virsh-snapshot.c | 9 +- 179 files changed, 1296 insertions(+), 380 deletions(-) delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-bios.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/20-libvirt-bios.json delete mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-combined.json create mode 120000 tests/qemufirmwaredata/etc/qemu/firmware/59-libvirt-combined.json rename tests/qemufirmwaredata/etc/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/home/user/.config/qemu/firmware/{10-bios.json => 10-libvirt-bios.json} (100%) copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 70-edk2-ovmf-qemuvars-x64-sb-enrolled.json} (55%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json copy tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 71-edk2-ovmf-qemuvars-x64-sb.json} (51%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/71-edk2-qemuvars-aarch64-sb.json rename tests/qemufirmwaredata/usr/share/qemu/firmware/{90-combined.json => 90-libvirt-combined.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{91-bios.json => 91-libvirt-bios.json} (90%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{92-masked.json => 92-libvirt-masked.json} (100%) rename tests/qemufirmwaredata/usr/share/qemu/firmware/{93-invalid.json => 93-libvirt-invalid.json} (100%) copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.xml => firmware-auto-bios-not-stateless.x86_64-latest.xml} (84%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-auto-efi-varstore-aarch64.aarch64-latest.args} (72%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.xml copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.args => firmware-auto-efi-varstore-q35.x86_64-latest.args} (83%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-varstore-q35.x86_64-latest.xml} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.xml copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-bios-not-stateless.x86_64-latest.args} (84%) delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err copy tests/qemuxmlconfdata/{firmware-manual-bios.x86_64-latest.xml => firmware-manual-bios-not-stateless.x86_64-latest.xml} (90%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-aarch64.aarch64-latest.args} (73%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-8.2.0.err copy tests/qemuxmlconfdata/{firmware-auto-bios.x86_64-latest.args => firmware-manual-efi-varstore-q35.x86_64-latest.args} (85%) copy tests/qemuxmlconfdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-manual-efi-varstore-q35.x86_64-latest.xml} (74%) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.xml -- 2.53.0

1 38

[PATCH] virsh: Switch cmdDomIfAddr() to vshTable
by Michal Privoznik 09 Feb '26

09 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> The aim of cmdDomIfAddr() is to obtain IP addresses for given domain and then print (ifName, MAC, type, IP Address) tuple. Preferably in an aligned table. This is hard to do with printf style of spacing ("%-NNs") since the interface name (ifName) can vary a lot in length. Fortunately, we have vshTable which is designed to handle this case. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-domain-monitor.c | 53 ++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index f4274f2721..c0db30cb11 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -2279,6 +2279,7 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) bool full = vshCommandOptBool(cmd, "full"); const char *sourcestr = NULL; int source = VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE; + g_autoptr(vshTable) table = NULL; if (vshCommandOptString(ctl, cmd, "interface", &ifacestr) < 0) return false; @@ -2299,28 +2300,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) goto cleanup; } - vshPrintExtra(ctl, " %-10s %-20s %-8s %s\n%s%s\n", _("Name"), - _("MAC address"), _("Protocol"), _("Address"), - _("-------------------------------------------------"), - _("------------------------------")); + table = vshTableNew(_("Name"), _("MAC address"), _("Protocol"), _("Address"), NULL); + if (!table) + return false; for (i = 0; i < ifaces_count; i++) { virDomainInterfacePtr iface = ifaces[i]; const char *type = NULL; + const char *hwaddr = "N/A"; if (ifacestr && STRNEQ(ifacestr, iface->name)) continue; + if (iface->hwaddr) + hwaddr = iface->hwaddr; + /* When the interface has no IP address */ if (!iface->naddrs) { - vshPrint(ctl, " %-10s %-17s %-12s %s\n", - iface->name, - iface->hwaddr ? iface->hwaddr : "N/A", "N/A", "N/A"); + if (vshTableRowAppend(table, + iface->name, hwaddr, "N/A", "N/A", NULL) < 0) + goto cleanup; continue; } for (j = 0; j < iface->naddrs; j++) { - g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_autofree char *ip_addr_str = NULL; switch (iface->addrs[j].type) { @@ -2332,26 +2335,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) break; } - virBufferAsprintf(&buf, "%-12s %s/%d", - type, iface->addrs[j].addr, - iface->addrs[j].prefix); - - ip_addr_str = virBufferContentAndReset(&buf); - - if (!ip_addr_str) - ip_addr_str = g_strdup(""); + ip_addr_str = g_strdup_printf("%s/%d", + iface->addrs[j].addr, + iface->addrs[j].prefix); /* Don't repeat interface name */ - if (full || !j) - vshPrint(ctl, " %-10s %-17s %s\n", - iface->name, - NULLSTR_EMPTY(iface->hwaddr), ip_addr_str); - else - vshPrint(ctl, " %-10s %-17s %s\n", - "-", "-", ip_addr_str); + if (full || !j) { + if (vshTableRowAppend(table, + iface->name, + NULLSTR_EMPTY(iface->hwaddr), + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } else { + if (vshTableRowAppend(table, + "-", "-", + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } } } + vshTablePrintToStdout(table, ctl); + ret = true; cleanup: -- 2.52.0

2 1

[PATCH] qapi/net: deprecate TAP fd and vhostfd options
by Vladimir Sementsov-Ogievskiy 09 Feb '26

09 Feb '26

They are the same as fds and vhostfds, except they accept only one fd. Let's deprecate redundant options. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- Hi all! after "[PATCH v2 00/12] net: refactoring and fixes" options fd and vhostfd becomes redundant, fds and vhostfds may be used instead. this patch also based on "[PATCH v6] qapi: net: deprecate vhostforce option", that's why it's sent separately. Based-on: <20260129213215.1405459-1-vsementsov(a)yandex-team.ru> Based-on: <20251113071711.349651-1-vsementsov(a)yandex-team.ru> docs/about/deprecated.rst | 6 ++++++ qapi/net.json | 9 +++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index e8ff478583..9010f8ab07 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -451,6 +451,12 @@ TAP ``vhostforce`` (since 11.0) The ``vhostforce`` option is redundant with the ``vhost`` option. If they conflict, ``vhost`` takes precedence. Just use ``vhost``. +TAP ``fd`` and ``vhostfd`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Use ``fds`` and ``vhostfds`` correspondingly, each set with one fd +instead of ``fd`` and ``vhsotfd``. + Vhost-user ``vhostforce`` (since 11.0) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/qapi/net.json b/qapi/net.json index 9a00d578e9..2d5aed3ef8 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -326,8 +326,7 @@ # # @fd: file descriptor of an already opened tap # -# @fds: multiple file descriptors of already opened multiqueue capable -# tap +# @fds: multiple file descriptors of already opened tap # # @script: script to initialize the interface # @@ -359,13 +358,15 @@ # Features: # # @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# Member @fd is deprecated. Use @fds instead. +# Member @vhostfd is deprecated. Use @vhostfds instead. # # Since: 1.2 ## { 'struct': 'NetdevTapOptions', 'data': { '*ifname': 'str', - '*fd': 'str', + '*fd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*fds': 'str', '*script': 'str', '*downscript': 'str', @@ -374,7 +375,7 @@ '*sndbuf': 'size', '*vnet_hdr': 'bool', '*vhost': 'bool', - '*vhostfd': 'str', + '*vhostfd': { 'type': 'str', 'features': [ 'deprecated' ] }, '*vhostfds': 'str', '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', -- 2.52.0

3 6

[PATCH v6 00/27] hw/i386/pc: Remove deprecated 2.6 and 2.7 PC machines
by Zhao Liu 07 Feb '26

07 Feb '26

Hi, This v6 is based on the master branch at the commit 0fc482b73d8e ("Merge tag 'pull-aspeed-20260105' of https://github.com/legoater/qemu into staging"). Since there's the discussion around fw_cfg_init_io_nodma() [*], v6 doesn't include that cleanups. Therefore, comparing v5, v6 has *very* minimal changes and most of patches have been reviewed (except patch 15 - I think it needs an additianl review :-) ). Thanks for your patience and review! Introduction ============ A brief introduction from Philippe's v4: The versioned 'pc' and 'q35' machines up to 2.12 been marked as deprecated three releases ago, and are older than 6 years, so according to our support policy we can remove them. This series only includes the 2.6 and 2.7 machines removal, as it is a big enough number of LoC removed. Rest will follow. Change Log ========== (Main) changes since v5: * Merge pc & q35 changes for testing DSDT tables into one patch and simplify the commit message. * Reorganize S-o-b and collect review tags from Igor. (Main) changes since v4: * Completely remove the legacy CPU hotplug approach. - New patch 2-8. - Test CPU hot-plug & hot-unplug via qmp. * Keep "dma_enabled" property in fw_cfg_io_properties[] since Sun4u & Sun4v are still using it. - About more details, please see commit message of patch 15. * Temporarily keep these properties: "cpuid-0xb" (of X86CPU), "fill-mtrr-mask" (of X86CPU), "version" (of IOAPICCommonState). - These properties will be deprecated first before removal, in another series. * Keep "l3-cache" (of X86CPU) and "page-per-vq" (of VirtIOPCIProxy), since they are still in use (e.g., libvirt). Reference ========= [*]: https://lore.kernel.org/qemu-devel/20251203060942.57851-1-philmd@linaro.org/ Best Regards, Zhao --- Igor Mammedov (1): tests/acpi: Allow DSDT table change for x86 machines Philippe Mathieu-Daudé (22): hw/i386/pc: Remove deprecated pc-q35-2.6 and pc-i440fx-2.6 machines hw/i386/pc: Remove PCMachineClass::legacy_cpu_hotplug field hw/nvram/fw_cfg: Rename fw_cfg_init_mem() with '_nodma' suffix hw/mips/loongson3_virt: Prefer using fw_cfg_init_mem_nodma() hw/nvram/fw_cfg: Factor fw_cfg_init_mem_internal() out hw/nvram/fw_cfg: Rename fw_cfg_init_mem_wide() -> fw_cfg_init_mem_dma() hw/i386/x86: Remove X86MachineClass::fwcfg_dma_enabled field hw/i386/pc: Remove multiboot.bin hw/i386: Assume fw_cfg DMA is always enabled hw/i386: Remove linuxboot.bin hw/i386/pc: Remove pc_compat_2_6[] array hw/intc/apic: Remove APICCommonState::legacy_instance_id field hw/core/machine: Remove hw_compat_2_6[] array hw/virtio/virtio-mmio: Remove VirtIOMMIOProxy::format_transport_address field hw/i386/pc: Remove deprecated pc-q35-2.7 and pc-i440fx-2.7 machines hw/i386/pc: Remove pc_compat_2_7[] array target/i386/cpu: Remove CPUX86State::full_cpuid_auto_level field hw/audio/pcspk: Remove PCSpkState::migrate field hw/core/machine: Remove hw_compat_2_7[] array hw/i386/intel_iommu: Remove IntelIOMMUState::buggy_eim field hw/virtio/virtio-pci: Remove VirtIOPCIProxy::ignore_backend_features field hw/char/virtio-serial: Do not expose the 'emergency-write' property Zhao Liu (4): pc: Start with modern CPU hotplug interface by default acpi: Remove legacy cpu hotplug utilities docs/specs/acpi_cpu_hotplug: Remove legacy cpu hotplug descriptions tests/acpi: Update DSDT tables for pc & q35 machines docs/specs/acpi_cpu_hotplug.rst | 28 +- hw/acpi/acpi-cpu-hotplug-stub.c | 19 +- hw/acpi/cpu.c | 10 - hw/acpi/cpu_hotplug.c | 348 ------------------ hw/acpi/generic_event_device.c | 1 + hw/acpi/ich9.c | 61 +-- hw/acpi/meson.build | 2 +- hw/acpi/piix4.c | 61 +-- hw/arm/virt.c | 2 +- hw/audio/pcspk.c | 10 - hw/char/virtio-serial-bus.c | 9 +- hw/core/machine.c | 17 - hw/hppa/machine.c | 2 +- hw/i386/acpi-build.c | 7 +- hw/i386/fw_cfg.c | 16 +- hw/i386/intel_iommu.c | 5 +- hw/i386/microvm.c | 3 - hw/i386/multiboot.c | 7 +- hw/i386/pc.c | 25 +- hw/i386/pc_piix.c | 23 -- hw/i386/pc_q35.c | 24 -- hw/i386/x86-common.c | 8 +- hw/i386/x86.c | 2 - hw/intc/apic_common.c | 5 - hw/loongarch/fw_cfg.c | 4 +- hw/loongarch/virt-acpi-build.c | 1 - hw/mips/loongson3_virt.c | 2 +- hw/nvram/fw_cfg.c | 22 +- hw/riscv/virt.c | 4 +- hw/virtio/virtio-mmio.c | 15 - hw/virtio/virtio-pci.c | 5 +- include/hw/acpi/cpu.h | 1 - include/hw/acpi/ich9.h | 4 +- include/hw/acpi/piix4.h | 4 +- include/hw/core/boards.h | 6 - include/hw/i386/apic_internal.h | 1 - include/hw/i386/intel_iommu.h | 1 - include/hw/i386/pc.h | 9 - include/hw/i386/x86.h | 2 - include/hw/nvram/fw_cfg.h | 9 +- include/hw/virtio/virtio-mmio.h | 1 - include/hw/virtio/virtio-pci.h | 1 - include/hw/virtio/virtio-serial.h | 2 - pc-bios/meson.build | 2 - pc-bios/multiboot.bin | Bin 1024 -> 0 bytes pc-bios/optionrom/Makefile | 2 +- pc-bios/optionrom/linuxboot.S | 195 ---------- pc-bios/optionrom/multiboot.S | 232 ------------ pc-bios/optionrom/multiboot_dma.S | 234 +++++++++++- pc-bios/optionrom/optionrom.h | 4 - target/i386/cpu.c | 119 +++--- target/i386/cpu.h | 3 - tests/data/acpi/x86/pc/DSDT | Bin 8611 -> 8598 bytes tests/data/acpi/x86/pc/DSDT.acpierst | Bin 8522 -> 8509 bytes tests/data/acpi/x86/pc/DSDT.acpihmat | Bin 9936 -> 9923 bytes tests/data/acpi/x86/pc/DSDT.bridge | Bin 15482 -> 15469 bytes tests/data/acpi/x86/pc/DSDT.cphp | Bin 9075 -> 9062 bytes tests/data/acpi/x86/pc/DSDT.dimmpxm | Bin 10265 -> 10252 bytes tests/data/acpi/x86/pc/DSDT.hpbridge | Bin 8562 -> 8549 bytes tests/data/acpi/x86/pc/DSDT.hpbrroot | Bin 5100 -> 5087 bytes tests/data/acpi/x86/pc/DSDT.ipmikcs | Bin 8683 -> 8670 bytes tests/data/acpi/x86/pc/DSDT.memhp | Bin 9970 -> 9957 bytes tests/data/acpi/x86/pc/DSDT.nohpet | Bin 8469 -> 8456 bytes tests/data/acpi/x86/pc/DSDT.numamem | Bin 8617 -> 8604 bytes tests/data/acpi/x86/pc/DSDT.roothp | Bin 12404 -> 12391 bytes tests/data/acpi/x86/q35/DSDT | Bin 8440 -> 8427 bytes tests/data/acpi/x86/q35/DSDT.acpierst | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.acpihmat | Bin 9765 -> 9752 bytes .../data/acpi/x86/q35/DSDT.acpihmat-generic-x | Bin 12650 -> 12637 bytes .../acpi/x86/q35/DSDT.acpihmat-noinitiator | Bin 8719 -> 8706 bytes tests/data/acpi/x86/q35/DSDT.applesmc | Bin 8486 -> 8473 bytes tests/data/acpi/x86/q35/DSDT.bridge | Bin 12053 -> 12040 bytes tests/data/acpi/x86/q35/DSDT.core-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.core-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.cphp | Bin 8904 -> 8891 bytes tests/data/acpi/x86/q35/DSDT.cxl | Bin 13231 -> 13218 bytes tests/data/acpi/x86/q35/DSDT.dimmpxm | Bin 10094 -> 10081 bytes tests/data/acpi/x86/q35/DSDT.ipmibt | Bin 8515 -> 8502 bytes tests/data/acpi/x86/q35/DSDT.ipmismbus | Bin 8528 -> 8515 bytes tests/data/acpi/x86/q35/DSDT.ivrs | Bin 8457 -> 8444 bytes tests/data/acpi/x86/q35/DSDT.memhp | Bin 9799 -> 9786 bytes tests/data/acpi/x86/q35/DSDT.mmio64 | Bin 9570 -> 9557 bytes tests/data/acpi/x86/q35/DSDT.multi-bridge | Bin 13293 -> 13280 bytes tests/data/acpi/x86/q35/DSDT.noacpihp | Bin 8302 -> 8289 bytes tests/data/acpi/x86/q35/DSDT.nohpet | Bin 8298 -> 8285 bytes tests/data/acpi/x86/q35/DSDT.numamem | Bin 8446 -> 8433 bytes tests/data/acpi/x86/q35/DSDT.pvpanic-isa | Bin 8541 -> 8528 bytes tests/data/acpi/x86/q35/DSDT.thread-count | Bin 12998 -> 12985 bytes tests/data/acpi/x86/q35/DSDT.thread-count2 | Bin 33855 -> 33842 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm12 | Bin 9046 -> 9033 bytes tests/data/acpi/x86/q35/DSDT.tis.tpm2 | Bin 9072 -> 9059 bytes tests/data/acpi/x86/q35/DSDT.type4-count | Bin 18674 -> 18661 bytes tests/data/acpi/x86/q35/DSDT.viot | Bin 14697 -> 14684 bytes tests/data/acpi/x86/q35/DSDT.xapic | Bin 35803 -> 35790 bytes tests/qtest/test-x86-cpuid-compat.c | 11 - 95 files changed, 363 insertions(+), 1228 deletions(-) delete mode 100644 hw/acpi/cpu_hotplug.c delete mode 100644 pc-bios/multiboot.bin delete mode 100644 pc-bios/optionrom/linuxboot.S delete mode 100644 pc-bios/optionrom/multiboot.S -- 2.34.1

3 30

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant B
by Peter Krempa 06 Feb '26

06 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. Thus this version is the more cautious approach of adding a capability and only switching the generator once deprecations are set up. While adding the capability I've also uncovered a bug in the QMP query strings where it was not possible to query features of an object member. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (5): virQEMUQAPISchemaTraverseObject: Consider features also on current members qemu: capabilities: Introduce QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL qemuxmlconftest: Add version-locked test cases for the use of -netdev tap with fd/vhostfd qemuBuildHostNetProps: Use 'fds', 'vhostfds' with QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_capabilities.c | 8 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_qapi.c | 26 + .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 11 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-10.2.0.args | 36 + .../qemuxmlconfdata/net-eth.x86_64-10.2.0.xml | 44 + .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-10.2.0.args | 42 + .../net-virtio-vhost.x86_64-10.2.0.xml | 65 + .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 4 + 32 files changed, 2048 insertions(+), 1828 deletions(-) create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.xml create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.xml -- 2.53.0

1 5

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant A
by Peter Krempa 06 Feb '26

06 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. This is the optimistic approach should it be possible for us to unconditionally use the plural variands. Reordering the patches shows that the proposal causes test suite failures in our code. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (2): qemuBuildHostNetProps: Use only plural form of 'fds' and 'vhostfds' properties [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_command.c | 24 +- .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 10 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- 22 files changed, 1815 insertions(+), 1842 deletions(-) -- 2.53.0

1 2

[PATCH v2 0/2] target/arm: Deprecate '-cpu any'
by Philippe Mathieu-Daudé 06 Feb '26

06 Feb '26

Arm '-cpu any' is aliased to '-cpu max' since more than 5 years. Deprecate the former in preparation of removal. v2: s/any/max/ in target/arm/cpu.c comment Philippe Mathieu-Daudé (2): target/arm: Remove dead code target/arm: Deprecate '-cpu any' (remplaced by '-cpu max') docs/about/deprecated.rst | 8 ++++++++ target/arm/cpu.h | 2 +- target/arm/cpu.c | 1 + target/arm/tcg/cpu32.c | 3 --- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.52.0

3 7

[PATCH] hyperv: Avoid memleak in hypervDomainDefParsePhysicalDisk
by Michal Privoznik 06 Feb '26

06 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> When parsing a physical disk, the @hostResouce is escaped once with the retval being stored into @hostEscaped. Then, it's escaped again, but the retval is stored into the very same variable, leading to a leak where intermediate value is lost. 256 bytes in 1 blocks are definitely lost in loss record 469 of 483 at 0x49543A0: realloc (vg_replace_malloc.c:1804) by 0x516C251: g_realloc (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BB7E: g_string_expand (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BFF9: g_string_insert_len (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x4A58B5F: g_string_append_len_inline (gstring.h:247) by 0x4A58B5F: virBufferAdd (virbuffer.c:164) by 0x4AFDA71: virStringReplace (virstring.c:708) by 0x4DA4381: hypervDomainDefParsePhysicalDisk (hyperv_driver.c:1375) by 0x4DA4A18: hypervDomainDefParseStorage (hyperv_driver.c:1487) by 0x4DA9E31: hypervDomainGetXMLDesc (hyperv_driver.c:2761) by 0x4DFB3E5: virDomainGetXMLDesc (libvirt-domain.c:2898) by 0x406D39B: cmdDumpXML (virsh-domain.c:10787) by 0x40B13B1: vshCommandRun (vsh.c:1383) Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hyperv/hyperv_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index 8dd56f39dc..203bbeb8a5 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -1351,6 +1351,7 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, virDomainDiskDef *disk = NULL; char **hostResource = entry->data->HostResource.data; g_autofree char *hostEscaped = NULL; + g_autofree char *hostEscapedTwice = NULL; g_autofree char *driveNumberStr = NULL; g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; int addr = -1, ctrlr_idx = -1; @@ -1373,12 +1374,12 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, /* Query Msvm_DiskDrive for the DriveNumber */ hostEscaped = virStringReplace(*hostResource, "\\\"", "\""); - hostEscaped = virStringReplace(hostEscaped, "\\", "\\\\"); + hostEscapedTwice = virStringReplace(hostEscaped, "\\", "\\\\"); /* quotes must be preserved, so virBufferEscapeSQL can't be used */ virBufferAsprintf(&query, MSVM_DISKDRIVE_WQL_SELECT "WHERE __PATH='%s'", - hostEscaped); + hostEscapedTwice); if (hypervGetWmiClass(Msvm_DiskDrive, &diskdrive) < 0) goto cleanup; -- 2.52.0

2 1

[PATCH] virt-aa-helper: Fix unchecked return values
by Dmitry Lopatin 06 Feb '26

06 Feb '26

Add missing return value checks to fix the following issues reported by the static analyzer: - vah_add_file() call when adding render node path to the AppArmor profile (line 1029) was not checked, while there are examples with return code check throughout the code. - vah_add_file() call when adding default render node path (line 1037) had the same issue. - virDriverLoadModule() call when loading the storage driver (line 908) was not checked, while there are examples with return code check throughout the code. Signed-off-by: Dmitry Lopatin <dmitry.lopatin(a)flant.com> --- src/security/virt-aa-helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 067a17f331..07e5882237 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -905,7 +905,8 @@ get_files(vahControl * ctl) /* load the storage driver so that backing store can be accessed */ #ifdef WITH_STORAGE - virDriverLoadModule("storage", "storageRegister", false); + if (virDriverLoadModule("storage", "storageRegister", false) < 0) + goto cleanup; #endif for (i = 0; i < ctl->def->ndisks; i++) { @@ -1026,7 +1027,8 @@ get_files(vahControl * ctl) const char *rendernode = virDomainGraphicsGetRenderNode(graphics); if (rendernode) { - vah_add_file(&buf, rendernode, "rw"); + if (vah_add_file(&buf, rendernode, "rw") != 0) + goto cleanup; needsgl = true; } else { if (virDomainGraphicsNeedsAutoRenderNode(graphics)) { @@ -1034,7 +1036,8 @@ get_files(vahControl * ctl) needsgl = true; if (defaultRenderNode) { - vah_add_file(&buf, defaultRenderNode, "rw"); + if (vah_add_file(&buf, defaultRenderNode, "rw") != 0) + goto cleanup; VIR_FREE(defaultRenderNode); } } -- 2.34.1

5 9

[PATCH] src/esx/esx_vi.c: Debug path element comparisons
by Richard W.M. Jones 06 Feb '26

06 Feb '26

Libvirt vpx:// and esx:// URIs are quite obscure. In particular it is very difficult to construct a correct path to a VMware resource. Basically you are iterating over VMware structures blindly with no way to know what your choices are at each level in the path. This commit doesn't directly address this. It's still difficult. But at least let's add the true path choices to the debug output so someone could in theory use 'LIBVIRT_DEBUG=1' to find out what possible choices exist at a path level. For example this command fails because the label (which looks like an IPv6 address, but is really a label) should use "::" instead of ":0:": LIBVIRT_DEBUG=1 virsh -c 'vpx://root@.../data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/?no_verify=1' In the debugging output we now print: 2026-02-05 10:58:25.421+0000: 1528876: debug : esxVI_LookupManagedObjectHelper:4956 : comparing path element 'aaaa:52:0:49e0:2eea:7fff:fee6:eca0' with candidate name 'aaaa:52::49e0:2eea:7fff:fee6:eca0' 2026-02-05 10:58:25.421+0000: 1528876: error : esxVI_Context_LookupManagedObjectsByPath:1098 : internal error: Could not find compute resource specified in '/data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/' In an ideal world we should improve the error message to show the possible choices, but the way the code is structured makes that prohibitive. Related: https://issues.redhat.com/browse/RHEL-145080 --- src/esx/esx_vi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 8d2ffb3f8f..cfd783622d 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -4953,6 +4953,8 @@ esxVI_LookupManagedObjectHelper(esxVI_Context *ctx, goto cleanup; } + VIR_DEBUG("comparing path element '%s' with candidate name '%s'", + name, name_candidate); if (STREQ(name_candidate, name)) { /* Found item with matching name */ break; -- 2.52.0

2 2

[PATCH v5 02/23] vhost: drop backend_features field
by Vladimir Sementsov-Ogievskiy 06 Feb '26

06 Feb '26

This field is mostly unused and sometimes confusing. We even have a TODO-like comment to drop it, the comment is removed in this commit. The field is used to held VHOST_USER_F_PROTOCOL_FEATURES for vhost-user and/or VHOST_NET_F_VIRTIO_NET_HDR for vhost-net (which may be vhost-user-net). But we can simply recalculate these two flags in place from hdev->features, and from net-client for VHOST_NET_F_VIRTIO_NET_HDR. Note: removing field from x-query-virtio-status result is incompatible change. We can do it because the command is unstable. Cc: devel(a)lists.libvirt.org Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Acked-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Daniil Tatianin <d-tatianin(a)yandex-team.ru> Acked-by: Raphael Norwitz <raphael.s.norwitz(a)gmail.com> --- hw/block/vhost-user-blk.c | 1 - hw/net/vhost_net.c | 26 ++++++++++++++------------ hw/scsi/vhost-scsi.c | 1 - hw/scsi/vhost-user-scsi.c | 1 - hw/virtio/vdpa-dev.c | 1 - hw/virtio/vhost-user.c | 17 ++++++++--------- hw/virtio/virtio-hmp-cmds.c | 2 -- hw/virtio/virtio-qmp.c | 4 ---- include/hw/virtio/vhost.h | 7 ------- qapi/virtio.json | 3 --- 10 files changed, 22 insertions(+), 41 deletions(-) diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index c151e83677..dc99de0263 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -348,7 +348,6 @@ static int vhost_user_blk_connect(DeviceState *dev, Error **errp) s->dev.nvqs = s->num_queues; s->dev.vqs = s->vhost_vqs; s->dev.vq_index = 0; - s->dev.backend_features = 0; vhost_dev_set_config_notifier(&s->dev, &blk_ops); diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 25e9f1fd24..fda90e231e 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -52,8 +52,14 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data, void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features) { - virtio_features_copy(net->dev.acked_features_ex, - net->dev.backend_features_ex); + virtio_features_clear(net->dev.acked_features_ex); + if (net->backend == -1) { + net->dev.acked_features = + net->dev.features & (1ULL << VHOST_USER_F_PROTOCOL_FEATURES); + } else if (!qemu_has_vnet_hdr(net->nc)) { + net->dev.acked_features = 1ULL << VHOST_NET_F_VIRTIO_NET_HDR; + } + vhost_ack_features_ex(&net->dev, net->feature_bits, features); } @@ -258,12 +264,9 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) if (r < 0) { goto fail; } - net->dev.backend_features = qemu_has_vnet_hdr(options->net_backend) - ? 0 : (1ULL << VHOST_NET_F_VIRTIO_NET_HDR); net->backend = r; net->dev.protocol_features = 0; } else { - virtio_features_clear(net->dev.backend_features_ex); net->dev.protocol_features = 0; net->backend = -1; @@ -284,13 +287,12 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) net->dev.features &= ~(1ULL << VIRTIO_NET_F_MRG_RXBUF); } - if (virtio_features_andnot(missing_features, - net->dev.backend_features_ex, - net->dev.features_ex)) { - fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT - " for backend\n", VIRTIO_FEATURES_PR(missing_features)); - goto fail; - } + if (!qemu_has_vnet_hdr(options->net_backend) && + (~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR))) { + fprintf(stderr, "vhost lacks feature mask 0x%llx for backend\n", + ~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR)); + goto fail; + } } /* Set sane init value. Override when guest acks. */ diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c index 699863cc10..859888fdba 100644 --- a/hw/scsi/vhost-scsi.c +++ b/hw/scsi/vhost-scsi.c @@ -275,7 +275,6 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp) vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vqs = vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, (void *)(uintptr_t)vhostfd, VHOST_BACKEND_TYPE_KERNEL, 0, errp); diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c index 3612897d4b..5070178dc2 100644 --- a/hw/scsi/vhost-user-scsi.c +++ b/hw/scsi/vhost-user-scsi.c @@ -159,7 +159,6 @@ static int vhost_user_scsi_connect(DeviceState *dev, Error **errp) vsc->dev.nvqs = VIRTIO_SCSI_VQ_NUM_FIXED + vs->conf.num_queues; vsc->dev.vqs = s->vhost_vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, &s->vhost_user, VHOST_BACKEND_TYPE_USER, 0, errp); diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 4532d63653..06179e402e 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -104,7 +104,6 @@ static void vhost_vdpa_device_realize(DeviceState *dev, Error **errp) v->dev.vqs = vqs; v->dev.vq_index = 0; v->dev.vq_index_end = v->dev.nvqs; - v->dev.backend_features = 0; v->started = false; ret = vhost_vdpa_get_iova_range(v->vhostfd, &iova_range); diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 3ffb6af19f..e21013f2ca 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1470,14 +1470,15 @@ static int vhost_user_set_features(struct vhost_dev *dev, int ret; /* - * We need to include any extra backend only feature bits that - * might be needed by our device. Currently this includes the - * VHOST_USER_F_PROTOCOL_FEATURES bit for enabling protocol - * features. + * Don't lose VHOST_USER_F_PROTOCOL_FEATURES, which is vhost-user + * specific. */ - ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, - features | dev->backend_features, - log_enabled); + if (virtio_has_feature(dev->features, VHOST_USER_F_PROTOCOL_FEATURES)) { + features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; + } + + ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, features, + log_enabled); if (virtio_has_feature(dev->protocol_features, VHOST_USER_PROTOCOL_F_STATUS)) { @@ -2197,8 +2198,6 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque, (dev->config_ops && dev->config_ops->vhost_dev_config_notifier); uint64_t protocol_features; - dev->backend_features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; - err = vhost_user_get_u64(dev, VHOST_USER_GET_PROTOCOL_FEATURES, &protocol_features); if (err < 0) { diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c index 1daae482d3..4bf9a3109d 100644 --- a/hw/virtio/virtio-hmp-cmds.c +++ b/hw/virtio/virtio-hmp-cmds.c @@ -176,8 +176,6 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict) hmp_virtio_dump_features(mon, s->vhost_dev->features); monitor_printf(mon, " Acked features:\n"); hmp_virtio_dump_features(mon, s->vhost_dev->acked_features); - monitor_printf(mon, " Backend features:\n"); - hmp_virtio_dump_features(mon, s->vhost_dev->backend_features); monitor_printf(mon, " Protocol features:\n"); hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); } diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c index 968299fda0..916972e331 100644 --- a/hw/virtio/virtio-qmp.c +++ b/hw/virtio/virtio-qmp.c @@ -780,8 +780,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) vdev->guest_features_ex); status->host_features = qmp_decode_features(vdev->device_id, vdev->host_features_ex); - status->backend_features = qmp_decode_features(vdev->device_id, - vdev->backend_features_ex); switch (vdev->device_endian) { case VIRTIO_DEVICE_ENDIAN_LITTLE: @@ -822,8 +820,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) qmp_decode_features(vdev->device_id, hdev->features_ex); status->vhost_dev->acked_features = qmp_decode_features(vdev->device_id, hdev->acked_features_ex); - status->vhost_dev->backend_features = - qmp_decode_features(vdev->device_id, hdev->backend_features_ex); status->vhost_dev->protocol_features = qmp_decode_protocols(hdev->protocol_features); diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h index 3dfec5e15c..e139e05985 100644 --- a/include/hw/virtio/vhost.h +++ b/include/hw/virtio/vhost.h @@ -100,16 +100,9 @@ struct vhost_dev { * * @features: available features provided by the backend * @acked_features: final negotiated features with front-end driver - * - * @backend_features: this is used in a couple of places to either - * store VHOST_USER_F_PROTOCOL_FEATURES to apply to - * VHOST_USER_SET_FEATURES or VHOST_NET_F_VIRTIO_NET_HDR. Its - * future use should be discouraged and the variable retired as - * its easy to confuse with the VirtIO backend_features. */ VIRTIO_DECLARE_FEATURES(features); VIRTIO_DECLARE_FEATURES(acked_features); - VIRTIO_DECLARE_FEATURES(backend_features); /** * @protocol_features: is the vhost-user only feature set by diff --git a/qapi/virtio.json b/qapi/virtio.json index cd67c4f52e..53ddc6b6a4 100644 --- a/qapi/virtio.json +++ b/qapi/virtio.json @@ -85,8 +85,6 @@ # # @acked-features: vhost_dev acked_features # -# @backend-features: vhost_dev backend_features -# # @protocol-features: vhost_dev protocol_features # # @max-queues: vhost_dev max_queues @@ -106,7 +104,6 @@ 'vq-index': 'int', 'features': 'VirtioDeviceFeatures', 'acked-features': 'VirtioDeviceFeatures', - 'backend-features': 'VirtioDeviceFeatures', 'protocol-features': 'VhostDeviceProtocols', 'max-queues': 'uint64', 'backend-cap': 'uint64', -- 2.52.0

1 0

[PATCH v2 0/7] virtio-iommu: Support setting aw-bits and granule
by Michal Privoznik 06 Feb '26

06 Feb '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3HN6… diff to v1: - setting of granule is done in a subelement of driver now Michal Prívozník (7): conf: Teach virDomainParseMemory() new retval qemu_capabilities: Introduce QEMU_CAPS_VIRTIO_IOMMU_AW_BITS conf: Allow aw_bits for virtio-iommu qemu_command: Generate aw_bits prop for virtio-iommu conf: Introduce granule attribute for virtio-iommu qemu_validate: Check whether granule of virtio-iommu is supported qemu_command: Generate granule prop for virtio-iommu docs/formatdomain.rst | 40 +++++++- src/conf/domain_conf.c | 95 +++++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 21 +++- src/conf/schemas/domaincommon.rng | 22 +++++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +++ src/qemu/qemu_validate.c | 30 +++++- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_ppc64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_riscv64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_aarch64+hvf.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + .../virtio-iommu-aarch64.aarch64-latest.args | 2 +- .../virtio-iommu-aarch64.aarch64-latest.xml | 3 + .../qemuxmlconfdata/virtio-iommu-aarch64.xml | 6 +- ...io-iommu-dma-translation.x86_64-latest.err | 2 +- .../virtio-iommu-x86_64.x86_64-latest.args | 2 +- .../virtio-iommu-x86_64.x86_64-latest.xml | 3 + tests/qemuxmlconfdata/virtio-iommu-x86_64.xml | 6 +- 37 files changed, 247 insertions(+), 21 deletions(-) -- 2.52.0

2 11

[PATCH 0/3] apparmor: Separate seclabel generation and profile loading
by Michal Privoznik 04 Feb '26

04 Feb '26

See 3/3 for explanation. Michal Prívozník (3): security: Introduce virSecurityDomainLoadProfile() qemu: Call virSecurityManagerLoadProfile() at the end of qemuProcessPrepareDomain() security_apparmor: Move profile loading into .domainLoadProfile callback src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 7 +++++++ src/qemu/qemu_security.h | 1 + src/security/security_apparmor.c | 31 +++++++++++++++++++++++-------- src/security/security_driver.h | 4 ++++ src/security/security_manager.c | 13 +++++++++++++ src/security/security_manager.h | 2 ++ src/security/security_stack.c | 15 +++++++++++++++ 8 files changed, 66 insertions(+), 8 deletions(-) -- 2.52.0

2 4

Download of volume: alternating frames of 262120 and 24 bytes
by Erik Huelsmann 03 Feb '26

03 Feb '26

Hi, While analysing traffic generated by "virsh vol-download", I noticed that the download stream exhibits the following pattern (over qemu+ssh://): <Start> Read 4 bytes (= frame length field) Read 262144 bytes (= header + payload ; VIR_NET_MESSAGE_HEADER_MAX (24) + VIR_NET_MESSAGE_LEGACY_PAYLOAD_MAX (262120)) Read 4 bytes (= frame length field) Read 48 bytes (= header + payload) <Go back to Start> While nothing seems to be actually wrong with this pattern, the average payload on large data transfers is only (262120+24)/2 == 131072 and the CPU makes double the iterations necessary. I'll be trying to figure out where this comes from, but I imagine that will be pretty hard to track down. Two questions: 1. Do you see the same thing? 2. Any ideas/hints where I could start looking? Regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 8

[PATCH v2 0/2] bhyve: improve loader handling on arm64
by Roman Bogorodskiy 03 Feb '26

03 Feb '26

Changes since v1: - Make the default loader uboot path configurable in bhyve.conf. It might be useful for users and also way simpler to mock in the test than the hardcoded value in the code. Roman Bogorodskiy (2): bhyve: improve loader handling on arm64 bhyve: conf: do not hardcode datadir in bhyve.conf src/bhyve/{bhyve.conf => bhyve.conf.in} | 7 +++++- src/bhyve/bhyve_conf.c | 8 +++++++ src/bhyve/bhyve_domain.c | 23 +++++++++++++++++++ src/bhyve/bhyve_utils.h | 2 ++ src/bhyve/meson.build | 13 +++++++++-- .../aarch64/bhyvexml2argv-base.args | 1 + .../aarch64/bhyvexml2argv-base.ldargs | 8 +------ .../aarch64/bhyvexml2argv-console.args | 1 + .../aarch64/bhyvexml2argv-console.ldargs | 8 +------ tests/bhyvexml2argvmock.c | 20 +++++++++++++++- tests/bhyvexml2argvtest.c | 2 ++ .../aarch64/bhyvexml2xmlout-base.xml | 1 + .../aarch64/bhyvexml2xmlout-console.xml | 1 + tests/bhyvexml2xmltest.c | 4 ++++ 14 files changed, 81 insertions(+), 18 deletions(-) rename src/bhyve/{bhyve.conf => bhyve.conf.in} (73%) -- 2.52.0

2 6

[PATCH 0/9] bhyve: A couple of memleak fixes
by Michal Privoznik 03 Feb '26

03 Feb '26

*** BLURB HERE *** Michal Prívozník (9): bhyve: Avoid memleak in bhyveParsePassthru() bhyve: Avoid leaking @addrs in bhyveDomainAssignPCIAddresses() bhyve_command: Avoid leaking @buf in virBhyveProcessBuildBhyveCmd() bhyve_command: Avoid memleak in bhyveBuildNetArgStr() bhyvexml2argvmock: Provide virCPUProbeHost() bhyvexml2argvtest: Avoid leaking driver caps bhyvexml2argvtest: Don't leak parts of driver config bhyvexml2argvtest: Avoid leaking firmwareDir bhyvexml2xmltest: Avoid leaking driver caps src/bhyve/bhyve_command.c | 26 ++++++++++++-------------- src/bhyve/bhyve_device.c | 10 +++++++--- src/bhyve/bhyve_parse_command.c | 2 +- tests/bhyvexml2argvmock.c | 8 ++++++++ tests/bhyvexml2argvtest.c | 10 +++++++--- tests/bhyvexml2xmltest.c | 1 + 6 files changed, 36 insertions(+), 21 deletions(-) -- 2.52.0

2 10

[PATCH] rpcgen: Pass XDRPROC_T_3ARGS to test_demo.c
by Michal Privoznik 03 Feb '26

03 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> In previous commit of v12.0.0-85-g2c66b6d72c we've tried to solve a problem where xdrproc_t is a prototype of a function which takes only two arguments instead of three. See original commit for more info. The fix consists of a config time check and setting XDRPROC_T_3ARGS accordingly (in meson-config.h). This works for nearly all of our code, except rpcgen which is intentionally independent of the rest of the code. Therefore, the macro has to be set extra - by specifying it on the compiler cmd line. Fixes: 2c66b6d72cd48d3cf80f957f55cfb1548feb46c4 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- scripts/rpcgen/tests/meson.build | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/rpcgen/tests/meson.build b/scripts/rpcgen/tests/meson.build index 057a61433d..4df7471a99 100644 --- a/scripts/rpcgen/tests/meson.build +++ b/scripts/rpcgen/tests/meson.build @@ -4,13 +4,17 @@ rpcgen_tests = files([ 'test_parser.py', ]) +xdrproc_flags = [] +if conf.has('XDRPROC_T_3ARGS') + xdrproc_flags += [ '-DXDRPROC_T_3ARGS' ] +endif test_demo = executable( 'test_demo', [ 'test_demo.c' ], c_args: [ '-Dabs_srcdir="@0@"'.format(meson.current_source_dir()), - ] + cc_flags_relaxed_frame_limit, + ] + cc_flags_relaxed_frame_limit + xdrproc_flags, dependencies: [ xdr_dep, glib_dep ], -- 2.52.0

3 2

[PATCH] build: add detection of xdrproc_t arguments count
by Roman Bogorodskiy 03 Feb '26

03 Feb '26

According to 9fa3a8ab6fd82ad2f5a14b490696085061418718, macOS insists on passing 3 arguments for xdrproc_t. Passing 3 arguments was a good common ground, but since recently[1] FreeBSD only accepts 2 arguments. Add a meson.build check whether 3 arguments are accepted, and add macros which passes either 2 or 3 arguments to xdrproc_t based on the result of this check. 1: https://cgit.freebsd.org/src/commit/?id=ac5a19ec6989675c8ec6c3ca245dba243d1… Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- meson.build | 19 +++++++++++++++++++ scripts/rpcgen/tests/test_demo.c | 12 +++++++++--- src/rpc/virnetmessage.c | 10 ++++++++-- 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/meson.build b/meson.build index 964d1fa4e1..4a4f89c1cb 100644 --- a/meson.build +++ b/meson.build @@ -893,6 +893,25 @@ else xdr_dep = dependency('', required: false) endif +if xdr_dep.found() + xdrproc_3arg_code = ''' + #include <rpc/xdr.h> + + bool_t test_filter(XDR *xdr, void *data, unsigned int opaque_flags) { + return TRUE; + } + + int main() { + XDR xdr; + xdrproc_t filter = (xdrproc_t)&test_filter; + (*filter)(&xdr, NULL, 0); + return 0; + } + ''' + if cc.compiles(xdrproc_3arg_code, dependencies: xdr_dep) + conf.set('XDRPROC_T_3ARGS', 1) + endif +endif # generic build dependencies diff --git a/scripts/rpcgen/tests/test_demo.c b/scripts/rpcgen/tests/test_demo.c index e6ba7ddbc5..82eda89592 100644 --- a/scripts/rpcgen/tests/test_demo.c +++ b/scripts/rpcgen/tests/test_demo.c @@ -8,6 +8,12 @@ # define xdr_uint64_t xdr_u_int64_t #endif +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC(proc, xdr, data) (proc(&xdr, data, 0)) +#else +# define XDRPROC(proc, xdr, data) (proc(&xdr, data)) +#endif + #include "demo.h" #include "demo.c" @@ -27,7 +33,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 1: serialize the vorig and compare to the data in test .bin files */ xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vorig, 0); + ret = !!XDRPROC(proc, xdr, vorig); g_assert_cmpint(ret, ==, !fail); if (fail) @@ -54,7 +60,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 2: de-serialize the state to create a new object */ xdrmem_create(&xdr, buf, buflen, XDR_DECODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); @@ -68,7 +74,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); diff --git a/src/rpc/virnetmessage.c b/src/rpc/virnetmessage.c index af0f9cb30b..e66df5c9e2 100644 --- a/src/rpc/virnetmessage.c +++ b/src/rpc/virnetmessage.c @@ -34,6 +34,12 @@ VIR_LOG_INIT("rpc.netmessage"); +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data, 0)) +#else +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data)) +#endif + virNetMessage *virNetMessageNew(bool tracked) { virNetMessage *msg; @@ -367,7 +373,7 @@ int virNetMessageEncodePayload(virNetMessage *msg, msg->bufferLength - msg->bufferOffset, XDR_ENCODE); /* Try to encode the payload. If the buffer is too small increase it. */ - while (!(*filter)(&xdr, data, 0)) { + while (!XDRPROC_FILTER(*filter, xdr, data)) { unsigned int newlen = msg->bufferLength - VIR_NET_MESSAGE_LEN_MAX; newlen *= 2; @@ -424,7 +430,7 @@ int virNetMessageDecodePayload(virNetMessage *msg, xdrmem_create(&xdr, msg->buffer + msg->bufferOffset, msg->bufferLength - msg->bufferOffset, XDR_DECODE); - if (!(*filter)(&xdr, data, 0)) { + if (!XDRPROC_FILTER(*filter, xdr, data)) { virReportError(VIR_ERR_RPC, "%s", _("Unable to decode message payload")); goto error; } -- 2.52.0

4 7

[RFC PATCH] Prioritise and validate cgroup2 canonical mount on /sys/fs/cgroup
by Rogério Vinhal Nunes 03 Feb '26

03 Feb '26

Hey folks, we've gotten an issue with how libvirt is currently detecting the cgroup2 mounts. Basically we expose cgroup2 mounts in a container from the host-level and libvirt was selecting that instead of the container-level mount, which uses the canonical path. The current logic basically iterate on the mounts until it finds a cgroup2 mount and uses that. If there's multiple, it will override until the last one is read, which is not very safe. I've cut a quick patch that should: 1. Validate that the mount is actually an existing directory in the context 2. Prefer the canonical mount (/sys/fs/cgroup) if it's available 3. only override it once, so it will not go through lists of mounts overriding up to the end I'm happy to get some feedback here especially on step 3 as I'm not very sure how we should proceed on non-canonical situations or if we should at all. Maybe the best solution is to just use the canonical path? From 4a0bf5c5b1e1cd4e0393981a25e1407d29beb43e Mon Sep 17 00:00:00 2001 From: Rogerio Vinhal Nunes <rogervn(a)meta.com> Date: Mon, 2 Feb 2026 19:24:52 +0000 Subject: [PATCH] Preferred /sys/fs/cgroup as a canonical mount but also verifies if the mount is an existing directory in the namespace. The reason for this is preventing that mounts that are not visible in the container namespace or additional cgroupv2 mounts to share host context might be incorrectly taken as targets here. --- src/util/vircgroupv2.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c index eaf5ae98f6..aa8c950691 100644 --- a/src/util/vircgroupv2.c +++ b/src/util/vircgroupv2.c @@ -23,6 +23,7 @@ #ifdef __linux__ # include <mntent.h> # include <sys/mount.h> +# include <sys/stat.h> #endif /* __linux__ */ #include "internal.h" @@ -46,6 +47,8 @@ VIR_LOG_INIT("util.cgroup"); #define VIR_FROM_THIS VIR_FROM_CGROUP +#define VIR_CGROUP_SYSFS_MOUNT "/sys/fs/cgroup" + VIR_ENUM_DECL(virCgroupV2Controller); VIR_ENUM_IMPL(virCgroupV2Controller, VIR_CGROUP_CONTROLLER_LAST, @@ -173,12 +176,26 @@ virCgroupV2DetectMounts(virCgroup *group, const char *mntOpts G_GNUC_UNUSED, const char *mntDir) { + struct stat sb; + if (STRNEQ(mntType, "cgroup2")) return 0; - VIR_FREE(group->unified.mountPoint); + if (stat(mntDir, &sb) < 0 || !S_ISDIR(sb.st_mode)) { + VIR_DEBUG("Skipping non-directory cgroup2 mount: %s", mntDir); + return 0; + } + + /* Always prefer /sys/fs/cgroup as the canonical mount point. + * If we already have /sys/fs/cgroup, don't override it. + * Otherwise, use the first valid directory we find as fallback. */ + if (STREQ(mntDir, VIR_CGROUP_SYSFS_MOUNT)) { + VIR_FREE(group->unified.mountPoint); + group->unified.mountPoint = g_strdup(mntDir); + } else if (!group->unified.mountPoint) { + group->unified.mountPoint = g_strdup(mntDir); + } - group->unified.mountPoint = g_strdup(mntDir); return 0; } -- 2.52.0

1 0

[RFC PATCH v4 0/7] riscv: add initial sdext support
by Chao Liu 03 Feb '26

03 Feb '26

Hi, Per Daniel's review feedback, this v4 series is based on Alistair's riscv-to-apply.next branch [3]. It depends on patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series (not included; apply them first) [2]. It is based on RISC-V Debug Specification 1.0 [1]. It introduces the sdext/sdtrig config bits, DCSR/DPC/DSCRATCH state, Debug Mode enter/leave helpers, DRET, EBREAK entry, single-step, and trigger action=debug mode. To reduce review load, this series focuses on the Sdext features first. The Debug Module (DM) and related flows will follow in a later series. Changes in v4: - Fixed linux-user build errors: moved debug_mode/dcsr/dpc/dscratch fields inside #ifndef CONFIG_USER_ONLY block in cpu.h, and wrapped all code using these fields with proper guards. (Daniel) - Updated dependency from single patch (patch 5 only) to patches 1-5 of Max Chou's "Add Zvfbfa extension support" v2 series to avoid compilation errors. Changes in v3: - Rebase onto Alistair's riscv-to-apply.next branch. - Depend on Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." (not included; apply it first) [2]. - Patch 2: default sdext to false in riscv_cpu_extensions[]. Changes in v2: - Drop the RHCT expected AML update from this series. - Replace the split sdext/sdtrig config bits patch with deprecating the 'debug' CPU property. - Rebase and update patch subjects to target/riscv prefix. Changes in v1: - Debug Mode entry/exit updates DCSR/DPC and restores execution via DRET. - EBREAK honors DCSR ebreak bits and enters Debug Mode when enabled. - Single-step uses DCSR.STEP with a TB flag and a helper at TB exit. It references Max Chou's patch "target/riscv: Use the tb->cs_bqse as the extend tb flags." [2]. - Sdtrig supports action=debug mode for mcontrol/mcontrol6 and reports inst-count triggers in tinfo. Differences vs Debug Spec (known gaps): - No Debug Module (no DMI, dmcontrol/dmstatus, haltreq/resumereq). - No debug ROM, program buffer, abstract commands, or SBA. - Resume is modeled by leaving Debug Mode at cpu_exec_enter. - Step/exception ordering is simplified: if the stepped instruction traps, the normal exception is taken and Debug Mode is not forced. - Several DCSR fields are not fully modeled (stopcount/stoptime, etc). Roadmap (next stage, DM focus): 1) Add a DM core with DMI access and hart state tracking. 2) Implement halt/resume handshake and move Debug Mode transitions under DM control. 3) Add debug ROM, program buffer, and abstract commands for GPR/CSR and memory access. 4) Add SBA if required by tooling. 5) Tighten ordering rules for step/exception/trigger priorities. References: [1] https://github.com/riscv/riscv-debug-spec/releases/tag/1.0 [2] https://lore.kernel.org/qemu-devel/20260108132631.9429-1-max.chou@sifive.co… [3] https://github.com/alistair23/qemu/tree/riscv-to-apply.next Thanks, Chao Chao Liu (6): target/riscv: add sdext debug CSRs state target/riscv: add sdext Debug Mode helpers target/riscv: add dret instruction target/riscv: add sdext enter Debug Mode on ebreak target/riscv: add sdext single-step support target/riscv: add sdtrig trigger action=debug mode Daniel Henrique Barboza (1): target/riscv: deprecate 'debug' CPU property docs/about/deprecated.rst | 7 + include/exec/translation-block.h | 4 +- target/riscv/cpu.c | 62 ++++++++- target/riscv/cpu.h | 9 ++ target/riscv/cpu_bits.h | 33 +++++ target/riscv/cpu_cfg_fields.h.inc | 3 +- target/riscv/cpu_helper.c | 90 ++++++++++++ target/riscv/csr.c | 128 +++++++++++++++++- target/riscv/debug.c | 58 +++++++- target/riscv/helper.h | 3 + target/riscv/insn32.decode | 1 + .../riscv/insn_trans/trans_privileged.c.inc | 24 ++++ target/riscv/machine.c | 44 ++++-- target/riscv/op_helper.c | 70 ++++++++++ target/riscv/tcg/tcg-cpu.c | 21 ++- target/riscv/translate.c | 16 ++- 16 files changed, 548 insertions(+), 25 deletions(-) -- 2.52.0

2 15

Qemu pause-before-switchover and libvirt live migration
by Rogério Vinhal Nunes 02 Feb '26

02 Feb '26

Hello, I’m looking into the libvirt hooks that are available to make use of during a live migration, but there's only hooks on migration begin and migration end. On qemu directly I’m able to use pause-before-switchover migration capability to run a custom operation just before it moves to the destination, but within libvirt it seems that while this is leveraged internally, it’s not currently exposed to the client in a way I can use. Does anyone have any suggestions on how I could expose this to the client in a generic and sensible way? Thanks, Rogerio

3 11

[PATCH v6 0/7] qemu: Implement support for iommufd
by Nathan Chen 02 Feb '26

02 Feb '26

Hi, This is a follow up to the fifth patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v5: - Updated documentation to point to 12.1.0 (QEMU and KVM only) - Move define and VIR_LOG_INIT out of #ifdef __linux__ block in viriommufd.h - Remove unneeded virPCIDeviceFree() from AppArmorSetSecurityHostdevLabel - Always error out if per-process accounting failed Changes from v4: - Move qemuProcessOpenVfioFds() to qemu_process.h in patch 4/7 - Add `linux/iommufd.h` into headers list in the meson.build file - Correct viriommufd.c pre-processor definition indentations - Restore call to virIOMMUFDSetRLimitMode() in patch 5/7 - Fix indentations for various print function calls - Move the qemuProcessOpenVfioFds() call to qemuProcessPrepareHost() - Make qemuProcessOpenVfioFds() static - Remove unnecessary formatting and comment in virPCIDeviceGetVfioPath() - Clean up namespace and cgroup changes with conditional check for iommufd - Remove virIOMMUFDSupported() - Fix seclabel return logic - In Apparmor seclabel logic, use g_autoptr for virPCIDevice pointer Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/commits/iommufd-v6-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/GKSD… Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Support per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 6 + meson.build | 1 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 4 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 3 + src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 17 +++ src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_process.c | 121 ++++++++++++++++++ src/security/security_apparmor.c | 28 ++-- src/security/security_dac.c | 49 +++++-- src/security/security_selinux.c | 47 +++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 111 ++++++++++++++++ src/util/viriommufd.h | 25 ++++ src/util/virpci.c | 39 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 32 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 31 +++++ .../iommufd-virt-pci-bus-single.xml | 22 ++++ .../iommufd-virt.aarch64-latest.args | 36 ++++++ .../iommufd-virt.aarch64-latest.xml | 53 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 +++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 43 files changed, 1090 insertions(+), 44 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 11

[PATCH 0/2] target/arm: Deprecate '-cpu any'
by Philippe Mathieu-Daudé 02 Feb '26

02 Feb '26

Arm '-cpu any' is aliased to '-cpu max' since more than 5 years. Deprecate the former in preparation of removal. Philippe Mathieu-Daudé (2): target/arm: Remove dead code target/arm: Deprecate '-cpu any' (remplaced by '-cpu max') docs/about/deprecated.rst | 8 ++++++++ target/arm/cpu.c | 1 + target/arm/tcg/cpu32.c | 3 --- 3 files changed, 9 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH v5 0/7] qemu: Implement support for iommufd
by Nathan Chen 30 Jan '26

30 Jan '26

Hi, This is a follow up to the fourth patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v4: - Move qemuProcessOpenVfioFds() to qemu_process.h in patch 4/7 - Add `linux/iommufd.h` into headers list in the meson.build file - Correct viriommufd.c pre-processor definition indentations - Restore call to virIOMMUFDSetRLimitMode() in patch 5/7 - Fix indentations for various print function calls - Move the qemuProcessOpenVfioFds() call to qemuProcessPrepareHost() - Make qemuProcessOpenVfioFds() static - Remove unnecessary formatting and comment in virPCIDeviceGetVfioPath() - Clean up namespace and cgroup changes with conditional check for iommufd - Remove virIOMMUFDSupported() - Fix seclabel return logic - In Apparmor seclabel logic, use g_autoptr for virPCIDevice pointer Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/commits/iommufd-v5-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/4BEU… Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Support per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 7 + meson.build | 1 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 4 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 3 + src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 17 +++ src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_process.c | 121 ++++++++++++++++++ src/security/security_apparmor.c | 31 +++-- src/security/security_dac.c | 49 +++++-- src/security/security_selinux.c | 47 +++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 111 ++++++++++++++++ src/util/viriommufd.h | 25 ++++ src/util/virpci.c | 39 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 32 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 31 +++++ .../iommufd-virt-pci-bus-single.xml | 22 ++++ .../iommufd-virt.aarch64-latest.args | 36 ++++++ .../iommufd-virt.aarch64-latest.xml | 53 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 +++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 43 files changed, 1093 insertions(+), 45 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 21