Backport packages from upstream

2 months ago · 7f339284d9
190 changed files with 47412 additions and 2 deletions
--- a/centos-10/SOURCES/libvirt-Expose-latency-histograms-via-virConnectGetAllDomainStats.patch
+++ b/centos-10/SOURCES/libvirt-Expose-latency-histograms-via-virConnectGetAllDomainStats.patch
@ -0,0 +1,248 @@
 From 48f5933f6cd6f53997823cfe2a277b822b00264f Mon Sep 17 00:00:00 2001
 Message-ID: <48f5933f6cd6f53997823cfe2a277b822b00264f.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 29 Jan 2026 18:10:26 +0100
 Subject: [PATCH] Expose latency histograms via 'virConnectGetAllDomainStats'
 Add documentation and constants for constructing the stats field names
 for latency histograms and expose them in the qemu driver:
 Example:
  block.1.latency_histogram.read.bin.count=9
  block.1.latency_histogram.read.bin.0.start=0
  block.1.latency_histogram.read.bin.0.value=0
  block.1.latency_histogram.read.bin.1.start=10
  block.1.latency_histogram.read.bin.1.value=0
  block.1.latency_histogram.read.bin.2.start=100
  block.1.latency_histogram.read.bin.2.value=0
  block.1.latency_histogram.read.bin.3.start=1000
  block.1.latency_histogram.read.bin.3.value=1047
  block.1.latency_histogram.read.bin.4.start=10000
  block.1.latency_histogram.read.bin.4.value=2131
  block.1.latency_histogram.read.bin.5.start=100000
  block.1.latency_histogram.read.bin.5.value=0
  block.1.latency_histogram.read.bin.6.start=1000000
  block.1.latency_histogram.read.bin.6.value=0
  block.1.latency_histogram.read.bin.7.start=10000000
  block.1.latency_histogram.read.bin.7.value=0
  block.1.latency_histogram.read.bin.8.start=100000000
  block.1.latency_histogram.read.bin.8.value=0
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 237e49127a9390f054e33e689ba9db1587cdc9f1)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 docs/manpages/virsh.rst          |   7 ++
 include/libvirt/libvirt-domain.h | 113 +++++++++++++++++++++++++++++++
 src/qemu/qemu_driver.c           |  43 ++++++++++++
 3 files changed, 163 insertions(+)
 diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst
 index a9d691824e..ff0cf1a715 100644
 --- a/docs/manpages/virsh.rst
 +++ b/docs/manpages/virsh.rst
@@ -2811,6 +2811,13 @@ Information listed includes:
   pending write operations in the defined interval
 * ``block.<num>.timed_group.<num>.zone_append_queue_depth_avg`` - average number
   of pending zone append operations in the defined interval
 +* ``block.<num>.latency_histogram.<type>.bin.count`` - number of bins in
 +  latency histogram. <type> is one of ``read``, ``write``, ``zone_append``, or
 +  ``flush``
 +* ``block.<num>.latency_histogram.<type>.bin.<num>.start`` start boundary of
 +  a latency histogram bin in nanoseconds of given operation duration
 +* ``block.<num>.latency_histogram.<type>.bin.<num>.value`` current number of
 +  events corresponding to the given bin and type
 *--iothread* returns information about IOThreads on the running guest
 diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
 index 16fac6b085..8e62bd23d4 100644
 --- a/include/libvirt/libvirt-domain.h
 +++ b/include/libvirt/libvirt-domain.h
@@ -3815,6 +3815,119 @@ struct _virDomainStatsRecord {
  */
 # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_ZONE_APPEND_QUEUE_DEPTH_AVG ".zone_append_queue_depth_avg"
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_READ_PREFIX:
 + *
 + * The parameter name prefix to access 'read' latency histograms. Concatenate
 + * the prefix with either:
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT
 + *    to get the number of bins in given histogram
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX and
 + *    entry number formatted as an unsigned integer and one of the latency
 + *    histogram suffix parameters to compelte a full bin parameter name
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_READ_PREFIX ".latency_histogram.read."
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_WRITE_PREFIX:
 + *
 + * The parameter name prefix to access 'write' latency histograms. Concatenate
 + * the prefix with either:
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT
 + *    to get the number of bins in given histogram
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX and
 + *    entry number formatted as an unsigned integer and one of the latency
 + *    histogram suffix parameters to compelte a full bin parameter name
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_WRITE_PREFIX ".latency_histogram.write."
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_ZONE_APPEND_PREFIX:
 + *
 + * The parameter name prefix to access 'zone_append' latency histograms. Concatenate
 + * the prefix with either:
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT
 + *    to get the number of bins in given histogram
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX and
 + *    entry number formatted as an unsigned integer and one of the latency
 + *    histogram suffix parameters to compelte a full bin parameter name
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_ZONE_APPEND_PREFIX ".latency_histogram.zone_append."
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_FLUSH_PREFIX:
 + *
 + * The parameter name prefix to access 'flush' latency histograms. Concatenate
 + * the prefix with either:
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT
 + *    to get the number of bins in given histogram
 + *  - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX and
 + *    entry number formatted as an unsigned integer and one of the latency
 + *    histogram suffix parameters to compelte a full bin parameter name
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_FLUSH_PREFIX ".latency_histogram.flush."
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT:
 + *
 + * The parameter name suffix to access number of bins in one of the following
 + * latency histogram types:
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_READ_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_WRITE_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_ZONE_APPEND_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_FLUSH_PREFIX
 + *
 + * Number of bins in latency histogram as unsigned long long.
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT "bin.count"
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX:
 + *
 + * The parameter name suffix to access a latency histogram bin in one of the
 + * following latency histogram types:
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_READ_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_WRITE_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_ZONE_APPEND_PREFIX
 + *   - VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_FLUSH_PREFIX
 + *
 + * Concatenate with a bin number as unsigned int and one of the other field
 + * suffixes to access bin parameters.
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX "bin."
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_START:
 + *
 + * Start of the current latency histogram bin in nanoseconds as unsigned long long.
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_START ".start"
 +
 +/**
 + * VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_VALUE:
 + *
 + * Current value of the number of occurences of the latency within this bin
 + * as unsigned long long.
 + *
 + * Since: 12.1.0
 + */
 +# define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_VALUE ".value"
 +
 +
 /**
  * VIR_DOMAIN_STATS_PERF_CMT:
  *
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
 index 08a547c546..f3e7410f9e 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
@@ -17597,6 +17597,36 @@ qemuDomainGetStatsBlockExportBackendStorage(const char *entryname,
 }
 +static void
 +qemuDomainGetStatsBlockExportFrontendLatencyHistogram(struct qemuBlockStatsLatencyHistogram *h,
 +                                                      size_t disk_idx,
 +                                                      const char *prefix_hist,
 +                                                      virTypedParamList *par)
 +{
 +    size_t i;
 +
 +    if (!h)
 +        return;
 +
 +    virTypedParamListAddULLong(par, h->nbins,
 +                               VIR_DOMAIN_STATS_BLOCK_PREFIX "%zu%s" VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_COUNT,
 +                               disk_idx, prefix_hist);
 +
 +    for (i = 0; i < h->nbins; i++) {
 +        virTypedParamListAddULLong(par, h->bins[i].start,
 +                                   VIR_DOMAIN_STATS_BLOCK_PREFIX "%zu%s"
 +                                   VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX "%zu"
 +                                   VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_START,
 +                                   disk_idx, prefix_hist, i);
 +        virTypedParamListAddULLong(par, h->bins[i].value,
 +                                   VIR_DOMAIN_STATS_BLOCK_PREFIX "%zu%s"
 +                                   VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_PREFIX "%zu"
 +                                   VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_SUFFIX_BIN_SUFFIX_VALUE,
 +                                   disk_idx, prefix_hist, i);
 +    }
 +}
 +
 +
 static void
 qemuDomainGetStatsBlockExportFrontend(const char *frontendname,
                                       GHashTable *stats,
@@ -17721,6 +17751,19 @@ qemuDomainGetStatsBlockExportFrontend(const char *frontendname,
                                        idx, i);
         }
     }
 +
 +    qemuDomainGetStatsBlockExportFrontendLatencyHistogram(en->histogram_read, idx,
 +                                                          VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_READ_PREFIX,
 +                                                          par);
 +    qemuDomainGetStatsBlockExportFrontendLatencyHistogram(en->histogram_write, idx,
 +                                                          VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_WRITE_PREFIX,
 +                                                          par);
 +    qemuDomainGetStatsBlockExportFrontendLatencyHistogram(en->histogram_zone, idx,
 +                                                          VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_ZONE_APPEND_PREFIX,
 +                                                          par);
 +    qemuDomainGetStatsBlockExportFrontendLatencyHistogram(en->histogram_flush, idx,
 +                                                          VIR_DOMAIN_STATS_BLOCK_SUFFIX_LATENCY_HISTOGRAM_FLUSH_PREFIX,
 +                                                          par);
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-Introduce-support-for-disk-operation-latency-histogram-collection.patch
+++ b/centos-10/SOURCES/libvirt-Introduce-support-for-disk-operation-latency-histogram-collection.patch
@ -0,0 +1,422 @@
 From 8fbea435edb1635ec98c9419e9249223e5c3b2b6 Mon Sep 17 00:00:00 2001
 Message-ID: <8fbea435edb1635ec98c9419e9249223e5c3b2b6.1771336682.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Fri, 23 Jan 2026 17:09:27 +0100
 Subject: [PATCH] Introduce support for disk operation latency histogram
 collection
 Add config and docs allowing enabling latency histogram collection for
 block device operations.
 This patch sets up the docs, schema and XML infrastructure.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit b874c944bd8c4ffa6c51394557587c8c203f1656)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 docs/formatdomain.rst                         |  41 ++++++
 src/conf/domain_conf.c                        | 133 +++++++++++++++++-
 src/conf/domain_conf.h                        |   7 +
 src/conf/schemas/domaincommon.rng             |  37 ++++-
 ...isk-statistics-intervals.x86_64-latest.xml |  29 ++++
 .../disk-statistics-intervals.xml             |  25 ++++
 6 files changed, 262 insertions(+), 10 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 70882c6820..31232deb3c 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -3628,6 +3628,47 @@ paravirtualized driver is specified via the ``disk`` element.
       :since:`Since 11.9.0 (QEMU 10.2, virtio, ide, scsi disks only)`.
 +      Block operation latency histogram collection can be configured using
 +      ``<latency-histogram>`` sub-element. The histogram is collected for
 +      the whole runtime of the VM, but can be re-started or reconfigured using
 +      the `virDomainUpdateDeviceFlags <html/libvirt-libvirt-domain.html#virDomainUpdateDeviceFlags>`__
 +      API. Using the same config re-starts histogram collection.
 +
 +      The optional ``type`` attribute configures specific operation to collect
 +      the histogram for. Supported types are ``read``, ``write``, ``zone``, and
 +      ``flush``. If the ``type`` attribute is omitted the histogram collection
 +      bins bins apply to all of the aforementioned types, which can be overriden
 +      with specific config.
 +
 +      The ``<latency-histogram>`` has multiple mandatory ``<bin>`` sub-elements
 +      with mandatory ``start`` attribute configuring the starting boundary of
 +      the histogram bin configured in nanosecods of the operation duration and
 +      the intervals must be properly ordered and non-duplicate.
 +
 +      Example::
 +
 +        <driver name='qemu'>
 +          <statistics>
 +
 +            <latency-histogram>
 +              <bin start='0'/>
 +              <bin start='1000'/>
 +              <bin start='100000'/>
 +            </latency-histogram>
 +
 +         [or for specific operation types]
 +
 +            <latency-histogram type='read'>
 +              <bin start='0'/>
 +              <bin start='1000'/>
 +              <bin start='100000'/>
 +            </latency-histogram>
 +
 +          </statistics>
 +        </driver>
 +
 +      :since:`Since 12.1.0`.
 +
    -  The optional ``queues`` attribute specifies the number of virt queues for
       virtio-blk ( :since:`Since 3.9.0` ) or vhost-user-blk
       ( :since:`Since 7.1.0` )
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index f5c4d135a9..83c58ab5ff 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -2445,6 +2445,11 @@ virDomainDiskDefFree(virDomainDiskDef *def)
     virObjectUnref(def->privateData);
     g_slist_free_full(def->iothreads, (GDestroyNotify) virDomainIothreadMappingDefFree);
     g_free(def->statistics);
 +    g_free(def->histogram_boundaries);
 +    g_free(def->histogram_boundaries_read);
 +    g_free(def->histogram_boundaries_write);
 +    g_free(def->histogram_boundaries_zone);
 +    g_free(def->histogram_boundaries_flush);
     if (def->throttlefilters) {
         size_t i;
@@ -8307,6 +8312,91 @@ virDomainIothreadMappingDefParse(xmlNodePtr driverNode,
 }
 +static int
 +virDomainDiskDefDriverParseXMLHistogramOne(virDomainDiskDef *def,
 +                                           xmlNodePtr cur)
 +{
 +    g_autofree char *histogram_type = NULL;
 +    unsigned int **histogram_config = NULL;
 +    g_autoptr(GPtrArray) binNodes = virXMLNodeGetSubelementList(cur, "bin");
 +    size_t nbins = 0;
 +    size_t i;
 +
 +    if ((histogram_type = virXMLPropString(cur, "type"))) {
 +        if (STREQ(histogram_type, "read")) {
 +            histogram_config = &def->histogram_boundaries_read;
 +        } else if (STREQ(histogram_type, "write")) {
 +            histogram_config = &def->histogram_boundaries_write;
 +        } else if (STREQ(histogram_type, "zone")) {
 +            histogram_config = &def->histogram_boundaries_zone;
 +        } else if (STREQ(histogram_type, "flush")) {
 +            histogram_config = &def->histogram_boundaries_flush;
 +        } else {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                           _("unknown latency_histogram type '%1$s'"),
 +                           histogram_type);
 +            return -1;
 +        }
 +    } else {
 +        histogram_config = &def->histogram_boundaries;
 +    }
 +
 +    if (*histogram_config) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                       _("only one latency-histogram of a given type is supported"));
 +        return -1;
 +    }
 +
 +    if (binNodes->len == 0) {
 +        virReportError(VIR_ERR_XML_ERROR, "%s",
 +                       _("missing 'bin' elements for 'latency-histogram'"));
 +        return -1;
 +    }
 +
 +    *histogram_config = g_new0(unsigned int, binNodes->len + 1);
 +
 +    for (i = 0; i < binNodes->len; i++) {
 +        unsigned int val;
 +
 +        if (virXMLPropUInt(g_ptr_array_index(binNodes, i),
 +                           "start", 10,
 +                           VIR_XML_PROP_REQUIRED,
 +                           &val) < 0)
 +            return -1;
 +
 +        if (nbins > 0 &&
 +            (val == 0 ||
 +             val <= (*histogram_config)[nbins-1])) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                           _("the values of 'start' attribute of a 'latency-histogram' 'bin' configuration must be sorted and non-overlapping"));
 +            return -1;
 +        }
 +
 +        if (val > 0)
 +            (*histogram_config)[nbins++] = val;
 +    }
 +
 +    return 0;
 +}
 +
 +
 +static int
 +virDomainDiskDefDriverParseXMLHistograms(virDomainDiskDef *def,
 +                                         xmlNodePtr cur)
 +{
 +    g_autoptr(GPtrArray) histogramNodes = virXMLNodeGetSubelementList(cur, "latency-histogram");
 +    size_t i;
 +
 +    for (i = 0; i < histogramNodes->len; i++) {
 +        if (virDomainDiskDefDriverParseXMLHistogramOne(def,
 +                                                       g_ptr_array_index(histogramNodes, i)) < 0)
 +            return -1;
 +    }
 +
 +    return 0;
 +}
 +
 +
 static int
 virDomainDiskDefDriverParseXML(virDomainDiskDef *def,
                                xmlNodePtr cur)
@@ -8380,6 +8470,9 @@ virDomainDiskDefDriverParseXML(virDomainDiskDef *def,
                     return -1;
             }
         }
 +
 +        if (virDomainDiskDefDriverParseXMLHistograms(def, statisticsNode) < 0)
 +            return -1;
     }
     if (virXMLPropEnum(cur, "detect_zeroes",
@@ -23961,12 +24054,37 @@ virDomainDiskDefFormatThrottleFilters(virBuffer *buf,
 }
 +static void
 +virDomainDiskDefFormatDriverHistogram(virBuffer *buf,
 +                                      const char *type,
 +                                      unsigned int *bins)
 +{
 +    g_auto(virBuffer) histogramAttrBuf = VIR_BUFFER_INITIALIZER;
 +    g_auto(virBuffer) histogramChildBuf = VIR_BUFFER_INIT_CHILD(buf);
 +
 +    if (!bins || bins[0] == 0)
 +        return;
 +
 +    if (type)
 +        virBufferAsprintf(&histogramAttrBuf, " type='%s'", type);
 +
 +    /* we dont store the start boundary of the first bin but it's always there */
 +    virBufferAddLit(&histogramChildBuf, "<bin start='0'/>\n");
 +
 +    for (; *bins > 0; bins++)
 +        virBufferAsprintf(&histogramChildBuf, "<bin start='%u'/>\n", *bins);
 +
 +    virXMLFormatElement(buf, "latency-histogram", &histogramAttrBuf, &histogramChildBuf);
 +}
 +
 +
 static void
 virDomainDiskDefFormatDriver(virBuffer *buf,
                              virDomainDiskDef *disk)
 {
     g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER;
     g_auto(virBuffer) childBuf = VIR_BUFFER_INIT_CHILD(buf);
 +    g_auto(virBuffer) statisticsChildBuf = VIR_BUFFER_INIT_CHILD(&childBuf);
     virBufferEscapeString(&attrBuf, " name='%s'", virDomainDiskGetDriver(disk));
@@ -24038,16 +24156,25 @@ virDomainDiskDefFormatDriver(virBuffer *buf,
     virDomainIothreadMappingDefFormat(&childBuf, disk->iothreads);
     if (disk->statistics) {
 -        g_auto(virBuffer) statisticsChildBuf = VIR_BUFFER_INIT_CHILD(&childBuf);
         size_t i;
         for (i = 0; disk->statistics[i] > 0; i++)
             virBufferAsprintf(&statisticsChildBuf, "<statistic interval='%u'/>\n",
                               disk->statistics[i]);
 -
 -        virXMLFormatElement(&childBuf, "statistics", NULL, &statisticsChildBuf);
     }
 +    virDomainDiskDefFormatDriverHistogram(&statisticsChildBuf, NULL,
 +                                          disk->histogram_boundaries);
 +    virDomainDiskDefFormatDriverHistogram(&statisticsChildBuf, "read",
 +                                          disk->histogram_boundaries_read);
 +    virDomainDiskDefFormatDriverHistogram(&statisticsChildBuf, "write",
 +                                          disk->histogram_boundaries_write);
 +    virDomainDiskDefFormatDriverHistogram(&statisticsChildBuf, "zone",
 +                                          disk->histogram_boundaries_zone);
 +    virDomainDiskDefFormatDriverHistogram(&statisticsChildBuf, "flush",
 +                                          disk->histogram_boundaries_flush);
 +
 +    virXMLFormatElement(&childBuf, "statistics", NULL, &statisticsChildBuf);
     virXMLFormatElement(buf, "driver", &attrBuf, &childBuf);
 }
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index 8f53ed96c0..b120d4a68e 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -596,6 +596,13 @@ struct _virDomainDiskDef {
     GSList *iothreads; /* List of virDomainIothreadMappingDef */
     unsigned int *statistics; /* Optional, zero terminated list of intervals to
                                 collect statistics for */
 +    /* optional zero terminated lists of bin boundaries for latency histograms */
 +    unsigned int *histogram_boundaries;
 +    unsigned int *histogram_boundaries_read;
 +    unsigned int *histogram_boundaries_write;
 +    unsigned int *histogram_boundaries_zone;
 +    unsigned int *histogram_boundaries_flush;
 +
     virDomainDiskDetectZeroes detect_zeroes;
     virTristateSwitch discard_no_unref;
     char *domain_name; /* backend domain name */
 diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
 index 1f9ac102a0..441328a08e 100644
 --- a/src/conf/schemas/domaincommon.rng
 +++ b/src/conf/schemas/domaincommon.rng
@@ -2728,13 +2728,36 @@
         </optional>
         <optional>
           <element name="statistics">
 -            <zeroOrMore>
 -              <element name="statistic">
 -                <attribute name="interval">
 -                  <ref name="unsignedInt"/>
 -                </attribute>
 -              </element>
 -            </zeroOrMore>
 +            <interleave>
 +              <zeroOrMore>
 +                <element name="statistic">
 +                  <attribute name="interval">
 +                    <ref name="unsignedInt"/>
 +                  </attribute>
 +                </element>
 +              </zeroOrMore>
 +              <zeroOrMore>
 +                <element name="latency-histogram">
 +                  <optional>
 +                    <attribute name='type'>
 +                      <choice>
 +                        <value>read</value>
 +                        <value>write</value>
 +                        <value>zone</value>
 +                        <value>flush</value>
 +                      </choice>
 +                    </attribute>
 +                  </optional>
 +                  <oneOrMore>
 +                    <element name='bin'>
 +                      <attribute name='start'>
 +                        <ref name="unsignedInt"/>
 +                      </attribute>
 +                    </element>
 +                  </oneOrMore>
 +                </element>
 +              </zeroOrMore>
 +            </interleave>
           </element>
         </optional>
       </interleave>
 diff --git a/tests/qemuxmlconfdata/disk-statistics-intervals.x86_64-latest.xml b/tests/qemuxmlconfdata/disk-statistics-intervals.x86_64-latest.xml
 index 4c55c50ef5..d02f954073 100644
 --- a/tests/qemuxmlconfdata/disk-statistics-intervals.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/disk-statistics-intervals.x86_64-latest.xml
@@ -22,6 +22,11 @@
         <statistics>
           <statistic interval='3'/>
           <statistic interval='10'/>
 +          <latency-histogram>
 +            <bin start='0'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
         </statistics>
       </driver>
       <source file='/var/lib/libvirt/images/iothrtest1.img'/>
@@ -33,6 +38,30 @@
         <statistics>
           <statistic interval='5'/>
           <statistic interval='15'/>
 +          <latency-histogram type='read'>
 +            <bin start='0'/>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='write'>
 +            <bin start='0'/>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='zone'>
 +            <bin start='0'/>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='flush'>
 +            <bin start='0'/>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
         </statistics>
       </driver>
       <source file='/var/lib/libvirt/images/iothrtest2.img'/>
 diff --git a/tests/qemuxmlconfdata/disk-statistics-intervals.xml b/tests/qemuxmlconfdata/disk-statistics-intervals.xml
 index f5e801f5a8..5f9e9470d7 100644
 --- a/tests/qemuxmlconfdata/disk-statistics-intervals.xml
 +++ b/tests/qemuxmlconfdata/disk-statistics-intervals.xml
@@ -19,6 +19,11 @@
         <statistics>
           <statistic interval='3'/>
           <statistic interval='10'/>
 +          <latency-histogram>
 +            <bin start='0'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
         </statistics>
       </driver>
       <source file='/var/lib/libvirt/images/iothrtest1.img'/>
@@ -29,6 +34,26 @@
         <statistics>
           <statistic interval='5'/>
           <statistic interval='15'/>
 +          <latency-histogram type='read'>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='write'>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='zone'>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
 +          <latency-histogram type='flush'>
 +            <bin start='10'/>
 +            <bin start='20'/>
 +            <bin start='30'/>
 +          </latency-histogram>
         </statistics>
       </driver>
       <source file='/var/lib/libvirt/images/iothrtest2.img'/>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-RHEL-ONLY-backport-test-data-for-migrate-pr-capability-of-scsi-block.patch
+++ b/centos-10/SOURCES/libvirt-RHEL-ONLY-backport-test-data-for-migrate-pr-capability-of-scsi-block.patch
@ -0,0 +1,125 @@
 From c2eb6d70891d9be5ce13f07946841239a81c3ed9 Mon Sep 17 00:00:00 2001
 Message-ID: <c2eb6d70891d9be5ce13f07946841239a81c3ed9.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 16 Feb 2026 15:08:54 +0100
 Subject: [PATCH] RHEL-ONLY: backport test data for 'migrate-pr' capability of
 'scsi-block'
 In upstream qemu the capability is present starting with qemu-11.0. We
 don't have the test data downstream and backporting them would be too
 invasive. Backport the relevant capability detection as a
 downstream-only fix.
 https://issues.redhat.com/browse/RHEL-140614 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-135115 [rhel-10.2]
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 ---
 .../caps_10.2.0_x86_64.replies                | 79 ++++++++++++++++++-
 .../caps_10.2.0_x86_64.xml                    |  1 +
 2 files changed, 76 insertions(+), 4 deletions(-)
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.replies b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.replies
 index cb4abb4533..10db9baca1 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.replies
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.replies
@@ -33081,10 +33081,81 @@
 }
 {
 -  "error": {
 -    "class": "DeviceNotFound",
 -    "desc": "The libvirt device dump was not collected for this version+device tuple"
 -  },
 +  "return": [
 +    {
 +      "default-value": 4294967295,
 +      "name": "scsi-id",
 +      "type": "uint32"
 +    },
 +    {
 +      "default-value": 4294967295,
 +      "name": "lun",
 +      "type": "uint32"
 +    },
 +    {
 +      "default-value": 0,
 +      "name": "channel",
 +      "type": "uint32"
 +    },
 +    {
 +      "default-value": "auto",
 +      "name": "rerror",
 +      "description": "Error handling policy (report/ignore/enospc/stop/auto)",
 +      "type": "BlockdevOnError"
 +    },
 +    {
 +      "default-value": 2147483647,
 +      "name": "max_io_size",
 +      "type": "uint64"
 +    },
 +    {
 +      "default-value": false,
 +      "name": "share-rw",
 +      "description": "on/off",
 +      "type": "bool"
 +    },
 +    {
 +      "default-value": true,
 +      "name": "migrate-pr",
 +      "description": "on/off",
 +      "type": "bool"
 +    },
 +    {
 +      "default-value": "auto",
 +      "name": "werror",
 +      "description": "Error handling policy (report/ignore/enospc/stop/auto)",
 +      "type": "BlockdevOnError"
 +    },
 +    {
 +      "default-value": 1073741824,
 +      "name": "max_unmap_size",
 +      "type": "uint64"
 +    },
 +    {
 +      "default-value": -1,
 +      "name": "scsi_version",
 +      "type": "int32"
 +    },
 +    {
 +      "default-value": 0,
 +      "name": "rotation_rate",
 +      "type": "uint16"
 +    },
 +    {
 +      "name": "drive",
 +      "description": "Node name or ID of a block device to use as a backend",
 +      "type": "str"
 +    },
 +    {
 +      "default-value": 30,
 +      "name": "io_timeout",
 +      "type": "uint32"
 +    },
 +    {
 +      "name": "bootindex",
 +      "type": "int32"
 +    }
 +  ],
   "id": "libvirt-37"
 }
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 index 7cff2c2291..7d5a75ce88 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
@@ -215,6 +215,7 @@
   <flag name='acpi-generic-initiator'/>
   <flag name='disk-timed-stats'/>
   <flag name='query-accelerators'/>
 +  <flag name='scsi-block.migrate-pr'/>
   <version>10001091</version>
   <microcodeVersion>43100287</microcodeVersion>
   <package>v10.2.0-rc1-38-gfb241d0a1f</package>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Add-firmwareFeatures-element-for-domaincaps.patch
+++ b/centos-10/SOURCES/libvirt-conf-Add-firmwareFeatures-element-for-domaincaps.patch
@ -0,0 +1,85 @@
 From 271cfe0d7954d5398af307b24fc5b601977975b8 Mon Sep 17 00:00:00 2001
 Message-ID: <271cfe0d7954d5398af307b24fc5b601977975b8.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 9 Feb 2026 21:28:50 +0100
 Subject: [PATCH] conf: Add firmwareFeatures element for domaincaps
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 928bdc3e67b29ff2314ff538905703e299b1e47e)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_capabilities.c | 15 +++++++++++++++
 src/conf/domain_capabilities.h |  8 ++++++++
 2 files changed, 23 insertions(+)
 diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c
 index 49179b97ab..9b3577cd08 100644
 --- a/src/conf/domain_capabilities.c
 +++ b/src/conf/domain_capabilities.c
@@ -422,6 +422,19 @@ virDomainCapsFeatureFormatSimple(virBuffer *buf,
 }
 +static void
 +virDomainCapsFirmwareFeaturesFormat(virBuffer *buf,
 +                                    const virDomainCapsFirmwareFeatures *firmwareFeatures)
 +{
 +    FORMAT_PROLOGUE(firmwareFeatures);
 +
 +    ENUM_PROCESS(firmwareFeatures, secureBoot, virTristateBoolTypeToString);
 +    ENUM_PROCESS(firmwareFeatures, enrolledKeys, virTristateBoolTypeToString);
 +
 +    FORMAT_EPILOGUE(firmwareFeatures);
 +}
 +
 +
 static void
 virDomainCapsLoaderFormat(virBuffer *buf,
                           const virDomainCapsLoader *loader)
@@ -440,12 +453,14 @@ static void
 virDomainCapsOSFormat(virBuffer *buf,
                       const virDomainCapsOS *os)
 {
 +    const virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures;
     const virDomainCapsLoader *loader = &os->loader;
     FORMAT_PROLOGUE(os);
     ENUM_PROCESS(os, firmware, virDomainOsDefFirmwareTypeToString);
 +    virDomainCapsFirmwareFeaturesFormat(&childBuf, firmwareFeatures);
     virDomainCapsLoaderFormat(&childBuf, loader);
     FORMAT_EPILOGUE(os);
 diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
 index b10370db8f..a68fafe235 100644
 --- a/src/conf/domain_capabilities.h
 +++ b/src/conf/domain_capabilities.h
@@ -43,6 +43,13 @@ struct _virDomainCapsStringValues {
     size_t nvalues; /* number of strings */
 };
 +typedef struct _virDomainCapsFirmwareFeatures virDomainCapsFirmwareFeatures;
 +struct _virDomainCapsFirmwareFeatures {
 +    virTristateBool supported;
 +    virDomainCapsEnum secureBoot;
 +    virDomainCapsEnum enrolledKeys;
 +};
 +
 STATIC_ASSERT_ENUM(VIR_DOMAIN_LOADER_TYPE_LAST);
 STATIC_ASSERT_ENUM(VIR_TRISTATE_BOOL_LAST);
 typedef struct _virDomainCapsLoader virDomainCapsLoader;
@@ -59,6 +66,7 @@ typedef struct _virDomainCapsOS virDomainCapsOS;
 struct _virDomainCapsOS {
     virTristateBool supported;
     virDomainCapsEnum firmware;     /* Info about virDomainOsDefFirmware */
 +    virDomainCapsFirmwareFeatures firmwareFeatures;
     virDomainCapsLoader loader;     /* Info about virDomainLoaderDef */
 };
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Include-varstore-element-in-domcaps.patch
+++ b/centos-10/SOURCES/libvirt-conf-Include-varstore-element-in-domcaps.patch
@ -0,0 +1,140 @@
 From af94300604718604a70a5d587e56187ffe5e6557 Mon Sep 17 00:00:00 2001
 Message-ID: <af94300604718604a70a5d587e56187ffe5e6557.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 30 Jan 2026 17:46:30 +0100
 Subject: [PATCH] conf: Include varstore element in domcaps
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We want to advertise whether the element is usable when
 defining new domains.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 3d6987914bb10beb11b9eb5e83ec2194dfab1659)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 docs/formatdomaincaps.rst       |  7 +++++++
 src/conf/domain_capabilities.c  | 10 ++++++++++
 src/conf/domain_capabilities.h  |  6 ++++++
 src/conf/schemas/domaincaps.rng |  9 +++++++++
 4 files changed, 32 insertions(+)
 diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
 index 3426b7c9cd..5a1d3f2670 100644
 --- a/docs/formatdomaincaps.rst
 +++ b/docs/formatdomaincaps.rst
@@ -141,6 +141,7 @@ domains.
            <value>no</value>
          </enum>
        </loader>
 +       <varstore supported='yes'/>
      </os>
      ...
    <domainCapabilities>
@@ -227,6 +228,12 @@ are the following:
    possible to enforce Secure Boot, look at the ``enrolledKeys`` enum inside
    the ``<firmwareFeatures/>`` element instead.
 +The ``<varstore/>`` element :since:`(since 12.1.0)` indicates whether UEFI
 +variable storage backed by the ``uefi-vars`` QEMU device can be used as an
 +alternative to pflash-based NVRAM storage. This is the only type of variable
 +storage compatible with Secure Boot on non-x86 architectures, but it can be
 +used on x86 too.
 +
 CPU configuration
 ~~~~~~~~~~~~~~~~~
 diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c
 index 9b3577cd08..78b8e6e6e1 100644
 --- a/src/conf/domain_capabilities.c
 +++ b/src/conf/domain_capabilities.c
@@ -449,12 +449,21 @@ virDomainCapsLoaderFormat(virBuffer *buf,
     FORMAT_EPILOGUE(loader);
 }
 +static void
 +virDomainCapsVarstoreFormat(virBuffer *buf,
 +                            const virDomainCapsVarstore *varstore)
 +{
 +    FORMAT_PROLOGUE(varstore);
 +    FORMAT_EPILOGUE(varstore);
 +}
 +
 static void
 virDomainCapsOSFormat(virBuffer *buf,
                       const virDomainCapsOS *os)
 {
     const virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures;
     const virDomainCapsLoader *loader = &os->loader;
 +    const virDomainCapsVarstore *varstore = &os->varstore;
     FORMAT_PROLOGUE(os);
@@ -462,6 +471,7 @@ virDomainCapsOSFormat(virBuffer *buf,
     virDomainCapsFirmwareFeaturesFormat(&childBuf, firmwareFeatures);
     virDomainCapsLoaderFormat(&childBuf, loader);
 +    virDomainCapsVarstoreFormat(&childBuf, varstore);
     FORMAT_EPILOGUE(os);
 }
 diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
 index a68fafe235..02344fd9b6 100644
 --- a/src/conf/domain_capabilities.h
 +++ b/src/conf/domain_capabilities.h
@@ -61,6 +61,11 @@ struct _virDomainCapsLoader {
     virDomainCapsEnum secure;   /* Info about secure:virTristateBool */
 };
 +typedef struct _virDomainCapsVarstore virDomainCapsVarstore;
 +struct _virDomainCapsVarstore {
 +    virTristateBool supported;
 +};
 +
 STATIC_ASSERT_ENUM(VIR_DOMAIN_OS_DEF_FIRMWARE_LAST);
 typedef struct _virDomainCapsOS virDomainCapsOS;
 struct _virDomainCapsOS {
@@ -68,6 +73,7 @@ struct _virDomainCapsOS {
     virDomainCapsEnum firmware;     /* Info about virDomainOsDefFirmware */
     virDomainCapsFirmwareFeatures firmwareFeatures;
     virDomainCapsLoader loader;     /* Info about virDomainLoaderDef */
 +    virDomainCapsVarstore varstore;
 };
 STATIC_ASSERT_ENUM(VIR_DOMAIN_MEMORY_SOURCE_LAST);
 diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng
 index 3b24caeca6..4682abbf41 100644
 --- a/src/conf/schemas/domaincaps.rng
 +++ b/src/conf/schemas/domaincaps.rng
@@ -87,6 +87,12 @@
     </element>
   </define>
 +  <define name="varstore">
 +    <element name="varstore">
 +      <ref name="supported"/>
 +    </element>
 +  </define>
 +
   <define name="os">
     <element name="os">
       <interleave>
@@ -98,6 +104,9 @@
         <optional>
           <ref name="loader"/>
         </optional>
 +        <optional>
 +          <ref name="varstore"/>
 +        </optional>
       </interleave>
     </element>
   </define>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Introduce-iommufd-enum-for-domaincaps.patch
+++ b/centos-10/SOURCES/libvirt-conf-Introduce-iommufd-enum-for-domaincaps.patch
@ -0,0 +1,69 @@
 From c0fbd0d516a2c4457789d158bfdea839255d0854 Mon Sep 17 00:00:00 2001
 Message-ID: <c0fbd0d516a2c4457789d158bfdea839255d0854.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 06:14:20 +0100
 Subject: [PATCH] conf: Introduce iommufd enum for domaincaps
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 855f8fe9e2454555ba84696750e0e1501dd5ba80)
 Resolves: https://issues.redhat.com/browse/RHEL-148135
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 docs/formatdomaincaps.rst      | 7 +++++++
 src/conf/domain_capabilities.c | 1 +
 src/conf/domain_capabilities.h | 1 +
 3 files changed, 9 insertions(+)
 diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
 index 8b4f0ecff3..6ba7f84f96 100644
 --- a/docs/formatdomaincaps.rst
 +++ b/docs/formatdomaincaps.rst
@@ -461,6 +461,10 @@ Well, only if the following is enabled:
            <value>vfio</value>
            <value>xen</value>
          </enum>
 +         <enum name='iommufd'>
 +           <value>yes</value>
 +           <value>no</value>
 +         </enum>
        </hostdev>
      </devices>
    </domainCapabilities>
@@ -477,6 +481,9 @@ Well, only if the following is enabled:
    ``mode="capabilities"``.
 ``pciBackend``
    Options for the ``name`` attribute of the <driver/> element.
 +``iommufd``
 +   Options for the ``iommufd`` attribute of the <driver/> element.
 +   :since:`Since 12.1.0`
 RNG device
 ^^^^^^^^^^
 diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c
 index f843124695..49179b97ab 100644
 --- a/src/conf/domain_capabilities.c
 +++ b/src/conf/domain_capabilities.c
@@ -620,6 +620,7 @@ virDomainCapsDeviceHostdevFormat(virBuffer *buf,
     ENUM_PROCESS(hostdev, subsysType, virDomainHostdevSubsysTypeToString);
     ENUM_PROCESS(hostdev, capsType, virDomainHostdevCapsTypeToString);
     ENUM_PROCESS(hostdev, pciBackend, virDeviceHostdevPCIDriverNameTypeToString);
 +    ENUM_PROCESS(hostdev, iommufd, virTristateBoolTypeToString);
     FORMAT_EPILOGUE(hostdev);
 }
 diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
 index 437981c711..b10370db8f 100644
 --- a/src/conf/domain_capabilities.h
 +++ b/src/conf/domain_capabilities.h
@@ -108,6 +108,7 @@ struct _virDomainCapsDeviceHostdev {
     virDomainCapsEnum subsysType;       /* Info about virDomainHostdevSubsysType */
     virDomainCapsEnum capsType;         /* Info about virDomainHostdevCapsType */
     virDomainCapsEnum pciBackend;       /* Info about virDomainHostdevSubsysPCIBackendType */
 +    virDomainCapsEnum iommufd;          /* Info about iommufd:virTristateBool */
     /* add new fields here */
 };
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Introduce-virDomainDefHasPCIHostdevWithIOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-conf-Introduce-virDomainDefHasPCIHostdevWithIOMMUFD.patch
@ -0,0 +1,132 @@
 From 4e8fe2eb42b47a55e491a63e2600a24e0501fd1f Mon Sep 17 00:00:00 2001
 Message-ID: <4e8fe2eb42b47a55e491a63e2600a24e0501fd1f.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 18:19:56 +0100
 Subject: [PATCH] conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4b176cfc3877cca882d63ab4ed446794d7a05722)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/conf/domain_conf.c   | 14 ++++++++++++++
 src/conf/domain_conf.h   |  3 +++
 src/libvirt_private.syms |  1 +
 src/qemu/qemu_command.c  | 42 ++++++++++++----------------------------
 4 files changed, 30 insertions(+), 30 deletions(-)
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 9ae48e9abc..cb047e5a3e 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -32482,6 +32482,20 @@ virDomainDefHasPCIHostdev(const virDomainDef *def)
 }
 +bool
 +virDomainDefHasPCIHostdevWithIOMMUFD(const virDomainDef *def)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < def->nhostdevs; i++) {
 +        if (virHostdevIsPCIDeviceWithIOMMUFD(def->hostdevs[i]))
 +            return true;
 +    }
 +
 +    return false;
 +}
 +
 +
 bool
 virDomainDefHasMdevHostdev(const virDomainDef *def)
 {
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index d958ed04f9..69a8e79c6d 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -4655,6 +4655,9 @@ virDomainDefHasNVMeDisk(const virDomainDef *def);
 bool
 virDomainDefHasPCIHostdev(const virDomainDef *def);
 +bool
 +virDomainDefHasPCIHostdevWithIOMMUFD(const virDomainDef *def);
 +
 bool
 virDomainDefHasMdevHostdev(const virDomainDef *def);
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 863e50ec4f..effe44fe57 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -348,6 +348,7 @@ virDomainDefHasNVMeDisk;
 virDomainDefHasOldStyleROUEFI;
 virDomainDefHasOldStyleUEFI;
 virDomainDefHasPCIHostdev;
 +virDomainDefHasPCIHostdevWithIOMMUFD;
 virDomainDefHasTimer;
 virDomainDefHasUSB;
 virDomainDefHasVcpusOffline;
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index c8626e6d49..3119191413 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -5349,43 +5349,25 @@ qemuBuildIOMMUFDCommandLine(virCommand *cmd,
                             const virDomainDef *def,
                             virDomainObj *vm)
 {
 -    size_t i;
     qemuDomainObjPrivate *priv = vm->privateData;
     g_autofree char *fdstr = g_strdup_printf("%d", priv->iommufd);
 +    g_autoptr(virJSONValue) props = NULL;
 +    if (!virDomainDefHasPCIHostdevWithIOMMUFD(def))
 +        return 0;
 -    for (i = 0; i < def->nhostdevs; i++) {
 -        virDomainHostdevDef *hostdev = def->hostdevs[i];
 -        virDomainHostdevSubsys *subsys = &hostdev->source.subsys;
 -        g_autoptr(virJSONValue) props = NULL;
 +    virCommandPassFD(cmd, priv->iommufd, VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 -        if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
 -            continue;
 +    priv->iommufd = -1;
 -        if (subsys->type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI)
 -            continue;
 +    if (qemuMonitorCreateObjectProps(&props, "iommufd",
 +                                     "iommufd0",
 +                                     "S:fd", fdstr,
 +                                     NULL) < 0)
 +        return -1;
 -        if (hostdev->info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_UNASSIGNED)
 -            continue;
 -
 -        if (subsys->u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES)
 -            continue;
 -
 -        virCommandPassFD(cmd, priv->iommufd, VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 -
 -        priv->iommufd = -1;
 -
 -        if (qemuMonitorCreateObjectProps(&props, "iommufd",
 -                                         "iommufd0",
 -                                         "S:fd", fdstr,
 -                                         NULL) < 0)
 -            return -1;
 -
 -        if (qemuBuildObjectCommandlineFromJSON(cmd, props) < 0)
 -            return -1;
 -
 -        break;
 -    }
 +    if (qemuBuildObjectCommandlineFromJSON(cmd, props) < 0)
 +        return -1;
     return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Introduce-virHostdevIsPCIDeviceWithIOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-conf-Introduce-virHostdevIsPCIDeviceWithIOMMUFD.patch
@ -0,0 +1,89 @@
 From 615f11792c8988cfd6a30717dcc8d5d9174ea508 Mon Sep 17 00:00:00 2001
 Message-ID: <615f11792c8988cfd6a30717dcc8d5d9174ea508.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 18:19:23 +0100
 Subject: [PATCH] conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 97eed30948e980be8b7552fff637e828768854e4)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/conf/domain_conf.c   | 15 +++++++++++++++
 src/conf/domain_conf.h   |  3 +++
 src/libvirt_private.syms |  1 +
 src/qemu/qemu_process.c  |  5 +----
 4 files changed, 20 insertions(+), 4 deletions(-)
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 83c58ab5ff..9ae48e9abc 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -32758,6 +32758,21 @@ virHostdevIsPCIDevice(const virDomainHostdevDef *hostdev)
 }
 +/**
 + * virHostdevIsPCIDeviceWithIOMMUFD:
 + * @hostdev: host device to check
 + *
 + * Returns true if @hostdev is a PCI device with IOMMUFD enabled, false otherwise.
 + */
 +bool
 +virHostdevIsPCIDeviceWithIOMMUFD(const virDomainHostdevDef *hostdev)
 +{
 +    return virHostdevIsPCIDevice(hostdev) &&
 +        hostdev->source.subsys.u.pci.driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 +        hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES;
 +}
 +
 +
 static void
 virDomainObjGetMessagesIOErrorsSrc(virStorageSource *src,
                                    const char *diskdst,
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index b120d4a68e..d958ed04f9 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -4713,6 +4713,9 @@ virHostdevIsMdevDevice(const virDomainHostdevDef *hostdev)
 bool
 virHostdevIsPCIDevice(const virDomainHostdevDef *hostdev)
     ATTRIBUTE_NONNULL(1);
 +bool
 +virHostdevIsPCIDeviceWithIOMMUFD(const virDomainHostdevDef *hostdev)
 +    ATTRIBUTE_NONNULL(1);
 void
 virDomainObjGetMessagesIOErrorsChain(virStorageSource *src,
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 9ae44e31b8..863e50ec4f 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -812,6 +812,7 @@ virDomainQemuMonitorEventNew;
 virDomainQemuMonitorEventStateRegisterID;
 virHostdevIsMdevDevice;
 virHostdevIsPCIDevice;
 +virHostdevIsPCIDeviceWithIOMMUFD;
 virHostdevIsSCSIDevice;
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 7e32325fa0..3bd81c55b3 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7732,10 +7732,7 @@ qemuProcessOpenVfioFds(virDomainObj *vm)
     for (i = 0; i < vm->def->nhostdevs; i++) {
         virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 -        if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
 -            hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI &&
 -            hostdev->source.subsys.u.pci.driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 -            hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 +        if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
             /* Open VFIO device FD */
             if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
                 return -1;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Move-type-rom-default-for-loader-to-drivers.patch
+++ b/centos-10/SOURCES/libvirt-conf-Move-type-rom-default-for-loader-to-drivers.patch
@ -0,0 +1,104 @@
 From 08ff36546b810ae14135c19c99fb1dc1aa5fcbb2 Mon Sep 17 00:00:00 2001
 Message-ID: <08ff36546b810ae14135c19c99fb1dc1aa5fcbb2.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 3 Feb 2026 15:18:39 +0100
 Subject: [PATCH] conf: Move type=rom default for loader to drivers
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Right now we set this default in the common parsing code, which
 is not a big problem per se but would get in the way of some
 upcoming changes.
 Leave this choice to individual drivers instead. Only the QEMU
 and Xen drivers use the value for anything, so we can limit the
 amount of code duplication this change causes.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 1504b7f687bdfc679377e605d076776b18533468)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_postparse.c | 19 -------------------
 src/libxl/libxl_domain.c    |  6 ++++++
 src/qemu/qemu_firmware.c    |  5 +++++
 3 files changed, 11 insertions(+), 19 deletions(-)
 diff --git a/src/conf/domain_postparse.c b/src/conf/domain_postparse.c
 index 38e731348d..cbaae75c02 100644
 --- a/src/conf/domain_postparse.c
 +++ b/src/conf/domain_postparse.c
@@ -89,22 +89,6 @@ virDomainDefPostParseMemory(virDomainDef *def,
 }
 -static int
 -virDomainDefPostParseOs(virDomainDef *def)
 -{
 -    if (!def->os.loader)
 -        return 0;
 -
 -    if (def->os.loader->path &&
 -        def->os.loader->type == VIR_DOMAIN_LOADER_TYPE_NONE) {
 -        /* By default, loader is type of 'rom' */
 -        def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM;
 -    }
 -
 -    return 0;
 -}
 -
 -
 static void
 virDomainDefPostParseMemtune(virDomainDef *def)
 {
@@ -1251,9 +1235,6 @@ virDomainDefPostParseCommon(virDomainDef *def,
     if (virDomainDefPostParseMemory(def, data->parseFlags) < 0)
         return -1;
 -    if (virDomainDefPostParseOs(def) < 0)
 -        return -1;
 -
     virDomainDefPostParseMemtune(def);
     if (virDomainDefRejectDuplicateControllers(def) < 0)
 diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c
 index 9842d6fece..c6717e31cf 100644
 --- a/src/libxl/libxl_domain.c
 +++ b/src/libxl/libxl_domain.c
@@ -279,6 +279,12 @@ libxlDomainDefPostParse(virDomainDef *def,
             def->features[VIR_DOMAIN_FEATURE_ACPI] = VIR_TRISTATE_SWITCH_ON;
     }
 +    if (def->os.loader &&
 +        def->os.loader->path &&
 +        !def->os.loader->type) {
 +        def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM;
 +    }
 +
     /* add implicit balloon device */
     if (def->memballoon == NULL) {
         virDomainMemballoonDef *memballoon;
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 519828f6f9..6a074055ca 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1662,6 +1662,11 @@ qemuFirmwareFillDomainCustom(virDomainDef *def)
     if (!loader)
         return;
 +    if (loader->path &&
 +        !loader->type) {
 +        loader->type = VIR_DOMAIN_LOADER_TYPE_ROM;
 +    }
 +
     if (loader->path &&
         !loader->format) {
         loader->format = VIR_STORAGE_FILE_RAW;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Parse-and-format-varstore-element.patch
+++ b/centos-10/SOURCES/libvirt-conf-Parse-and-format-varstore-element.patch
@ -0,0 +1,385 @@
 From 50a7a37ea4d6c8ffab8110a58db1b16b9d1d7b84 Mon Sep 17 00:00:00 2001
 Message-ID: <50a7a37ea4d6c8ffab8110a58db1b16b9d1d7b84.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 19 Jan 2026 14:20:06 +0100
 Subject: [PATCH] conf: Parse and format varstore element
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This will be used to configure the backing storage used by the
 uefi-vars QEMU device.
 Dealing with the element itself is trivial, however we have to
 refactor the existing code which deals with the loader and nvram
 elements slightly: in particular, we can no longer perform an
 early exit if those elements are absent.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 3feee6d0aba5abf5e69d69b0022c08ea6bd5af3e)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 docs/formatdomain.rst             | 23 +++++++--
 docs/kbase/secureboot.rst         | 46 ++++++++++++------
 src/conf/domain_conf.c            | 81 ++++++++++++++++++++++++++++---
 src/conf/domain_conf.h            |  9 ++++
 src/conf/schemas/domaincommon.rng | 22 ++++++++-
 src/conf/virconftypes.h           |  2 +
 src/libvirt_private.syms          |  2 +
 7 files changed, 157 insertions(+), 28 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 152fd7f530..7d6cc45efd 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -196,9 +196,9 @@ harddisk, cdrom, network) determining where to obtain/find the boot image.
 ``firmware``
    The ``firmware`` attribute allows management applications to automatically
 -   fill ``<loader/>`` and ``<nvram/>`` elements and possibly enable some
 -   features required by selected firmware. Accepted values are ``bios`` and
 -   ``efi``.
 +   fill ``<loader/>`` and ``<nvram/>`` or ``<varstore/>`` elements and possibly
 +   enable some features required by selected firmware. Accepted values are
 +   ``bios`` and ``efi``.
    The selection process scans for files describing installed firmware images in
    specified location and uses the most specific one which fulfills domain
    requirements. The locations in order of preference (from generic to most
@@ -311,6 +311,23 @@ harddisk, cdrom, network) determining where to obtain/find the boot image.
    It is not valid to provide this element if the loader is marked as
    stateless.
 +``varstore``
 +   This works much the same way as the ``<nvram/>`` element described above,
 +   except that variable storage is handled by the ``uefi-vars`` QEMU device
 +   instead of being backed by a pflash device. :since:`Since 12.1.0 (QEMU only)`
 +
 +   The ``path`` attribute contains the path of the domain-specific file where
 +   variables are stored, while the ``template`` attribute points to a template
 +   that the domain-specific file can be (re)generated from. Assuming that the
 +   necessary JSON firmware descriptor files are present, both attributes will
 +   be filled in automatically by libvirt.
 +
 +   Using ``<varstore/>`` instead of ``<nvram/>`` is particularly useful on
 +   non-x86 architectures such as aarch64, where it represents the only way to
 +   get Secure Boot working. It can be used on x86 too, and doing so will make
 +   it possible to keep UEFI authenticated variables safe from tampering without
 +   requiring the use of SMM emulation.
 +
 ``boot``
    The ``dev`` attribute takes one of the values "fd", "hd", "cdrom" or
    "network" and is used to specify the next boot device to consider. The
 diff --git a/docs/kbase/secureboot.rst b/docs/kbase/secureboot.rst
 index 6c22b08d22..b411b65f00 100644
 --- a/docs/kbase/secureboot.rst
 +++ b/docs/kbase/secureboot.rst
@@ -74,8 +74,8 @@ Changing an existing VM
 When a VM is defined, libvirt will pick the firmware that best
 satisfies the provided criteria and record this information for use
 -on subsequent boots. The resulting XML configuration will look like
 -this:
 +on subsequent boots. The resulting XML configuration will look either
 +like this:
 ::
@@ -88,14 +88,28 @@ this:
     <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/vm_VARS.fd</nvram>
   </os>
 +or like this:
 +
 +::
 +
 +  <os firmware='efi'>
 +    <firmware>
 +      <feature enabled='yes' name='enrolled-keys'/>
 +      <feature enabled='yes' name='secure-boot'/>
 +    </firmware>
 +    <loader type='rom' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd</loader>
 +    <varstore template='/usr/share/edk2/aarch64/vars.secboot.json' path='/var/lib/libvirt/qemu/varstore/vm.json'/>
 +  </os>
 +
 In order to force libvirt to repeat the firmware autoselection
 -process, it's necessary to remove the ``<loader>`` and ``<nvram>``
 -elements. Failure to do so will likely result in an error.
 +process, it's necessary to remove the ``<loader>`` as well as the
 +``<nvram>`` or ``<varstore>`` elements, depending on what's
 +applicable. Failure to do so will likely result in an error.
 Note that updating the XML configuration as described above is
 -**not** enough to change the Secure Boot status: the NVRAM file
 -associated with the VM has to be regenerated from its template as
 -well.
 +**not** enough to change the Secure Boot status: the NVRAM/varstore
 +file associated with the VM has to be regenerated from its template
 +as well.
 In order to do that, update the XML and then start the VM with
@@ -107,9 +121,9 @@ This option is only available starting with libvirt 8.1.0, so if your
 version of libvirt is older than that you will have to delete the
 NVRAM file manually before starting the VM.
 -Most guest operating systems will be able to cope with the NVRAM file
 -being reinitialized, but in some cases the VM will be unable to boot
 -after the change.
 +Most guest operating systems will be able to cope with the
 +NVRAM/varstore file being reinitialized, but in some cases the VM
 +will be unable to boot after the change.
 Additional information
@@ -126,15 +140,15 @@ can be used to validate the operating system signature need to be
 provided as well.
 Asking for the ``enrolled-keys`` firmware feature to be enabled will
 -cause libvirt to initialize the NVRAM file associated with the VM
 -from a template that contains a suitable set of keys. These keys
 -being present will cause the firmware to enforce the Secure Boot
 +cause libvirt to initialize the NVRAM/varstore file associated with
 +the VM from a template that contains a suitable set of keys. These
 +keys being present will cause the firmware to enforce the Secure Boot
 signing requirements.
 The opposite configuration, where the feature is explicitly disabled,
 -will result in no keys being present in the NVRAM file. Unable to
 -verify signatures, the firmware will allow even unsigned operating
 -systems to run.
 +will result in no keys being present in the NVRAM/varstore file.
 +Unable to verify signatures, the firmware will allow even unsigned
 +operating systems to run.
 If running unsigned code is desired, it's also possible to ask for
 the ``secure-boot`` feature to be disabled, which will cause libvirt
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index e72cda0048..16ea9f0b2e 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -3932,6 +3932,27 @@ virDomainLoaderDefFree(virDomainLoaderDef *loader)
     g_free(loader);
 }
 +virDomainVarstoreDef *
 +virDomainVarstoreDefNew(void)
 +{
 +    virDomainVarstoreDef *def = NULL;
 +
 +    def = g_new0(virDomainVarstoreDef, 1);
 +
 +    return def;
 +}
 +
 +void
 +virDomainVarstoreDefFree(virDomainVarstoreDef *varstore)
 +{
 +    if (!varstore)
 +        return;
 +
 +    g_free(varstore->path);
 +    g_free(varstore->template);
 +    g_free(varstore);
 +}
 +
 static void
 virDomainResctrlMonDefFree(virDomainResctrlMonDef *domresmon)
@@ -4034,6 +4055,7 @@ virDomainOSDefClear(virDomainOSDef *os)
         virDomainOSACPITableDefFree(os->acpiTables[i]);
     g_free(os->acpiTables);
     virDomainLoaderDefFree(os->loader);
 +    virDomainVarstoreDefFree(os->varstore);
     g_free(os->bootloader);
     g_free(os->bootloaderArgs);
 }
@@ -17983,6 +18005,17 @@ virDomainLoaderDefParseXMLLoader(virDomainLoaderDef *loader,
 }
 +static int
 +virDomainVarstoreDefParseXML(virDomainVarstoreDef *varstore,
 +                             xmlNodePtr varstoreNode)
 +{
 +    varstore->path = virXMLPropString(varstoreNode, "path");
 +    varstore->template = virXMLPropString(varstoreNode, "template");
 +
 +    return 0;
 +}
 +
 +
 static int
 virDomainLoaderDefParseXML(virDomainLoaderDef *loader,
                            xmlNodePtr loaderNode,
@@ -18430,16 +18463,29 @@ virDomainDefParseBootLoaderOptions(virDomainDef *def,
     xmlNodePtr loaderNode = virXPathNode("./os/loader[1]", ctxt);
     xmlNodePtr nvramNode = virXPathNode("./os/nvram[1]", ctxt);
     xmlNodePtr nvramSourceNode = virXPathNode("./os/nvram/source[1]", ctxt);
 +    xmlNodePtr varstoreNode = virXPathNode("./os/varstore[1]", ctxt);
 -    if (!loaderNode && !nvramNode)
 -        return 0;
 -
 -    def->os.loader = virDomainLoaderDefNew();
 -
 -    if (virDomainLoaderDefParseXML(def->os.loader,
 -                                   loaderNode, nvramNode, nvramSourceNode,
 -                                   ctxt, xmlopt, flags) < 0)
 +    if (nvramNode && varstoreNode) {
 +        virReportError(VIR_ERR_XML_ERROR, "%s",
 +                       _("Cannot have both <nvram> and <varstore>"));
         return -1;
 +    }
 +
 +    if (loaderNode || nvramNode) {
 +        def->os.loader = virDomainLoaderDefNew();
 +
 +        if (virDomainLoaderDefParseXML(def->os.loader,
 +                                       loaderNode, nvramNode, nvramSourceNode,
 +                                       ctxt, xmlopt, flags) < 0)
 +            return -1;
 +    }
 +
 +    if (varstoreNode) {
 +        def->os.varstore = virDomainVarstoreDefNew();
 +
 +        if (virDomainVarstoreDefParseXML(def->os.varstore, varstoreNode) < 0)
 +            return -1;
 +    }
     return 0;
 }
@@ -28062,6 +28108,20 @@ virDomainLoaderDefFormat(virBuffer *buf,
     return 0;
 }
 +static int
 +virDomainVarstoreDefFormat(virBuffer *buf,
 +                           virDomainVarstoreDef *varstore)
 +{
 +    g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER;
 +
 +    virBufferEscapeString(&attrBuf, " template='%s'", varstore->template);
 +    virBufferEscapeString(&attrBuf, " path='%s'", varstore->path);
 +
 +    virXMLFormatElementEmpty(buf, "varstore", &attrBuf, NULL);
 +
 +    return 0;
 +}
 +
 static void
 virDomainKeyWrapDefFormat(virBuffer *buf, virDomainKeyWrapDef *keywrap)
 {
@@ -29523,6 +29583,11 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def,
     if (def->os.loader &&
         virDomainLoaderDefFormat(buf, def->os.loader, xmlopt, flags) < 0)
         return -1;
 +
 +    if (def->os.varstore &&
 +        virDomainVarstoreDefFormat(buf, def->os.varstore) < 0)
 +        return -1;
 +
     virBufferEscapeString(buf, "<kernel>%s</kernel>\n",
                           def->os.kernel);
     virBufferEscapeString(buf, "<initrd>%s</initrd>\n",
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index 69a8e79c6d..ead3b07475 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -2420,6 +2420,14 @@ struct _virDomainLoaderDef {
 virDomainLoaderDef *virDomainLoaderDefNew(void);
 void virDomainLoaderDefFree(virDomainLoaderDef *loader);
 +struct _virDomainVarstoreDef {
 +    char *path;
 +    char *template;
 +};
 +
 +virDomainVarstoreDef *virDomainVarstoreDefNew(void);
 +void virDomainVarstoreDefFree(virDomainVarstoreDef *varstore);
 +
 typedef enum {
     VIR_DOMAIN_IOAPIC_NONE = 0,
     VIR_DOMAIN_IOAPIC_QEMU,
@@ -2573,6 +2581,7 @@ struct _virDomainOSDef {
     size_t nacpiTables;
     virDomainOSACPITableDef **acpiTables;
     virDomainLoaderDef *loader;
 +    virDomainVarstoreDef *varstore;
     char *bootloader;
     char *bootloaderArgs;
     int smbios_mode;
 diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
 index 92f82c8fbf..7215db3fc1 100644
 --- a/src/conf/schemas/domaincommon.rng
 +++ b/src/conf/schemas/domaincommon.rng
@@ -349,7 +349,10 @@
             </element>
           </optional>
           <optional>
 -            <ref name="osnvram"/>
 +            <choice>
 +              <ref name="osnvram"/>
 +              <ref name="osvarstore"/>
 +            </choice>
           </optional>
           <optional>
             <ref name="osbootkernel"/>
@@ -456,6 +459,23 @@
     </element>
   </define>
 +  <define name="osvarstore">
 +    <element name="varstore">
 +      <interleave>
 +        <optional>
 +          <attribute name="template">
 +            <ref name="absFilePath"/>
 +          </attribute>
 +        </optional>
 +        <optional>
 +          <attribute name="path">
 +            <ref name="absFilePath"/>
 +          </attribute>
 +        </optional>
 +      </interleave>
 +    </element>
 +  </define>
 +
   <define name="osexe">
     <element name="os">
       <interleave>
 diff --git a/src/conf/virconftypes.h b/src/conf/virconftypes.h
 index 6e2573035a..0596791a4d 100644
 --- a/src/conf/virconftypes.h
 +++ b/src/conf/virconftypes.h
@@ -164,6 +164,8 @@ typedef struct _virDomainLeaseDef virDomainLeaseDef;
 typedef struct _virDomainLoaderDef virDomainLoaderDef;
 +typedef struct _virDomainVarstoreDef virDomainVarstoreDef;
 +
 typedef struct _virDomainMemballoonDef virDomainMemballoonDef;
 typedef struct _virDomainMemoryDef virDomainMemoryDef;
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index effe44fe57..1308fa2e51 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -718,6 +718,8 @@ virDomainTPMProfileRemoveDisabledTypeToString;
 virDomainTPMVersionTypeFromString;
 virDomainTPMVersionTypeToString;
 virDomainUSBDeviceDefForeach;
 +virDomainVarstoreDefFree;
 +virDomainVarstoreDefNew;
 virDomainVideoDefaultRAM;
 virDomainVideoDefClear;
 virDomainVideoDefFree;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-conf-Update-validation-to-consider-varstore-element.patch
+++ b/centos-10/SOURCES/libvirt-conf-Update-validation-to-consider-varstore-element.patch
@ -0,0 +1,378 @@
 From f47031d4e6439d1daf5711d4117c0fa647196944 Mon Sep 17 00:00:00 2001
 Message-ID: <f47031d4e6439d1daf5711d4117c0fa647196944.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Thu, 22 Jan 2026 19:27:03 +0100
 Subject: [PATCH] conf: Update validation to consider varstore element
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The code is reworked quite significantly, but most of the
 existing checks are preserved. Those that aren't, notably the
 one that allowed pflash as the only acceptable non-stateless
 firmware type, are intentionally removed because they will no
 longer reflect reality once support for the uefi-vars QEMU
 device is introduced.
 As a side effect, reworking the function in this fashion
 resolves a subtle bug: due to the early exits that were being
 performed when the loader element was missing, the checks at
 the bottom of the function (related to the shim and kernel
 elements) were effectively never performed. This is no longer
 the case.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 1c2dbdf3ac5bed84caeacf585d5143dcf32df75e)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_validate.c                    | 100 +++++++-----------
 ...-auto-bios-not-stateless.x86_64-latest.err |   2 +-
 ...-auto-bios-not-stateless.x86_64-latest.xml |  35 ++++++
 ...firmware-auto-bios-nvram.x86_64-latest.err |   2 +-
 ...nual-bios-not-stateless.x86_64-latest.args |  32 ++++++
 ...anual-bios-not-stateless.x86_64-latest.err |   1 -
 ...anual-bios-not-stateless.x86_64-latest.xml |  28 +++++
 ...nual-efi-nvram-stateless.x86_64-latest.err |   2 +-
 ...nvram-template-stateless.x86_64-latest.err |   2 +-
 ...ware-manual-efi-rw-nvram.x86_64-latest.err |   2 +-
 tests/qemuxmlconftest.c                       |   7 +-
 11 files changed, 144 insertions(+), 69 deletions(-)
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args
 delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err
 create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml
 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
 index 7346a61731..163095d55c 100644
 --- a/src/conf/domain_validate.c
 +++ b/src/conf/domain_validate.c
@@ -1723,95 +1723,46 @@ virDomainDefOSValidate(const virDomainDef *def,
                        virDomainXMLOption *xmlopt)
 {
     virDomainLoaderDef *loader = def->os.loader;
 +    virDomainVarstoreDef *varstore = def->os.varstore;
 +    virDomainOsDefFirmware firmware = def->os.firmware;
 +    int *firmwareFeatures = def->os.firmwareFeatures;
 +    bool usesNvram = loader && (loader->nvram || loader->nvramTemplate || loader->nvramTemplateFormat);
 -    if (def->os.firmware) {
 +    if (firmware) {
         if (xmlopt && !(xmlopt->config.features & VIR_DOMAIN_DEF_FEATURE_FW_AUTOSELECT)) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("firmware auto selection not implemented for this driver"));
             return -1;
         }
 -        if (def->os.firmwareFeatures &&
 -            def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES &&
 -            def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) {
 +        if (firmwareFeatures &&
 +            firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES &&
 +            firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("firmware feature 'enrolled-keys' cannot be enabled when firmware feature 'secure-boot' is disabled"));
             return -1;
         }
 -
 -        if (!loader)
 -            return 0;
 -
 -        if (loader->nvram && def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
 -            virReportError(VIR_ERR_XML_DETAIL,
 -                           _("firmware type '%1$s' does not support nvram"),
 -                           virDomainOsDefFirmwareTypeToString(def->os.firmware));
 -            return -1;
 -        }
     } else {
 -        if (def->os.firmwareFeatures) {
 +        if (firmwareFeatures) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("cannot use feature-based firmware autoselection when firmware autoselection is disabled"));
             return -1;
         }
 -        if (!loader)
 -            return 0;
 -
 -        if (!loader->path) {
 +        if (loader && !loader->path) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("no loader path specified and firmware auto selection disabled"));
             return -1;
         }
     }
 -    if (loader->readonly == VIR_TRISTATE_BOOL_NO) {
 -        if (loader->type == VIR_DOMAIN_LOADER_TYPE_ROM) {
 +    if (loader && loader->type == VIR_DOMAIN_LOADER_TYPE_ROM) {
 +        if (loader->readonly == VIR_TRISTATE_BOOL_NO) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("ROM loader type cannot be used as read/write"));
             return -1;
         }
 -        if (loader->nvramTemplate) {
 -            virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                           _("NVRAM template is not permitted when loader is read/write"));
 -            return -1;
 -        }
 -
 -        if (loader->nvram) {
 -            virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                           _("NVRAM is not permitted when loader is read/write"));
 -            return -1;
 -        }
 -    }
 -
 -    if (loader->stateless == VIR_TRISTATE_BOOL_YES) {
 -        if (loader->nvramTemplate) {
 -            virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                           _("NVRAM template is not permitted when loader is stateless"));
 -            return -1;
 -        }
 -
 -        if (loader->nvram) {
 -            virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                           _("NVRAM is not permitted when loader is stateless"));
 -            return -1;
 -        }
 -    } else if (loader->stateless == VIR_TRISTATE_BOOL_NO) {
 -        if (def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_NONE) {
 -            if (def->os.loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH) {
 -                virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                               _("Only pflash loader type permits NVRAM"));
 -                return -1;
 -            }
 -        } else if (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
 -            virReportError(VIR_ERR_XML_DETAIL, "%s",
 -                           _("Only EFI firmware permits NVRAM"));
 -            return -1;
 -        }
 -    }
 -
 -    if (loader->type == VIR_DOMAIN_LOADER_TYPE_ROM) {
         if (loader->format &&
             loader->format != VIR_STORAGE_FILE_RAW) {
             virReportError(VIR_ERR_XML_DETAIL,
@@ -1821,6 +1772,33 @@ virDomainDefOSValidate(const virDomainDef *def,
         }
     }
 +    if (usesNvram && varstore) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("Only one of NVRAM/varstore can be used"));
 +            return -1;
 +    }
 +
 +    if (usesNvram || varstore) {
 +        if (firmware && firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
 +            virReportError(VIR_ERR_XML_DETAIL,
 +                           _("Firmware type '%1$s' does not support variable storage (NVRAM/varstore)"),
 +                           virDomainOsDefFirmwareTypeToString(firmware));
 +            return -1;
 +        }
 +
 +        if (loader && loader->stateless == VIR_TRISTATE_BOOL_YES) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("Variable storage (NVRAM/varstore) is not permitted when loader is stateless"));
 +            return -1;
 +        }
 +
 +        if (loader && loader->readonly == VIR_TRISTATE_BOOL_NO) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("Variable storage (NVRAM/varstore) is not permitted when loader is read/write"));
 +            return -1;
 +        }
 +    }
 +
     if (def->os.shim && !def->os.kernel) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                        _("shim only allowed with kernel option"));
 diff --git a/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.err
 index b058f970a4..743fe27a97 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.err
@@ -1 +1 @@
 -Only EFI firmware permits NVRAM
 +operation failed: Unable to find 'bios' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml
 new file mode 100644
 index 0000000000..062835e351
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-bios-not-stateless.x86_64-latest.xml
@@ -0,0 +1,35 @@
 +<domain type='kvm'>
 +  <name>guest</name>
 +  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 +  <memory unit='KiB'>1048576</memory>
 +  <currentMemory unit='KiB'>1048576</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os firmware='bios'>
 +    <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 +    <loader stateless='no' format='raw'/>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <acpi/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu64</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 +    <controller type='usb' index='0' model='none'/>
 +    <controller type='sata' index='0'>
 +      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pcie-root'/>
 +    <input type='mouse' bus='ps2'/>
 +    <input type='keyboard' bus='ps2'/>
 +    <audio id='1' type='none'/>
 +    <watchdog model='itco' action='reset'/>
 +    <memballoon model='none'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxmlconfdata/firmware-auto-bios-nvram.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-bios-nvram.x86_64-latest.err
 index 772beb49e2..c4eeb92788 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-bios-nvram.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-auto-bios-nvram.x86_64-latest.err
@@ -1 +1 @@
 -firmware type 'bios' does not support nvram
 +Firmware type 'bios' does not support variable storage (NVRAM/varstore)
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args
 new file mode 100644
 index 0000000000..969c7ad68c
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.args
@@ -0,0 +1,32 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 +-accel tcg \
 +-cpu qemu64 \
 +-bios /usr/share/seabios/bios.bin \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err
 deleted file mode 100644
 index 188a5a4180..0000000000
 --- a/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -Only pflash loader type permits NVRAM
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml
 new file mode 100644
 index 0000000000..075da36d00
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-manual-bios-not-stateless.x86_64-latest.xml
@@ -0,0 +1,28 @@
 +<domain type='qemu'>
 +  <name>guest</name>
 +  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 +  <memory unit='KiB'>1048576</memory>
 +  <currentMemory unit='KiB'>1048576</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type>
 +    <loader type='rom' stateless='no' format='raw'>/usr/share/seabios/bios.bin</loader>
 +    <boot dev='hd'/>
 +  </os>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu64</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 +    <controller type='usb' index='0' model='none'/>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <input type='mouse' bus='ps2'/>
 +    <input type='keyboard' bus='ps2'/>
 +    <audio id='1' type='none'/>
 +    <memballoon model='none'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-stateless.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-stateless.x86_64-latest.err
 index de8db3763d..9bfd4465ab 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-stateless.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-stateless.x86_64-latest.err
@@ -1 +1 @@
 -NVRAM is not permitted when loader is stateless
 +Variable storage (NVRAM/varstore) is not permitted when loader is stateless
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-stateless.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-stateless.x86_64-latest.err
 index 95ec794c17..9bfd4465ab 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-stateless.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-stateless.x86_64-latest.err
@@ -1 +1 @@
 -NVRAM template is not permitted when loader is stateless
 +Variable storage (NVRAM/varstore) is not permitted when loader is stateless
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
 index d0cf62061a..708b4838d4 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
@@ -1 +1 @@
 -NVRAM is not permitted when loader is read/write
 +Variable storage (NVRAM/varstore) is not permitted when loader is read/write
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 822e29b888..a3d4d2de5c 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1575,7 +1575,10 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-manual-bios");
     DO_TEST_CAPS_LATEST("firmware-manual-bios-stateless");
 -    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-bios-not-stateless");
 +    /* This combination doesn't make sense (BIOS is stateless by definition)
 +     * but unfortunately there's no way for libvirt to report an error in this
 +     * scenario. The stateless=no attribute will effectively be ignored */
 +    DO_TEST_CAPS_LATEST("firmware-manual-bios-not-stateless");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-bios-rw");
     DO_TEST_CAPS_LATEST("firmware-manual-efi");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-features");
@@ -1628,7 +1631,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-bios");
     DO_TEST_CAPS_LATEST("firmware-auto-bios-stateless");
     DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-bios-rw");
 -    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-bios-not-stateless");
 +    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-bios-not-stateless");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-bios-nvram");
     DO_TEST_CAPS_LATEST("firmware-auto-efi");
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-docs-Document-firmwareFeature-element-for-domaincaps.patch
+++ b/centos-10/SOURCES/libvirt-docs-Document-firmwareFeature-element-for-domaincaps.patch
@ -0,0 +1,88 @@
 From 8754c491f66e5d13290aaf221a29b19bd855a171 Mon Sep 17 00:00:00 2001
 Message-ID: <8754c491f66e5d13290aaf221a29b19bd855a171.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 11 Feb 2026 00:48:18 +0100
 Subject: [PATCH] docs: Document firmwareFeature element for domaincaps
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit cf4dfcf7951779a815324adebcdaa8a845d4c0e1)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 docs/formatdomaincaps.rst | 51 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
 index 6ba7f84f96..cca827923c 100644
 --- a/docs/formatdomaincaps.rst
 +++ b/docs/formatdomaincaps.rst
@@ -111,6 +111,16 @@ be passed to its children.
          <value>bios</value>
          <value>efi</value>
        </enum>
 +       <firmwareFeatures supported='yes'>
 +         <enum name='secureBoot'>
 +           <value>yes</value>
 +           <value>no</value>
 +         </enum>
 +         <enum name='enrolledKeys'>
 +           <value>yes</value>
 +           <value>no</value>
 +         </enum>
 +       </firmwareFeatures>
        <loader supported='yes'>
          <value>/usr/share/OVMF/OVMF_CODE.fd</value>
          <enum name='type'>
@@ -140,6 +150,47 @@ about a given BIOS or UEFI binary on the host, e.g. the firmware binary path,
 its architecture, supported machine types, NVRAM template, etc. This ensures
 that the reported values won't cause a failure on guest boot.
 +The ``<firmwareFeatures/>`` element :since:`(since 12.1.0)` contains one
 +enum for each of the features that can be used to fine-tune the firmware
 +autoselection process. For example:
 +
 +::
 +
 +    <firmwareFeatures supported='yes'>
 +      <enum name='secureBoot'>
 +        <value>yes</value>
 +      </enum>
 +      <enum name='enrolledKeys'>
 +        <value>yes</value>
 +        <value>no</value>
 +      </enum>
 +    </firmwareFeatures>
 +
 +indicates that a domain XML such as:
 +
 +::
 +
 +    <os firmware='efi'>
 +      <firmware>
 +        <feature name='secure-boot' enabled='yes'/>
 +        <feature name='enrolled-keys' enabled='no'/>
 +      </firmware>
 +    </os>
 +
 +can be used to allow unsigned operating system to run, whereas a domain XML
 +such as:
 +
 +::
 +
 +    <os firmware='efi'>
 +      <firmware>
 +        <feature name='secure-boot' enabled='no'/>
 +      </firmware>
 +    </os>
 +
 +would not work, since ``no`` is not one of the valid values advertised by
 +the ``secureBoot`` enum.
 +
 For the ``loader`` element, the following can occur:
 ``value``
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-docs-Improvement-related-to-firmware-selection.patch
+++ b/centos-10/SOURCES/libvirt-docs-Improvement-related-to-firmware-selection.patch
@ -0,0 +1,109 @@
 From 495763256a6e10ff90210d54efd53f1d4f9e2544 Mon Sep 17 00:00:00 2001
 Message-ID: <495763256a6e10ff90210d54efd53f1d4f9e2544.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 23 Feb 2026 14:58:15 +0100
 Subject: [PATCH] docs: Improvement related to firmware selection
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Recommend that users take advantage of firmware autoselection
 and discourage providing paths manually.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit a03a8205725efec69b1fc7cc0318fa6ce79b6aa9)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 docs/formatdomaincaps.rst | 59 ++++++++++++++++++++++-----------------
 1 file changed, 34 insertions(+), 25 deletions(-)
 diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
 index 22a6d5d067..3426b7c9cd 100644
 --- a/docs/formatdomaincaps.rst
 +++ b/docs/formatdomaincaps.rst
@@ -145,15 +145,17 @@ domains.
      ...
    <domainCapabilities>
 -The ``firmware`` enum corresponds to the ``firmware`` attribute of the ``os``
 -element in the domain XML. The presence of this enum means libvirt is capable of
 -the so-called firmware auto-selection feature. And the listed firmware values
 -represent the accepted input in the domain XML. Note that the ``firmware`` enum
 -reports only those values for which a firmware "descriptor file" exists on the
 -host. Firmware descriptor file is a small JSON document that describes details
 -about a given BIOS or UEFI binary on the host, e.g. the firmware binary path,
 -its architecture, supported machine types, NVRAM template, etc. This ensures
 -that the reported values won't cause a failure on guest boot.
 +The presence of the ``firmware`` enum means that libvirt can perform firmware
 +autoselection, and each of the values is guaranteed to be usable. In the
 +domain XML, firmware autoselection is enabled as follows:
 +
 +::
 +
 +    <os firmware='efi'>
 +      ...
 +
 +Autoselection is the recommended mechanism for configuring the guest firmware.
 +Providing paths and other information manually is discouraged.
 The ``<firmwareFeatures/>`` element :since:`(since 12.1.0)` contains one
 enum for each of the features that can be used to fine-tune the firmware
@@ -196,27 +198,34 @@ such as:
 would not work, since ``no`` is not one of the valid values advertised by
 the ``secureBoot`` enum.
 -For the ``loader`` element, the following can occur:
 +The information contained in the ``<loader/>`` element is not relevant when
 +using firmware autoselection, which is the recommended approach to guest
 +firmware configuration, and as such can largely be ignored. Its subelements
 +are the following:
 ``value``
 -   List of known firmware binary paths. Currently this is used only to advertise
 -   the known location of OVMF binaries for QEMU. OVMF binaries will only be
 -   listed if they actually exist on host.
 +   One element for each known firmware binary present on the system.
 +
 +   Note that a binary being present here indicates that the file exists and it
 +   is compatible with the architecture/machine type, but does not provide any
 +   insight into which mechanism (see ``type`` below) should be used to load it.
 ``type``
 -   Whether the boot loader is a typical BIOS (``rom``) or a UEFI firmware
 -   (``pflash``). Each ``value`` sub-element under the ``type`` enum represents a
 -   possible value for the ``type`` attribute for the <loader/> element in the
 -   domain XML. E.g. the presence of ``pfalsh`` under the ``type`` enum means
 -   that a domain XML can use UEFI firmware via: <loader/> type="pflash"
 -   ...>/path/to/the/firmware/binary/</loader>.
 +   Whether firmware can be loaded using a ``pflash`` device (UEFI only) or as
 +   a ``rom`` (either UEFI or BIOS).
 ``readonly``
 -   Options for the ``readonly`` attribute of the <loader/> element in the domain
 -   XML.
 +   Supported values for the ``readonly`` attribute of the ``<loader/>`` element
 +   in the domain XML.
 ``secure``
 -   Options for the ``secure`` attribute of the <loader/> element in the domain
 -   XML. Note that the value ``yes`` is listed only if libvirt detects a firmware
 -   descriptor file that has path to an OVMF binary that supports Secure boot,
 -   and lists its architecture and supported machine type.
 +   Supported values for the ``secure`` attribute of the ``<loader/>`` element
 +   in the domain XML.
 +
 +   Note that the value ``yes`` is listed if libvirt detects a firmware
 +   descriptor file that points to a firmware binary that implements Secure
 +   Boot and is compatible with the architecture/machine type, but the UEFI
 +   variable store template associated with it might not have the usual set of
 +   Secure Boot certificates enrolled. To figure out whether it's actually
 +   possible to enforce Secure Boot, look at the ``enrolledKeys`` enum inside
 +   the ``<firmwareFeatures/>`` element instead.
 CPU configuration
 ~~~~~~~~~~~~~~~~~
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-docs-Rename-BIOS-bootloader-section-to-guest-firmware.patch
+++ b/centos-10/SOURCES/libvirt-docs-Rename-BIOS-bootloader-section-to-guest-firmware.patch
@ -0,0 +1,159 @@
 From 807dfc5b7ce3d77d7343b896082d2ae3395b3fdc Mon Sep 17 00:00:00 2001
 Message-ID: <807dfc5b7ce3d77d7343b896082d2ae3395b3fdc.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 23 Feb 2026 14:55:20 +0100
 Subject: [PATCH] docs: Rename "BIOS bootloader" section to "guest firmware"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The new name is much more accurate since the documentation is
 applicable to firmware other than BIOS, notably UEFI.
 An empty container is used to keep old links working.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 38379f59c0d26d006414a1fd92bdf332dadd1ddd)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 docs/formatcaps.rst       |  2 +-
 docs/formatdomain.rst     | 24 ++++++++++++++----------
 docs/formatdomaincaps.rst | 19 ++++++++++++-------
 3 files changed, 27 insertions(+), 18 deletions(-)
 diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst
 index fa8ab5197f..9458e1289a 100644
 --- a/docs/formatcaps.rst
 +++ b/docs/formatcaps.rst
@@ -172,7 +172,7 @@ The ``<guest/>`` element will typically wrap up the following elements:
       Emulator (device model) path, for use in
       `emulator <formatdomain.html#devices>`__ element of domain XML.
    ``loader``
 -      Loader path, for use in `loader <formatdomain.html#bios-bootloader>`__
 +      Loader path, for use in `loader <formatdomain.html#guest-firmware>`__
       element of domain XML.
    ``machine``
       Machine type, for use in
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 31232deb3c..152fd7f530 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -103,12 +103,16 @@ Operating system booting
 There are a number of different ways to boot virtual machines each with their
 own pros and cons.
 +Guest firmware
 +~~~~~~~~~~~~~~
 -BIOS bootloader
 -~~~~~~~~~~~~~~~
 +.. container::
 +   :name: bios-bootloader
 -Booting via the BIOS is available for hypervisors supporting full
 -virtualization. In this case the BIOS has a boot order priority (floppy,
 +   .. this container only exists to keep old links working
 +
 +Booting via a guest firmware is available for hypervisors supporting full
 +virtualization. In this case the firmware has a boot order priority (floppy,
 harddisk, cdrom, network) determining where to obtain/find the boot image.
 ::
@@ -411,10 +415,10 @@ and full virtualized guests.
 ``type``
    This element has the same semantics as described earlier in the
 -   `BIOS bootloader`_ section.
 +   `guest firmware`_ section.
 ``loader``
    This element has the same semantics as described earlier in the
 -   `BIOS bootloader`_ section.
 +   `guest firmware`_ section.
 ``kernel``
    The contents of this element specify the fully-qualified path to the kernel
    image in the host OS.
@@ -3732,7 +3736,7 @@ paravirtualized driver is specified via the ``disk`` element.
    attribute is an 8 character string which can be queried by guests on S390 via
    sclp or diag 308. Linux guests on S390 can use ``loadparm`` to select a boot
    entry. :since:`Since 3.5.0` The per-device ``boot`` elements cannot be used
 -   together with general boot elements in `BIOS bootloader`_
 +   together with general boot elements in `guest firmware`_
    section. :since:`Since 0.8.8`
 ``encryption``
    since:`Since 3.9.0` the ``encryption`` element is preferred
@@ -4897,7 +4901,7 @@ or:
    Specifies that the device is bootable. The ``order`` attribute determines the
    order in which devices will be tried during boot sequence. The per-device
    ``boot`` elements cannot be used together with general boot elements in
 -   `BIOS bootloader`_ section. :since:`Since 0.8.8` for PCI
 +   `guest firmware`_ section. :since:`Since 0.8.8` for PCI
    devices, :since:`Since 1.0.1` for USB devices.
 ``rom``
    The ``rom`` element is used to change how a PCI device's ROM is presented to
@@ -5121,7 +5125,7 @@ USB device redirection through a character device is supported
    Specifies that the device is bootable. The ``order`` attribute determines the
    order in which devices will be tried during boot sequence. The per-device
    ``boot`` elements cannot be used together with general boot elements in
 -   `BIOS bootloader`_ section. ( :since:`Since 1.0.1` )
 +   `guest firmware`_ section. ( :since:`Since 1.0.1` )
 ``redirfilter``
    The\ ``redirfilter``\ element is used for creating the filter rule to filter
    out certain devices from redirection. It uses sub-element ``<usbdev>`` to
@@ -6377,7 +6381,7 @@ Specifying boot order
 For hypervisors which support this, you can set a specific NIC to be used for
 network boot. The ``order`` attribute determines the order in which devices will
 be tried during boot sequence. The per-device ``boot`` elements cannot be used
 -together with general boot elements in `BIOS bootloader`_
 +together with general boot elements in `guest firmware`_
 section. :since:`Since 0.8.8`
 Interface ROM BIOS configuration
 diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
 index cca827923c..22a6d5d067 100644
 --- a/docs/formatdomaincaps.rst
 +++ b/docs/formatdomaincaps.rst
@@ -72,11 +72,11 @@ The root element that emulator capability XML document starts with has name
    Describes the `virtualization type <formatdomain.html#element-and-attribute-overview>`__ (or so
    called domain type).
 ``machine``
 -   The domain's `machine type <formatdomain.html#bios-bootloader>`__. Since not
 +   The domain's `machine type <formatdomain.html#guest-firmware>`__. Since not
    every hypervisor has a sense of machine types this element might be omitted
    in such drivers.
 ``arch``
 -   The domain's `architecture <formatdomain.html#bios-bootloader>`__.
 +   The domain's `architecture <formatdomain.html#guest-firmware>`__.
 CPU Allocation
 ~~~~~~~~~~~~~~
@@ -95,12 +95,17 @@ capabilities, e.g. virtual CPUs:
 ``vcpu``
    The maximum number of supported virtual CPUs
 -BIOS bootloader
 -~~~~~~~~~~~~~~~
 +Guest firmware
 +~~~~~~~~~~~~~~
 -Sometimes users might want to tweak some BIOS knobs or use UEFI. For cases like
 -that, `os <formatdomain.html#bios-bootloader>`__ element exposes what values can
 -be passed to its children.
 +.. container::
 +   :name: bios-bootloader
 +
 +   .. this container only exists to keep old links working
 +
 +Exposes information about supported
 +`guest firmware <formatdomain.html#guest-firmware>`__ configurations for
 +domains.
 ::
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-docs-formatdomain-Fix-indentation-of-docs-for-disk-driver-statistics-element.patch
+++ b/centos-10/SOURCES/libvirt-docs-formatdomain-Fix-indentation-of-docs-for-disk-driver-statistics-element.patch
@ -0,0 +1,62 @@
 From f6268acd96651ce72014e2ea7ed649caff0b9133 Mon Sep 17 00:00:00 2001
 Message-ID: <f6268acd96651ce72014e2ea7ed649caff0b9133.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Fri, 30 Jan 2026 17:47:46 +0100
 Subject: [PATCH] docs: formatdomain: Fix indentation of docs for
 <disk><driver><statistics> element
 All other paragraphs in this section use 2 spaces after hyphen, fix the
 recently added section.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 7da1a83914ca10cc811583d7310bf60e04b70488)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 docs/formatdomain.rst | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 9836837441..45f262113b 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -3605,22 +3605,22 @@ paravirtualized driver is specified via the ``disk`` element.
           </iothreads>
         </driver>
 -   - The optional ``statistics`` sub-element allows configuring statistics
 -     collection in configurable intervals for the given disk. Intervals are
 -     configured by ``<statistic>`` sub-elements with ``interval`` attribute
 -     configuring the collection window duration in seconds. The statistics
 -     are available via the bulk statistics API.
 +   -  The optional ``statistics`` sub-element allows configuring statistics
 +      collection in configurable intervals for the given disk. Intervals are
 +      configured by ``<statistic>`` sub-elements with ``interval`` attribute
 +      configuring the collection window duration in seconds. The statistics
 +      are available via the bulk statistics API.
 -     Example::
 +      Example::
 -       <driver name='qemu'>
 -         <statistics>
 -           <statistic interval='1'/>
 -           <statistic interval='10'/>
 -         </statistics>
 -       </driver>
 +        <driver name='qemu'>
 +          <statistics>
 +            <statistic interval='1'/>
 +            <statistic interval='10'/>
 +          </statistics>
 +        </driver>
 -    :since:`Since 11.9.0 (QEMU 10.2, virtio, ide, scsi disks only)`.
 +      :since:`Since 11.9.0 (QEMU 10.2, virtio, ide, scsi disks only)`.
    -  The optional ``queues`` attribute specifies the number of virt queues for
       virtio-blk ( :since:`Since 3.9.0` ) or vhost-user-blk
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-docs-formatdomain-Reword-section-about-the-statistics-element-under-disk-driver.patch
+++ b/centos-10/SOURCES/libvirt-docs-formatdomain-Reword-section-about-the-statistics-element-under-disk-driver.patch
@ -0,0 +1,51 @@
 From ea6f8a96929577416a5cc4f4452f920312aef081 Mon Sep 17 00:00:00 2001
 Message-ID: <ea6f8a96929577416a5cc4f4452f920312aef081.1771336682.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Fri, 30 Jan 2026 17:37:48 +0100
 Subject: [PATCH] docs: formatdomain: Reword section about the '<statistics>'
 element under disk driver
 Separate the timed statistics group and link to the fields which are
 returned by it.
 Prepare the wording for more statistics configs in the future.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ad65b00c1393f7f13e15744e2e1be4fb531e2a17)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 docs/formatdomain.rst | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 45f262113b..70882c6820 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -3605,11 +3605,17 @@ paravirtualized driver is specified via the ``disk`` element.
           </iothreads>
         </driver>
 -   -  The optional ``statistics`` sub-element allows configuring statistics
 -      collection in configurable intervals for the given disk. Intervals are
 -      configured by ``<statistic>`` sub-elements with ``interval`` attribute
 -      configuring the collection window duration in seconds. The statistics
 -      are available via the bulk statistics API.
 +   -  The optional ``statistics`` sub-element allows configuring various optional
 +      statistics collection.
 +
 +      Statistic values returned under
 +      `VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_PREFIX <html/libvirt-libvirt-domain.html#VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_PREFIX>`__
 +      typed parameter prefix returned by the
 +      `virConnectGetAllDomainStats <html/libvirt-libvirt-domain.html#virConnectGetAllDomainStats>`__
 +      API are collected based on one or more configurable intervals. An interval
 +      of collection is configured by ``<statistic>`` sub-elements with
 +      ``interval`` attribute configuring the collection window duration in
 +      seconds.
       Example::
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-domain_conf-initialize-network-hostdev-private-data.patch
+++ b/centos-10/SOURCES/libvirt-domain_conf-initialize-network-hostdev-private-data.patch
@ -0,0 +1,94 @@
 From 96d171449cb675b48838b955ddd0ba41a783dba1 Mon Sep 17 00:00:00 2001
 Message-ID: <96d171449cb675b48838b955ddd0ba41a783dba1.1772815314.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Thu, 26 Feb 2026 10:18:23 +0100
 Subject: [PATCH] domain_conf: initialize network hostdev private data
 Currently virDomainNetDef and virDomainActualNetDef use
 virDomainHostdevDef directly as structure and the code doesn't call
 virDomainHostdevDefNew() that would initialize private data.
 This is hackish quick fix to solve a crash that happens in two
 scenarios:
 1. attaching any interface with hostdev backend
 0x0000fffbfc0e2a90 in qemuDomainAttachHostPCIDevice (driver=0xfffbb4006750, vm=0xfffbf001f790, hostdev=0xfffbf400b150) at ../src/qemu/qemu_hotplug.c:1652
 1652 if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0)
 2. starting VM with interface with hostdev backend using iommufd
 0x00007f6638d5b9ca in qemuProcessOpenVfioDeviceFd (hostdev=hostdev@entry=0x7f6634425ee0) at ../src/qemu/qemu_process.c:7719
 7719	    hostdevPriv->vfioDeviceFd = qemuFDPassDirectNew(name, &vfioDeviceFd);
 Proper fix for this issue is to refactor network code to use pointer and to
 use virDomainHostdevDefNew().
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit fe782ed334ea0d4373e6dad093f5815fc925a56b)
 https://issues.redhat.com/browse/RHEL-151916
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/conf/domain_conf.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 16ea9f0b2e..8877aefb7c 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -3489,6 +3489,20 @@ void virDomainVideoDefFree(virDomainVideoDef *def)
 }
 +static int
 +virDomainHostdevDefPrivateDataNew(virDomainHostdevDef *def,
 +                                  virDomainXMLOption *xmlopt)
 +{
 +    if (!xmlopt || !xmlopt->privateData.hostdevNew)
 +        return 0;
 +
 +    if (!(def->privateData = xmlopt->privateData.hostdevNew()))
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 virDomainHostdevDef *
 virDomainHostdevDefNew(virDomainXMLOption *xmlopt)
 {
@@ -3498,8 +3512,7 @@ virDomainHostdevDefNew(virDomainXMLOption *xmlopt)
     def->info = g_new0(virDomainDeviceInfo, 1);
 -    if (xmlopt && xmlopt->privateData.hostdevNew &&
 -        !(def->privateData = xmlopt->privateData.hostdevNew())) {
 +    if (virDomainHostdevDefPrivateDataNew(def, xmlopt) < 0) {
         VIR_FREE(def->info);
         VIR_FREE(def);
         return NULL;
@@ -9675,6 +9688,9 @@ virDomainActualNetDefParseXML(xmlNodePtr node,
         virDomainHostdevDef *hostdev = &actual->data.hostdev.def;
         int type;
 +        if (virDomainHostdevDefPrivateDataNew(hostdev, xmlopt) < 0)
 +            goto error;
 +
         hostdev->parentnet = parent;
         hostdev->info = &parent->info;
         /* The helper function expects type to already be found and
@@ -10368,6 +10384,9 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt,
         g_autofree char *addrtype = virXPathString("string(./source/address/@type)", ctxt);
         int type;
 +        if (virDomainHostdevDefPrivateDataNew(&def->data.hostdev.def, xmlopt) < 0)
 +            return NULL;
 +
         def->data.hostdev.def.parentnet = def;
         def->data.hostdev.def.info = &def->info;
         def->data.hostdev.def.mode = VIR_DOMAIN_HOSTDEV_MODE_SUBSYS;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-domain_validate-Reject-NVRAM-with-read-write-firmware.patch
+++ b/centos-10/SOURCES/libvirt-domain_validate-Reject-NVRAM-with-read-write-firmware.patch
@ -0,0 +1,165 @@
 From 33766fc329d60ba7fcf467756a442dd83cc00987 Mon Sep 17 00:00:00 2001
 Message-ID: <33766fc329d60ba7fcf467756a442dd83cc00987.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 5 Dec 2025 18:34:38 +0100
 Subject: [PATCH] domain_validate: Reject NVRAM with read/write firmware
 The combination doesn't make sense.
 After this change the firmware-manual-bios-rw test cases starts
 failing, as it should have in the first place.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 46970217a8258538b5dd9d746ec4191ee6d48d98)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_validate.c                    | 14 +++++++
 ...are-manual-efi-rw-nvram.x86_64-latest.args | 37 -----------------
 ...ware-manual-efi-rw-nvram.x86_64-latest.err |  1 +
 ...ware-manual-efi-rw-nvram.x86_64-latest.xml | 40 -------------------
 tests/qemuxmlconftest.c                       |  2 +-
 5 files changed, 16 insertions(+), 78 deletions(-)
 delete mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.args
 create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
 delete mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.xml
 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
 index 4558e7b210..09c1b3f13f 100644
 --- a/src/conf/domain_validate.c
 +++ b/src/conf/domain_validate.c
@@ -1765,6 +1765,20 @@ virDomainDefOSValidate(const virDomainDef *def,
         }
     }
 +    if (loader->readonly == VIR_TRISTATE_BOOL_NO) {
 +        if (loader->nvramTemplate) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("NVRAM template is not permitted when loader is read/write"));
 +            return -1;
 +        }
 +
 +        if (loader->nvram) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("NVRAM is not permitted when loader is read/write"));
 +            return -1;
 +        }
 +    }
 +
     if (loader->stateless == VIR_TRISTATE_BOOL_YES) {
         if (loader->nvramTemplate) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.args
 deleted file mode 100644
 index 6b3eec0a27..0000000000
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.args
 +++ /dev/null
@@ -1,37 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF.combined.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":false,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 --machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --global driver=cfi.pflash01,property=secure,value=on \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
 new file mode 100644
 index 0000000000..d0cf62061a
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.err
@@ -0,0 +1 @@
 +NVRAM is not permitted when loader is read/write
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.xml
 deleted file mode 100644
 index f6436df80f..0000000000
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-rw-nvram.x86_64-latest.xml
 +++ /dev/null
@@ -1,40 +0,0 @@
 -<domain type='kvm'>
 -  <name>guest</name>
 -  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 -  <memory unit='KiB'>1048576</memory>
 -  <currentMemory unit='KiB'>1048576</currentMemory>
 -  <vcpu placement='static'>1</vcpu>
 -  <os firmware='efi'>
 -    <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='no' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF.combined.fd</loader>
 -    <nvram format='raw'>/path/to/guest_VARS.fd</nvram>
 -    <boot dev='hd'/>
 -  </os>
 -  <features>
 -    <acpi/>
 -    <smm state='on'/>
 -  </features>
 -  <cpu mode='custom' match='exact' check='none'>
 -    <model fallback='forbid'>qemu64</model>
 -  </cpu>
 -  <clock offset='utc'/>
 -  <on_poweroff>destroy</on_poweroff>
 -  <on_reboot>restart</on_reboot>
 -  <on_crash>destroy</on_crash>
 -  <devices>
 -    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 -    <controller type='usb' index='0' model='none'/>
 -    <controller type='sata' index='0'>
 -      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
 -    </controller>
 -    <controller type='pci' index='0' model='pcie-root'/>
 -    <input type='mouse' bus='ps2'/>
 -    <input type='keyboard' bus='ps2'/>
 -    <audio id='1' type='none'/>
 -    <watchdog model='itco' action='reset'/>
 -    <memballoon model='none'/>
 -  </devices>
 -</domain>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 726281a4ab..5299f341cf 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1583,7 +1583,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-legacy-paths");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-modern-paths");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit");
 -    DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-nvram");
 +    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-rw-nvram");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-loader-no-path");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-path-nonstandard");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-domain_validate-Reject-ROMs-with-format-other-than-raw.patch
+++ b/centos-10/SOURCES/libvirt-domain_validate-Reject-ROMs-with-format-other-than-raw.patch
@ -0,0 +1,157 @@
 From 247090edf75839e13a23885a84cf090fbdd42228 Mon Sep 17 00:00:00 2001
 Message-ID: <247090edf75839e13a23885a84cf090fbdd42228.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 19 Dec 2025 15:19:26 +0100
 Subject: [PATCH] domain_validate: Reject ROMs with format other than raw
 The combination doesn't make sense.
 After this change the firmware-auto-efi-format-loader-qcow2-rom
 test case starts failing, as it should have in the first place.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit c74adb33e4d97202e08a53119f463c54370e5816)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_validate.c                    | 10 +++++
 ...format-loader-qcow2-rom.x86_64-latest.args | 34 ----------------
 ...-format-loader-qcow2-rom.x86_64-latest.err |  1 +
 ...-format-loader-qcow2-rom.x86_64-latest.xml | 39 -------------------
 tests/qemuxmlconftest.c                       |  2 +-
 5 files changed, 12 insertions(+), 74 deletions(-)
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.args
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.err
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.xml
 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
 index 93a54f8cc7..7346a61731 100644
 --- a/src/conf/domain_validate.c
 +++ b/src/conf/domain_validate.c
@@ -1811,6 +1811,16 @@ virDomainDefOSValidate(const virDomainDef *def,
         }
     }
 +    if (loader->type == VIR_DOMAIN_LOADER_TYPE_ROM) {
 +        if (loader->format &&
 +            loader->format != VIR_STORAGE_FILE_RAW) {
 +            virReportError(VIR_ERR_XML_DETAIL,
 +                           _("Invalid format '%1$s' for ROM loader type"),
 +                           virStorageFileFormatTypeToString(loader->format));
 +            return -1;
 +        }
 +    }
 +
     if (def->os.shim && !def->os.kernel) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                        _("shim only allowed with kernel option"));
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.args
 deleted file mode 100644
 index 417084d45e..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.args
 +++ /dev/null
@@ -1,34 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --bios /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.err
 new file mode 100644
 index 0000000000..b7b1400f6a
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.err
@@ -0,0 +1 @@
 +Invalid format 'qcow2' for ROM loader type
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.xml
 deleted file mode 100644
 index 862a50ddb4..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-loader-qcow2-rom.x86_64-latest.xml
 +++ /dev/null
@@ -1,39 +0,0 @@
 -<domain type='kvm'>
 -  <name>guest</name>
 -  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 -  <memory unit='KiB'>1048576</memory>
 -  <currentMemory unit='KiB'>1048576</currentMemory>
 -  <vcpu placement='static'>1</vcpu>
 -  <os firmware='efi'>
 -    <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='enrolled-keys'/>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader type='rom' format='qcow2'>/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd</loader>
 -    <boot dev='hd'/>
 -  </os>
 -  <features>
 -    <acpi/>
 -  </features>
 -  <cpu mode='custom' match='exact' check='none'>
 -    <model fallback='forbid'>qemu64</model>
 -  </cpu>
 -  <clock offset='utc'/>
 -  <on_poweroff>destroy</on_poweroff>
 -  <on_reboot>restart</on_reboot>
 -  <on_crash>destroy</on_crash>
 -  <devices>
 -    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 -    <controller type='usb' index='0' model='none'/>
 -    <controller type='sata' index='0'>
 -      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
 -    </controller>
 -    <controller type='pci' index='0' model='pcie-root'/>
 -    <input type='mouse' bus='ps2'/>
 -    <input type='keyboard' bus='ps2'/>
 -    <audio id='1' type='none'/>
 -    <watchdog model='itco' action='reset'/>
 -    <memballoon model='none'/>
 -  </devices>
 -</domain>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 0a4dab9fe0..3296f6f990 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1650,7 +1650,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-efi-nvram-network-iscsi");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-loader-qcow2");
 -    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-loader-qcow2-rom");
 +    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-format-loader-qcow2-rom");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-loader-qcow2-nvram-path");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-qcow2");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-qcow2-path");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-domain_validate-Reject-read-write-ROMs.patch
+++ b/centos-10/SOURCES/libvirt-domain_validate-Reject-read-write-ROMs.patch
@ -0,0 +1,140 @@
 From 3872c63fb5af9e6d37f14b157171ab9fead24b83 Mon Sep 17 00:00:00 2001
 Message-ID: <3872c63fb5af9e6d37f14b157171ab9fead24b83.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 12 Dec 2025 16:31:09 +0100
 Subject: [PATCH] domain_validate: Reject read/write ROMs
 The combination doesn't make sense.
 After this change the firmware-manual-bios-rw test case starts
 failing, as it should have in the first place.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit a5ae34aa74647e06114d85601c146a991323284b)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_validate.c                    |  6 ++++
 ...firmware-manual-bios-rw.x86_64-latest.args | 32 -------------------
 .../firmware-manual-bios-rw.x86_64-latest.err |  1 +
 .../firmware-manual-bios-rw.x86_64-latest.xml | 28 ----------------
 tests/qemuxmlconftest.c                       |  2 +-
 5 files changed, 8 insertions(+), 61 deletions(-)
 delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.args
 create mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.err
 delete mode 100644 tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.xml
 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
 index 09c1b3f13f..93a54f8cc7 100644
 --- a/src/conf/domain_validate.c
 +++ b/src/conf/domain_validate.c
@@ -1766,6 +1766,12 @@ virDomainDefOSValidate(const virDomainDef *def,
     }
     if (loader->readonly == VIR_TRISTATE_BOOL_NO) {
 +        if (loader->type == VIR_DOMAIN_LOADER_TYPE_ROM) {
 +            virReportError(VIR_ERR_XML_DETAIL, "%s",
 +                           _("ROM loader type cannot be used as read/write"));
 +            return -1;
 +        }
 +
         if (loader->nvramTemplate) {
             virReportError(VIR_ERR_XML_DETAIL, "%s",
                            _("NVRAM template is not permitted when loader is read/write"));
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.args
 deleted file mode 100644
 index 969c7ad68c..0000000000
 --- a/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.args
 +++ /dev/null
@@ -1,32 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 --accel tcg \
 --cpu qemu64 \
 --bios /usr/share/seabios/bios.bin \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.err
 new file mode 100644
 index 0000000000..13e9d7c0f1
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.err
@@ -0,0 +1 @@
 +ROM loader type cannot be used as read/write
 diff --git a/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.xml
 deleted file mode 100644
 index 65bb8493c9..0000000000
 --- a/tests/qemuxmlconfdata/firmware-manual-bios-rw.x86_64-latest.xml
 +++ /dev/null
@@ -1,28 +0,0 @@
 -<domain type='qemu'>
 -  <name>guest</name>
 -  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 -  <memory unit='KiB'>1048576</memory>
 -  <currentMemory unit='KiB'>1048576</currentMemory>
 -  <vcpu placement='static'>1</vcpu>
 -  <os>
 -    <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type>
 -    <loader readonly='no' type='rom' format='raw'>/usr/share/seabios/bios.bin</loader>
 -    <boot dev='hd'/>
 -  </os>
 -  <cpu mode='custom' match='exact' check='none'>
 -    <model fallback='forbid'>qemu64</model>
 -  </cpu>
 -  <clock offset='utc'/>
 -  <on_poweroff>destroy</on_poweroff>
 -  <on_reboot>restart</on_reboot>
 -  <on_crash>destroy</on_crash>
 -  <devices>
 -    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 -    <controller type='usb' index='0' model='none'/>
 -    <controller type='pci' index='0' model='pci-root'/>
 -    <input type='mouse' bus='ps2'/>
 -    <input type='keyboard' bus='ps2'/>
 -    <audio id='1' type='none'/>
 -    <memballoon model='none'/>
 -  </devices>
 -</domain>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index ba33267d4e..a45487b1b5 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1576,7 +1576,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-manual-bios");
     DO_TEST_CAPS_LATEST("firmware-manual-bios-stateless");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-bios-not-stateless");
 -    DO_TEST_CAPS_LATEST("firmware-manual-bios-rw");
 +    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-bios-rw");
     DO_TEST_CAPS_LATEST("firmware-manual-efi");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-features");
     DO_TEST_CAPS_LATEST_ABI_UPDATE_PARSE_ERROR("firmware-manual-efi-features");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-include-Mention-varstore-where-applicable.patch
+++ b/centos-10/SOURCES/libvirt-include-Mention-varstore-where-applicable.patch
@ -0,0 +1,69 @@
 From af33f07936bd97081a626499700a872c9cfdbecb Mon Sep 17 00:00:00 2001
 Message-ID: <af33f07936bd97081a626499700a872c9cfdbecb.1772815314.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 30 Jan 2026 18:34:40 +0100
 Subject: [PATCH] include: Mention varstore where applicable
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We are not introducing additional API flags for varstore
 handling since that would require unnecessary churn in all
 libvirt-based apps, and the intent is the same: recreate
 the UEFI variable storage, be it NVRAM or varstore, from its
 template.
 In order to clarify that the existing flags affect varstore
 too, update their documentation.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 31e40b6229cd3bc1affaecdc577f1ec1dd85d54c)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 include/libvirt/libvirt-domain-snapshot.h | 2 +-
 include/libvirt/libvirt-domain.h          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/include/libvirt/libvirt-domain-snapshot.h b/include/libvirt/libvirt-domain-snapshot.h
 index a11cd3f823..e14b661e37 100644
 --- a/include/libvirt/libvirt-domain-snapshot.h
 +++ b/include/libvirt/libvirt-domain-snapshot.h
@@ -217,7 +217,7 @@ typedef enum {
     VIR_DOMAIN_SNAPSHOT_REVERT_RUNNING = 1 << 0, /* Run after revert (Since: 0.9.5) */
     VIR_DOMAIN_SNAPSHOT_REVERT_PAUSED  = 1 << 1, /* Pause after revert (Since: 0.9.5) */
     VIR_DOMAIN_SNAPSHOT_REVERT_FORCE   = 1 << 2, /* Allow risky reverts (Since: 0.9.7) */
 -    VIR_DOMAIN_SNAPSHOT_REVERT_RESET_NVRAM = 1 << 3, /* Re-initialize NVRAM from template (Since: 8.1.0) */
 +    VIR_DOMAIN_SNAPSHOT_REVERT_RESET_NVRAM = 1 << 3, /* Re-initialize NVRAM/varstore from template (Since: 8.1.0) */
 } virDomainSnapshotRevertFlags;
 /* Revert the domain to a point-in-time snapshot.  The
 diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
 index 8e62bd23d4..221e22443e 100644
 --- a/include/libvirt/libvirt-domain.h
 +++ b/include/libvirt/libvirt-domain.h
@@ -371,7 +371,7 @@ typedef enum {
     VIR_DOMAIN_START_BYPASS_CACHE = 1 << 2, /* Avoid file system cache pollution (Since: 0.9.4) */
     VIR_DOMAIN_START_FORCE_BOOT   = 1 << 3, /* Boot, discarding any managed save (Since: 0.9.5) */
     VIR_DOMAIN_START_VALIDATE     = 1 << 4, /* Validate the XML document against schema (Since: 1.2.12) */
 -    VIR_DOMAIN_START_RESET_NVRAM  = 1 << 5, /* Re-initialize NVRAM from template (Since: 8.1.0) */
 +    VIR_DOMAIN_START_RESET_NVRAM  = 1 << 5, /* Re-initialize NVRAM/varstore from template (Since: 8.1.0) */
 } virDomainCreateFlags;
@@ -1652,7 +1652,7 @@ typedef enum {
     VIR_DOMAIN_SAVE_BYPASS_CACHE = 1 << 0, /* Avoid file system cache pollution (Since: 0.9.4) */
     VIR_DOMAIN_SAVE_RUNNING      = 1 << 1, /* Favor running over paused (Since: 0.9.5) */
     VIR_DOMAIN_SAVE_PAUSED       = 1 << 2, /* Favor paused over running (Since: 0.9.5) */
 -    VIR_DOMAIN_SAVE_RESET_NVRAM  = 1 << 3, /* Re-initialize NVRAM from template (Since: 8.1.0) */
 +    VIR_DOMAIN_SAVE_RESET_NVRAM  = 1 << 3, /* Re-initialize NVRAM/varstore from template (Since: 8.1.0) */
 } virDomainSaveRestoreFlags;
 int                     virDomainSave           (virDomainPtr domain,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-iommufd-fix-FD-leak-in-case-of-error.patch
+++ b/centos-10/SOURCES/libvirt-iommufd-fix-FD-leak-in-case-of-error.patch
@ -0,0 +1,38 @@
 From a07ea47ade888579a3ceb1699a2e029c699fda4f Mon Sep 17 00:00:00 2001
 Message-ID: <a07ea47ade888579a3ceb1699a2e029c699fda4f.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Tue, 17 Feb 2026 08:38:07 +0100
 Subject: [PATCH] iommufd: fix FD leak in case of error
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Reported-by: coverity
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit f37e14119c257281eab4fd1fed1b1018fe4f63b1)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/util/viriommufd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c
 index 1f3353eab4..b62d59241d 100644
 --- a/src/util/viriommufd.c
 +++ b/src/util/viriommufd.c
@@ -87,8 +87,10 @@ virIOMMUFDOpenDevice(void)
     if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0)
         virReportSystemError(errno, "%s", _("cannot open IOMMUFD device"));
 -    if (virIOMMUFDSetRLimitMode(fd, true) < 0)
 +    if (virIOMMUFDSetRLimitMode(fd, true) < 0) {
 +        VIR_FORCE_CLOSE(fd);
         return -1;
 +    }
     return fd;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Convert-IOMMUFD-to-qemuFDPassDirect.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Convert-IOMMUFD-to-qemuFDPassDirect.patch
@ -0,0 +1,125 @@
 From 48ae2b31930d1b5203c88acd6498893948aa2674 Mon Sep 17 00:00:00 2001
 Message-ID: <48ae2b31930d1b5203c88acd6498893948aa2674.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:42:39 +0100
 Subject: [PATCH] qemu: Convert IOMMUFD to qemuFDPassDirect
 This cleans up creating QEMU command line and makes it easier when
 adding hotplug support.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit df59beed37db5451a44955c1c440eebc474bffb2)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c | 7 ++-----
 src/qemu/qemu_domain.c  | 4 ++--
 src/qemu/qemu_domain.h  | 2 +-
 src/qemu/qemu_process.c | 6 ++++--
 tests/qemuxmlconftest.c | 6 ++++--
 5 files changed, 13 insertions(+), 12 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 3119191413..443780eff5 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -5350,19 +5350,16 @@ qemuBuildIOMMUFDCommandLine(virCommand *cmd,
                             virDomainObj *vm)
 {
     qemuDomainObjPrivate *priv = vm->privateData;
 -    g_autofree char *fdstr = g_strdup_printf("%d", priv->iommufd);
     g_autoptr(virJSONValue) props = NULL;
     if (!virDomainDefHasPCIHostdevWithIOMMUFD(def))
         return 0;
 -    virCommandPassFD(cmd, priv->iommufd, VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 -
 -    priv->iommufd = -1;
 +    qemuFDPassDirectTransferCommand(priv->iommufd, cmd);
     if (qemuMonitorCreateObjectProps(&props, "iommufd",
                                      "iommufd0",
 -                                     "S:fd", fdstr,
 +                                     "S:fd", qemuFDPassDirectGetPath(priv->iommufd),
                                      NULL) < 0)
         return -1;
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 64b01e524f..d9cd9324e0 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -1975,7 +1975,7 @@ qemuDomainObjPrivateDataClear(qemuDomainObjPrivate *priv)
     priv->migrationRecoverSetup = false;
 -    VIR_FORCE_CLOSE(priv->iommufd);
 +    g_clear_pointer(&priv->iommufd, qemuFDPassDirectFree);
     g_clear_pointer(&priv->memoryBackingDir, g_free);
 }
@@ -2044,7 +2044,7 @@ qemuDomainObjPrivateAlloc(void *opaque)
     priv->blockjobs = virHashNew(virObjectUnref);
     priv->fds = virHashNew(g_object_unref);
 -    priv->iommufd = -1;
 +    priv->iommufd = NULL;
     priv->pidMonitored = -1;
     /* agent commands block by default, user can choose different behavior */
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index 30ca67bf76..a5403ecc93 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -264,7 +264,7 @@ struct _qemuDomainObjPrivate {
     /* named file descriptor groups associated with the VM */
     GHashTable *fds;
 -    int iommufd;
 +    qemuFDPassDirect *iommufd;
     char *memoryBackingDir;
 };
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 3729edcd7e..91167d73bc 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7685,13 +7685,15 @@ static int
 qemuProcessOpenIommuFd(virDomainObj *vm)
 {
     qemuDomainObjPrivate *priv = vm->privateData;
 +    int iommufd;
     VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name);
 -    if ((priv->iommufd = virIOMMUFDOpenDevice()) < 0)
 +    if ((iommufd = virIOMMUFDOpenDevice()) < 0)
         return -1;
 -    VIR_DEBUG("Opened IOMMU FD %d for domain %s", priv->iommufd, vm->def->name);
 +    priv->iommufd = qemuFDPassDirectNew("iommufd", &iommufd);
 +
     return 0;
 }
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 6f16b6cee8..b58bdc1f80 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -406,8 +406,10 @@ testQemuPrepareHostdev(virDomainObj *vm)
         }
     }
 -    if (virDomainDefHasPCIHostdevWithIOMMUFD(vm->def))
 -        priv->iommufd = 0;
 +    if (virDomainDefHasPCIHostdevWithIOMMUFD(vm->def)) {
 +        int iommufd = 0;
 +        priv->iommufd = qemuFDPassDirectNew("iommufd", &iommufd);
 +    }
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Convert-vfioDeviceFd-to-qemuFDPassDirect.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Convert-vfioDeviceFd-to-qemuFDPassDirect.patch
@ -0,0 +1,129 @@
 From f0bc052ed97cd00f6d3da0493bb33b95db93a776 Mon Sep 17 00:00:00 2001
 Message-ID: <f0bc052ed97cd00f6d3da0493bb33b95db93a776.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:28:16 +0100
 Subject: [PATCH] qemu: Convert vfioDeviceFd to qemuFDPassDirect
 This cleans up creating QEMU command line and makes it easier when
 adding hotplug support.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4611f227c7882c8b9237da5e2fab21932ef6bd51)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c | 15 +++++----------
 src/qemu/qemu_domain.c  |  4 ++--
 src/qemu/qemu_domain.h  |  2 +-
 src/qemu/qemu_process.c |  6 +++++-
 tests/qemuxmlconftest.c |  4 +++-
 5 files changed, 16 insertions(+), 15 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 443780eff5..33127fbc0a 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -4811,12 +4811,10 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
         pcisrc->driver.iommufd == VIR_TRISTATE_BOOL_YES) {
         qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(dev);
 -        if (hostdevPriv->vfioDeviceFd != -1) {
 -            g_autofree char *fdstr = g_strdup_printf("%d", hostdevPriv->vfioDeviceFd);
 -            if (virJSONValueObjectAdd(&props, "S:fd", fdstr, NULL) < 0)
 -                return NULL;
 -            hostdevPriv->vfioDeviceFd = -1;
 -        }
 +        if (virJSONValueObjectAdd(&props,
 +                                  "S:fd", qemuFDPassDirectGetPath(hostdevPriv->vfioDeviceFd),
 +                                  NULL) < 0)
 +            return NULL;
     }
     if (qemuBuildDeviceAddressProps(props, def, dev->info) < 0)
@@ -5266,10 +5264,7 @@ qemuBuildHostdevCommandLine(virCommand *cmd,
             if (subsys->u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
                 qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 -                if (hostdevPriv->vfioDeviceFd != -1) {
 -                    virCommandPassFD(cmd, hostdevPriv->vfioDeviceFd,
 -                                     VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 -                }
 +                qemuFDPassDirectTransferCommand(hostdevPriv->vfioDeviceFd, cmd);
             }
             if (!(devprops = qemuBuildPCIHostdevDevProps(def, hostdev)))
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index d9cd9324e0..ada9d3431c 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -1245,7 +1245,7 @@ qemuDomainHostdevPrivateDispose(void *obj)
 {
     qemuDomainHostdevPrivate *priv = obj;
 -    VIR_FORCE_CLOSE(priv->vfioDeviceFd);
 +    g_clear_pointer(&priv->vfioDeviceFd, qemuFDPassDirectFree);
 }
@@ -1271,7 +1271,7 @@ qemuDomainHostdevPrivateNew(void)
     if (!(priv = virObjectNew(qemuDomainHostdevPrivateClass)))
         return NULL;
 -    priv->vfioDeviceFd = -1;
 +    priv->vfioDeviceFd = NULL;
     return (virObject *) priv;
 }
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index a5403ecc93..8aa94fc25b 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -471,7 +471,7 @@ struct _qemuDomainHostdevPrivate {
     virObject parent;
     /* VFIO device file descriptor for iommufd passthrough */
 -    int vfioDeviceFd;
 +    qemuFDPassDirect *vfioDeviceFd;
 };
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 91167d73bc..59fff1aa19 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7710,10 +7710,14 @@ qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 {
     qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
     virDomainHostdevSubsysPCI *pci = &hostdev->source.subsys.u.pci;
 +    g_autofree char *name = g_strdup_printf("hostdev-%s-fd", hostdev->info->alias);
 +    int vfioDeviceFd;
 -    if ((hostdevPriv->vfioDeviceFd = virPCIDeviceOpenVfioFd(&pci->addr)) < 0)
 +    if ((vfioDeviceFd = virPCIDeviceOpenVfioFd(&pci->addr)) < 0)
         return -1;
 +    hostdevPriv->vfioDeviceFd = qemuFDPassDirectNew(name, &vfioDeviceFd);
 +
     return 0;
 }
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index b58bdc1f80..bddd659fd4 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -357,8 +357,10 @@ testQemuPrepareHostdevPCI(virDomainHostdevDef *hostdev)
     qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
     if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +        g_autofree char *name = g_strdup_printf("hostdev-%s-fd", hostdev->info->alias);
         /* Use a placeholder FD value for tests */
 -        hostdevPriv->vfioDeviceFd = 0;
 +        int vfioDeviceFD = 0;
 +        hostdevPriv->vfioDeviceFd = qemuFDPassDirectNew(name, &vfioDeviceFD);
     }
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Create-and-delete-varstore-file.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Create-and-delete-varstore-file.patch
@ -0,0 +1,118 @@
 From ab8dbe11d56790f6fd140919559ad7610cc1f535 Mon Sep 17 00:00:00 2001
 Message-ID: <ab8dbe11d56790f6fd140919559ad7610cc1f535.1772815314.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 23 Jan 2026 19:47:13 +0100
 Subject: [PATCH] qemu: Create and delete varstore file
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Simply mimicking what is currently done for NVRAM files does
 the trick. A few user-visible messages are updated to reflect
 the fact that they apply both to NVRAM and varstore.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 5dc97de2c4fb4c2097c29cbe0eb38e3cdb4e92b0)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_driver.c  | 14 +++++++++-----
 src/qemu/qemu_process.c | 28 ++++++++++++++++++++++++++--
 2 files changed, 35 insertions(+), 7 deletions(-)
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
 index d314aa94ce..ad894c7584 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
@@ -6639,22 +6639,26 @@ qemuDomainUndefineFlags(virDomainPtr dom,
         }
     }
 -    if (vm->def->os.loader && vm->def->os.loader->nvram &&
 -        virStorageSourceIsLocalStorage(vm->def->os.loader->nvram)) {
 -        nvram_path = g_strdup(vm->def->os.loader->nvram->path);
 +    if (vm->def->os.loader) {
 +        if (vm->def->os.loader->nvram &&
 +            virStorageSourceIsLocalStorage(vm->def->os.loader->nvram)) {
 +            nvram_path = g_strdup(vm->def->os.loader->nvram->path);
 +        } else if (vm->def->os.varstore && vm->def->os.varstore->path) {
 +            nvram_path = g_strdup(vm->def->os.varstore->path);
 +        }
     }
     if (nvram_path && virFileExists(nvram_path)) {
         if ((flags & VIR_DOMAIN_UNDEFINE_NVRAM)) {
             if (unlink(nvram_path) < 0) {
                 virReportSystemError(errno,
 -                                     _("failed to remove nvram: %1$s"),
 +                                     _("Failed to remove NVRAM/varstore: %1$s"),
                                      nvram_path);
                 goto endjob;
             }
         } else if (!(flags & VIR_DOMAIN_UNDEFINE_KEEP_NVRAM)) {
             virReportError(VIR_ERR_OPERATION_INVALID, "%s",
 -                           _("cannot undefine domain with nvram"));
 +                           _("Cannot undefine domain with NVRAM/varstore"));
             goto endjob;
         }
     }
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 47deb9abb9..3ca87df284 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -5031,6 +5031,27 @@ qemuPrepareNVRAM(virQEMUDriver *driver,
 }
 +static int
 +qemuPrepareVarstore(virQEMUDriver *driver,
 +                    virDomainDef *def,
 +                    bool reset_nvram)
 +{
 +    virDomainLoaderDef *loader = def->os.loader;
 +    virDomainVarstoreDef *varstore = def->os.varstore;
 +
 +    if (!loader || !varstore)
 +        return 0;
 +
 +    VIR_DEBUG("varstore='%s'", NULLSTR(varstore->path));
 +
 +    if (qemuPrepareNVRAMFileCommon(driver, varstore->path,
 +                                   varstore->template, reset_nvram) < 0)
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 static void
 qemuLogOperation(virDomainObj *vm,
                  const char *msg,
@@ -7795,6 +7816,7 @@ qemuProcessPrepareHost(virQEMUDriver *driver,
     unsigned int hostdev_flags = 0;
     qemuDomainObjPrivate *priv = vm->privateData;
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
 +    bool reset_nvram = !!(flags & VIR_QEMU_PROCESS_START_RESET_NVRAM);
     /*
      * Create all per-domain directories in order to make sure domain
@@ -7804,8 +7826,10 @@ qemuProcessPrepareHost(virQEMUDriver *driver,
         qemuProcessMakeDir(driver, vm, priv->channelTargetDir) < 0)
         return -1;
 -    if (qemuPrepareNVRAM(driver, vm->def,
 -                         !!(flags & VIR_QEMU_PROCESS_START_RESET_NVRAM)) < 0)
 +    if (qemuPrepareNVRAM(driver, vm->def, reset_nvram) < 0)
 +        return -1;
 +
 +    if (qemuPrepareVarstore(driver, vm->def, reset_nvram) < 0)
         return -1;
     if (vm->def->vsock) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Extract-disk-setup-done-via-QMP-into-a-separate-helper.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Extract-disk-setup-done-via-QMP-into-a-separate-helper.patch
@ -0,0 +1,144 @@
 From 92a7fef67b736e20c8e94f3407df7a984ee59102 Mon Sep 17 00:00:00 2001
 Message-ID: <92a7fef67b736e20c8e94f3407df7a984ee59102.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 29 Jan 2026 11:15:04 +0100
 Subject: [PATCH] qemu: Extract disk setup done via QMP into a separate helper
 Introduce 'qemuProcessSetupDiskPropsRuntime' helper function which will
 collect all code used for runtime setup of a disk.
 This is currently old-style throttling.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 1789a0f8a3623e8f0f6e50730feb58e3d8c48376)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 Conflicts:
 - Commit b9b9092c9c1f8b42e311c524d9fc4a8e73ae28a6 which dropped disk
   property refresh was not backported, thus the context around the call
   to qemuProcessSetupDiskPropsRuntime was different
 ---
 src/qemu/qemu_hotplug.c | 23 +++++------------------
 src/qemu/qemu_process.c | 37 +++++++++++++++++++++++++++----------
 src/qemu/qemu_process.h |  3 +++
 3 files changed, 35 insertions(+), 28 deletions(-)
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index fb426deb1a..f2dc4469a3 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -569,13 +569,8 @@ qemuDomainChangeMediaBlockdev(virDomainObj *vm,
     }
     /* set throttling for the new image */
 -    if (rc == 0 &&
 -        !virStorageSourceIsEmpty(newsrc) &&
 -        qemuDiskConfigBlkdeviotuneEnabled(disk)) {
 -        rc = qemuMonitorSetBlockIoThrottle(priv->mon,
 -                                           diskPriv->qomName,
 -                                           &disk->blkdeviotune);
 -    }
 +    if (rc == 0)
 +        rc = qemuProcessSetupDiskPropsRuntime(priv->mon, disk);
     if (rc == 0)
         rc = qemuMonitorBlockdevTrayClose(priv->mon, diskPriv->qomName);
@@ -795,21 +790,13 @@ qemuDomainAttachDiskGeneric(virDomainObj *vm,
     if (rc == 0)
         rc = qemuMonitorAddDeviceProps(priv->mon, &devprops);
 -    /* Setup throttling of disk via block_set_io_throttle QMP command. This
 -     * is a hack until the 'throttle' blockdev driver will support modification
 -     * of the trhottle group. See also qemuProcessSetupDiskThrottlingBlockdev.
 -     * As there isn't anything sane to do if this fails, let's just return
 -     * success.
 -     */
     if (rc == 0) {
         qemuDomainDiskPrivate *diskPriv = QEMU_DOMAIN_DISK_PRIVATE(disk);
         g_autoptr(GHashTable) blockinfo = NULL;
 -        if (qemuDiskConfigBlkdeviotuneEnabled(disk)) {
 -            if (qemuMonitorSetBlockIoThrottle(priv->mon, diskPriv->qomName,
 -                                              &disk->blkdeviotune) < 0)
 -                VIR_WARN("failed to set blkdeviotune for '%s' of '%s'", disk->dst, vm->def->name);
 -        }
 +        /* There isn't anything sane to do if this fails (rollback would
 +         * require hot-unplug), let's just return success. */
 +        ignore_value(qemuProcessSetupDiskPropsRuntime(priv->mon, disk));
         if ((blockinfo = qemuMonitorGetBlockInfo(priv->mon))) {
             struct qemuDomainDiskInfo *diskinfo;
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index d8f0c78fd1..c99bb36c93 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7937,6 +7937,32 @@ qemuProcessGenID(virDomainObj *vm,
 }
 +/**
 + * qemuProcessSetupDiskPropsRuntime:
 + * @mon: qemu monitor object
 + * @disk: disk definition
 + *
 + * This function expects that caller already entered 'monitor' context.
 + *
 + * Sets up disk properties which are only possible to be set in runtime.
 + */
 +int
 +qemuProcessSetupDiskPropsRuntime(qemuMonitor *mon,
 +                                 virDomainDiskDef *disk)
 +{
 +    if (virStorageSourceIsEmpty(disk->src))
 +        return 0;
 +
 +    if (qemuDiskConfigBlkdeviotuneEnabled(disk) &&
 +        qemuMonitorSetBlockIoThrottle(mon,
 +                                      QEMU_DOMAIN_DISK_PRIVATE(disk)->qomName,
 +                                      &disk->blkdeviotune) < 0)
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 /**
  * qemuProcessSetupDiskThrottling:
  *
@@ -7960,16 +7986,7 @@ qemuProcessSetupDiskThrottling(virDomainObj *vm,
     for (i = 0; i < vm->def->ndisks; i++) {
         virDomainDiskDef *disk = vm->def->disks[i];
 -        /* Setting throttling for empty drives fails */
 -        if (virStorageSourceIsEmpty(disk->src))
 -            continue;
 -
 -        if (!qemuDiskConfigBlkdeviotuneEnabled(disk))
 -            continue;
 -
 -        if (qemuMonitorSetBlockIoThrottle(qemuDomainGetMonitor(vm),
 -                                          QEMU_DOMAIN_DISK_PRIVATE(disk)->qomName,
 -                                          &disk->blkdeviotune) < 0)
 +        if (qemuProcessSetupDiskPropsRuntime(qemuDomainGetMonitor(vm), disk) < 0)
             goto cleanup;
     }
 diff --git a/src/qemu/qemu_process.h b/src/qemu/qemu_process.h
 index 426e11d79e..df78b00abb 100644
 --- a/src/qemu/qemu_process.h
 +++ b/src/qemu/qemu_process.h
@@ -146,6 +146,9 @@ int qemuProcessPrepareHostStorageSourceChain(virDomainObj *vm,
 int qemuProcessPrepareHostStorageDisk(virDomainObj *vm,
                                   virDomainDiskDef *disk);
 +int qemuProcessSetupDiskPropsRuntime(qemuMonitor *mon,
 +                                     virDomainDiskDef *disk);
 +
 int qemuProcessDeleteThreadContext(virDomainObj *vm);
 int qemuProcessLaunch(virConnectPtr conn,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Fill-in-firmwareFeature-element-for-domaincaps.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Fill-in-firmwareFeature-element-for-domaincaps.patch
--- a/centos-10/SOURCES/libvirt-qemu-Fill-in-varstore-element-in-domcaps.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Fill-in-varstore-element-in-domcaps.patch
--- a/centos-10/SOURCES/libvirt-qemu-Fill-iommufd-domain-capability.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Fill-iommufd-domain-capability.patch
--- a/centos-10/SOURCES/libvirt-qemu-Ignore-cmp_legacy-CPU-flag.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Ignore-cmp_legacy-CPU-flag.patch
@ -0,0 +1,713 @@
 From 636b8f50486f3007be1b92ddb84f326f58d168d8 Mon Sep 17 00:00:00 2001
 Message-ID: <636b8f50486f3007be1b92ddb84f326f58d168d8.1770825107.git.jdenemar@redhat.com>
 From: Jean-Louis Dupond <jean-louis@dupond.be>
 Date: Thu, 5 Feb 2026 14:18:42 +0100
 Subject: [PATCH] qemu: Ignore cmp_legacy CPU flag
 Since commit 99a637a8 in qemu 10.0, the way the cmp_legacy flag is
 reported changed. The same way as happend with the 'ht' flag in commit
 c6bd2dd634208, which was fixed in libvirt since commit ba16113c.
 This causes migrations from a hypervisor running a qemu version before
 that commit to a hypervisor running qemu after that commit fails
 with the following error:
 guest CPU doesn't match specification: extra features: cmp_legacy
 We can just ignore this flag, just like we did with the 'ht' flag.
 Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit fc5840b4980045a05b8973900cdbe36162e48331)
 https://issues.redhat.com/browse/RHEL-148494
 Conflicts:
 	tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
 	tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
 	tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
 	tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
            - upstream commit v11.10.0-78-g380764992d
              (qemucapabilitiesdata: Re-generate 'caps_10.2.0_x86_64')
              that added rdseed=off to test files is not backported
 	tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args
            - missing downstream, it was added upstream after the last
              rebase
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_capabilities.c                                    | 1 +
 .../cpu-host-model-fallback-kvm.x86_64-10.0.0.args              | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-10.1.0.args              | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-6.2.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-7.0.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-7.1.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-7.2.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-8.0.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-8.1.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-8.2.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-9.0.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-9.1.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-9.2.0.args               | 2 +-
 .../cpu-host-model-fallback-kvm.x86_64-latest.args              | 2 +-
 .../cpu-host-model-fallback-tcg.x86_64-10.1.0.args              | 2 +-
 .../cpu-host-model-fallback-tcg.x86_64-latest.args              | 2 +-
 .../qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args  | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args     | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args     | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args      | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args     | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-10.0.0.args            | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-10.1.0.args            | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-6.2.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-7.0.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-7.1.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-7.2.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-8.0.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-8.1.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-8.2.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-9.0.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-9.1.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-9.2.0.args             | 2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-latest.args            | 2 +-
 .../cpu-host-model-nofallback-tcg.x86_64-10.1.0.args            | 2 +-
 .../cpu-host-model-nofallback-tcg.x86_64-latest.args            | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args     | 2 +-
 tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args     | 2 +-
 tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args        | 2 +-
 48 files changed, 48 insertions(+), 47 deletions(-)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 92b863a826..d738805ee8 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -3772,6 +3772,7 @@ const char *ignoredFeatures[] = {
     "vmx-ept-uc", "vmx-ept-wb",      /* never supported by QEMU */
     "vmx-invvpid-single-context",    /* never supported by QEMU */
     "ht",                            /* ignored by QEMU, set according to topology */
 +    "cmp_legacy",                    /* ignored by QEMU, set according to topology */
 };
 bool
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args
 index edd334dd8b..08f37274b2 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args
 index 57982574eb..e4044a0c64 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args
 index 4aa9011fe8..e8a9aceb4a 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-6.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args
 index e944e69cfd..0df6ce9e3d 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args
 index d9edda2733..b4a91fa921 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args
 index 1d1839b7fa..5d69199876 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-7.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args
 index 8278629ee7..e7b424819e 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args
 index 3b733a3c5d..58ad565dba 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args
 index 73296c7df0..fa1b674fa5 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-8.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args
 index 8f8b74fa56..fc9985f901 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args
 index c2f394bf09..1db86cb31e 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args
 index 35c8d397c4..4dcd9332cb 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-9.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
 index 6afa8a4c2d..e5b0acb87b 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args
 index 3b93ed510d..0b67c7f158 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args
 index 01cf90bb67..443de62f69 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-tcg.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
 index ce60a39acc..52f636fa77 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off,abm=on,ds=on,invtsc=off \
 +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off,abm=on,ds=on,invtsc=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args
 index a1c034ec51..7dd5723b98 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args
 index ddf940f75c..987baa9b30 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args
 index f65444948e..4402bad82d 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-6.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args
 index 8f8b1645d5..d6dfadc3b2 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args
 index df03bafab3..09e220487d 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args
 index 7a796812fa..7e90b309a9 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-7.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args
 index d63438e81c..fc02c9a7e0 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args
 index 901f279a02..8360dc02ef 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args
 index d141aca9f0..b00138933c 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-8.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args
 index 49575ff4d9..3b42130bd2 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args
 index fd25e4cd23..c451426cdd 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args
 index 4b69f59064..1da6e508ff 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-9.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
 index 2bf920b9c7..30010edb3b 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args
 index edd334dd8b..08f37274b2 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args
 index 57982574eb..e4044a0c64 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args
 index 4aa9011fe8..e8a9aceb4a 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-6.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-6.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args
 index e944e69cfd..0df6ce9e3d 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.0,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args
 index d9edda2733..b4a91fa921 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.1,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,tsc-scale=on,vmcb-clean=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args
 index 1d1839b7fa..5d69199876 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-7.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-7.2,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args
 index 8278629ee7..e7b424819e 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args
 index 3b733a3c5d..58ad565dba 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args
 index 73296c7df0..fa1b674fa5 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-8.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args
 index 8f8b74fa56..fc9985f901 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args
 index c2f394bf09..1db86cb31e 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args
 index 35c8d397c4..4dcd9332cb 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-9.2.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-9.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,cmp-legacy=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 +-cpu EPYC-Rome,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,stibp=on,arch-capabilities=on,ssbd=on,overflow-recov=on,succor=on,amd-ssbd=on,virt-ssbd=on,lbrv=on,tsc-scale=on,vmcb-clean=on,flushbyasid=on,pause-filter=on,pfthreshold=on,v-vmsave-vmload=on,vgif=on,svme-addr-chk=on,lfence-always-serializing=on,null-sel-clr-base=on,ibpb-brtype=on,rdctl-no=on,skip-l1dfl-vmentry=on,mds-no=on,pschange-mc-no=on,gds-no=on,rfds-no=on,xsaves=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
 index 6afa8a4c2d..e5b0acb87b 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
 --cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,cmp-legacy=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 +-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args
 index 3b93ed510d..0b67c7f158 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-i440fx-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args
 index 01cf90bb67..443de62f69 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-tcg.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args
 index 4defeceac3..d12cb96786 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-10.1.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc-q35-10.1,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args
 index 479266659a..688a217c3c 100644
 --- a/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-host-model-tcg.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,cmp-legacy=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 +-cpu EPYC,monitor=on,x2apic=on,hypervisor=on,acpi=on,ss=on,erms=on,mpx=on,clwb=on,umip=on,pku=on,vaes=on,la57=on,rdpid=on,pks=on,fsrm=on,cmpccxadd=on,fzrm=on,fsrs=on,fsrc=on,3dnowext=on,3dnow=on,xsaveerptr=on,wbnoinvd=on,npt=on,vgif=on,svme-addr-chk=on,no-nested-data-bp=on,null-sel-clr-base=on,vme=off,xsavec=off,misalignsse=off,osvw=off,topoext=off,fxsr-opt=off,nrip-save=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args
 index 49e1b590dd..d425866c67 100644
 --- a/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/cpu-translation.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel tcg \
 --cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 +-cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Implement-support-for-associating-iommufd-to-hostdev.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Implement-support-for-associating-iommufd-to-hostdev.patch
@ -0,0 +1,191 @@
 From bb8ef43213cb1f8c123cdcc693d99a30b09dfa16 Mon Sep 17 00:00:00 2001
 Message-ID: <bb8ef43213cb1f8c123cdcc693d99a30b09dfa16.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:12 -0800
 Subject: [PATCH] qemu: Implement support for associating iommufd to hostdev
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Implement a new iommufd attribute under hostdevs' PCI
 subsystem driver that can be used to specify associated
 iommufd object when launching a qemu VM.
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit fd113055bb174c7284081731d16959f73796e3d7)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 docs/formatdomain.rst           |  6 +++++
 src/conf/device_conf.c          | 11 ++++++++
 src/conf/device_conf.h          |  1 +
 src/conf/schemas/basictypes.rng |  5 ++++
 src/qemu/qemu_command.c         | 46 +++++++++++++++++++++++++++++++++
 5 files changed, 69 insertions(+)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 1467fc7e10..167912348e 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -4907,6 +4907,12 @@ or:
    found is "problematic" in some way, the generic vfio-pci driver
    similarly be forced.
 +   :since:`Since 12.1.0 (QEMU and KVM only)`, the ``iommufd`` element
 +   can be used to enable IOMMUFD backend for VFIO device. This
 +   provides an interface to propagate DMA mappings to kernel for
 +   assigned devices. Libvirt will open the /dev/iommu and VFIO device
 +   cdev and pass associated file descriptors to QEMU.
 +
    (Note: :since:`Since 1.0.5`, the ``name`` attribute has been
    described to be used to select the type of PCI device assignment
    ("vfio", "kvm", or "xen"), but those values have been mostly
 diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
 index c278b81652..d68232a4f4 100644
 --- a/src/conf/device_conf.c
 +++ b/src/conf/device_conf.c
@@ -67,6 +67,11 @@ virDeviceHostdevPCIDriverInfoParseXML(xmlNodePtr node,
         return -1;
     }
 +    if (virXMLPropTristateBool(node, "iommufd",
 +                               VIR_XML_PROP_NONE,
 +                               &driver->iommufd) < 0)
 +        return -1;
 +
     driver->model = virXMLPropString(node, "model");
     return 0;
 }
@@ -93,6 +98,12 @@ virDeviceHostdevPCIDriverInfoFormat(virBuffer *buf,
     virBufferEscapeString(&driverAttrBuf, " model='%s'", driver->model);
 +    if (driver->iommufd == VIR_TRISTATE_BOOL_YES) {
 +        virBufferAddLit(&driverAttrBuf, " iommufd='yes'");
 +    } else if (driver->iommufd == VIR_TRISTATE_BOOL_NO) {
 +        virBufferAddLit(&driverAttrBuf, " iommufd='no'");
 +    }
 +
     virXMLFormatElement(buf, "driver", &driverAttrBuf, NULL);
     return 0;
 }
 diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
 index e570f51824..116b959143 100644
 --- a/src/conf/device_conf.h
 +++ b/src/conf/device_conf.h
@@ -47,6 +47,7 @@ VIR_ENUM_DECL(virDeviceHostdevPCIDriverName);
 struct _virDeviceHostdevPCIDriverInfo {
     virDeviceHostdevPCIDriverName name;
     char *model;
 +    virTristateBool iommufd;
 };
 typedef enum {
 diff --git a/src/conf/schemas/basictypes.rng b/src/conf/schemas/basictypes.rng
 index 5689170fad..381e0ac24f 100644
 --- a/src/conf/schemas/basictypes.rng
 +++ b/src/conf/schemas/basictypes.rng
@@ -673,6 +673,11 @@
           <ref name="genericName"/>
         </attribute>
       </optional>
 +      <optional>
 +        <attribute name="iommufd">
 +          <ref name="virYesNo"/>
 +        </attribute>
 +      </optional>
       <empty/>
     </element>
   </define>
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index fb89dbec27..1fb31d1721 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -4754,6 +4754,7 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
     g_autofree char *host = virPCIDeviceAddressAsString(&pcisrc->addr);
     const char *failover_pair_id = NULL;
     const char *driver = NULL;
 +    const char *iommufdId = NULL;
     /* 'ramfb' property must be omitted unless it's to be enabled */
     bool ramfb = pcisrc->ramfb == VIR_TRISTATE_SWITCH_ON;
@@ -4787,6 +4788,9 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
         teaming->persistent)
         failover_pair_id = teaming->persistent;
 +    if (pcisrc->driver.iommufd == VIR_TRISTATE_BOOL_YES)
 +        iommufdId = "iommufd0";
 +
     if (virJSONValueObjectAdd(&props,
                               "s:driver", driver,
                               "s:host", host,
@@ -4795,6 +4799,7 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
                               "S:failover_pair_id", failover_pair_id,
                               "S:display", qemuOnOffAuto(pcisrc->display),
                               "B:ramfb", ramfb,
 +                              "S:iommufd", iommufdId,
                               NULL) < 0)
         return NULL;
@@ -5314,6 +5319,44 @@ qemuBuildHostdevCommandLine(virCommand *cmd,
 }
 +static int
 +qemuBuildIOMMUFDCommandLine(virCommand *cmd,
 +                            const virDomainDef *def)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < def->nhostdevs; i++) {
 +        virDomainHostdevDef *hostdev = def->hostdevs[i];
 +        virDomainHostdevSubsys *subsys = &hostdev->source.subsys;
 +        g_autoptr(virJSONValue) props = NULL;
 +
 +        if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
 +            continue;
 +
 +        if (subsys->type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI)
 +            continue;
 +
 +        if (hostdev->info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_UNASSIGNED)
 +            continue;
 +
 +        if (subsys->u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES)
 +            continue;
 +
 +        if (qemuMonitorCreateObjectProps(&props, "iommufd",
 +                                         "iommufd0",
 +                                         NULL) < 0)
 +            return -1;
 +
 +        if (qemuBuildObjectCommandlineFromJSON(cmd, props) < 0)
 +            return -1;
 +
 +        break;
 +    }
 +
 +    return 0;
 +}
 +
 +
 static int
 qemuBuildMonitorCommandLine(virCommand *cmd,
                             qemuDomainObjPrivate *priv)
@@ -10926,6 +10969,9 @@ qemuBuildCommandLine(virDomainObj *vm,
     if (qemuBuildRedirdevCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 +    if (qemuBuildIOMMUFDCommandLine(cmd, def) < 0)
 +        return NULL;
 +
     if (qemuBuildHostdevCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-Implement-support-for-persistent-reservation-migration-control.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Implement-support-for-persistent-reservation-migration-control.patch
@ -0,0 +1,220 @@
 From 3f03b1cbc20d0af7900cc43cc576a356a95a292b Mon Sep 17 00:00:00 2001
 Message-ID: <3f03b1cbc20d0af7900cc43cc576a356a95a292b.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 11 Dec 2025 19:47:16 +0100
 Subject: [PATCH] qemu: Implement support for persistent reservation migration
 control
 The 'migration' attribute for the '<reservations>' element allows to
 control the persistent reservation migration feature independently of
 the machine type default.
 Add the XML plumbing and qemu support.
 We consider it ABI for now since it influences qemu migration protocol.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 0d3ef7cb71979172de2c531d865e4525a314f902)
 https://issues.redhat.com/browse/RHEL-140614 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-135115 [rhel-10.2]
 ---
 docs/formatdomain.rst                         |  3 +++
 src/conf/domain_conf.c                        | 21 +++++++++++++++++++
 src/conf/schemas/storagecommon.rng            |  5 +++++
 src/conf/storage_source_conf.c                | 10 +++++++++
 src/conf/storage_source_conf.h                |  2 ++
 src/qemu/qemu_command.c                       |  4 ++++
 src/qemu/qemu_validate.c                      | 16 ++++++++++++++
 ...irtio-scsi-reservations.x86_64-latest.args |  2 +-
 .../disk-virtio-scsi-reservations.xml         |  2 +-
 9 files changed, 63 insertions(+), 2 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 167912348e..9836837441 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -3169,6 +3169,9 @@ paravirtualized driver is specified via the ``disk`` element.
       the socket, and finally ``mode`` which accepts one value ``client``
       specifying the role of hypervisor. It's recommended to allow libvirt
       manage the persistent reservations.
 +      :since:`Since 12.1.0` the ``migration`` (values ``yes``, ``no``) controls
 +      whether the hypervisor should attempt to migrate persistent reservations
 +      during migration.
    ``initiator``
       :since:`Since 4.7.0`, the ``initiator`` element is supported for
       a disk ``type`` "network" that is using a ``source`` element with the
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 902c1188ef..f5c4d135a9 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -20951,6 +20951,27 @@ virDomainDiskDefCheckABIStability(virDomainDiskDef *src,
         return false;
     }
 +    /* While not guest visible it influences the qemu migration stream so
 +     * we need to keep it identical */
 +    if (src->src->pr || dst->src->pr) {
 +        virTristateBool srcmig = VIR_TRISTATE_BOOL_ABSENT;
 +        virTristateBool dstmig = VIR_TRISTATE_BOOL_ABSENT;
 +
 +        if (src->src->pr)
 +            srcmig = src->src->pr->migration;
 +
 +        if (dst->src->pr)
 +            dstmig = dst->src->pr->migration;
 +
 +        if (srcmig != dstmig) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                           _("Target disk reservations 'migration' property %1$s does not match source %2$s"),
 +                           virTristateBoolTypeToString(dstmig),
 +                           virTristateBoolTypeToString(srcmig));
 +            return false;
 +        }
 +    }
 +
     if (!virDomainVirtioOptionsCheckABIStability(src->virtio, dst->virtio))
         return false;
 diff --git a/src/conf/schemas/storagecommon.rng b/src/conf/schemas/storagecommon.rng
 index 14704c737e..450d53131f 100644
 --- a/src/conf/schemas/storagecommon.rng
 +++ b/src/conf/schemas/storagecommon.rng
@@ -104,6 +104,11 @@
           <ref name="virYesNo"/>
         </attribute>
       </optional>
 +      <optional>
 +        <attribute name="migration">
 +          <ref name="virYesNo"/>
 +        </attribute>
 +      </optional>
       <optional>
         <ref name="unixSocketSource"/>
       </optional>
 diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c
 index 087de1eaf2..24d4b0de6a 100644
 --- a/src/conf/storage_source_conf.c
 +++ b/src/conf/storage_source_conf.c
@@ -330,6 +330,11 @@ virStoragePRDefParseXML(xmlXPathContextPtr ctxt)
                                &prd->managed) < 0)
         goto cleanup;
 +    if (virXMLPropTristateBool(ctxt->node, "migration",
 +                               VIR_XML_PROP_NONZERO,
 +                               &prd->migration) < 0)
 +        goto cleanup;
 +
     type = virXPathString("string(./source[1]/@type)", ctxt);
     path = virXPathString("string(./source[1]/@path)", ctxt);
     mode = virXPathString("string(./source[1]/@mode)", ctxt);
@@ -384,6 +389,11 @@ virStoragePRDefFormat(virBuffer *buf,
 {
     virBufferAsprintf(buf, "<reservations managed='%s'",
                       virTristateBoolTypeToString(prd->managed));
 +
 +    if (prd->migration != VIR_TRISTATE_BOOL_ABSENT)
 +        virBufferAsprintf(buf, " migration='%s'",
 +                          virTristateBoolTypeToString(prd->migration));
 +
     if (prd->path &&
         (prd->managed == VIR_TRISTATE_BOOL_NO || !migratable)) {
         virBufferAddLit(buf, ">\n");
 diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h
 index fc868b31af..5a4b088eeb 100644
 --- a/src/conf/storage_source_conf.h
 +++ b/src/conf/storage_source_conf.h
@@ -235,6 +235,8 @@ struct _virStoragePRDef {
     virTristateBool managed;
     char *path;
 +    virTristateBool migration;
 +
     /* manager object alias */
     char *mgralias;
 };
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index f355352018..c8626e6d49 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -1691,6 +1691,7 @@ qemuBuildDiskDeviceProps(const virDomainDef *def,
     g_autofree char *usbdiskalias = NULL;
     const virDomainDeviceInfo *deviceinfo = &disk->info;
     g_autoptr(virJSONValue) statistics = NULL;
 +    virTristateBool migrate_pr = VIR_TRISTATE_BOOL_ABSENT;
     virDomainDeviceInfo usbSCSIinfo = {
         .type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE,
         .addr.drive = { .diskbus = VIR_DOMAIN_DISK_BUS_USB },
@@ -1716,6 +1717,8 @@ qemuBuildDiskDeviceProps(const virDomainDef *def,
     case VIR_DOMAIN_DISK_BUS_SCSI:
         if (disk->device == VIR_DOMAIN_DISK_DEVICE_LUN) {
             driver = "scsi-block";
 +            if (disk->src->pr)
 +                migrate_pr = disk->src->pr->migration;
         } else {
             if (disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM) {
                 driver = "scsi-cd";
@@ -1937,6 +1940,7 @@ qemuBuildDiskDeviceProps(const virDomainDef *def,
                               "S:rerror", rpolicy,
                               "A:stats-intervals", &statistics,
                               "T:dpofua", disk->dpofua, /* SCSI-only, ensured by validation */
 +                              "T:migrate-pr", migrate_pr, /* 'scsi-block' only, ensured by validation */
                               NULL) < 0)
         return NULL;
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index da08fd17cd..a3dbd9a33b 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -3227,6 +3227,22 @@ qemuValidateDomainDeviceDefDiskFrontend(const virDomainDiskDef *disk,
         }
     }
 +    if (disk->src->pr &&
 +        disk->src->pr->migration != VIR_TRISTATE_BOOL_ABSENT) {
 +        if (disk->device != VIR_DOMAIN_DISK_DEVICE_LUN ||
 +            disk->bus != VIR_DOMAIN_DISK_BUS_SCSI) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                           _("persistent reservation migration supported only with 'lun' disks on 'scsi' bus"));
 +            return -1;
 +        }
 +
 +        if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR)) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                           _("persistent reservation migration not supported by this qemu"));
 +            return -1;
 +        }
 +    }
 +
     if (disk->rotation_rate) {
         if (disk->bus != VIR_DOMAIN_DISK_BUS_SCSI &&
             disk->bus != VIR_DOMAIN_DISK_BUS_IDE &&
 diff --git a/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.x86_64-latest.args b/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.x86_64-latest.args
 index cbc2a0f398..f1d7a450ee 100644
 --- a/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.x86_64-latest.args
@@ -33,7 +33,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"scsi-block","bus":"scsi0.0","channel":0,"scsi-id":0,"lun":0,"drive":"libvirt-2-storage","id":"scsi0-0-0-0","bootindex":1}' \
 -object '{"qom-type":"pr-manager-helper","id":"pr-helper-libvirt-1-storage","path":"/path/to/qemu-pr-helper.sock"}' \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest2","pr-manager":"pr-helper-libvirt-1-storage","node-name":"libvirt-1-storage","read-only":false}' \
 --device '{"driver":"scsi-block","bus":"scsi0.0","channel":0,"scsi-id":0,"lun":1,"drive":"libvirt-1-storage","id":"scsi0-0-0-1"}' \
 +-device '{"driver":"scsi-block","bus":"scsi0.0","channel":0,"scsi-id":0,"lun":1,"drive":"libvirt-1-storage","id":"scsi0-0-0-1","migrate-pr":true}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 diff --git a/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.xml b/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.xml
 index 9c55d6ec3e..7f9160ff3a 100644
 --- a/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.xml
 +++ b/tests/qemuxmlconfdata/disk-virtio-scsi-reservations.xml
@@ -28,7 +28,7 @@
     <disk type='block' device='lun'>
       <driver name='qemu' type='raw'/>
       <source dev='/dev/HostVG/QEMUGuest2'>
 -        <reservations managed='no'>
 +        <reservations managed='no' migration='yes'>
           <source type='unix' path='/path/to/qemu-pr-helper.sock' mode='client'/>
         </reservations>
       </source>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Introduce-QEMU_CAPS_OBJECT_IOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Introduce-QEMU_CAPS_OBJECT_IOMMUFD.patch
@ -0,0 +1,266 @@
 From 13871e41d1697608a55fa40d3855193a636109bb Mon Sep 17 00:00:00 2001
 Message-ID: <13871e41d1697608a55fa40d3855193a636109bb.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Mon, 16 Feb 2026 08:59:39 +0100
 Subject: [PATCH] qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD
 Detect if QEMU was compiled with IOMMUFD.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4a0ea9bcf13ea05c90f294ba70c767bc79e2ebbe)
 Conflicts:
  These files don't exist in downstream:
    tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml
    tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml
    tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
    tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_capabilities.c                              | 4 ++++
 src/qemu/qemu_capabilities.h                              | 3 +++
 src/qemu/qemu_validate.c                                  | 8 ++++++++
 tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml        | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml          | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml  | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml         | 1 +
 .../qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml  | 1 +
 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml         | 1 +
 tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml    | 1 +
 tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml         | 1 +
 tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml          | 1 +
 tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml           | 1 +
 tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml          | 1 +
 tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml           | 1 +
 tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml   | 1 +
 tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml          | 1 +
 17 files changed, 29 insertions(+)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 2c8bd62c99..c23ff5539a 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -756,6 +756,9 @@ VIR_ENUM_IMPL(virQEMUCaps,
               "query-accelerators", /* QEMU_CAPS_QUERY_ACCELERATORS */
               "mshv", /* QEMU_CAPS_MSHV */
               "scsi-block.migrate-pr", /* QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR */
 +
 +              /* 490 */
 +              "iommufd", /* QEMU_CAPS_OBJECT_IOMMUFD */
     );
@@ -1463,6 +1466,7 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[] = {
     { "tpm-emulator", QEMU_CAPS_DEVICE_TPM_EMULATOR },
     { "tpm-passthrough", QEMU_CAPS_DEVICE_TPM_PASSTHROUGH },
     { "acpi-generic-initiator", QEMU_CAPS_ACPI_GENERIC_INITIATOR },
 +    { "iommufd", QEMU_CAPS_OBJECT_IOMMUFD },
 };
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index 0c76f2edda..f7c8680f94 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -732,6 +732,9 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     QEMU_CAPS_MSHV, /* -accel mshv */
     QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR, /* persistent reservation migration support */
 +    /* 490 */
 +    QEMU_CAPS_OBJECT_IOMMUFD, /* -object iommufd */
 +
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index a3dbd9a33b..18f148f48c 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -2723,6 +2723,14 @@ qemuValidateDomainDeviceDefHostdev(const virDomainHostdevDef *hostdev,
                                    _("VFIO PCI device assignment is not supported by this version of qemu"));
                     return -1;
                 }
 +
 +                if (hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 +                    if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_OBJECT_IOMMUFD)) {
 +                        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                                       _("IOMMUFD is not supported by this version of qemu"));
 +                        return -1;
 +                    }
 +                }
             }
             if (hostdev->writeFiltering != VIR_TRISTATE_BOOL_ABSENT) {
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
 index 90e8d868cc..bbb8b33cde 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
@@ -163,6 +163,7 @@
   <flag name='nvme-ns'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>10000000</version>
   <microcodeVersion>61700285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml
 index 82a66a6524..cf00ac4ea0 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml
@@ -136,6 +136,7 @@
   <flag name='nvme'/>
   <flag name='nvme-ns'/>
   <flag name='usb-bot'/>
 +  <flag name='iommufd'/>
   <version>10000000</version>
   <microcodeVersion>39100285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
 index cfce1c963d..5acd1a33fd 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
@@ -209,6 +209,7 @@
   <flag name='amd-iommu'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>10000000</version>
   <microcodeVersion>43100285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
 index f94c8388d6..50f58791e6 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
@@ -209,6 +209,7 @@
   <flag name='amd-iommu.pci-id'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>10000000</version>
   <microcodeVersion>43100285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
 index 8e989a139f..e321c352a3 100644
 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
@@ -191,6 +191,7 @@
   <flag name='usb-bot'/>
   <flag name='tdx-guest'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>10000050</version>
   <microcodeVersion>43100286</microcodeVersion>
   <package>v10.0.0-1724-gf9a3def17b</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
 index 520a3d8ee8..2d52659520 100644
 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
@@ -214,6 +214,7 @@
   <flag name='tdx-guest'/>
   <flag name='qom-list-get'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>10001000</version>
   <microcodeVersion>43100286</microcodeVersion>
   <package>v10.1.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
 index 874fd7bddb..eb2ab001a6 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
@@ -201,6 +201,7 @@
   <flag name='acpi-generic-initiator'/>
   <flag name='query-accelerators'/>
   <flag name='mshv'/>
 +  <flag name='iommufd'/>
   <version>10001050</version>
   <microcodeVersion>43100287</microcodeVersion>
   <package>v10.1.0-1778-ge090e0312d</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 index 7d5a75ce88..c4ea924c1f 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
@@ -216,6 +216,7 @@
   <flag name='disk-timed-stats'/>
   <flag name='query-accelerators'/>
   <flag name='scsi-block.migrate-pr'/>
 +  <flag name='iommufd'/>
   <version>10001091</version>
   <microcodeVersion>43100287</microcodeVersion>
   <package>v10.2.0-rc1-38-gfb241d0a1f</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml
 index 1f2e27a218..88bd502fee 100644
 --- a/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml
@@ -204,6 +204,7 @@
   <flag name='amd-iommu'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>9000000</version>
   <microcodeVersion>43100245</microcodeVersion>
   <package>v9.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
 index b961f79808..3d2692b02c 100644
 --- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
@@ -126,6 +126,7 @@
   <flag name='nvme'/>
   <flag name='nvme-ns'/>
   <flag name='usb-bot'/>
 +  <flag name='iommufd'/>
   <version>9001000</version>
   <microcodeVersion>39100246</microcodeVersion>
   <package>v9.1.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
 index 35ddf30736..66578099a7 100644
 --- a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
@@ -203,6 +203,7 @@
   <flag name='amd-iommu'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>9001000</version>
   <microcodeVersion>43100246</microcodeVersion>
   <package>v9.1.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
 index e9f79261f7..9f95ed891e 100644
 --- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
@@ -129,6 +129,7 @@
   <flag name='nvme'/>
   <flag name='nvme-ns'/>
   <flag name='usb-bot'/>
 +  <flag name='iommufd'/>
   <version>9002000</version>
   <microcodeVersion>39100247</microcodeVersion>
   <package>v9.2.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml
 index 0e52c3e23d..6636346bc5 100644
 --- a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml
@@ -207,6 +207,7 @@
   <flag name='amd-iommu'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>9002000</version>
   <microcodeVersion>43100247</microcodeVersion>
   <package>v9.2.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml
 index 95f8a4d878..dee30415aa 100644
 --- a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml
@@ -205,6 +205,7 @@
   <flag name='amd-iommu'/>
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
 +  <flag name='iommufd'/>
   <version>9002000</version>
   <microcodeVersion>43100247</microcodeVersion>
   <package>v9.2.0</package>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Introduce-privateData-for-hostdevs.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Introduce-privateData-for-hostdevs.patch
@ -0,0 +1,277 @@
 From 94e2bf223d9fb7b9b65deaf8f2fbafb01dff5578 Mon Sep 17 00:00:00 2001
 Message-ID: <94e2bf223d9fb7b9b65deaf8f2fbafb01dff5578.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:13 -0800
 Subject: [PATCH] qemu: Introduce privateData for hostdevs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Introduce private data for hostdevs and allocate hostdev
 private data by default.
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit 1043e04e17ed4be59b46e925089204333c08f05e)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/bhyve/bhyve_parse_command.c |  2 +-
 src/conf/domain_conf.c          | 13 +++++++++--
 src/conf/domain_conf.h          |  5 ++++-
 src/libxl/xen_common.c          |  2 +-
 src/libxl/xen_xl.c              |  2 +-
 src/lxc/lxc_native.c            |  2 +-
 src/qemu/qemu_domain.c          | 40 +++++++++++++++++++++++++++++++++
 src/qemu/qemu_domain.h          | 15 +++++++++++++
 src/vbox/vbox_common.c          |  2 +-
 tests/virhostdevtest.c          |  2 +-
 10 files changed, 76 insertions(+), 9 deletions(-)
 diff --git a/src/bhyve/bhyve_parse_command.c b/src/bhyve/bhyve_parse_command.c
 index d62ea64beb..8b405206bd 100644
 --- a/src/bhyve/bhyve_parse_command.c
 +++ b/src/bhyve/bhyve_parse_command.c
@@ -687,7 +687,7 @@ bhyveParsePassthru(virDomainDef *def G_GNUC_UNUSED,
         return -1;
     }
 -    hostdev = virDomainHostdevDefNew();
 +    hostdev = virDomainHostdevDefNew(NULL);
     hostdev->mode = VIR_DOMAIN_HOSTDEV_MODE_SUBSYS;
     hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI;
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 541dad5bdc..f950f7c75d 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -2733,6 +2733,8 @@ virDomainHostdevDefClear(virDomainHostdevDef *def)
     case VIR_DOMAIN_HOSTDEV_MODE_LAST:
         break;
     }
 +
 +    g_clear_pointer(&def->privateData, virObjectUnref);
 }
@@ -3483,7 +3485,7 @@ void virDomainVideoDefFree(virDomainVideoDef *def)
 virDomainHostdevDef *
 -virDomainHostdevDefNew(void)
 +virDomainHostdevDefNew(virDomainXMLOption *xmlopt)
 {
     virDomainHostdevDef *def;
@@ -3491,6 +3493,13 @@ virDomainHostdevDefNew(void)
     def->info = g_new0(virDomainDeviceInfo, 1);
 +    if (xmlopt && xmlopt->privateData.hostdevNew &&
 +        !(def->privateData = xmlopt->privateData.hostdevNew())) {
 +        VIR_FREE(def->info);
 +        VIR_FREE(def);
 +        return NULL;
 +    }
 +
     return def;
 }
@@ -13678,7 +13687,7 @@ virDomainHostdevDefParseXML(virDomainXMLOption *xmlopt,
     ctxt->node = node;
 -    def = virDomainHostdevDefNew();
 +    def = virDomainHostdevDefNew(xmlopt);
     if (virXMLPropEnumDefault(node, "mode", virDomainHostdevModeTypeFromString,
                               VIR_XML_PROP_NONE,
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index cb35ff06bd..8f53ed96c0 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -364,6 +364,8 @@ struct _virDomainHostdevDef {
      */
     virDomainNetDef *parentnet;
 +    virObject *privateData;
 +
     virDomainHostdevMode mode;
     virDomainStartupPolicy startupPolicy;
     bool managed;
@@ -3588,6 +3590,7 @@ struct _virDomainXMLPrivateDataCallbacks {
     virDomainXMLPrivateDataNewFunc    vsockNew;
     virDomainXMLPrivateDataNewFunc    cryptoNew;
     virDomainXMLPrivateDataNewFunc    graphicsNew;
 +    virDomainXMLPrivateDataNewFunc    hostdevNew;
     virDomainXMLPrivateDataNewFunc    networkNew;
     virDomainXMLPrivateDataNetParseFunc networkParse;
     virDomainXMLPrivateDataNetFormatFunc networkFormat;
@@ -3797,7 +3800,7 @@ virDomainVideoDef *virDomainVideoDefNew(virDomainXMLOption *xmlopt);
 void virDomainVideoDefFree(virDomainVideoDef *def);
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virDomainVideoDef, virDomainVideoDefFree);
 void virDomainVideoDefClear(virDomainVideoDef *def);
 -virDomainHostdevDef *virDomainHostdevDefNew(void);
 +virDomainHostdevDef *virDomainHostdevDefNew(virDomainXMLOption *xmlopt);
 void virDomainHostdevDefFree(virDomainHostdevDef *def);
 void virDomainHubDefFree(virDomainHubDef *def);
 void virDomainRedirdevDefFree(virDomainRedirdevDef *def);
 diff --git a/src/libxl/xen_common.c b/src/libxl/xen_common.c
 index 666c6cae20..f19e4f6abb 100644
 --- a/src/libxl/xen_common.c
 +++ b/src/libxl/xen_common.c
@@ -445,7 +445,7 @@ xenParsePCI(char *entry)
         }
     }
 -    hostdev = virDomainHostdevDefNew();
 +    hostdev = virDomainHostdevDefNew(NULL);
     hostdev->managed = false;
     hostdev->writeFiltering = filtered;
     hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI;
 diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c
 index b2ff0edcf2..e62302736b 100644
 --- a/src/libxl/xen_xl.c
 +++ b/src/libxl/xen_xl.c
@@ -930,7 +930,7 @@ xenParseXLUSB(virConf *conf, virDomainDef *def)
                 key = nextkey;
             }
 -            hostdev = virDomainHostdevDefNew();
 +            hostdev = virDomainHostdevDefNew(NULL);
             hostdev->managed = false;
             hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB;
             hostdev->source.subsys.u.usb.bus = busNum;
 diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c
 index 7700804429..a94427b027 100644
 --- a/src/lxc/lxc_native.c
 +++ b/src/lxc/lxc_native.c
@@ -376,7 +376,7 @@ lxcCreateNetDef(const char *type,
 static virDomainHostdevDef *
 lxcCreateHostdevDef(const char *data)
 {
 -    virDomainHostdevDef *hostdev = virDomainHostdevDefNew();
 +    virDomainHostdevDef *hostdev = virDomainHostdevDefNew(NULL);
     hostdev->mode = VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES;
     hostdev->source.caps.type = VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET;
     hostdev->source.caps.u.net.ifname = g_strdup(data);
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 486a0e7913..3366214677 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -1238,6 +1238,45 @@ qemuDomainNetworkPrivateFormat(const virDomainNetDef *net,
 }
 +static virClass *qemuDomainHostdevPrivateClass;
 +
 +static void
 +qemuDomainHostdevPrivateDispose(void *obj)
 +{
 +    qemuDomainHostdevPrivate *priv = obj;
 +
 +    VIR_FORCE_CLOSE(priv->vfioDeviceFd);
 +}
 +
 +
 +static int
 +qemuDomainHostdevPrivateOnceInit(void)
 +{
 +    if (!VIR_CLASS_NEW(qemuDomainHostdevPrivate, virClassForObject()))
 +        return -1;
 +
 +    return 0;
 +}
 +
 +VIR_ONCE_GLOBAL_INIT(qemuDomainHostdevPrivate);
 +
 +virObject *
 +qemuDomainHostdevPrivateNew(void)
 +{
 +    qemuDomainHostdevPrivate *priv;
 +
 +    if (qemuDomainHostdevPrivateInitialize() < 0)
 +        return NULL;
 +
 +    if (!(priv = virObjectNew(qemuDomainHostdevPrivateClass)))
 +        return NULL;
 +
 +    priv->vfioDeviceFd = -1;
 +
 +    return (virObject *) priv;
 +}
 +
 +
 /* qemuDomainSecretInfoSetup:
  * @priv: pointer to domain private object
  * @alias: alias of the secret
@@ -3563,6 +3602,7 @@ virDomainXMLPrivateDataCallbacks virQEMUDriverPrivateDataCallbacks = {
     .chrSourceNew = qemuDomainChrSourcePrivateNew,
     .vsockNew = qemuDomainVsockPrivateNew,
     .graphicsNew = qemuDomainGraphicsPrivateNew,
 +    .hostdevNew = qemuDomainHostdevPrivateNew,
     .networkNew = qemuDomainNetworkPrivateNew,
     .networkParse = qemuDomainNetworkPrivateParse,
     .networkFormat = qemuDomainNetworkPrivateFormat,
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index b9bb338682..88c8416aa4 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -461,6 +461,18 @@ struct _qemuDomainTPMPrivate {
 };
 +#define QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev) \
 +    ((qemuDomainHostdevPrivate *) (hostdev)->privateData)
 +
 +typedef struct _qemuDomainHostdevPrivate qemuDomainHostdevPrivate;
 +struct _qemuDomainHostdevPrivate {
 +    virObject parent;
 +
 +    /* VFIO device file descriptor for iommufd passthrough */
 +    int vfioDeviceFd;
 +};
 +
 +
 void
 qemuDomainNetworkPrivateClearFDs(qemuDomainNetworkPrivate *priv);
@@ -1175,3 +1187,6 @@ qemuDomainCheckCPU(virArch arch,
 bool
 qemuDomainMachineSupportsFloppy(const char *machine,
                                 virQEMUCaps *qemuCaps);
 +
 +virObject *
 +qemuDomainHostdevPrivateNew(void);
 diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c
 index 26c5fdfef6..d2a8cf8da4 100644
 --- a/src/vbox/vbox_common.c
 +++ b/src/vbox/vbox_common.c
@@ -3090,7 +3090,7 @@ vboxHostDeviceGetXMLDesc(struct _vboxDriver *data, virDomainDef *def, IMachine *
     def->hostdevs = g_new0(virDomainHostdevDef *, def->nhostdevs);
     for (i = 0; i < def->nhostdevs; i++)
 -        def->hostdevs[i] = virDomainHostdevDefNew();
 +        def->hostdevs[i] = virDomainHostdevDefNew(NULL);
     for (i = 0; i < deviceFilters.count; i++) {
         PRBool active = PR_FALSE;
 diff --git a/tests/virhostdevtest.c b/tests/virhostdevtest.c
 index aec474a148..a35c1d9402 100644
 --- a/tests/virhostdevtest.c
 +++ b/tests/virhostdevtest.c
@@ -124,7 +124,7 @@ myInit(void)
     for (i = 0; i < nhostdevs; i++) {
         virDomainHostdevSubsys *subsys;
 -        hostdevs[i] = virDomainHostdevDefNew();
 +        hostdevs[i] = virDomainHostdevDefNew(NULL);
         if (!hostdevs[i])
             goto cleanup;
         hostdevs[i]->mode = VIR_DOMAIN_HOSTDEV_MODE_SUBSYS;
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-Introduce-qemuPrepareNVRAMFileCommon.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Introduce-qemuPrepareNVRAMFileCommon.patch
@ -0,0 +1,123 @@
 From 11e31d9728c42cbb9f4a3a564e9ddec5d09849ba Mon Sep 17 00:00:00 2001
 Message-ID: <11e31d9728c42cbb9f4a3a564e9ddec5d09849ba.1772815314.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 3 Feb 2026 20:26:59 +0100
 Subject: [PATCH] qemu: Introduce qemuPrepareNVRAMFileCommon()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Most of the code in the qemuPrepareNVRAMFile() function can
 be reused to create a varstore file from template. Move the
 common parts to a generic helper, leaving only the parts
 that are NVRAM-specific in the original function.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 41fe1199bbad4ab9cc4bda078571cd7bc5897d44)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_process.c | 56 +++++++++++++++++++++++++++--------------
 1 file changed, 37 insertions(+), 19 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 1aff3a277b..47deb9abb9 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -4921,45 +4921,40 @@ qemuPrepareNVRAMBlock(virDomainLoaderDef *loader,
 static int
 -qemuPrepareNVRAMFile(virQEMUDriver *driver,
 -                     virDomainLoaderDef *loader,
 -                     bool reset_nvram)
 +qemuPrepareNVRAMFileCommon(virQEMUDriver *driver,
 +                           const char *path,
 +                           const char *template,
 +                           bool reset_nvram)
 {
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     VIR_AUTOCLOSE srcFD = -1;
     struct qemuPrepareNVRAMHelperData data;
 -    if (virFileExists(loader->nvram->path) && !reset_nvram)
 +    if (!path)
         return 0;
 -    if (!loader->nvramTemplate) {
 +    if (virFileExists(path) && !reset_nvram)
 +        return 0;
 +
 +    if (!template) {
         virReportError(VIR_ERR_OPERATION_FAILED,
                        _("unable to find any master var store for loader: %1$s"),
 -                       loader->path);
 +                       path);
         return -1;
     }
 -    /* If 'nvramTemplateFormat' is empty it means that it's a user-provided
 -     * template which we couldn't verify. Assume the user knows what they're doing */
 -    if (loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE &&
 -        loader->nvram->format != loader->nvramTemplateFormat) {
 -        virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
 -                       _("conversion of the nvram template to another target format is not supported"));
 -        return -1;
 -    }
 -
 -    if ((srcFD = virFileOpenAs(loader->nvramTemplate, O_RDONLY,
 +    if ((srcFD = virFileOpenAs(template, O_RDONLY,
                                0, -1, -1, 0)) < 0) {
         virReportSystemError(-srcFD,
                              _("Failed to open file '%1$s'"),
 -                             loader->nvramTemplate);
 +                             template);
         return -1;
     }
     data.srcFD = srcFD;
 -    data.srcPath = loader->nvramTemplate;
 +    data.srcPath = template;
 -    if (virFileRewrite(loader->nvram->path,
 +    if (virFileRewrite(path,
                        S_IRUSR | S_IWUSR,
                        cfg->user, cfg->group,
                        qemuPrepareNVRAMHelper,
@@ -4971,6 +4966,29 @@ qemuPrepareNVRAMFile(virQEMUDriver *driver,
 }
 +static int
 +qemuPrepareNVRAMFile(virQEMUDriver *driver,
 +                     virDomainLoaderDef *loader,
 +                     bool reset_nvram)
 +{
 +    /* If 'nvramTemplateFormat' is empty it means that it's a user-provided
 +     * template which we couldn't verify. Assume the user knows what they're doing */
 +    if (loader && loader->nvram &&
 +        loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE &&
 +        loader->nvram->format != loader->nvramTemplateFormat) {
 +        virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
 +                       _("conversion of the nvram template to another target format is not supported"));
 +        return -1;
 +    }
 +
 +    if (qemuPrepareNVRAMFileCommon(driver, loader->nvram->path,
 +                                   loader->nvramTemplate, reset_nvram) < 0)
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 int
 qemuPrepareNVRAM(virQEMUDriver *driver,
                  virDomainDef *def,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Introduce-varstoreDir.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Introduce-varstoreDir.patch
@ -0,0 +1,135 @@
 From b59cc7646f454eb6626e976f20649d2bce3f21e6 Mon Sep 17 00:00:00 2001
 Message-ID: <b59cc7646f454eb6626e976f20649d2bce3f21e6.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 4 Feb 2026 17:43:36 +0100
 Subject: [PATCH] qemu: Introduce varstoreDir
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This is the same as the existing nvramDir, except it will be
 used to store the files used with the uefi-vars QEMU device.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit df3121d21ef257c601c0f15deb78deadcc6bffad)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 libvirt.spec.in        |  1 +
 src/qemu/meson.build   |  1 +
 src/qemu/qemu_conf.c   |  4 ++++
 src/qemu/qemu_conf.h   |  1 +
 src/qemu/qemu_driver.c | 12 ++++++++++++
 tests/testutilsqemu.c  |  2 ++
 6 files changed, 21 insertions(+)
 diff --git a/src/qemu/meson.build b/src/qemu/meson.build
 index ff9a904277..b4fb62f14f 100644
 --- a/src/qemu/meson.build
 +++ b/src/qemu/meson.build
@@ -223,6 +223,7 @@ if conf.has('WITH_QEMU')
     localstatedir / 'lib' / 'libvirt' / 'qemu' / 'ram',
     localstatedir / 'lib' / 'libvirt' / 'qemu' / 'save',
     localstatedir / 'lib' / 'libvirt' / 'qemu' / 'snapshot',
 +    localstatedir / 'lib' / 'libvirt' / 'qemu' / 'varstore',
     localstatedir / 'lib' / 'libvirt' / 'swtpm',
     localstatedir / 'log' / 'libvirt' / 'qemu',
     localstatedir / 'log' / 'swtpm' / 'libvirt' / 'qemu',
 diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
 index 242955200a..0a2eae3d76 100644
 --- a/src/qemu/qemu_conf.c
 +++ b/src/qemu/qemu_conf.c
@@ -167,6 +167,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged,
         cfg->checkpointDir = g_strdup_printf("%s/checkpoint", cfg->libDir);
         cfg->autoDumpPath = g_strdup_printf("%s/dump", cfg->libDir);
         cfg->nvramDir = g_strdup_printf("%s/nvram", cfg->libDir);
 +        cfg->varstoreDir = g_strdup_printf("%s/varstore", cfg->libDir);
         cfg->memoryBackingDir = g_strdup_printf("%s/ram", cfg->libDir);
     } else if (privileged) {
         cfg->logDir = g_strdup_printf("%s/log/libvirt/qemu", LOCALSTATEDIR);
@@ -188,6 +189,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged,
         cfg->checkpointDir = g_strdup_printf("%s/checkpoint", cfg->libDir);
         cfg->autoDumpPath = g_strdup_printf("%s/dump", cfg->libDir);
         cfg->nvramDir = g_strdup_printf("%s/nvram", cfg->libDir);
 +        cfg->varstoreDir = g_strdup_printf("%s/varstore", cfg->libDir);
         cfg->memoryBackingDir = g_strdup_printf("%s/ram", cfg->libDir);
         cfg->swtpmStorageDir = g_strdup_printf("%s/lib/libvirt/swtpm",
                                                LOCALSTATEDIR);
@@ -215,6 +217,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged,
                                              cfg->configBaseDir);
         cfg->autoDumpPath = g_strdup_printf("%s/qemu/dump", cfg->configBaseDir);
         cfg->nvramDir = g_strdup_printf("%s/qemu/nvram", cfg->configBaseDir);
 +        cfg->varstoreDir = g_strdup_printf("%s/qemu/varstore", cfg->configBaseDir);
         cfg->memoryBackingDir = g_strdup_printf("%s/qemu/ram", cfg->configBaseDir);
         cfg->swtpmStorageDir = g_strdup_printf("%s/qemu/swtpm",
                                                cfg->configBaseDir);
@@ -367,6 +370,7 @@ static void virQEMUDriverConfigDispose(void *obj)
     g_free(cfg->checkpointDir);
     g_free(cfg->channelTargetDir);
     g_free(cfg->nvramDir);
 +    g_free(cfg->varstoreDir);
     g_free(cfg->defaultTLSx509certdir);
     g_free(cfg->defaultTLSx509secretUUID);
 diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
 index edb65c99f4..3b97d24622 100644
 --- a/src/qemu/qemu_conf.h
 +++ b/src/qemu/qemu_conf.h
@@ -120,6 +120,7 @@ struct _virQEMUDriverConfig {
     char *checkpointDir;
     char *channelTargetDir;
     char *nvramDir;
 +    char *varstoreDir;
     char *swtpmStorageDir;
     char *defaultTLSx509certdir;
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
 index f3e7410f9e..d314aa94ce 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
@@ -626,6 +626,11 @@ qemuStateInitialize(bool privileged,
                              cfg->nvramDir);
         goto error;
     }
 +    if (g_mkdir_with_parents(cfg->varstoreDir, 0777) < 0) {
 +        virReportSystemError(errno, _("Failed to create varstore dir %1$s"),
 +                             cfg->varstoreDir);
 +        goto error;
 +    }
     if (g_mkdir_with_parents(cfg->memoryBackingDir, 0777) < 0) {
         virReportSystemError(errno, _("Failed to create memory backing dir %1$s"),
                              cfg->memoryBackingDir);
@@ -784,6 +789,13 @@ qemuStateInitialize(bool privileged,
                                  (int)cfg->group);
             goto error;
         }
 +        if (chown(cfg->varstoreDir, cfg->user, cfg->group) < 0) {
 +            virReportSystemError(errno,
 +                                 _("unable to set ownership of '%1$s' to %2$d:%3$d"),
 +                                 cfg->varstoreDir, (int)cfg->user,
 +                                 (int)cfg->group);
 +            goto error;
 +        }
         if (chown(cfg->memoryBackingDir, cfg->user, cfg->group) < 0) {
             virReportSystemError(errno,
                                  _("unable to set ownership of '%1$s' to %2$d:%3$d"),
 diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
 index 78ec521266..21dfd3141d 100644
 --- a/tests/testutilsqemu.c
 +++ b/tests/testutilsqemu.c
@@ -336,6 +336,8 @@ int qemuTestDriverInit(virQEMUDriver *driver)
     cfg->memoryBackingDir = g_strdup("/var/lib/libvirt/qemu/ram");
     VIR_FREE(cfg->nvramDir);
     cfg->nvramDir = g_strdup("/var/lib/libvirt/qemu/nvram");
 +    VIR_FREE(cfg->varstoreDir);
 +    cfg->varstoreDir = g_strdup("/var/lib/libvirt/qemu/varstore");
     VIR_FREE(cfg->passtStateDir);
     cfg->passtStateDir = g_strdup("/var/run/libvirt/qemu/passt");
     VIR_FREE(cfg->dbusStateDir);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Move-IOMMUFD-validation-to-qemu_validate.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Move-IOMMUFD-validation-to-qemu_validate.patch
@ -0,0 +1,111 @@
 From cd9099d42dfaa10d7863f1615a35c48db9924191 Mon Sep 17 00:00:00 2001
 Message-ID: <cd9099d42dfaa10d7863f1615a35c48db9924191.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Mon, 16 Feb 2026 09:12:02 +0100
 Subject: [PATCH] qemu: Move IOMMUFD validation to qemu_validate
 Fail early if kernel doesn't support IOMMUFD.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 0c1af67be554d4daa2facfb647ce6e9914da2f06)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/libvirt_private.syms |  1 +
 src/qemu/qemu_process.c  |  8 +-------
 src/qemu/qemu_validate.c |  7 +++++++
 src/util/viriommufd.c    | 13 +++++++++++++
 src/util/viriommufd.h    |  2 ++
 5 files changed, 24 insertions(+), 7 deletions(-)
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index e2a7a16347..0904265459 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -2654,6 +2654,7 @@ virInitctlSetRunLevel;
 # util/viriommufd.h
 virIOMMUFDSetRLimitMode;
 +virIOMMUFDSupported;
 # util/viriscsi.h
 virISCSIConnectionLogin;
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 37e688018c..479437fb34 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7690,13 +7690,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm)
     VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name);
     if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0) {
 -        if (errno == ENOENT) {
 -            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 -                           _("IOMMU FD support requires /dev/iommu device"));
 -        } else {
 -            virReportSystemError(errno, "%s",
 -                                 _("cannot open /dev/iommu"));
 -        }
 +        virReportSystemError(errno, "%s", _("cannot open /dev/iommu"));
         return -1;
     }
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index 18f148f48c..aa441188cb 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -27,6 +27,7 @@
 #include "qemu_process.h"
 #include "domain_conf.h"
 #include "virbitmap.h"
 +#include "viriommufd.h"
 #include "virlog.h"
 #include "virutil.h"
@@ -2730,6 +2731,12 @@ qemuValidateDomainDeviceDefHostdev(const virDomainHostdevDef *hostdev,
                                        _("IOMMUFD is not supported by this version of qemu"));
                         return -1;
                     }
 +
 +                    if (!virIOMMUFDSupported()) {
 +                        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                                       _("IOMMUFD is not supported by host kernel"));
 +                        return -1;
 +                    }
                 }
             }
 diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c
 index 5af097683d..44b30029a5 100644
 --- a/src/util/viriommufd.c
 +++ b/src/util/viriommufd.c
@@ -88,3 +88,16 @@ int virIOMMUFDSetRLimitMode(int fd G_GNUC_UNUSED,
 }
 #endif
 +
 +/**
 + * virIOMMUFDSupported:
 + *
 + * Check the presence of IOMMU device.
 + *
 + * Retruns: true if it exists, false otherwise
 + */
 +bool
 +virIOMMUFDSupported(void)
 +{
 +    return virFileExists(VIR_IOMMU_DEV_PATH);
 +}
 diff --git a/src/util/viriommufd.h b/src/util/viriommufd.h
 index ebecfe3633..ec6be9fa66 100644
 --- a/src/util/viriommufd.h
 +++ b/src/util/viriommufd.h
@@ -23,3 +23,5 @@
 #define VIR_IOMMU_DEV_PATH "/dev/iommu"
 int virIOMMUFDSetRLimitMode(int fd, bool processAccounting);
 +
 +bool virIOMMUFDSupported(void);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Save-IOMMUFD-state-into-status-XML.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Save-IOMMUFD-state-into-status-XML.patch
@ -0,0 +1,79 @@
 From 66f478cd56f2f8fbd3bca3b229a8fcafe29bbee0 Mon Sep 17 00:00:00 2001
 Message-ID: <66f478cd56f2f8fbd3bca3b229a8fcafe29bbee0.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 17:54:57 +0100
 Subject: [PATCH] qemu: Save IOMMUFD state into status XML
 We need to track if iommufd object was added to the VM when we add
 hotplug support.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit b21b6dcc72f1853f103f3cfbe1ebbcfbf128b458)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c | 2 ++
 src/qemu/qemu_domain.c  | 6 ++++++
 src/qemu/qemu_domain.h  | 1 +
 3 files changed, 9 insertions(+)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index d11d16e533..cca5fed285 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -5359,6 +5359,8 @@ qemuBuildIOMMUFDCommandLine(virCommand *cmd,
     if (qemuBuildObjectCommandlineFromJSON(cmd, props) < 0)
         return -1;
 +    priv->iommufdState = true;
 +
     return 0;
 }
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index ada9d3431c..ccbfc8bac7 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -1976,6 +1976,7 @@ qemuDomainObjPrivateDataClear(qemuDomainObjPrivate *priv)
     priv->migrationRecoverSetup = false;
     g_clear_pointer(&priv->iommufd, qemuFDPassDirectFree);
 +    priv->iommufdState = false;
     g_clear_pointer(&priv->memoryBackingDir, g_free);
 }
@@ -2844,6 +2845,9 @@ qemuDomainObjPrivateXMLFormat(virBuffer *buf,
                           priv->preMigrationMemlock);
     }
 +    if (priv->iommufdState)
 +        virBufferAddLit(buf, "<iommufd/>\n");
 +
     return 0;
 }
@@ -3582,6 +3586,8 @@ qemuDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt,
         return -1;
     }
 +    priv->iommufdState = virXPathBoolean("boolean(./iommufd)", ctxt) == 1;
 +
     return 0;
 }
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index 8aa94fc25b..62c5252b9f 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -265,6 +265,7 @@ struct _qemuDomainObjPrivate {
     GHashTable *fds;
     qemuFDPassDirect *iommufd;
 +    bool iommufdState; /* true if --object iommufd was added */
     char *memoryBackingDir;
 };
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Setup-disk-latency-histograms-on-startup-hotplug-update.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Setup-disk-latency-histograms-on-startup-hotplug-update.patch
@ -0,0 +1,132 @@
 From f496b6095bf96eb8931b78054a272a5aaf70a2d9 Mon Sep 17 00:00:00 2001
 Message-ID: <f496b6095bf96eb8931b78054a272a5aaf70a2d9.1771336682.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Fri, 23 Jan 2026 17:18:14 +0100
 Subject: [PATCH] qemu: Setup disk latency histograms on startup/hotplug/update
 Setup the histograms on startup and hotplug of devices via
 'qemuProcessSetupDiskPropsRuntime' and facilitate update/reset/disable
 of histogram collection via 'qemuDomainChangeDiskLive'.
 The latter allows to use the update device API to either clear the bins
 or select new bin configuration or disable the histogram altogether
 without the need for a specific API.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 5787326541be4eafaa7ae3b4f866b3da793d44fe)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 src/qemu/qemu_domain.c  | 17 +++++++++++++++++
 src/qemu/qemu_domain.h  |  3 +++
 src/qemu/qemu_hotplug.c | 29 +++++++++++++++++++++++++++++
 src/qemu/qemu_process.c | 10 ++++++++++
 4 files changed, 59 insertions(+)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 8e1ebe7799..bdab117e96 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -10463,6 +10463,23 @@ qemuDomainInitializePflashStorageSource(virDomainObj *vm,
 }
 +/**
 + * qemuDomainDiskHasLatencyHistogram:
 + * @disk: disk definition
 + *
 + * Returns whether @disk has any latency histogram settings configured.
 + */
 +bool
 +qemuDomainDiskHasLatencyHistogram(virDomainDiskDef *disk)
 +{
 +    return disk->histogram_boundaries ||
 +           disk->histogram_boundaries_read ||
 +           disk->histogram_boundaries_write ||
 +           disk->histogram_boundaries_zone ||
 +           disk->histogram_boundaries_flush;
 +}
 +
 +
 /**
  * qemuDomainDiskBlockJobIsSupported:
  *
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index 3361e97315..30ca67bf76 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -1078,6 +1078,9 @@ int
 qemuDomainInitializePflashStorageSource(virDomainObj *vm,
                                         virQEMUDriverConfig *cfg);
 +bool
 +qemuDomainDiskHasLatencyHistogram(virDomainDiskDef *disk);
 +
 bool
 qemuDomainDiskBlockJobIsSupported(virDomainDiskDef *disk);
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index f2dc4469a3..9445599d2c 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -7310,6 +7310,35 @@ qemuDomainChangeDiskLive(virDomainObj *vm,
         dev->data.disk->src = NULL;
     }
 +    if (qemuDomainDiskHasLatencyHistogram(disk) ||
 +        qemuDomainDiskHasLatencyHistogram(orig_disk)) {
 +        int rc;
 +
 +        qemuDomainObjEnterMonitor(vm);
 +        rc = qemuMonitorBlockLatencyHistogramSet(qemuDomainGetMonitor(vm),
 +                                                 QEMU_DOMAIN_DISK_PRIVATE(orig_disk)->qomName,
 +                                                 disk->histogram_boundaries,
 +                                                 disk->histogram_boundaries_read,
 +                                                 disk->histogram_boundaries_write,
 +                                                 disk->histogram_boundaries_zone,
 +                                                 disk->histogram_boundaries_flush);
 +        qemuDomainObjExitMonitor(vm);
 +
 +        if (rc < 0)
 +            return -1;
 +
 +        g_clear_pointer(&orig_disk->histogram_boundaries, g_free);
 +        g_clear_pointer(&orig_disk->histogram_boundaries_read, g_free);
 +        g_clear_pointer(&orig_disk->histogram_boundaries_write, g_free);
 +        g_clear_pointer(&orig_disk->histogram_boundaries_zone, g_free);
 +        g_clear_pointer(&orig_disk->histogram_boundaries_flush, g_free);
 +        orig_disk->histogram_boundaries = g_steal_pointer(&disk->histogram_boundaries);
 +        orig_disk->histogram_boundaries_read = g_steal_pointer(&disk->histogram_boundaries_read);
 +        orig_disk->histogram_boundaries_write = g_steal_pointer(&disk->histogram_boundaries_write);
 +        orig_disk->histogram_boundaries_zone = g_steal_pointer(&disk->histogram_boundaries_zone);
 +        orig_disk->histogram_boundaries_flush = g_steal_pointer(&disk->histogram_boundaries_flush);
 +    }
 +
     /* in case when we aren't updating disk source we update startup policy here */
     orig_disk->startupPolicy = dev->data.disk->startupPolicy;
     orig_disk->snapshot = dev->data.disk->snapshot;
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index aadfaa92b0..37e688018c 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7959,6 +7959,16 @@ qemuProcessSetupDiskPropsRuntime(qemuMonitor *mon,
                                       &disk->blkdeviotune) < 0)
         return -1;
 +    if (qemuDomainDiskHasLatencyHistogram(disk) &&
 +        qemuMonitorBlockLatencyHistogramSet(mon,
 +                                            QEMU_DOMAIN_DISK_PRIVATE(disk)->qomName,
 +                                            disk->histogram_boundaries,
 +                                            disk->histogram_boundaries_read,
 +                                            disk->histogram_boundaries_write,
 +                                            disk->histogram_boundaries_zone,
 +                                            disk->histogram_boundaries_flush) < 0)
 +        return -1;
 +
     return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-Support-per-process-memory-accounting-for-iommufd.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Support-per-process-memory-accounting-for-iommufd.patch
@ -0,0 +1,212 @@
 From 9a525305075612f540a1d3b2727ddf8b5320ff01 Mon Sep 17 00:00:00 2001
 Message-ID: <9a525305075612f540a1d3b2727ddf8b5320ff01.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:14 -0800
 Subject: [PATCH] qemu: Support per-process memory accounting for iommufd
 Implement the IOMMU_OPTION_RLIMIT_MODE
 ioctl to set per-process memory accounting for
 iommufd. This prevents ENOMEM errors from the
 default per-user memory accounting when multiple
 VMs under the libvirt-qemu user have their pinned
 memory summed and checked against a per-process
 RLIMIT_MEMLOCK limit.
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit f91a07d0c8dd583928974e80bb13b54feb5aa908)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 meson.build              |  1 +
 po/POTFILES              |  1 +
 src/libvirt_private.syms |  3 ++
 src/util/meson.build     |  1 +
 src/util/viriommufd.c    | 90 ++++++++++++++++++++++++++++++++++++++++
 src/util/viriommufd.h    | 25 +++++++++++
 6 files changed, 121 insertions(+)
 create mode 100644 src/util/viriommufd.c
 create mode 100644 src/util/viriommufd.h
 diff --git a/meson.build b/meson.build
 index 6ac9d01952..28745e4e32 100644
 --- a/meson.build
 +++ b/meson.build
@@ -673,6 +673,7 @@ headers = [
   'ifaddrs.h',
   'libtasn1.h',
   'linux/kvm.h',
 +  'linux/iommufd.h',
   'mntent.h',
   'net/ethernet.h',
   'net/if.h',
 diff --git a/po/POTFILES b/po/POTFILES
 index f0aad35c8c..c78d2b8000 100644
 --- a/po/POTFILES
 +++ b/po/POTFILES
@@ -303,6 +303,7 @@ src/util/virhostuptime.c
 src/util/viridentity.c
 src/util/virinhibitor.c
 src/util/virinitctl.c
 +src/util/viriommufd.c
 src/util/viriscsi.c
 src/util/virjson.c
 src/util/virlease.c
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 4e57e4a8f6..66261ed6cf 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -2652,6 +2652,9 @@ virInhibitorRelease;
 virInitctlFifos;
 virInitctlSetRunLevel;
 +# util/viriommufd.h
 +virIOMMUFDSetRLimitMode;
 +
 # util/viriscsi.h
 virISCSIConnectionLogin;
 virISCSIConnectionLogout;
 diff --git a/src/util/meson.build b/src/util/meson.build
 index 4950a795cc..9fb0aa0fe7 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
@@ -46,6 +46,7 @@ util_sources = [
   'viridentity.c',
   'virinhibitor.c',
   'virinitctl.c',
 +  'viriommufd.c',
   'viriscsi.c',
   'virjson.c',
   'virkeycode.c',
 diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c
 new file mode 100644
 index 0000000000..5af097683d
 --- /dev/null
 +++ b/src/util/viriommufd.c
@@ -0,0 +1,90 @@
 +#include <config.h>
 +
 +#include "viriommufd.h"
 +#include "virlog.h"
 +#include "virerror.h"
 +#include "virfile.h"
 +
 +#define VIR_FROM_THIS VIR_FROM_NONE
 +
 +VIR_LOG_INIT("util.iommufd");
 +
 +#ifdef __linux__
 +
 +# include <sys/ioctl.h>
 +# include <linux/types.h>
 +
 +# ifdef HAVE_LINUX_IOMMUFD_H
 +#  include <linux/iommufd.h>
 +# endif
 +
 +# ifndef IOMMU_OPTION
 +
 +enum iommufd_option {
 +    IOMMU_OPTION_RLIMIT_MODE = 0,
 +    IOMMU_OPTION_HUGE_PAGES = 1,
 +};
 +
 +enum iommufd_option_ops {
 +    IOMMU_OPTION_OP_SET = 0,
 +    IOMMU_OPTION_OP_GET = 1,
 +};
 +
 +struct iommu_option {
 +    __u32 size;
 +    __u32 option_id;
 +    __u16 op;
 +    __u16 __reserved;
 +    __u32 object_id;
 +    __aligned_u64 val64;
 +};
 +
 +#  define IOMMUFD_TYPE (';')
 +#  define IOMMUFD_CMD_OPTION 0x87
 +#  define IOMMU_OPTION _IO(IOMMUFD_TYPE, IOMMUFD_CMD_OPTION)
 +
 +# endif
 +
 +/**
 + * virIOMMUFDSetRLimitMode:
 + * @fd: iommufd file descriptor
 + * @processAccounting: true for per-process, false for per-user
 + *
 + * Set RLIMIT_MEMLOCK accounting mode for the iommufd.
 + *
 + * Returns: 0 on success, -1 on error
 + */
 +int
 +virIOMMUFDSetRLimitMode(int fd, bool processAccounting)
 +{
 +    struct iommu_option option = {
 +        .size = sizeof(struct iommu_option),
 +        .option_id = IOMMU_OPTION_RLIMIT_MODE,
 +        .op = IOMMU_OPTION_OP_SET,
 +        .__reserved = 0,
 +        .object_id = 0,
 +        .val64 = processAccounting ? 1 : 0,
 +    };
 +
 +    if (ioctl(fd, IOMMU_OPTION, &option) < 0) {
 +        virReportSystemError(errno, "%s",
 +                             _("failed to set memory accounting for iommufd"));
 +        return -1;
 +    }
 +
 +    VIR_DEBUG("Set iommufd rlimit mode to %s-based accounting",
 +              processAccounting ? "process" : "user");
 +    return 0;
 +}
 +
 +#else
 +
 +int virIOMMUFDSetRLimitMode(int fd G_GNUC_UNUSED,
 +                            bool processAccounting G_GNUC_UNUSED)
 +{
 +    virReportError(VIR_ERR_NO_SUPPORT, "%s",
 +                   _("IOMMUFD is not supported on this platform"));
 +    return -1;
 +}
 +
 +#endif
 diff --git a/src/util/viriommufd.h b/src/util/viriommufd.h
 new file mode 100644
 index 0000000000..ebecfe3633
 --- /dev/null
 +++ b/src/util/viriommufd.h
@@ -0,0 +1,25 @@
 +/*
 + * viriommufd.h: iommufd helpers
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2.1 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library.  If not, see
 + * <http://www.gnu.org/licenses/>.
 + */
 +
 +#pragma once
 +
 +#include "internal.h"
 +
 +#define VIR_IOMMU_DEV_PATH "/dev/iommu"
 +
 +int virIOMMUFDSetRLimitMode(int fd, bool processAccounting);
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-Update-Cgroup-namespace-and-seclabel-for-iommufd.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Update-Cgroup-namespace-and-seclabel-for-iommufd.patch
@ -0,0 +1,336 @@
 From 01ce19df7986fe190ce212fa05f2caed799cc50f Mon Sep 17 00:00:00 2001
 Message-ID: <01ce19df7986fe190ce212fa05f2caed799cc50f.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:17 -0800
 Subject: [PATCH] qemu: Update Cgroup, namespace, and seclabel for iommufd
 When launching a qemu VM with the iommufd feature enabled for VFIO
 hostdevs:
 - Do not allow cgroup, namespace, and seclabel access to VFIO
 paths (/dev/vfio/vfio and /dev/vfio/<iommugroup>)
 - Allow access to iommufd paths (/dev/iommu and
 /dev/vfio/devices/vfio*) for AppArmor, SELinux, and DAC
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit 7d2f91f9cb572ab95d0916bdd1a46dd198874529)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_cgroup.c           |  3 ++
 src/qemu/qemu_namespace.c        |  3 ++
 src/security/security_apparmor.c | 28 ++++++++++++------
 src/security/security_dac.c      | 49 +++++++++++++++++++++++++-------
 src/security/security_selinux.c  | 47 +++++++++++++++++++++++-------
 src/security/virt-aa-helper.c    | 32 ++++++++++++++++-----
 6 files changed, 127 insertions(+), 35 deletions(-)
 diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
 index 7dadef0739..6148990f19 100644
 --- a/src/qemu/qemu_cgroup.c
 +++ b/src/qemu/qemu_cgroup.c
@@ -479,6 +479,9 @@ qemuSetupHostdevCgroup(virDomainObj *vm,
     g_autofree char *path = NULL;
     int perms;
 +    if (dev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES)
 +        return 0;
 +
     if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES))
         return 0;
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index c689cc3e40..fb0734193d 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -345,6 +345,9 @@ qemuDomainSetupHostdev(virDomainObj *vm,
 {
     g_autofree char *path = NULL;
 +    if (hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES)
 +        return 0;
 +
     if (qemuDomainGetHostdevPath(hostdev, &path, NULL) < 0)
         return -1;
 diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
 index 68ac39611f..934acfb461 100644
 --- a/src/security/security_apparmor.c
 +++ b/src/security/security_apparmor.c
@@ -45,6 +45,7 @@
 #include "virstring.h"
 #include "virscsi.h"
 #include "virmdev.h"
 +#include "viriommufd.h"
 #define VIR_FROM_THIS VIR_FROM_SECURITY
@@ -841,25 +842,36 @@ AppArmorSetSecurityHostdevLabel(virSecurityManager *mgr,
     }
     case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: {
 -        virPCIDevice *pci =
 +        g_autoptr(virPCIDevice) pci =
             virPCIDeviceNew(&pcisrc->addr);
         if (!pci)
             goto done;
         if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO) {
 -            char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 +            if (dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
 +                char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 -            if (!vfioGroupDev) {
 -                virPCIDeviceFree(pci);
 -                goto done;
 +                if (!vfioGroupDev) {
 +                    goto done;
 +                }
 +                ret = AppArmorSetSecurityPCILabel(pci, vfioGroupDev, ptr);
 +                VIR_FREE(vfioGroupDev);
 +            } else {
 +                g_autofree char *vfiofdDev = NULL;
 +
 +                if (virPCIDeviceGetVfioPath(&dev->source.subsys.u.pci.addr, &vfiofdDev) < 0)
 +                    goto done;
 +
 +                ret = AppArmorSetSecurityPCILabel(pci, vfiofdDev, ptr);
 +                if (ret < 0)
 +                    goto done;
 +
 +                ret = AppArmorSetSecurityPCILabel(pci, VIR_IOMMU_DEV_PATH, ptr);
             }
 -            ret = AppArmorSetSecurityPCILabel(pci, vfioGroupDev, ptr);
 -            VIR_FREE(vfioGroupDev);
         } else {
             ret = virPCIDeviceFileIterate(pci, AppArmorSetSecurityPCILabel, ptr);
         }
 -        virPCIDeviceFree(pci);
         break;
     }
 diff --git a/src/security/security_dac.c b/src/security/security_dac.c
 index 2f788b872a..d0ed22db2d 100644
 --- a/src/security/security_dac.c
 +++ b/src/security/security_dac.c
@@ -41,6 +41,7 @@
 #include "virscsivhost.h"
 #include "virstring.h"
 #include "virutil.h"
 +#include "viriommufd.h"
 #define VIR_FROM_THIS VIR_FROM_SECURITY
@@ -1282,14 +1283,27 @@ virSecurityDACSetHostdevLabel(virSecurityManager *mgr,
             return -1;
         if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO) {
 -            g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 +            if (dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
 +                g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 -            if (!vfioGroupDev)
 -                return -1;
 +                if (!vfioGroupDev)
 +                    return -1;
 -            ret = virSecurityDACSetHostdevLabelHelper(vfioGroupDev,
 -                                                      false,
 -                                                      &cbdata);
 +                ret = virSecurityDACSetHostdevLabelHelper(vfioGroupDev,
 +                                                          false,
 +                                                          &cbdata);
 +            } else {
 +                g_autofree char *vfiofdDev = NULL;
 +
 +                if (virPCIDeviceGetVfioPath(&dev->source.subsys.u.pci.addr, &vfiofdDev) < 0)
 +                    return -1;
 +
 +                ret = virSecurityDACSetHostdevLabelHelper(vfiofdDev, false, &cbdata);
 +                if (ret < 0)
 +                    break;
 +
 +                ret = virSecurityDACSetHostdevLabelHelper(VIR_IOMMU_DEV_PATH, false, &cbdata);
 +            }
         } else {
             ret = virPCIDeviceFileIterate(pci,
                                           virSecurityDACSetPCILabel,
@@ -1443,13 +1457,28 @@ virSecurityDACRestoreHostdevLabel(virSecurityManager *mgr,
             return -1;
         if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO) {
 -            g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 +            if (dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
 +                g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 -            if (!vfioGroupDev)
 -                return -1;
 +                if (!vfioGroupDev)
 +                    return -1;
 -            ret = virSecurityDACRestoreFileLabelInternal(mgr, NULL,
 +                ret = virSecurityDACRestoreFileLabelInternal(mgr, NULL,
                                                          vfioGroupDev, false);
 +            } else {
 +                g_autofree char *vfiofdDev = NULL;
 +
 +                if (virPCIDeviceGetVfioPath(&dev->source.subsys.u.pci.addr, &vfiofdDev) < 0)
 +                    return -1;
 +
 +                ret = virSecurityDACRestoreFileLabelInternal(mgr, NULL,
 +                                                             vfiofdDev, false);
 +                if (ret < 0)
 +                    break;
 +
 +                ret = virSecurityDACRestoreFileLabelInternal(mgr, NULL,
 +                                                             VIR_IOMMU_DEV_PATH, false);
 +            }
         } else {
             ret = virPCIDeviceFileIterate(pci, virSecurityDACRestorePCILabel, mgr);
         }
 diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
 index 2f3cc274a5..834383a7de 100644
 --- a/src/security/security_selinux.c
 +++ b/src/security/security_selinux.c
@@ -41,6 +41,7 @@
 #include "virconf.h"
 #include "virtpm.h"
 #include "virstring.h"
 +#include "viriommufd.h"
 #define VIR_FROM_THIS VIR_FROM_SECURITY
@@ -2256,14 +2257,27 @@ virSecuritySELinuxSetHostdevSubsysLabel(virSecurityManager *mgr,
             return -1;
         if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO) {
 -            g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 +            if (dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
 +                g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 -            if (!vfioGroupDev)
 -                return -1;
 +                if (!vfioGroupDev)
 +                    return -1;
 -            ret = virSecuritySELinuxSetHostdevLabelHelper(vfioGroupDev,
 -                                                          false,
 -                                                          &data);
 +                ret = virSecuritySELinuxSetHostdevLabelHelper(vfioGroupDev,
 +                                                              false,
 +                                                              &data);
 +            } else {
 +                g_autofree char *vfiofdDev = NULL;
 +
 +                if (virPCIDeviceGetVfioPath(&dev->source.subsys.u.pci.addr, &vfiofdDev) < 0)
 +                    return -1;
 +
 +                ret = virSecuritySELinuxSetHostdevLabelHelper(vfiofdDev, false, &data);
 +                if (ret)
 +                    break;
 +
 +                ret = virSecuritySELinuxSetHostdevLabelHelper(VIR_IOMMU_DEV_PATH, false, &data);
 +            }
         } else {
             ret = virPCIDeviceFileIterate(pci, virSecuritySELinuxSetPCILabel, &data);
         }
@@ -2491,12 +2505,25 @@ virSecuritySELinuxRestoreHostdevSubsysLabel(virSecurityManager *mgr,
             return -1;
         if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO) {
 -            g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 +            if (dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
 +                g_autofree char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
 -            if (!vfioGroupDev)
 -                return -1;
 +                if (!vfioGroupDev)
 +                    return -1;
 -            ret = virSecuritySELinuxRestoreFileLabel(mgr, vfioGroupDev, false, false);
 +                ret = virSecuritySELinuxRestoreFileLabel(mgr, vfioGroupDev, false, false);
 +            } else {
 +                g_autofree char *vfiofdDev = NULL;
 +
 +                if (virPCIDeviceGetVfioPath(&dev->source.subsys.u.pci.addr, &vfiofdDev) < 0)
 +                    return -1;
 +
 +                ret = virSecuritySELinuxRestoreFileLabel(mgr, vfiofdDev, false, false);
 +                if (ret < 0)
 +                    break;
 +
 +                ret = virSecuritySELinuxRestoreFileLabel(mgr, VIR_IOMMU_DEV_PATH, false, false);
 +            }
         } else {
             ret = virPCIDeviceFileIterate(pci, virSecuritySELinuxRestorePCILabel, mgr);
         }
 diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
 index de0a826063..29e844c7ff 100644
 --- a/src/security/virt-aa-helper.c
 +++ b/src/security/virt-aa-helper.c
@@ -50,6 +50,7 @@
 #include "virstring.h"
 #include "virgettext.h"
 #include "virhostdev.h"
 +#include "viriommufd.h"
 #define VIR_FROM_THIS VIR_FROM_SECURITY
@@ -1114,8 +1115,9 @@ get_files(vahControl * ctl)
             virDeviceHostdevPCIDriverName driverName = dev->source.subsys.u.pci.driver.name;
 -            if (driverName == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO ||
 -                driverName == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_DEFAULT) {
 +            if ((driverName == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO ||
 +                driverName == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_DEFAULT) &&
 +                dev->source.subsys.u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES) {
                 needsVfio = true;
             }
@@ -1385,9 +1387,18 @@ get_files(vahControl * ctl)
         }
     }
 -    if (ctl->newfile &&
 -        vah_add_file(&buf, ctl->newfile, "rwk") != 0) {
 -        return -1;
 +    if (ctl->newfile) {
 +        const char *perms = "rwk";
 +
 +        /* VFIO and iommufd devices need mmap permission */
 +        if (STRPREFIX(ctl->newfile, "/dev/vfio/devices/vfio") ||
 +            STREQ(ctl->newfile, VIR_IOMMU_DEV_PATH)) {
 +            perms = "rwm";
 +        }
 +
 +        if (vah_add_file(&buf, ctl->newfile, perms) != 0) {
 +            return -1;
 +        }
     }
     ctl->files = virBufferContentAndReset(&buf);
@@ -1561,8 +1572,15 @@ main(int argc, char **argv)
                 }
         }
         if (ctl->append && ctl->newfile) {
 -            if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
 -                goto cleanup;
 +            const char *perms = "rwk";
 +
 +            if (STRPREFIX(ctl->newfile, "/dev/vfio/devices/vfio") ||
 +                STREQ(ctl->newfile, VIR_IOMMU_DEV_PATH)) {
 +                perms = "rwm";
 +            }
 +
 +            if (vah_add_file(&buf, ctl->newfile, perms) != 0)
 +                return -1;
         } else {
             if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU ||
                 ctl->def->virtType == VIR_DOMAIN_VIRT_KQEMU ||
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-Validate-presence-of-uefi-vars-device.patch
+++ b/centos-10/SOURCES/libvirt-qemu-Validate-presence-of-uefi-vars-device.patch
@ -0,0 +1,65 @@
 From 8b337691d19e1619f711b437b2618ac269e5e12f Mon Sep 17 00:00:00 2001
 Message-ID: <8b337691d19e1619f711b437b2618ac269e5e12f.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 21 Nov 2025 19:32:31 +0100
 Subject: [PATCH] qemu: Validate presence of uefi-vars device
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The use of varstore requires the uefi-vars device to be present
 in the QEMU binary.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit bd3504651759afac45e76b73912952bf2af2bcfa)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_validate.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index aa441188cb..25e1b9cf58 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -754,6 +754,23 @@ qemuValidateDomainDefNvram(const virDomainDef *def,
 }
 +static int
 +qemuValidateDomainDefVarstore(const virDomainDef *def,
 +                              virQEMUCaps *qemuCaps)
 +{
 +    if (!def->os.varstore)
 +        return 0;
 +
 +    if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_UEFI_VARS)) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                       _("The uefi-vars device is not supported by this QEMU binary"));
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 +
 static int
 qemuValidateDomainDefBoot(const virDomainDef *def,
                           virQEMUCaps *qemuCaps)
@@ -797,6 +814,9 @@ qemuValidateDomainDefBoot(const virDomainDef *def,
         if (qemuValidateDomainDefNvram(def, qemuCaps) < 0)
             return -1;
 +
 +        if (qemuValidateDomainDefVarstore(def, qemuCaps) < 0)
 +            return -1;
     }
     for (i = 0; i < def->os.nacpiTables; i++) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-capabilities-Introduce-QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR.patch
+++ b/centos-10/SOURCES/libvirt-qemu-capabilities-Introduce-QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR.patch
@ -0,0 +1,58 @@
 From 2674cc2e58f98439fe72e4d832e6e2e9b41a614f Mon Sep 17 00:00:00 2001
 Message-ID: <2674cc2e58f98439fe72e4d832e6e2e9b41a614f.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 11 Dec 2025 19:26:40 +0100
 Subject: [PATCH] qemu: capabilities: Introduce
 QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR
 Introduce capability for persisten migration control support.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit b0edb7eb9b819e0560bb7d65b4e0c89082b3b43b)
 https://issues.redhat.com/browse/RHEL-140614 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-135115 [rhel-10.2]
 Conflicts:
 - Commit befdd44bf836c3ba46e46d57b587127e12736591 adding
   QEMU_CAPS_VIRTIO_IOMMU_AW_BITS was not backported
 ---
 src/qemu/qemu_capabilities.c | 2 ++
 src/qemu/qemu_capabilities.h | 1 +
 2 files changed, 3 insertions(+)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 1efb77d03b..2c8bd62c99 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -755,6 +755,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
               "disk-timed-stats", /* QEMU_CAPS_DISK_TIMED_STATS */
               "query-accelerators", /* QEMU_CAPS_QUERY_ACCELERATORS */
               "mshv", /* QEMU_CAPS_MSHV */
 +              "scsi-block.migrate-pr", /* QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR */
     );
@@ -1536,6 +1537,7 @@ static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsSCSIDisk[] = {
 };
 static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsSCSIBlock[] = {
 +    { "migrate-pr", QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR, NULL },
 };
 static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsSCSIGeneric[] = {
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index f180844e66..0c76f2edda 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -730,6 +730,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     QEMU_CAPS_DISK_TIMED_STATS, /* timed stats support ('stats-intervals' property of disk frontends) */
     QEMU_CAPS_QUERY_ACCELERATORS, /* query-accelerators command */
     QEMU_CAPS_MSHV, /* -accel mshv */
 +    QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR, /* persistent reservation migration support */
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-capabilities-Probe-properties-of-scsi-block-and-scsi-generic-devices.patch
+++ b/centos-10/SOURCES/libvirt-qemu-capabilities-Probe-properties-of-scsi-block-and-scsi-generic-devices.patch
--- a/centos-10/SOURCES/libvirt-qemu-migration-Always-offer-block-dirty-bitmaps-during-migration.patch
+++ b/centos-10/SOURCES/libvirt-qemu-migration-Always-offer-block-dirty-bitmaps-during-migration.patch
@ -0,0 +1,147 @@
 From 64ae2c71b95cd25fb1e18fbc68ddbc814f3de8ca Mon Sep 17 00:00:00 2001
 Message-ID: <64ae2c71b95cd25fb1e18fbc68ddbc814f3de8ca.1770203422.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 27 Jan 2026 17:00:10 +0100
 Subject: [PATCH] qemu: migration: Always offer block dirty bitmaps during
 migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Until now block dirty bitmaps were offered to destination only if
 non-shared storage migration was enabled.
 Upcoming patches will want to support it also in cases when storage is
 shared but the destination has a qcow2 overlay using the 'data_file'
 feature where the qcow2 overlay is not actually shared.
 To support that we'll now always offer bitmaps for migration. The
 destination can then decide (using existing logic) to pick only the
 ones that are not present in the image on destination, which is how
 it was supposed to work even now.
 The patch removes all the flag checks and simply offers bitmaps in any
 case. The overhead incurred by this is one 'query-named-block-nodes'
 call to qemu.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit a4f610ff3fe190058f18baea18b095d0bc69441b)
 https://issues.redhat.com/browse/RHEL-145769 [rhel-10.2]
 https://issues.redhat.com/browse/RHEL-145770 [rhel-9.8]
 ---
 src/qemu/qemu_migration.c | 28 +++++++---------------------
 1 file changed, 7 insertions(+), 21 deletions(-)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 723e131c98..755b9a5e1a 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -2580,16 +2580,13 @@ qemuMigrationAnyConnectionClosed(virDomainObj *vm,
  * qemuMigrationSrcBeginPhaseBlockDirtyBitmaps:
  * @mig: migration cookie struct
  * @vm: domain object
 - * @migrate_disks: disks which are being migrated
 - * @nmigrage_disks: number of @migrate_disks
  *
  * Enumerates block dirty bitmaps on disks which will undergo storage migration
  * and fills them into @mig to be offered to the destination.
  */
 static int
 qemuMigrationSrcBeginPhaseBlockDirtyBitmaps(qemuMigrationCookie *mig,
 -                                            virDomainObj *vm,
 -                                            const char **migrate_disks)
 +                                            virDomainObj *vm)
 {
     GSList *disks = NULL;
@@ -2611,9 +2608,6 @@ qemuMigrationSrcBeginPhaseBlockDirtyBitmaps(qemuMigrationCookie *mig,
         if (!nodedata)
             continue;
 -        if (!qemuMigrationAnyCopyDisk(diskdef, migrate_disks))
 -            continue;
 -
         for (j = 0; j < nodedata->nbitmaps; j++) {
             qemuMigrationBlockDirtyBitmapsDiskBitmap *bitmap;
@@ -2680,7 +2674,6 @@ qemuMigrationSrcBeginXML(virDomainObj *vm,
                          char **cookieout,
                          int *cookieoutlen,
                          unsigned int cookieFlags,
 -                         const char **migrate_disks,
                          unsigned int flags)
 {
     qemuDomainObjPrivate *priv = vm->privateData;
@@ -2696,8 +2689,7 @@ qemuMigrationSrcBeginXML(virDomainObj *vm,
     if (!(mig = qemuMigrationCookieNew(vm->def, priv->origname)))
         return NULL;
 -    if (cookieFlags & QEMU_MIGRATION_COOKIE_NBD &&
 -        qemuMigrationSrcBeginPhaseBlockDirtyBitmaps(mig, vm, migrate_disks) < 0)
 +    if (qemuMigrationSrcBeginPhaseBlockDirtyBitmaps(mig, vm) < 0)
         return NULL;
     if (qemuMigrationCookieFormat(mig, driver, vm,
@@ -2879,8 +2871,7 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver,
         return NULL;
     return qemuMigrationSrcBeginXML(vm, xmlin,
 -                                    cookieout, cookieoutlen, cookieFlags,
 -                                    migrate_disks, flags);
 +                                    cookieout, cookieoutlen, cookieFlags, flags);
 }
@@ -2969,8 +2960,7 @@ qemuMigrationSrcBeginResume(virDomainObj *vm,
         return NULL;
     }
 -    return qemuMigrationSrcBeginXML(vm, xmlin,
 -                                    cookieout, cookieoutlen, 0, NULL, flags);
 +    return qemuMigrationSrcBeginXML(vm, xmlin, cookieout, cookieoutlen, 0, flags);
 }
@@ -4752,7 +4742,6 @@ qemuMigrationSrcRunPrepareBlockDirtyBitmaps(virDomainObj *vm,
     /* For VIR_MIGRATE_NON_SHARED_INC we can migrate the bitmaps directly,
      * otherwise we must create merged bitmaps from the whole chain */
 -
     if (!(flags & VIR_MIGRATE_NON_SHARED_INC) &&
         qemuMigrationSrcRunPrepareBlockDirtyBitmapsMerge(vm, mig) < 0)
         return -1;
@@ -4943,7 +4932,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
     VIR_AUTOCLOSE fd = -1;
     unsigned long restore_max_bandwidth = priv->migMaxBandwidth;
     virErrorPtr orig_err = NULL;
 -    unsigned int cookieFlags = 0;
 +    unsigned int cookieFlags = QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS;
     bool abort_on_error = !!(flags & VIR_MIGRATE_ABORT_ON_ERROR);
     bool storageMigration = flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC);
     bool cancel = false;
@@ -4967,10 +4956,8 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
         storageMigration = qemuMigrationHasAnyStorageMigrationDisks(vm->def,
                                                                     migrate_disks);
 -    if (storageMigration) {
 +    if (storageMigration)
         cookieFlags |= QEMU_MIGRATION_COOKIE_NBD;
 -        cookieFlags |= QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS;
 -    }
     if (virLockManagerPluginUsesState(driver->lockManager) &&
         !cookieout) {
@@ -5004,8 +4991,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
                                    cookiein, cookieinlen,
                                    cookieFlags |
                                    QEMU_MIGRATION_COOKIE_GRAPHICS |
 -                                   QEMU_MIGRATION_COOKIE_CAPS |
 -                                   QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS);
 +                                   QEMU_MIGRATION_COOKIE_CAPS);
     if (!mig)
         goto error;
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-monitor-Add-handlers-for-block-latency-histogram-set.patch
+++ b/centos-10/SOURCES/libvirt-qemu-monitor-Add-handlers-for-block-latency-histogram-set.patch
@ -0,0 +1,182 @@
 From 99b1b6fda9b4e098a7bbbbb44e02064c57bff558 Mon Sep 17 00:00:00 2001
 Message-ID: <99b1b6fda9b4e098a7bbbbb44e02064c57bff558.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 11 Dec 2025 18:38:12 +0100
 Subject: [PATCH] qemu: monitor: Add handlers for 'block-latency-histogram-set'
 Add QMP monitor code for setting up latency histogram configuration.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ad4830ce6844b75800685ea85b15a53b8dbc5ac6)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 src/qemu/qemu_monitor.c      | 21 +++++++++++++
 src/qemu/qemu_monitor.h      |  9 ++++++
 src/qemu/qemu_monitor_json.c | 60 ++++++++++++++++++++++++++++++++++++
 src/qemu/qemu_monitor_json.h |  9 ++++++
 tests/qemumonitorjsontest.c  |  9 ++++++
 5 files changed, 108 insertions(+)
 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
 index cdd08004fb..3d7477c01c 100644
 --- a/src/qemu/qemu_monitor.c
 +++ b/src/qemu/qemu_monitor.c
@@ -4612,3 +4612,24 @@ qemuMonitorBlockdevSetActive(qemuMonitor *mon,
     return qemuMonitorJSONBlockdevSetActive(mon, nodename, active);
 }
 +
 +
 +int
 +qemuMonitorBlockLatencyHistogramSet(qemuMonitor *mon,
 +                                    const char *id,
 +                                    unsigned int *boundaries,
 +                                    unsigned int *boundaries_read,
 +                                    unsigned int *boundaries_write,
 +                                    unsigned int *boundaries_zone,
 +                                    unsigned int *boundaries_flush)
 +{
 +    QEMU_CHECK_MONITOR(mon);
 +    VIR_DEBUG("id='%s'", id);
 +
 +    return qemuMonitorJSONBlockLatencyHistogramSet(mon, id,
 +                                                   boundaries,
 +                                                   boundaries_read,
 +                                                   boundaries_write,
 +                                                   boundaries_zone,
 +                                                   boundaries_flush);
 +}
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index 238f7be875..bbe400003a 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -1988,3 +1988,12 @@ int
 qemuMonitorBlockdevSetActive(qemuMonitor *mon,
                              const char *nodename,
                              bool active);
 +
 +int
 +qemuMonitorBlockLatencyHistogramSet(qemuMonitor *mon,
 +                                    const char *id,
 +                                    unsigned int *boundaries,
 +                                    unsigned int *boundaries_read,
 +                                    unsigned int *boundaries_write,
 +                                    unsigned int *boundaries_zone,
 +                                    unsigned int *boundaries_flush);
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index edeea22ee0..45f690d9e2 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -9130,3 +9130,63 @@ qemuMonitorJSONBlockdevSetActive(qemuMonitor *mon,
     return qemuMonitorJSONCheckError(cmd, reply);
 }
 +
 +
 +static virJSONValue *
 +qemuMonitorJSONBlockLatencyHistogramBoundary(unsigned int *bound)
 +{
 +    g_autoptr(virJSONValue) ret = virJSONValueNewArray();
 +
 +    if (!bound)
 +        return NULL;
 +
 +    for (; *bound > 0; bound++) {
 +        g_autoptr(virJSONValue) val = virJSONValueNewNumberUint(*bound);
 +
 +        /* the only error is if the first argument is not an array */
 +        ignore_value(virJSONValueArrayAppend(ret, &val));
 +    }
 +
 +    return g_steal_pointer(&ret);
 +}
 +
 +
 +int
 +qemuMonitorJSONBlockLatencyHistogramSet(qemuMonitor *mon,
 +                                        const char *id,
 +                                        unsigned int *boundaries,
 +                                        unsigned int *boundaries_read,
 +                                        unsigned int *boundaries_write,
 +                                        unsigned int *boundaries_zone,
 +                                        unsigned int *boundaries_flush)
 +{
 +    g_autoptr(virJSONValue) cmd = NULL;
 +    g_autoptr(virJSONValue) reply = NULL;
 +
 +    g_autoptr(virJSONValue) bound = NULL;
 +    g_autoptr(virJSONValue) bound_read = NULL;
 +    g_autoptr(virJSONValue) bound_write = NULL;
 +    g_autoptr(virJSONValue) bound_zone = NULL;
 +    g_autoptr(virJSONValue) bound_flush = NULL;
 +
 +    bound = qemuMonitorJSONBlockLatencyHistogramBoundary(boundaries);
 +    bound_read = qemuMonitorJSONBlockLatencyHistogramBoundary(boundaries_read);
 +    bound_write = qemuMonitorJSONBlockLatencyHistogramBoundary(boundaries_write);
 +    bound_zone = qemuMonitorJSONBlockLatencyHistogramBoundary(boundaries_zone);
 +    bound_flush = qemuMonitorJSONBlockLatencyHistogramBoundary(boundaries_flush);
 +
 +    if (!(cmd = qemuMonitorJSONMakeCommand("block-latency-histogram-set",
 +                                           "s:id", id,
 +                                           "A:boundaries", &bound,
 +                                           "A:boundaries-read", &bound_read,
 +                                           "A:boundaries-write", &bound_write,
 +                                           "A:boundaries-zap", &bound_zone,
 +                                           "A:boundaries-flush", &bound_flush,
 +                                           NULL)))
 +        return -1;
 +
 +    if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0)
 +        return -1;
 +
 +    return qemuMonitorJSONCheckError(cmd, reply);
 +}
 diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h
 index db9160eb68..b418f70048 100644
 --- a/src/qemu/qemu_monitor_json.h
 +++ b/src/qemu/qemu_monitor_json.h
@@ -815,3 +815,12 @@ int
 qemuMonitorJSONBlockdevSetActive(qemuMonitor *mon,
                                  const char *nodename,
                                  bool active);
 +
 +int
 +qemuMonitorJSONBlockLatencyHistogramSet(qemuMonitor *mon,
 +                                        const char *id,
 +                                        unsigned int *boundaries,
 +                                        unsigned int *boundaries_read,
 +                                        unsigned int *boundaries_write,
 +                                        unsigned int *boundaries_zone,
 +                                        unsigned int *boundaries_flush);
 diff --git a/tests/qemumonitorjsontest.c b/tests/qemumonitorjsontest.c
 index bfe81739a7..1c1aaaa586 100644
 --- a/tests/qemumonitorjsontest.c
 +++ b/tests/qemumonitorjsontest.c
@@ -1130,6 +1130,14 @@ GEN_TEST_FUNC(qemuMonitorJSONSetAction,
 GEN_TEST_FUNC(qemuMonitorJSONSetLaunchSecurityState, "sev_secret_header",
               "sev_secret", 0, true)
 +unsigned int testHistogramBoundaries[] = {10, 30, 50, 0};
 +GEN_TEST_FUNC(qemuMonitorJSONBlockLatencyHistogramSet, "devid",
 +              testHistogramBoundaries,
 +              testHistogramBoundaries,
 +              testHistogramBoundaries,
 +              testHistogramBoundaries,
 +              testHistogramBoundaries)
 +
 static int
 testQemuMonitorJSONqemuMonitorJSONNBDServerStart(const void *opaque)
 {
@@ -2958,6 +2966,7 @@ mymain(void)
     DO_TEST_GEN(qemuMonitorJSONBlockJobCancel);
     DO_TEST_GEN(qemuMonitorJSONSetAction);
     DO_TEST_GEN(qemuMonitorJSONSetLaunchSecurityState);
 +    DO_TEST_GEN(qemuMonitorJSONBlockLatencyHistogramSet);
     DO_TEST(qemuMonitorJSONGetBalloonInfo);
     DO_TEST(qemuMonitorJSONGetBlockInfo);
     DO_TEST(qemuMonitorJSONGetAllBlockStatsInfo);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-monitor-Detect-list-of-bitmaps-from-qcow2-format-specific-data.patch
+++ b/centos-10/SOURCES/libvirt-qemu-monitor-Detect-list-of-bitmaps-from-qcow2-format-specific-data.patch
@ -0,0 +1,173 @@
 From 0722d1d58171ca59ec1852026cf6df0faa0d9312 Mon Sep 17 00:00:00 2001
 Message-ID: <0722d1d58171ca59ec1852026cf6df0faa0d9312.1770203422.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 27 Jan 2026 20:07:32 +0100
 Subject: [PATCH] qemu: monitor: Detect list of bitmaps from 'qcow2' format
 specific data
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We currently probe dirty block tracking bitmaps by looking at the loaded
 ones ('dirty-bitmaps'). Unfortunately those may not yet be populated on
 incoming migration when the image was not yet activated, but we need to
 know which ones are stored in the image so that we don't migrate those
 explicitly, which would fail.
 Load the list of bitmaps in a qcow2 image from the format specific data,
 which is already loaded at that point.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit b2fe3465de1db033e436f38fdd24648c8c884a3d)
 https://issues.redhat.com/browse/RHEL-145769 [rhel-10.2]
 https://issues.redhat.com/browse/RHEL-145770 [rhel-9.8]
 ---
 src/qemu/qemu_monitor.h                      |  4 ++++
 src/qemu/qemu_monitor_json.c                 | 17 +++++++++++++++++
 tests/qemublocktest.c                        | 11 +++++++++++
 tests/qemublocktestdata/bitmap/snapshots.out |  5 +++++
 tests/qemublocktestdata/bitmap/synthetic.out |  4 ++++
 5 files changed, 41 insertions(+)
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index d096f474c1..041aa7bc12 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -893,8 +893,12 @@ struct _qemuBlockNamedNodeData {
     unsigned long long capacity;
     unsigned long long physical;
 +    /* Information about change block tracking bitmaps which are active and loaded */
     qemuBlockNamedNodeDataBitmap **bitmaps;
     size_t nbitmaps;
 +    /* With qcow2 we have also a separate list of bitmaps present in the image
 +     * but not yet activated, which happens when starting qemu during migration */
 +    char **qcow2bitmaps;
     /* hash table indexed by snapshot name containing data about snapshots
      * (qemuBlockNamedNodeDataSnapshot) */
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index 494d7ef515..401a28ff9a 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -2730,6 +2730,7 @@ qemuMonitorJSONBlockNamedNodeDataFree(qemuBlockNamedNodeData *data)
         qemuMonitorJSONBlockNamedNodeDataBitmapFree(data->bitmaps[i]);
     g_clear_pointer(&data->snapshots, g_hash_table_unref);
     g_free(data->bitmaps);
 +    g_strfreev(data->qcow2bitmaps);
     g_free(data);
 }
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(qemuBlockNamedNodeData, qemuMonitorJSONBlockNamedNodeDataFree);
@@ -2854,6 +2855,9 @@ qemuMonitorJSONBlockGetNamedNodeDataWorker(size_t pos G_GNUC_UNUSED,
         virJSONValue *qcow2props = virJSONValueObjectGetObject(format_specific, "data");
         if (qcow2props) {
 +            virJSONValue *bmp;
 +            size_t nbmp;
 +
             if (STREQ_NULLABLE(virJSONValueObjectGetString(qcow2props, "compat"), "0.10"))
                 ent->qcow2v2 = true;
@@ -2862,6 +2866,19 @@ qemuMonitorJSONBlockGetNamedNodeDataWorker(size_t pos G_GNUC_UNUSED,
             ignore_value(virJSONValueObjectGetBoolean(qcow2props, "data-file-raw",
                                                       &ent->qcow2dataFileRaw));
 +
 +            if ((bmp = virJSONValueObjectGetArray(qcow2props, "bitmaps")) &&
 +                ((nbmp = virJSONValueArraySize(bmp)) > 0)) {
 +                size_t i;
 +
 +                ent->qcow2bitmaps = g_new0(char *, nbmp + 1);
 +
 +                for (i = 0; i < nbmp; i++) {
 +                    virJSONValue *b = virJSONValueArrayGet(bmp, i);
 +
 +                    ent->qcow2bitmaps[i] = g_strdup(virJSONValueObjectGetString(b, "name"));
 +                }
 +            }
         }
     }
 diff --git a/tests/qemublocktest.c b/tests/qemublocktest.c
 index 51d9268cdd..18ec90edf5 100644
 --- a/tests/qemublocktest.c
 +++ b/tests/qemublocktest.c
@@ -600,6 +600,17 @@ testQemuDetectBitmapsWorker(void *payload,
                           bitmap->granularity, bitmap->dirtybytes);
     }
 +    if (data->qcow2bitmaps) {
 +        char **b;
 +
 +        virBufferAddLit(buf, "qcow2 bitmaps:");
 +
 +        for (b = data->qcow2bitmaps; *b; b++)
 +            virBufferAsprintf(buf, " %s", *b);
 +
 +        virBufferAddLit(buf, "\n");
 +    }
 +
     if (data->snapshots) {
         g_autofree virHashKeyValuePair *snaps = virHashGetItems(data->snapshots, NULL, true);
         virHashKeyValuePair *n;
 diff --git a/tests/qemublocktestdata/bitmap/snapshots.out b/tests/qemublocktestdata/bitmap/snapshots.out
 index 29c586be7e..dedd77465c 100644
 --- a/tests/qemublocktestdata/bitmap/snapshots.out
 +++ b/tests/qemublocktestdata/bitmap/snapshots.out
@@ -4,21 +4,26 @@ libvirt-1-format:
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
   current: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: current c b a d
 libvirt-1-storage:
 libvirt-2-format:
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: d a b c
 libvirt-2-storage:
 libvirt-3-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: c b a
 libvirt-3-storage:
 libvirt-4-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: a
 libvirt-4-storage:
 libvirt-5-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: a
 libvirt-5-storage:
 diff --git a/tests/qemublocktestdata/bitmap/synthetic.out b/tests/qemublocktestdata/bitmap/synthetic.out
 index 2f4ae2b217..0a47a90107 100644
 --- a/tests/qemublocktestdata/bitmap/synthetic.out
 +++ b/tests/qemublocktestdata/bitmap/synthetic.out
@@ -6,17 +6,21 @@ libvirt-1-format:
  top-inactive: record:0 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
  top-transient: record:1 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
  top-transient-inactive: record:0 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: current
 libvirt-1-storage:
 libvirt-2-format:
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: d
 libvirt-2-storage:
 libvirt-3-format:
         b: record:1 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
         c: record:0 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: c b
 libvirt-3-storage:
 libvirt-4-format:
 libvirt-4-storage:
 libvirt-5-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 + qcow2 bitmaps: a
 libvirt-5-storage:
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-monitor-Extract-block-latency-histogram-stats-into-qemuBlockStats.patch
+++ b/centos-10/SOURCES/libvirt-qemu-monitor-Extract-block-latency-histogram-stats-into-qemuBlockStats.patch
@ -0,0 +1,168 @@
 From e02f5e7ca63bdaaec62c2fffa681b9354bee0792 Mon Sep 17 00:00:00 2001
 Message-ID: <e02f5e7ca63bdaaec62c2fffa681b9354bee0792.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 29 Jan 2026 14:08:18 +0100
 Subject: [PATCH] qemu: monitor: Extract block latency histogram stats into
 'qemuBlockStats'
 Extract the 'rd_latency_histogram', 'wr_latency_histogram',
 'zone_append_latency_histogram', and 'flush_latency_histogram' stats
 objects into our internal data.
 Rather than storing 'boundaries' between bins we store them as start
 points.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 1c77d396ea9704eae09d7fea160cfd1a897beaf3)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 src/qemu/qemu_monitor.c      | 20 +++++++++++++
 src/qemu/qemu_monitor.h      | 18 ++++++++++++
 src/qemu/qemu_monitor_json.c | 55 ++++++++++++++++++++++++++++++++++++
 3 files changed, 93 insertions(+)
 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
 index 504500c864..cdd08004fb 100644
 --- a/src/qemu/qemu_monitor.c
 +++ b/src/qemu/qemu_monitor.c
@@ -1986,6 +1986,26 @@ qemuBlockStatsFinalize(GObject *object)
     g_free(stats->limits);
     g_free(stats->timed_stats);
 +    if (stats->histogram_read) {
 +        g_free(stats->histogram_read->bins);
 +        g_free(stats->histogram_read);
 +    }
 +
 +    if (stats->histogram_write) {
 +        g_free(stats->histogram_write->bins);
 +        g_free(stats->histogram_write);
 +    }
 +
 +    if (stats->histogram_zone) {
 +        g_free(stats->histogram_zone->bins);
 +        g_free(stats->histogram_zone);
 +    }
 +
 +    if (stats->histogram_flush) {
 +        g_free(stats->histogram_flush->bins);
 +        g_free(stats->histogram_flush);
 +    }
 +
     G_OBJECT_CLASS(qemu_block_stats_parent_class)->finalize(object);
 }
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index 041aa7bc12..238f7be875 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -806,6 +806,18 @@ struct qemuBlockStatsLimits {
 };
 +struct qemuBlockStatsLatencyHistogramBin {
 +    unsigned long long start;
 +    unsigned long long value;
 +};
 +
 +
 +struct qemuBlockStatsLatencyHistogram {
 +    struct qemuBlockStatsLatencyHistogramBin *bins;
 +    size_t nbins;
 +};
 +
 +
 struct qemuBlockStatsTimed {
     unsigned long long interval_length;
@@ -858,6 +870,12 @@ struct _qemuBlockStats {
     /* block accounting/timed stats from qemu - one entry per interval configured */
     size_t n_timed_stats;
     struct qemuBlockStatsTimed *timed_stats;
 +
 +    /* latency histograms */
 +    struct qemuBlockStatsLatencyHistogram *histogram_read;
 +    struct qemuBlockStatsLatencyHistogram *histogram_write;
 +    struct qemuBlockStatsLatencyHistogram *histogram_zone;
 +    struct qemuBlockStatsLatencyHistogram *histogram_flush;
 };
 G_DECLARE_FINAL_TYPE(qemuBlockStats, qemu_block_stats, QEMU, BLOCK_STATS, GObject);
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index 401a28ff9a..edeea22ee0 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -2425,6 +2425,52 @@ qemuMonitorJSONBlockStatsCollectDataTimed(virJSONValue *timed_stats,
 }
 +static void
 +qemuMonitorJSONBlockStatsCollectDataLatencyHistogram(virJSONValue *stats,
 +                                                     const char *histogram_field,
 +                                                     struct qemuBlockStatsLatencyHistogram **histogram_data)
 +{
 +    virJSONValue *hist;
 +    virJSONValue *hist_bins;
 +    virJSONValue *hist_bounds;
 +    g_autofree struct qemuBlockStatsLatencyHistogramBin *bins = NULL;
 +    size_t nbins = 0;
 +    size_t i;
 +
 +    if (!(hist = virJSONValueObjectGetObject(stats, histogram_field)))
 +        return;
 +
 +    if (!(hist_bins = virJSONValueObjectGetArray(hist, "bins")) ||
 +        !(hist_bounds = virJSONValueObjectGetArray(hist, "boundaries")) ||
 +        virJSONValueArraySize(hist_bins) != (virJSONValueArraySize(hist_bounds) + 1)) {
 +        VIR_DEBUG("malformed latency histogram container");
 +        return;
 +    }
 +
 +    nbins = virJSONValueArraySize(hist_bins);
 +    bins = g_new0(struct qemuBlockStatsLatencyHistogramBin, nbins);
 +
 +    for (i = 0; i < nbins; i++) {
 +        virJSONValue *bin = virJSONValueArrayGet(hist_bins, i);
 +        virJSONValue *bound = NULL;
 +
 +        if (i > 0)
 +            bound = virJSONValueArrayGet(hist_bounds, i - 1);
 +
 +        if (!bin ||
 +            virJSONValueGetNumberUlong(bin, &(bins[i].value)) < 0 ||
 +            (bound && virJSONValueGetNumberUlong(bound, &(bins[i].start)) < 0)) {
 +            VIR_DEBUG("malformed latency histogram container");
 +            return;
 +        }
 +    }
 +
 +    *histogram_data = g_new0(struct qemuBlockStatsLatencyHistogram, 1);
 +    (*histogram_data)->bins = g_steal_pointer(&bins);
 +    (*histogram_data)->nbins = nbins;
 +}
 +
 +
 static qemuBlockStats *
 qemuMonitorJSONBlockStatsCollectData(virJSONValue *dev,
                                      int *nstats)
@@ -2469,6 +2515,15 @@ qemuMonitorJSONBlockStatsCollectData(virJSONValue *dev,
             bstats->wr_highest_offset_valid = true;
     }
 +    qemuMonitorJSONBlockStatsCollectDataLatencyHistogram(stats, "rd_latency_histogram",
 +                                                         &bstats->histogram_read);
 +    qemuMonitorJSONBlockStatsCollectDataLatencyHistogram(stats, "wr_latency_histogram",
 +                                                         &bstats->histogram_write);
 +    qemuMonitorJSONBlockStatsCollectDataLatencyHistogram(stats, "zone_append_latency_histogram",
 +                                                         &bstats->histogram_zone);
 +    qemuMonitorJSONBlockStatsCollectDataLatencyHistogram(stats, "flush_latency_histogram",
 +                                                         &bstats->histogram_flush);
 +
     if ((timed_stats = virJSONValueObjectGetArray(stats, "timed_stats")) &&
         virJSONValueArraySize(timed_stats) > 0)
         qemuMonitorJSONBlockStatsCollectDataTimed(timed_stats, bstats);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu-open-VFIO-FDs-from-libvirt-backend.patch
+++ b/centos-10/SOURCES/libvirt-qemu-open-VFIO-FDs-from-libvirt-backend.patch
@ -0,0 +1,247 @@
 From 68a23646ba165aa45d3811d626885054ae9d9299 Mon Sep 17 00:00:00 2001
 Message-ID: <68a23646ba165aa45d3811d626885054ae9d9299.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:15 -0800
 Subject: [PATCH] qemu: open VFIO FDs from libvirt backend
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Open VFIO FDs from libvirt backend without exposing
 these FDs to XML users, i.e. one per iommufd hostdev
 for /dev/vfio/devices/vfioX, and pass the FD to qemu
 command line.
 Suggested-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit f6230804727df834da27370e835204672218ab23)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/libvirt_private.syms |  1 +
 src/qemu/qemu_command.c  | 21 +++++++++++
 src/qemu/qemu_process.c  | 78 ++++++++++++++++++++++++++++++++++++++++
 src/util/virpci.c        | 39 ++++++++++++++++++++
 src/util/virpci.h        |  2 ++
 5 files changed, 141 insertions(+)
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 66261ed6cf..e2a7a16347 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -3162,6 +3162,7 @@ virPCIDeviceGetStubDriverName;
 virPCIDeviceGetStubDriverType;
 virPCIDeviceGetUnbindFromStub;
 virPCIDeviceGetUsedBy;
 +virPCIDeviceGetVfioPath;
 virPCIDeviceGetVPD;
 virPCIDeviceHasPCIExpressLink;
 virPCIDeviceIsAssignable;
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 1fb31d1721..83935e82c3 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -4803,6 +4803,18 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
                               NULL) < 0)
         return NULL;
 +    if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 +        pcisrc->driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 +        qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(dev);
 +
 +        if (hostdevPriv->vfioDeviceFd != -1) {
 +            g_autofree char *fdstr = g_strdup_printf("%d", hostdevPriv->vfioDeviceFd);
 +            if (virJSONValueObjectAdd(&props, "S:fd", fdstr, NULL) < 0)
 +                return NULL;
 +            hostdevPriv->vfioDeviceFd = -1;
 +        }
 +    }
 +
     if (qemuBuildDeviceAddressProps(props, def, dev->info) < 0)
         return NULL;
@@ -5247,6 +5259,15 @@ qemuBuildHostdevCommandLine(virCommand *cmd,
             if (qemuCommandAddExtDevice(cmd, hostdev->info, def, qemuCaps) < 0)
                 return -1;
 +            if (subsys->u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 +                qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 +
 +                if (hostdevPriv->vfioDeviceFd != -1) {
 +                    virCommandPassFD(cmd, hostdevPriv->vfioDeviceFd,
 +                                     VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 +                }
 +            }
 +
             if (!(devprops = qemuBuildPCIHostdevDevProps(def, hostdev)))
                 return -1;
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 0e50cd1ccc..1ac57a6321 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -103,6 +103,7 @@
 #include "storage_source.h"
 #include "backup_conf.h"
 #include "storage_file_probe.h"
 +#include "virpci.h"
 #include "logging/log_manager.h"
 #include "logging/log_protocol.h"
@@ -7671,6 +7672,81 @@ qemuProcessPrepareHostBackendChardevHotplug(virDomainObj *vm,
     return 0;
 }
 +/**
 + * qemuProcessOpenVfioDeviceFd:
 + * @hostdev: host device definition
 + * @vfioFd: returned file descriptor
 + *
 + * Opens the VFIO device file descriptor for a hostdev.
 + *
 + * Returns: FD on success, -1 on failure
 + */
 +static int
 +qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 +{
 +    g_autofree char *vfioPath = NULL;
 +    int fd = -1;
 +
 +    if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS ||
 +        hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 +                       _("VFIO FD only supported for PCI hostdevs"));
 +        return -1;
 +    }
 +
 +    if (virPCIDeviceGetVfioPath(&hostdev->source.subsys.u.pci.addr, &vfioPath) < 0)
 +        return -1;
 +
 +    VIR_DEBUG("Opening VFIO device %s", vfioPath);
 +
 +    if ((fd = open(vfioPath, O_RDWR | O_CLOEXEC)) < 0) {
 +        if (errno == ENOENT) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                           _("VFIO device %1$s not found - ensure device is bound to vfio-pci driver"),
 +                           vfioPath);
 +        } else {
 +            virReportSystemError(errno,
 +                                 _("cannot open VFIO device %1$s"), vfioPath);
 +        }
 +        return -1;
 +    }
 +
 +    VIR_DEBUG("Opened VFIO device FD %d for %s", fd, vfioPath);
 +    return fd;
 +}
 +
 +/**
 + * qemuProcessOpenVfioFds:
 + * @vm: domain object
 + *
 + * Opens all necessary VFIO file descriptors for the domain.
 + *
 + * Returns: 0 on success, -1 on failure
 + */
 +static int
 +qemuProcessOpenVfioFds(virDomainObj *vm)
 +{
 +    size_t i;
 +
 +    /* Check if we have any hostdevs that need VFIO FDs */
 +    for (i = 0; i < vm->def->nhostdevs; i++) {
 +        virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 +        qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 +
 +        if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
 +            hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI &&
 +            hostdev->source.subsys.u.pci.driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 +            hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 +            /* Open VFIO device FD */
 +            hostdevPriv->vfioDeviceFd = qemuProcessOpenVfioDeviceFd(hostdev);
 +            if (hostdevPriv->vfioDeviceFd == -1)
 +                 return -1;
 +        }
 +    }
 +
 +    return 0;
 +}
 +
 /**
  * qemuProcessPrepareHost:
  * @driver: qemu driver
@@ -7726,6 +7802,8 @@ qemuProcessPrepareHost(virQEMUDriver *driver,
         hostdev_flags |= VIR_HOSTDEV_COLD_BOOT;
     if (qemuHostdevPrepareDomainDevices(driver, vm->def, hostdev_flags) < 0)
         return -1;
 +    if (qemuProcessOpenVfioFds(vm) < 0)
 +        return -1;
     VIR_DEBUG("Preparing chr device backends");
     if (qemuProcessPrepareHostBackendChardev(vm) < 0)
 diff --git a/src/util/virpci.c b/src/util/virpci.c
 index 90617e69c6..2348a98003 100644
 --- a/src/util/virpci.c
 +++ b/src/util/virpci.c
@@ -3320,3 +3320,42 @@ virPCIDeviceAddressFree(virPCIDeviceAddress *address)
 {
     g_free(address);
 }
 +
 +/**
 + * virPCIDeviceGetVfioPath:
 + * @addr: host device PCI address
 + * @vfioPath: returned VFIO device path
 + *
 + * Constructs the VFIO device path for a PCI hostdev.
 + *
 + * Returns: 0 on success, -1 on failure
 + */
 +int
 +virPCIDeviceGetVfioPath(virPCIDeviceAddress *addr,
 +                        char **vfioPath)
 +{
 +    g_autofree char *addrStr = NULL;
 +    g_autofree char *sysfsPath = NULL;
 +    g_autoptr(DIR) dir = NULL;
 +    struct dirent *entry = NULL;
 +
 +    *vfioPath = NULL;
 +    addrStr = virPCIDeviceAddressAsString(addr);
 +
 +    /* Look in device's vfio-dev subdirectory */
 +    sysfsPath = g_strdup_printf("/sys/bus/pci/devices/%s/vfio-dev/", addrStr);
 +
 +    if (virDirOpen(&dir, sysfsPath) == 1) {
 +        while (virDirRead(dir, &entry, sysfsPath) > 0) {
 +            if (STRPREFIX(entry->d_name, "vfio")) {
 +                *vfioPath = g_strdup_printf("/dev/vfio/devices/%s", entry->d_name);
 +                return 0;
 +            }
 +        }
 +    }
 +
 +    virReportError(VIR_ERR_INTERNAL_ERROR,
 +                   _("cannot find VFIO device for PCI device %1$s"),
 +                   addrStr);
 +    return -1;
 +}
 diff --git a/src/util/virpci.h b/src/util/virpci.h
 index fc538566e1..24ede10755 100644
 --- a/src/util/virpci.h
 +++ b/src/util/virpci.h
@@ -296,6 +296,8 @@ void virPCIEDeviceInfoFree(virPCIEDeviceInfo *dev);
 void virPCIDeviceAddressFree(virPCIDeviceAddress *address);
 +int virPCIDeviceGetVfioPath(virPCIDeviceAddress *addr, char **vfioPath);
 +
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virPCIDevice, virPCIDeviceFree);
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virPCIDeviceAddress, virPCIDeviceAddressFree);
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virPCIEDeviceInfo, virPCIEDeviceInfoFree);
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-open-iommufd-FD-from-libvirt-backend.patch
+++ b/centos-10/SOURCES/libvirt-qemu-open-iommufd-FD-from-libvirt-backend.patch
@ -0,0 +1,175 @@
 From a444918da5bd01fc11793c82ad33308892777c3a Mon Sep 17 00:00:00 2001
 Message-ID: <a444918da5bd01fc11793c82ad33308892777c3a.1770383182.git.jdenemar@redhat.com>
 From: Nathan Chen <nathanc@nvidia.com>
 Date: Fri, 30 Jan 2026 10:59:16 -0800
 Subject: [PATCH] qemu: open iommufd FD from libvirt backend
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Open iommufd FD from libvirt backend without exposing
 these FDs to XML users, i.e. one per domain for
 /dev/iommu, and pass the FD to qemu command line. Set
 per-process memory accounting for iommufd instead of
 the default per-user memory accounting.
 Suggested-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Nathan Chen <nathanc@nvidia.com>
 Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
 (cherry picked from commit 2f0999a161910e3992458902ce90d37f8b8f2642)
 Resolves: https://issues.redhat.com/browse/RHEL-74202
 Resolves: https://issues.redhat.com/browse/RHEL-126346
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c | 13 +++++++++++--
 src/qemu/qemu_domain.c  |  1 +
 src/qemu/qemu_domain.h  |  2 ++
 src/qemu/qemu_process.c | 43 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 57 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 83935e82c3..f355352018 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -5342,9 +5342,13 @@ qemuBuildHostdevCommandLine(virCommand *cmd,
 static int
 qemuBuildIOMMUFDCommandLine(virCommand *cmd,
 -                            const virDomainDef *def)
 +                            const virDomainDef *def,
 +                            virDomainObj *vm)
 {
     size_t i;
 +    qemuDomainObjPrivate *priv = vm->privateData;
 +    g_autofree char *fdstr = g_strdup_printf("%d", priv->iommufd);
 +
     for (i = 0; i < def->nhostdevs; i++) {
         virDomainHostdevDef *hostdev = def->hostdevs[i];
@@ -5363,8 +5367,13 @@ qemuBuildIOMMUFDCommandLine(virCommand *cmd,
         if (subsys->u.pci.driver.iommufd != VIR_TRISTATE_BOOL_YES)
             continue;
 +        virCommandPassFD(cmd, priv->iommufd, VIR_COMMAND_PASS_FD_CLOSE_PARENT);
 +
 +        priv->iommufd = -1;
 +
         if (qemuMonitorCreateObjectProps(&props, "iommufd",
                                          "iommufd0",
 +                                         "S:fd", fdstr,
                                          NULL) < 0)
             return -1;
@@ -10990,7 +10999,7 @@ qemuBuildCommandLine(virDomainObj *vm,
     if (qemuBuildRedirdevCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 -    if (qemuBuildIOMMUFDCommandLine(cmd, def) < 0)
 +    if (qemuBuildIOMMUFDCommandLine(cmd, def, vm) < 0)
         return NULL;
     if (qemuBuildHostdevCommandLine(cmd, def, qemuCaps) < 0)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 3366214677..8e1ebe7799 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -2042,6 +2042,7 @@ qemuDomainObjPrivateAlloc(void *opaque)
     priv->blockjobs = virHashNew(virObjectUnref);
     priv->fds = virHashNew(g_object_unref);
 +    priv->iommufd = -1;
     priv->pidMonitored = -1;
     /* agent commands block by default, user can choose different behavior */
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index 88c8416aa4..3361e97315 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -264,6 +264,8 @@ struct _qemuDomainObjPrivate {
     /* named file descriptor groups associated with the VM */
     GHashTable *fds;
 +    int iommufd;
 +
     char *memoryBackingDir;
 };
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 1ac57a6321..d8f0c78fd1 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -104,6 +104,7 @@
 #include "backup_conf.h"
 #include "storage_file_probe.h"
 #include "virpci.h"
 +#include "viriommufd.h"
 #include "logging/log_manager.h"
 #include "logging/log_protocol.h"
@@ -7672,6 +7673,42 @@ qemuProcessPrepareHostBackendChardevHotplug(virDomainObj *vm,
     return 0;
 }
 +/**
 + * qemuProcessOpenIommuFd:
 + * @vm: domain object
 + * @iommuFd: returned file descriptor
 + *
 + * Opens /dev/iommu file descriptor for the VM.
 + *
 + * Returns: FD on success, -1 on failure
 + */
 +static int
 +qemuProcessOpenIommuFd(virDomainObj *vm)
 +{
 +    int fd = -1;
 +
 +    VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name);
 +
 +    if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0) {
 +        if (errno == ENOENT) {
 +            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                           _("IOMMU FD support requires /dev/iommu device"));
 +        } else {
 +            virReportSystemError(errno, "%s",
 +                                 _("cannot open /dev/iommu"));
 +        }
 +        return -1;
 +    }
 +
 +    if (virIOMMUFDSetRLimitMode(fd, true) < 0) {
 +        VIR_FORCE_CLOSE(fd);
 +        return -1;
 +    }
 +
 +    VIR_DEBUG("Opened IOMMU FD %d for domain %s", fd, vm->def->name);
 +    return fd;
 +}
 +
 /**
  * qemuProcessOpenVfioDeviceFd:
  * @hostdev: host device definition
@@ -7726,6 +7763,7 @@ qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 static int
 qemuProcessOpenVfioFds(virDomainObj *vm)
 {
 +    qemuDomainObjPrivate *priv = vm->privateData;
     size_t i;
     /* Check if we have any hostdevs that need VFIO FDs */
@@ -7741,6 +7779,11 @@ qemuProcessOpenVfioFds(virDomainObj *vm)
             hostdevPriv->vfioDeviceFd = qemuProcessOpenVfioDeviceFd(hostdev);
             if (hostdevPriv->vfioDeviceFd == -1)
                  return -1;
 +
 +            /* Open IOMMU FD */
 +            priv->iommufd = qemuProcessOpenIommuFd(vm);
 +            if (priv->iommufd == -1)
 +                return -1;
         }
     }
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu-process-Rename-qemuProcessSetupDiskThrottling-to-qemuProcessSetupDisks.patch
+++ b/centos-10/SOURCES/libvirt-qemu-process-Rename-qemuProcessSetupDiskThrottling-to-qemuProcessSetupDisks.patch
@ -0,0 +1,62 @@
 From 0359b5fcf870f955bbdca998e5a02261e27c40b7 Mon Sep 17 00:00:00 2001
 Message-ID: <0359b5fcf870f955bbdca998e5a02261e27c40b7.1771336681.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 29 Jan 2026 11:21:38 +0100
 Subject: [PATCH] qemu: process: Rename 'qemuProcessSetupDiskThrottling' to
 'qemuProcessSetupDisks'
 Rename the runtime disk option setup function to be universal.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 42a39d703d98e4e48f0f9c8779884b6ac107de26)
 https://issues.redhat.com/browse/RHEL-147866 [rhel-9.8]
 https://issues.redhat.com/browse/RHEL-131335 [rhel-10.2]
 ---
 src/qemu/qemu_process.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index c99bb36c93..aadfaa92b0 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7964,21 +7964,19 @@ qemuProcessSetupDiskPropsRuntime(qemuMonitor *mon,
 /**
 - * qemuProcessSetupDiskThrottling:
 + * qemuProcessSetupDisks:
  *
 - * Sets up disk trottling for -blockdev via block_set_io_throttle monitor
 - * command. This hack should be replaced by proper use of the 'throttle'
 - * blockdev driver in qemu once it will support changing of the throttle group.
 - * Same hack is done in qemuDomainAttachDiskGeneric.
 + * Sets up disk settings available only at runtime:
 + *  - trottling for -blockdev via block_set_io_throttle QMP command
  */
 static int
 -qemuProcessSetupDiskThrottling(virDomainObj *vm,
 -                               virDomainAsyncJob asyncJob)
 +qemuProcessSetupDisks(virDomainObj *vm,
 +                      virDomainAsyncJob asyncJob)
 {
     size_t i;
     int ret = -1;
 -    VIR_DEBUG("Setting up disk throttling for -blockdev via block_set_io_throttle");
 +    VIR_DEBUG("Setting up disk config via runtime commands");
     if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0)
         return -1;
@@ -8575,7 +8573,7 @@ qemuProcessLaunch(virConnectPtr conn,
     if (qemuProcessSetupBalloon(vm, asyncJob) < 0)
         goto cleanup;
 -    if (qemuProcessSetupDiskThrottling(vm, asyncJob) < 0)
 +    if (qemuProcessSetupDisks(vm, asyncJob) < 0)
         goto cleanup;
     /* Since CPUs were not started yet, the balloon could not return the memory
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemuMigrationDstPrepareAnyBlockDirtyBitmaps-Always-consider-offered-bitmaps.patch
+++ b/centos-10/SOURCES/libvirt-qemuMigrationDstPrepareAnyBlockDirtyBitmaps-Always-consider-offered-bitmaps.patch
@ -0,0 +1,98 @@
 From bbd0fde5f840726928cdcd06691da13f1093c02e Mon Sep 17 00:00:00 2001
 Message-ID: <bbd0fde5f840726928cdcd06691da13f1093c02e.1770203422.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 27 Jan 2026 17:28:48 +0100
 Subject: [PATCH] qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider
 offered bitmaps
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Consider bitmaps for incoming migration regardless of non-shared storage
 flag.
 When bitmaps are offered from the source, consult the local image if the
 bitmap is present and if not accept migration. Migration of bitmaps
 which exist in the qcow2 metadata is skipped because qemu rejects such
 setup (although handles it correctly in case of shared storage setup;
 see below).
 This allows bitmap propagation for cases when the qcow2 image is not
 actually shared between destinations but the data is (using the
 data_file feature).
 At the same time this preserves existing bitmap handling semantics for
 other cases. Specifically qemu, in case of shared storage properly
 propagates the bitmap which was already recorded in the qcow2 metadata
 on disk even if libvirt doesn't instruct migration, yet tolerates
 migration instruction if the file is not yet recorded in the on-disk
 metadata. In both cases the contents are preserved correctly.
 When storage is not shared (which includes even cases when we migrate
 it via NBD) it's expected that the bitmaps don't exist on the
 destination and thus all will be picked for migration. We can also
 infer that this wasn't ever a problem by the fact that the code skipping
 migration of existing bitmaps was broken until recently, and qemu
 would refuse such config.
 I've tested all the above scenarios including verifying that the
 resulting bitmaps capture dirtied regions before and after migration.
 For testing this the following command is useful:
  virsh qemu-monitor-command --domain DOMNAME --hmp 'qemu-io -d /machine/peripheral/virtio-disk0/virtio-backend "write -P 0xcc 4M 1M"'
 Which simulates a write from the guest side without the need to interact
 with the guest OS.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit bf34b90bb4e39b3a2fd22a5531f5ea5a95681015)
 https://issues.redhat.com/browse/RHEL-145769 [rhel-10.2]
 https://issues.redhat.com/browse/RHEL-145770 [rhel-9.8]
 ---
 src/qemu/qemu_migration.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 755b9a5e1a..2a4df1191d 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -3183,7 +3183,6 @@ qemuMigrationDstPrepare(virQEMUDriver *driver,
  * @vm: domain object
  * @mig: migration cookie
  * @migParams: migration parameters
 - * @flags: migration flags
  *
  * Checks whether block dirty bitmaps offered by the migration source are
  * to be migrated (e.g. they don't exist, the destination is compatible etc)
@@ -3194,16 +3193,13 @@ qemuMigrationDstPrepare(virQEMUDriver *driver,
 static int
 qemuMigrationDstPrepareAnyBlockDirtyBitmaps(virDomainObj *vm,
                                             qemuMigrationCookie *mig,
 -                                            qemuMigrationParams *migParams,
 -                                            unsigned int flags)
 +                                            qemuMigrationParams *migParams)
 {
     g_autoptr(virJSONValue) mapping = NULL;
     g_autoptr(GHashTable) blockNamedNodeData = NULL;
     GSList *nextdisk;
 -    if (!mig->nbd ||
 -        !mig->blockDirtyBitmaps ||
 -        !(flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC)))
 +    if (!mig->blockDirtyBitmaps)
         return 0;
     if (qemuMigrationCookieBlockDirtyBitmapsMatchDisks(vm->def, mig->blockDirtyBitmaps) < 0)
@@ -3350,7 +3346,7 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver,
         goto error;
     }
 -    if (qemuMigrationDstPrepareAnyBlockDirtyBitmaps(vm, mig, migParams, flags) < 0)
 +    if (qemuMigrationDstPrepareAnyBlockDirtyBitmaps(vm, mig, migParams) < 0)
         goto error;
     if (qemuMigrationParamsCheck(vm, VIR_ASYNC_JOB_MIGRATION_IN, migParams,
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemuMigrationDstPrepareAnyBlockDirtyBitmaps-Fix-check-for-existing-bitmaps.patch
+++ b/centos-10/SOURCES/libvirt-qemuMigrationDstPrepareAnyBlockDirtyBitmaps-Fix-check-for-existing-bitmaps.patch
@ -0,0 +1,68 @@
 From b99fb51812da73df754151c59c259d15fa654168 Mon Sep 17 00:00:00 2001
 Message-ID: <b99fb51812da73df754151c59c259d15fa654168.1770203422.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 27 Jan 2026 19:22:08 +0100
 Subject: [PATCH] qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for
 existing bitmaps
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 On incoming migration qemu doesn't load bitmaps into memory (which makes
 them available under the 'dirty-bitmaps' field which we parse as the
 'bitmaps' array in 'qemuBlockNamedNodeData') until after actually
 resuming CPUs, thus the check for existing bitmaps never actually
 worked.
 We need to check the 'qcow2bitmaps' field instead which is populated
 from the qcow2 headers prior to activating the image.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 0c75fc1747f039bf878ceab69cf12482ebb14095)
 https://issues.redhat.com/browse/RHEL-145769 [rhel-10.2]
 https://issues.redhat.com/browse/RHEL-145770 [rhel-9.8]
 ---
 src/qemu/qemu_migration.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 9059f9aa3a..723e131c98 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -3227,6 +3227,8 @@ qemuMigrationDstPrepareAnyBlockDirtyBitmaps(virDomainObj *vm,
         qemuBlockNamedNodeData *nodedata;
         GSList *nextbitmap;
 +        VIR_DEBUG("offer migrate bitmaps for '%s'", disk->target);
 +
         if (!(nodedata = virHashLookup(blockNamedNodeData, disk->nodename))) {
             virReportError(VIR_ERR_INTERNAL_ERROR,
                            _("failed to find data for block node '%1$s'"),
@@ -3243,18 +3245,14 @@ qemuMigrationDstPrepareAnyBlockDirtyBitmaps(virDomainObj *vm,
         for (nextbitmap = disk->bitmaps; nextbitmap; nextbitmap = nextbitmap->next) {
             qemuMigrationBlockDirtyBitmapsDiskBitmap *bitmap = nextbitmap->data;
 -            size_t k;
             /* don't migrate into existing bitmaps */
 -            for (k = 0; k < nodedata->nbitmaps; k++) {
 -                if (STREQ(bitmap->bitmapname, nodedata->bitmaps[k]->name)) {
 -                    bitmap->skip = true;
 -                    break;
 -                }
 -            }
 +            if (nodedata->qcow2bitmaps)
 +                bitmap->skip = g_strv_contains((const char **) nodedata->qcow2bitmaps, bitmap->bitmapname);
 +
 +            VIR_DEBUG("offer migrate bitmap '%s' disk '%s' -> skip: '%d'",
 +                      bitmap->bitmapname, disk->target, bitmap->skip);
 -            if (bitmap->skip)
 -                continue;
         }
     }
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemu_capabilities-Introduce-QEMU_CAPS_DEVICE_UEFI_VARS.patch
+++ b/centos-10/SOURCES/libvirt-qemu_capabilities-Introduce-QEMU_CAPS_DEVICE_UEFI_VARS.patch
@ -0,0 +1,172 @@
 From 9daca4f4b8e914a09d86db07d1c7292a6e9e4048 Mon Sep 17 00:00:00 2001
 Message-ID: <9daca4f4b8e914a09d86db07d1c7292a6e9e4048.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 21 Nov 2025 15:34:32 +0100
 Subject: [PATCH] qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This capability indicates the availability of the uefi-vars
 device.
 The actual name of the QEMU device varies slightly depending on
 the architecture: it's uefi-vars-x64 on x86_64, uefi-vars-sysbus
 on other UEFI architectures (aarch64, riscv64, loongarch64).
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 12cdd613832c77d143bfa2b87539a22ec6911f6d)
 Conflicts:
  * tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml
    tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml
    tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml
    tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml
    - Missing downstream
  * tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
    tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
    tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
    - Trivial context conflicts caused by capabilities files
      being outdated downstream
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_capabilities.c                               | 3 +++
 src/qemu/qemu_capabilities.h                               | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml         | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml   | 1 +
 tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml          | 1 +
 tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml | 1 +
 tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml          | 1 +
 tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml     | 1 +
 tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml          | 1 +
 9 files changed, 11 insertions(+)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 7d88b8521a..8b20ca9312 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -760,6 +760,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
               /* 490 */
               "iommufd", /* QEMU_CAPS_OBJECT_IOMMUFD */
 +              "uefi-vars", /* QEMU_CAPS_DEVICE_UEFI_VARS */
     );
@@ -1468,6 +1469,8 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[] = {
     { "tpm-passthrough", QEMU_CAPS_DEVICE_TPM_PASSTHROUGH },
     { "acpi-generic-initiator", QEMU_CAPS_ACPI_GENERIC_INITIATOR },
     { "iommufd", QEMU_CAPS_OBJECT_IOMMUFD },
 +    { "uefi-vars-x64", QEMU_CAPS_DEVICE_UEFI_VARS },
 +    { "uefi-vars-sysbus", QEMU_CAPS_DEVICE_UEFI_VARS },
 };
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index f7c8680f94..4dcf464061 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -734,6 +734,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     /* 490 */
     QEMU_CAPS_OBJECT_IOMMUFD, /* -object iommufd */
 +    QEMU_CAPS_DEVICE_UEFI_VARS, /* -device uefi-vars-{x64,sysbus} */
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
 index bbb8b33cde..1243a56fb8 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml
@@ -164,6 +164,7 @@
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10000000</version>
   <microcodeVersion>61700285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
 index 5acd1a33fd..cd77e934c8 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml
@@ -210,6 +210,7 @@
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10000000</version>
   <microcodeVersion>43100285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
 index 50f58791e6..f2567a2025 100644
 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml
@@ -210,6 +210,7 @@
   <flag name='usb-bot'/>
   <flag name='acpi-generic-initiator'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10000000</version>
   <microcodeVersion>43100285</microcodeVersion>
   <package>v10.0.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
 index e321c352a3..a80aca9244 100644
 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml
@@ -192,6 +192,7 @@
   <flag name='tdx-guest'/>
   <flag name='acpi-generic-initiator'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10000050</version>
   <microcodeVersion>43100286</microcodeVersion>
   <package>v10.0.0-1724-gf9a3def17b</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
 index 2d52659520..03790f4e31 100644
 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml
@@ -215,6 +215,7 @@
   <flag name='qom-list-get'/>
   <flag name='acpi-generic-initiator'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10001000</version>
   <microcodeVersion>43100286</microcodeVersion>
   <package>v10.1.0</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
 index eb2ab001a6..0ba4d2f990 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml
@@ -202,6 +202,7 @@
   <flag name='query-accelerators'/>
   <flag name='mshv'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10001050</version>
   <microcodeVersion>43100287</microcodeVersion>
   <package>v10.1.0-1778-ge090e0312d</package>
 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 index c4ea924c1f..47bb94527f 100644
 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml
@@ -217,6 +217,7 @@
   <flag name='query-accelerators'/>
   <flag name='scsi-block.migrate-pr'/>
   <flag name='iommufd'/>
 +  <flag name='uefi-vars'/>
   <version>10001091</version>
   <microcodeVersion>43100287</microcodeVersion>
   <package>v10.2.0-rc1-38-gfb241d0a1f</package>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_command-Don-t-use-host-property-if-IOMMUFD-is-used.patch
+++ b/centos-10/SOURCES/libvirt-qemu_command-Don-t-use-host-property-if-IOMMUFD-is-used.patch
@ -0,0 +1,134 @@
 From 5cb651d76f287f1ae0212cf0f4d2d7618050e5d1 Mon Sep 17 00:00:00 2001
 Message-ID: <5cb651d76f287f1ae0212cf0f4d2d7618050e5d1.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:49:16 +0100
 Subject: [PATCH] qemu_command: Don't use host property if IOMMUFD is used
 They should not be used at the same time.
 Fixes: f6230804727df834da27370e835204672218ab23
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit f67e4ac4d071f6f05ae387bc3b09c6cebb10455d)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c                       | 24 +++++++++----------
 .../iommufd-q35.x86_64-latest.args            |  2 +-
 ...fd-virt-pci-bus-single.aarch64-latest.args |  2 +-
 .../iommufd-virt.aarch64-latest.args          |  4 ++--
 .../iommufd.x86_64-latest.args                |  2 +-
 5 files changed, 16 insertions(+), 18 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 33127fbc0a..d11d16e533 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -4755,10 +4755,11 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
     g_autoptr(virJSONValue) props = NULL;
     virDomainHostdevSubsysPCI *pcisrc = &dev->source.subsys.u.pci;
     virDomainNetTeamingInfo *teaming;
 -    g_autofree char *host = virPCIDeviceAddressAsString(&pcisrc->addr);
 +    g_autofree char *host = NULL;
     const char *failover_pair_id = NULL;
     const char *driver = NULL;
     const char *iommufdId = NULL;
 +    const char *fdstr = NULL;
     /* 'ramfb' property must be omitted unless it's to be enabled */
     bool ramfb = pcisrc->ramfb == VIR_TRISTATE_SWITCH_ON;
@@ -4792,31 +4793,28 @@ qemuBuildPCIHostdevDevProps(const virDomainDef *def,
         teaming->persistent)
         failover_pair_id = teaming->persistent;
 -    if (pcisrc->driver.iommufd == VIR_TRISTATE_BOOL_YES)
 +    if (virHostdevIsPCIDeviceWithIOMMUFD(dev)) {
 +        qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(dev);
 +
 +        fdstr = qemuFDPassDirectGetPath(hostdevPriv->vfioDeviceFd);
         iommufdId = "iommufd0";
 +    } else {
 +        host = virPCIDeviceAddressAsString(&pcisrc->addr);
 +    }
     if (virJSONValueObjectAdd(&props,
                               "s:driver", driver,
 -                              "s:host", host,
 +                              "S:host", host,
                               "s:id", dev->info->alias,
                               "p:bootindex", dev->info->effectiveBootIndex,
                               "S:failover_pair_id", failover_pair_id,
                               "S:display", qemuOnOffAuto(pcisrc->display),
                               "B:ramfb", ramfb,
                               "S:iommufd", iommufdId,
 +                              "S:fd", fdstr,
                               NULL) < 0)
         return NULL;
 -    if (pcisrc->driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 -        pcisrc->driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 -        qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(dev);
 -
 -        if (virJSONValueObjectAdd(&props,
 -                                  "S:fd", qemuFDPassDirectGetPath(hostdevPriv->vfioDeviceFd),
 -                                  NULL) < 0)
 -            return NULL;
 -    }
 -
     if (qemuBuildDeviceAddressProps(props, def, dev->info) < 0)
         return NULL;
 diff --git a/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args b/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
 index d5fe704021..f886c488e1 100644
 --- a/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
@@ -36,6 +36,6 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
 -object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 --device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x3"}' \
 +-device '{"driver":"vfio-pci","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x3"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args b/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
 index 99886468fb..d6562f9be3 100644
 --- a/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
@@ -28,6 +28,6 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 --device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x1"}' \
 +-device '{"driver":"vfio-pci","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x1"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args b/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
 index e3695c6982..9fd2a6adee 100644
 --- a/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
@@ -31,7 +31,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -device '{"driver":"pcie-root-port","port":10,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x1.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 --device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.1","addr":"0x0"}' \
 --device '{"driver":"vfio-pci","host":"0000:07:12.5","id":"hostdev1","iommufd":"iommufd0","fd":"0","bus":"pci.2","addr":"0x0"}' \
 +-device '{"driver":"vfio-pci","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.1","addr":"0x0"}' \
 +-device '{"driver":"vfio-pci","id":"hostdev1","iommufd":"iommufd0","fd":"0","bus":"pci.2","addr":"0x0"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/iommufd.x86_64-latest.args b/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
 index 15dabe197c..b9aefda39d 100644
 --- a/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
@@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 --device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.0","addr":"0x3"}' \
 +-device '{"driver":"vfio-pci","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.0","addr":"0x3"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_command-Extract-building-IOMMUFD-props-to-function.patch
+++ b/centos-10/SOURCES/libvirt-qemu_command-Extract-building-IOMMUFD-props-to-function.patch
@ -0,0 +1,73 @@
 From e5bdfe01cb976c45a440b88061a40f65ac6f8be8 Mon Sep 17 00:00:00 2001
 Message-ID: <e5bdfe01cb976c45a440b88061a40f65ac6f8be8.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 20:10:50 +0100
 Subject: [PATCH] qemu_command: Extract building IOMMUFD props to function
 This will be reused by hotplug code.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3f7ad3a8a5f0e453c85f186e811e051ead0f769a)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_command.c | 20 ++++++++++++++++----
 src/qemu/qemu_command.h |  3 +++
 2 files changed, 19 insertions(+), 4 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index cca5fed285..521aefbc10 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -5337,6 +5337,21 @@ qemuBuildHostdevCommandLine(virCommand *cmd,
 }
 +virJSONValue *
 +qemuBuildIOMMUFDProps(qemuFDPassDirect *iommufd)
 +{
 +    g_autoptr(virJSONValue) props = NULL;
 +
 +    if (qemuMonitorCreateObjectProps(&props, "iommufd",
 +                                     "iommufd0",
 +                                     "S:fd", qemuFDPassDirectGetPath(iommufd),
 +                                     NULL) < 0)
 +        return NULL;
 +
 +    return g_steal_pointer(&props);
 +}
 +
 +
 static int
 qemuBuildIOMMUFDCommandLine(virCommand *cmd,
                             const virDomainDef *def,
@@ -5350,10 +5365,7 @@ qemuBuildIOMMUFDCommandLine(virCommand *cmd,
     qemuFDPassDirectTransferCommand(priv->iommufd, cmd);
 -    if (qemuMonitorCreateObjectProps(&props, "iommufd",
 -                                     "iommufd0",
 -                                     "S:fd", qemuFDPassDirectGetPath(priv->iommufd),
 -                                     NULL) < 0)
 +    if (!(props = qemuBuildIOMMUFDProps(priv->iommufd)))
         return -1;
     if (qemuBuildObjectCommandlineFromJSON(cmd, props) < 0)
 diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
 index ad068f1f16..028d002ef9 100644
 --- a/src/qemu/qemu_command.h
 +++ b/src/qemu/qemu_command.h
@@ -190,6 +190,9 @@ int
 qemuBuildRNGBackendProps(virDomainRNGDef *rng,
                          virJSONValue **props);
 +virJSONValue *
 +qemuBuildIOMMUFDProps(qemuFDPassDirect *iommufd);
 +
 /* Current, best practice */
 virJSONValue *
 qemuBuildUSBHostdevDevProps(const virDomainDef *def,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_command-Use-uefi-vars-device-where-appropriate.patch
+++ b/centos-10/SOURCES/libvirt-qemu_command-Use-uefi-vars-device-where-appropriate.patch
@ -0,0 +1,154 @@
 From 71ed9b3cb411e469d78fd5203799f3086127b9c3 Mon Sep 17 00:00:00 2001
 Message-ID: <71ed9b3cb411e469d78fd5203799f3086127b9c3.1772815314.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 11 Nov 2025 15:33:41 +0100
 Subject: [PATCH] qemu_command: Use uefi-vars device where appropriate
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This makes guests actually functional.
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit bcda5b2efdf7c3472fd15dc758aad6842c214481)
 Conflicts:
  * tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args
    tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args
    tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args
    - GIC version mismatch caused by capabilities files
      being outdated or missing downstream
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_command.c                       | 34 +++++++++++++++++++
 ...-enrolled-keys-aarch64.aarch64-latest.args |  1 +
 ...o-efi-varstore-aarch64.aarch64-latest.args |  1 +
 ...e-auto-efi-varstore-q35.x86_64-latest.args |  1 +
 ...l-efi-varstore-aarch64.aarch64-latest.args |  1 +
 ...manual-efi-varstore-q35.x86_64-latest.args |  1 +
 6 files changed, 39 insertions(+)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 521aefbc10..7b1b470398 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -9788,6 +9788,37 @@ qemuBuildDomainLoaderCommandLine(virCommand *cmd,
 }
 +static int
 +qemuBuildUefiVarsCommandLine(virCommand *cmd,
 +                             const virDomainDef *def,
 +                             virQEMUCaps *qemuCaps)
 +{
 +    virDomainLoaderDef *loader = def->os.loader;
 +    virDomainVarstoreDef *varstore = def->os.varstore;
 +    g_autoptr(virJSONValue) props = NULL;
 +    const char *model = NULL;
 +
 +    if (!loader || !varstore || !varstore->path)
 +        return 0;
 +
 +    if (ARCH_IS_X86(def->os.arch))
 +        model = "uefi-vars-x64";
 +    else
 +        model = "uefi-vars-sysbus";
 +
 +    if (virJSONValueObjectAdd(&props,
 +                              "s:driver", model,
 +                              "s:jsonfile", varstore->path,
 +                              NULL) < 0)
 +        return -1;
 +
 +    if (qemuBuildDeviceCommandlineFromJSON(cmd, props, def, qemuCaps) < 0)
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 static int
 qemuBuildTPMDevCmd(virCommand *cmd,
                    const virDomainDef *def,
@@ -10862,6 +10893,9 @@ qemuBuildCommandLine(virDomainObj *vm,
     qemuBuildDomainLoaderCommandLine(cmd, def);
 +    if (qemuBuildUefiVarsCommandLine(cmd, def, qemuCaps) < 0)
 +        return NULL;
 +
     if (qemuBuildMemCommandLine(cmd, def, qemuCaps, priv) < 0)
         return NULL;
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args
 index 1cd04c87b1..caf1933091 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args
@@ -13,6 +13,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -machine virt-8.2,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \
 -accel kvm \
 -bios /usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd \
 +-device '{"driver":"uefi-vars-sysbus","jsonfile":"/var/lib/libvirt/qemu/varstore/guest.json"}' \
 -m size=1048576k \
 -object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args
 index 1cd04c87b1..caf1933091 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.args
@@ -13,6 +13,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -machine virt-8.2,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \
 -accel kvm \
 -bios /usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd \
 +-device '{"driver":"uefi-vars-sysbus","jsonfile":"/var/lib/libvirt/qemu/varstore/guest.json"}' \
 -m size=1048576k \
 -object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args
 index 9a899c2a65..392ea77c28 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.args
@@ -14,6 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -accel kvm \
 -cpu qemu64 \
 -bios /usr/share/edk2/ovmf/OVMF.qemuvars.fd \
 +-device '{"driver":"uefi-vars-x64","jsonfile":"/var/lib/libvirt/qemu/varstore/guest.json"}' \
 -m size=1048576k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args
 index 1cd04c87b1..1989405e07 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-varstore-aarch64.aarch64-latest.args
@@ -13,6 +13,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -machine virt-8.2,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \
 -accel kvm \
 -bios /usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd \
 +-device '{"driver":"uefi-vars-sysbus","jsonfile":"/path/to/guest.json"}' \
 -m size=1048576k \
 -object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args
 index 9a899c2a65..6c04c8c39f 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-varstore-q35.x86_64-latest.args
@@ -14,6 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -accel kvm \
 -cpu qemu64 \
 -bios /usr/share/edk2/ovmf/OVMF.qemuvars.fd \
 +-device '{"driver":"uefi-vars-x64","jsonfile":"/path/to/guest.json"}' \
 -m size=1048576k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_domain-Add-missing-IOMMUFD-cleanup.patch
+++ b/centos-10/SOURCES/libvirt-qemu_domain-Add-missing-IOMMUFD-cleanup.patch
@ -0,0 +1,33 @@
 From 31d95c7ad884094f2afd4a0f2450141cc68594ff Mon Sep 17 00:00:00 2001
 Message-ID: <31d95c7ad884094f2afd4a0f2450141cc68594ff.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 16:12:11 +0100
 Subject: [PATCH] qemu_domain: Add missing IOMMUFD cleanup
 If starting VM fails we would leak the FD for IOMMU device.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 7c062bfc4f8c0ba853873e72d21dba77f6ca938f)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_domain.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index bdab117e96..64b01e524f 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -1975,6 +1975,8 @@ qemuDomainObjPrivateDataClear(qemuDomainObjPrivate *priv)
     priv->migrationRecoverSetup = false;
 +    VIR_FORCE_CLOSE(priv->iommufd);
 +
     g_clear_pointer(&priv->memoryBackingDir, g_free);
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Allow-matching-both-UEFI-and-BIOS-for-ROM-loader.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Allow-matching-both-UEFI-and-BIOS-for-ROM-loader.patch
@ -0,0 +1,131 @@
 From a11c975eb05296487023db1beb72d5575af6b05a Mon Sep 17 00:00:00 2001
 Message-ID: <a11c975eb05296487023db1beb72d5575af6b05a.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 17 Nov 2025 18:02:15 +0100
 Subject: [PATCH] qemu_firmware: Allow matching both UEFI and BIOS for ROM
 loader
 Currently we apply a 1:1 mapping between loader type and firmware
 type: ROM can only match BIOS and pflash can only match UEFI.
 That was accurate at the time when the check was introduced, but
 is no longer the case today: the Intel TDX build of edk2, for
 example, is loaded as a ROM but it still provides an UEFI
 implementation to the guest.
 Tweak the matching logic so that a ROM loader is allowed to match
 both BIOS and UEFI firmware descriptors.
 The firmware-manual-efi-tdx test case benefits from this change,
 as all the missing information is now correctly filled in.
 This will also solve an issue reported to the list, where
 firmware builds targeting the confidential VM use case on aarch64
 would not be usable at all, due to the way UEFI and ACPI are
 depending on each other on the architecture.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 563a47ea7fc255c08d834f8a2d0956bae84317a9)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 43 +++++++++++--------
 ...-manual-efi-tdx.x86_64-latest+inteltdx.xml |  6 ++-
 2 files changed, 30 insertions(+), 19 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 7953b297bc..52205b72f8 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -937,23 +937,6 @@ qemuFirmwareOSInterfaceTypeToOsDefFirmware(qemuFirmwareOSInterface interface)
 }
 -static qemuFirmwareOSInterface
 -qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type)
 -{
 -    switch (type) {
 -    case VIR_DOMAIN_LOADER_TYPE_ROM:
 -        return QEMU_FIRMWARE_OS_INTERFACE_BIOS;
 -    case VIR_DOMAIN_LOADER_TYPE_PFLASH:
 -        return QEMU_FIRMWARE_OS_INTERFACE_UEFI;
 -    case VIR_DOMAIN_LOADER_TYPE_NONE:
 -    case VIR_DOMAIN_LOADER_TYPE_LAST:
 -        break;
 -    }
 -
 -    return QEMU_FIRMWARE_OS_INTERFACE_NONE;
 -}
 -
 -
 /**
  * qemuFirmwareEnsureNVRAM:
  * @def: domain definition
@@ -1100,6 +1083,8 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
     const virDomainLoaderDef *loader = def->os.loader;
     size_t i;
     qemuFirmwareOSInterface want;
 +    bool wantUEFI = false;
 +    bool wantBIOS = false;
     bool supportsS3 = false;
     bool supportsS4 = false;
     bool requiresSMM = false;
@@ -1115,12 +1100,34 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
     want = qemuFirmwareOSInterfaceTypeFromOsDefFirmware(def->os.firmware);
     if (want == QEMU_FIRMWARE_OS_INTERFACE_NONE && loader) {
 -        want = qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(loader->type);
 +        /* If an explicit request for a specific type of firmware is
 +         * not present, we can still infer this information from
 +         * other factors. Specifically, the pflash loader type is
 +         * only used for UEFI, while the rom loader type can be used
 +         * both for UEFI and BIOS */
 +        switch (loader->type) {
 +        case VIR_DOMAIN_LOADER_TYPE_PFLASH:
 +            wantUEFI = true;
 +            break;
 +        case VIR_DOMAIN_LOADER_TYPE_ROM:
 +            wantUEFI = true;
 +            wantBIOS = true;
 +            break;
 +        case VIR_DOMAIN_LOADER_TYPE_NONE:
 +        case VIR_DOMAIN_LOADER_TYPE_LAST:
 +        default:
 +            break;
 +        }
     }
     for (i = 0; i < fw->ninterfaces; i++) {
         if (fw->interfaces[i] == want)
             break;
 +
 +        if ((fw->interfaces[i] == QEMU_FIRMWARE_OS_INTERFACE_UEFI && wantUEFI) ||
 +            (fw->interfaces[i] == QEMU_FIRMWARE_OS_INTERFACE_BIOS && wantBIOS)) {
 +            break;
 +        }
     }
     if (i == fw->ninterfaces) {
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
 index cdb92dcf1d..5b87857425 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
@@ -4,8 +4,12 @@
   <memory unit='KiB'>1048576</memory>
   <currentMemory unit='KiB'>1048576</currentMemory>
   <vcpu placement='static'>1</vcpu>
 -  <os>
 +  <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 +    <firmware>
 +      <feature enabled='yes' name='enrolled-keys'/>
 +      <feature enabled='yes' name='secure-boot'/>
 +    </firmware>
     <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd</loader>
     <boot dev='hd'/>
   </os>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Allow-matching-stateful-ROMs.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Allow-matching-stateful-ROMs.patch
@ -0,0 +1,259 @@
 From fccbbe89fadebe350bf2452ef4dd3368bcf41803 Mon Sep 17 00:00:00 2001
 Message-ID: <fccbbe89fadebe350bf2452ef4dd3368bcf41803.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 19 Jan 2026 18:48:50 +0100
 Subject: [PATCH] qemu_firmware: Allow matching stateful ROMs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Stateful ROMs are those that use the uefi-vars QEMU device to
 implement access to UEFI variable storage.
 Matching works much the same as it does for pflash-based
 firmware images. Notably, the <varstore> element is only
 allowed for ROM and the <nvram> element is only allowed for
 pflash.
 The firmware-auto-efi-varstore-q35 and
 firmware-auto-efi-varstore-aarch64 fail in a different way
 after this change: the input XML is now considered valid, and
 the only remaining issue is that the firmware autoselection
 process is unable to find a match.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit fa74aae490f9f13c469eba8b3837ab8cd84c64fd)
 Conflicts:
  * tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml
    - GIC version mismatch caused by capabilities files
      being outdated or missing downstream
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 40 +++++++++++++++++--
 ...to-efi-varstore-aarch64.aarch64-latest.err |  2 +-
 ...to-efi-varstore-aarch64.aarch64-latest.xml | 28 +++++++++++++
 ...re-auto-efi-varstore-q35.x86_64-latest.err |  2 +-
 ...re-auto-efi-varstore-q35.x86_64-latest.xml | 36 +++++++++++++++++
 tests/qemuxmlconftest.c                       |  4 +-
 6 files changed, 104 insertions(+), 8 deletions(-)
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 1851ed4a80..60635b559f 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -893,15 +893,18 @@ qemuFirmwareMatchesMachineArch(const qemuFirmware *fw,
  * qemuFirmwareMatchesPaths:
  * @fw: firmware definition
  * @loader: loader definition
 + * @varstore: varstore definition
  *
  * Checks whether @fw is compatible with the information provided as
  * part of the domain definition.
  *
 - * Returns: true if @fw is compatible with @loader, false otherwise
 + * Returns: true if @fw is compatible with @loader and @varstore,
 + *          false otherwise
  */
 static bool
 qemuFirmwareMatchesPaths(const qemuFirmware *fw,
 -                         const virDomainLoaderDef *loader)
 +                         const virDomainLoaderDef *loader,
 +                         const virDomainVarstoreDef *varstore)
 {
     const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
     const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory;
@@ -922,6 +925,9 @@ qemuFirmwareMatchesPaths(const qemuFirmware *fw,
         if (loader && loader->path &&
             !virFileComparePaths(loader->path, memory->filename))
             return false;
 +        if (varstore && varstore->template &&
 +            !virFileComparePaths(varstore->template, memory->template))
 +            return false;
         break;
     case QEMU_FIRMWARE_DEVICE_NONE:
     case QEMU_FIRMWARE_DEVICE_LAST:
@@ -1112,6 +1118,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                         const char *path)
 {
     const virDomainLoaderDef *loader = def->os.loader;
 +    const virDomainVarstoreDef *varstore = def->os.varstore;
     size_t i;
     qemuFirmwareOSInterface want;
     bool wantUEFI = false;
@@ -1166,7 +1173,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
         return false;
     }
 -    if (!qemuFirmwareMatchesPaths(fw, def->os.loader)) {
 +    if (!qemuFirmwareMatchesPaths(fw, def->os.loader, def->os.varstore)) {
         VIR_DEBUG("No matching path in '%s'", path);
         return false;
     }
@@ -1279,6 +1286,9 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
     if (fw->mapping.device == QEMU_FIRMWARE_DEVICE_FLASH) {
         const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
 +        if (varstore)
 +            return false;
 +
         if (loader && loader->type &&
             loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH) {
             VIR_DEBUG("Discarding flash loader");
@@ -1377,16 +1387,38 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
             }
         }
     } else if (fw->mapping.device == QEMU_FIRMWARE_DEVICE_MEMORY) {
 +        const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory;
 +
 +        if (loader && loader->nvram)
 +            return false;
 +
         if (loader && loader->type &&
             loader->type != VIR_DOMAIN_LOADER_TYPE_ROM) {
             VIR_DEBUG("Discarding rom loader");
             return false;
         }
 -        if (loader && loader->stateless == VIR_TRISTATE_BOOL_NO) {
 +        /* Explicit requests for either a stateless or stateful
 +         * firmware should be fulfilled, but if no preference is
 +         * provided either one is fine as long as the other match
 +         * criteria are satisfied. varstore implies stateful */
 +        if (loader &&
 +            loader->stateless == VIR_TRISTATE_BOOL_NO &&
 +            !memory->template) {
             VIR_DEBUG("Discarding stateless loader");
             return false;
         }
 +        if (varstore &&
 +            !memory->template) {
 +            VIR_DEBUG("Discarding stateless loader");
 +            return false;
 +        }
 +        if (loader &&
 +            loader->stateless == VIR_TRISTATE_BOOL_YES &&
 +            memory->template) {
 +            VIR_DEBUG("Discarding non-stateless loader");
 +            return false;
 +        }
         if (loader && loader->readonly == VIR_TRISTATE_BOOL_NO) {
             VIR_DEBUG("Discarding readonly loader");
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.err
 index b45d304221..3edb2b3451 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.err
@@ -1 +1 @@
 -Only one of NVRAM/varstore can be used
 +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml
 new file mode 100644
 index 0000000000..867d8f03e3
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-aarch64.aarch64-latest.xml
@@ -0,0 +1,28 @@
 +<domain type='kvm'>
 +  <name>guest</name>
 +  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 +  <memory unit='KiB'>1048576</memory>
 +  <currentMemory unit='KiB'>1048576</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os firmware='efi'>
 +    <type arch='aarch64' machine='virt-8.2'>hvm</type>
 +    <loader format='raw'/>
 +    <varstore/>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <acpi/>
 +    <gic version='3'/>
 +  </features>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-aarch64</emulator>
 +    <controller type='usb' index='0' model='none'/>
 +    <controller type='pci' index='0' model='pcie-root'/>
 +    <audio id='1' type='none'/>
 +    <memballoon model='none'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.err
 index b45d304221..3edb2b3451 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.err
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.err
@@ -1 +1 @@
 -Only one of NVRAM/varstore can be used
 +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml
 new file mode 100644
 index 0000000000..c4d70c9fc5
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-varstore-q35.x86_64-latest.xml
@@ -0,0 +1,36 @@
 +<domain type='kvm'>
 +  <name>guest</name>
 +  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 +  <memory unit='KiB'>1048576</memory>
 +  <currentMemory unit='KiB'>1048576</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os firmware='efi'>
 +    <type arch='x86_64' machine='pc-q35-8.2'>hvm</type>
 +    <loader format='raw'/>
 +    <varstore/>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <acpi/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu64</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 +    <controller type='usb' index='0' model='none'/>
 +    <controller type='sata' index='0'>
 +      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pcie-root'/>
 +    <input type='mouse' bus='ps2'/>
 +    <input type='keyboard' bus='ps2'/>
 +    <audio id='1' type='none'/>
 +    <watchdog model='itco' action='reset'/>
 +    <memballoon model='none'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 48c2649aa5..e38a80c57a 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1667,8 +1667,8 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-efi-nvram-file");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-nvram-network-nbd");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-nvram-network-iscsi");
 -    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-varstore-q35");
 -    DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("firmware-auto-efi-varstore-aarch64", "aarch64");
 +    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-varstore-q35");
 +    DO_TEST_CAPS_ARCH_LATEST_FAILURE("firmware-auto-efi-varstore-aarch64", "aarch64");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-loader-qcow2");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-format-loader-qcow2-rom");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Consider-host-uefi-vars-feature-in-sanity-check.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Consider-host-uefi-vars-feature-in-sanity-check.patch
@ -0,0 +1,83 @@
 From 483c5c561743c4e685ffce1d238527f13c8e83a3 Mon Sep 17 00:00:00 2001
 Message-ID: <483c5c561743c4e685ffce1d238527f13c8e83a3.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 14:42:45 +0100
 Subject: [PATCH] qemu_firmware: Consider host-uefi-vars feature in sanity
 check
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Just like with firmware builds targeting the confidential use
 case, use of the uefi-vars device obviates the need to have SMM
 emulation enabled while still guaranteeing that protected EFI
 variables work as intended.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit d0c6aa084f53c0c856d00b87255a31fbbc1237ad)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 5c923b5a02..f9cb9058ac 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1552,6 +1552,7 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
     bool requiresSMM = false;
     bool supportsSecureBoot = false;
     bool hasEnrolledKeys = false;
 +    bool usesUefiVarsDevice = false;
     bool isConfidential = false;
     for (i = 0; i < fw->nfeatures; i++) {
@@ -1565,6 +1566,9 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
         case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS:
             hasEnrolledKeys = true;
             break;
 +        case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
 +            usesUefiVarsDevice = true;
 +            break;
         case QEMU_FIRMWARE_FEATURE_AMD_SEV:
         case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES:
         case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP:
@@ -1574,7 +1578,6 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
         case QEMU_FIRMWARE_FEATURE_NONE:
         case QEMU_FIRMWARE_FEATURE_ACPI_S3:
         case QEMU_FIRMWARE_FEATURE_ACPI_S4:
 -        case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC:
         case QEMU_FIRMWARE_FEATURE_LAST:
@@ -1588,14 +1591,21 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
      * support SMM. This is OK, because EFI binaries for confidential
      * VMs also don't support EFI variable storage in NVRAM, instead
      * the secureboot state is hardcoded to enabled.
 +     *
 +     * Similarly, use of the uefi-vars QEMU device guarantees that
 +     * protected EFI variables work as expected without requiring SMM
 +     * emulation.
      */
     if (!isConfidential &&
 +        !usesUefiVarsDevice &&
         supportsSecureBoot != requiresSMM) {
         VIR_WARN("Firmware description '%s' has invalid set of features: "
 -                 "%s = %d, %s = %d (isConfidential = %d)",
 +                 "%s = %d, %s = %d, %s = %d (isConfidential = %d)",
                  filename,
                  qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_REQUIRES_SMM),
                  requiresSMM,
 +                 qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS),
 +                 usesUefiVarsDevice,
                  qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_SECURE_BOOT),
                  supportsSecureBoot,
                  isConfidential);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Don-t-skip-autoselection-for-ROM.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Don-t-skip-autoselection-for-ROM.patch
@ -0,0 +1,64 @@
 From 598e238bae3ca9409997f4ddf0002f7dac820e96 Mon Sep 17 00:00:00 2001
 Message-ID: <598e238bae3ca9409997f4ddf0002f7dac820e96.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 17 Nov 2025 15:47:30 +0100
 Subject: [PATCH] qemu_firmware: Don't skip autoselection for ROM
 It's possible to have firmware descriptors for builds intended to
 be loaded as ROM, as is the case for those loaded as pflash.
 There is no reason to skip firmware autoselection in those cases,
 and doing so prevents useful information from being filled in.
 After this change, the firmware-manual-efi-tdx test case is
 augmented with some additional information. Even more information
 will be filled in later, when we improve the matching logic.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 9a041e61ec00fa61e94858c699f00eba95b3f226)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                               | 10 ++++------
 .../firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 9ba5d899fa..7953b297bc 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1913,13 +1913,11 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
         return -1;
     }
 -    /* If firmware autoselection is disabled and the loader is a ROM
 -     * instead of a PFLASH device, then we're using BIOS and we don't
 -     * need any information at all */
 -    if (!autoSelection &&
 -        (!loader || (loader && loader->type == VIR_DOMAIN_LOADER_TYPE_ROM))) {
 +    /* If firmware autoselection is disabled and no information
 +     * related to the loader was provided, then we're using the
 +     * default built-in firmware and we can stop here */
 +    if (!autoSelection && !loader)
         return 0;
 -    }
     /* Look for the information we need in firmware descriptors */
     if ((ret = qemuFirmwareFillDomainModern(driver, def)) < 0)
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
 index 7428a3dfef..cdb92dcf1d 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.xml
@@ -6,7 +6,7 @@
   <vcpu placement='static'>1</vcpu>
   <os>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <loader readonly='yes' type='rom'>/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd</loader>
 +    <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd</loader>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Drop-fallback-for-absent-nvramTemplateFormat.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Drop-fallback-for-absent-nvramTemplateFormat.patch
@ -0,0 +1,44 @@
 From 3273ec0979f661b5a00ce91e77c03427b5725df2 Mon Sep 17 00:00:00 2001
 Message-ID: <3273ec0979f661b5a00ce91e77c03427b5725df2.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 17:57:25 +0100
 Subject: [PATCH] qemu_firmware: Drop fallback for absent nvramTemplateFormat
 If this information is missing, the parsing code will consider
 the firmware descriptor to be invalid and matching against it will
 not even be attempted. So we can safely drop this redundant
 fallback.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 876a5d34d45afd71f509c971e37bdb45ceb8cc28)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 47a3987b64..9dff3828a2 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1421,14 +1421,8 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
             loader->nvramTemplateFormat = VIR_STORAGE_FILE_NONE;
             if (!loader->nvram || virStorageSourceIsLocalStorage(loader->nvram)) {
 -                /* validation when parsing the JSON files ensures that we get
 -                 * only 'raw' and 'qcow2' here. Fall back to sharing format with loader */
 -                if (flash->nvram_template.format)
 -                    loader->nvramTemplateFormat = virStorageFileFormatTypeFromString(flash->nvram_template.format);
 -                else
 -                    loader->nvramTemplateFormat = loader->format;
 -
                 loader->nvramTemplate = g_strdup(flash->nvram_template.filename);
 +                loader->nvramTemplateFormat = virStorageFileFormatTypeFromString(flash->nvram_template.format);
             }
         }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Drop-nvram-local-variable.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Drop-nvram-local-variable.patch
@ -0,0 +1,58 @@
 From ede04a5034d7b97d06033e9ccf77471afab41e04 Mon Sep 17 00:00:00 2001
 Message-ID: <ede04a5034d7b97d06033e9ccf77471afab41e04.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Sun, 28 Dec 2025 18:31:38 +0100
 Subject: [PATCH] qemu_firmware: Drop 'nvram' local variable
 We access the NVRAM information via the 'loader' local variable
 throughout the file, and this is the only spot where the 'nvram'
 local variable exists. It makes things inconsistent and opens up
 the possibility of the values for 'loader' and 'nvram' going out
 of sync, especially after a future commit will introduce the
 need to set the former. Just get rid of the additional variable.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit aaa0db64b4e5d44d7bb8aeee9c7b71a4f277a675)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index b168ec7cf7..903b0a984d 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1780,7 +1780,6 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
                        bool abiUpdate)
 {
     virDomainLoaderDef *loader = def->os.loader;
 -    virStorageSource *nvram = loader ? loader->nvram : NULL;
     bool autoSelection = (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_NONE);
     int ret;
@@ -1804,13 +1803,14 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
                        virStorageFileFormatTypeToString(loader->format));
         return -1;
     }
 -    if (nvram &&
 -        nvram->format &&
 -        nvram->format != VIR_STORAGE_FILE_RAW &&
 -        nvram->format != VIR_STORAGE_FILE_QCOW2) {
 +    if (loader &&
 +        loader->nvram &&
 +        loader->nvram->format &&
 +        loader->nvram->format != VIR_STORAGE_FILE_RAW &&
 +        loader->nvram->format != VIR_STORAGE_FILE_QCOW2) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                        _("Unsupported nvram format '%1$s'"),
 -                       virStorageFileFormatTypeToString(nvram->format));
 +                       virStorageFileFormatTypeToString(loader->nvram->format));
         return -1;
     }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Drop-support-for-kernel-descriptors.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Drop-support-for-kernel-descriptors.patch
@ -0,0 +1,232 @@
 From 1cd291897b5a4f97d2ceaf318584760dbd410dc2 Mon Sep 17 00:00:00 2001
 Message-ID: <1cd291897b5a4f97d2ceaf318584760dbd410dc2.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Thu, 27 Nov 2025 20:14:46 +0100
 Subject: [PATCH] qemu_firmware: Drop support for kernel descriptors
 I have been able to find exactly zero evidence of this type of
 firmware descriptor actually existing in the wild, so this is
 essentialy dead code. Dropping it simplifies the task of further
 tweaking the firmware selection code.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3f7eea0e17a4db70820c256af9705731a9a54672)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 83 ++--------------------------------------
 1 file changed, 3 insertions(+), 80 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 5bd34ea87f..b168ec7cf7 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -92,12 +92,6 @@ struct _qemuFirmwareMappingFlash {
 };
 -typedef struct _qemuFirmwareMappingKernel qemuFirmwareMappingKernel;
 -struct _qemuFirmwareMappingKernel {
 -    char *filename;
 -};
 -
 -
 typedef struct _qemuFirmwareMappingMemory qemuFirmwareMappingMemory;
 struct _qemuFirmwareMappingMemory {
     char *filename;
@@ -107,7 +101,6 @@ struct _qemuFirmwareMappingMemory {
 typedef enum {
     QEMU_FIRMWARE_DEVICE_NONE = 0,
     QEMU_FIRMWARE_DEVICE_FLASH,
 -    QEMU_FIRMWARE_DEVICE_KERNEL,
     QEMU_FIRMWARE_DEVICE_MEMORY,
     QEMU_FIRMWARE_DEVICE_LAST
@@ -118,7 +111,6 @@ VIR_ENUM_IMPL(qemuFirmwareDevice,
               QEMU_FIRMWARE_DEVICE_LAST,
               "",
               "flash",
 -              "kernel",
               "memory",
 );
@@ -129,7 +121,6 @@ struct _qemuFirmwareMapping {
     union {
         qemuFirmwareMappingFlash flash;
 -        qemuFirmwareMappingKernel kernel;
         qemuFirmwareMappingMemory memory;
     } data;
 };
@@ -222,13 +213,6 @@ qemuFirmwareMappingFlashFreeContent(qemuFirmwareMappingFlash *flash)
 }
 -static void
 -qemuFirmwareMappingKernelFreeContent(qemuFirmwareMappingKernel *kernel)
 -{
 -    g_free(kernel->filename);
 -}
 -
 -
 static void
 qemuFirmwareMappingMemoryFreeContent(qemuFirmwareMappingMemory *memory)
 {
@@ -243,9 +227,6 @@ qemuFirmwareMappingFreeContent(qemuFirmwareMapping *mapping)
     case QEMU_FIRMWARE_DEVICE_FLASH:
         qemuFirmwareMappingFlashFreeContent(&mapping->data.flash);
         break;
 -    case QEMU_FIRMWARE_DEVICE_KERNEL:
 -        qemuFirmwareMappingKernelFreeContent(&mapping->data.kernel);
 -        break;
     case QEMU_FIRMWARE_DEVICE_MEMORY:
         qemuFirmwareMappingMemoryFreeContent(&mapping->data.memory);
         break;
@@ -418,24 +399,6 @@ qemuFirmwareMappingFlashParse(const char *path,
 }
 -static int
 -qemuFirmwareMappingKernelParse(const char *path,
 -                               virJSONValue *doc,
 -                               qemuFirmwareMappingKernel *kernel)
 -{
 -    const char *filename;
 -
 -    if (!(filename = virJSONValueObjectGetString(doc, "filename"))) {
 -        VIR_DEBUG("missing 'filename' in '%s'", path);
 -        return -1;
 -    }
 -
 -    kernel->filename = g_strdup(filename);
 -
 -    return 0;
 -}
 -
 -
 static int
 qemuFirmwareMappingMemoryParse(const char *path,
                                virJSONValue *doc,
@@ -485,10 +448,6 @@ qemuFirmwareMappingParse(const char *path,
         if (qemuFirmwareMappingFlashParse(path, mapping, &fw->mapping.data.flash) < 0)
             return -1;
         break;
 -    case QEMU_FIRMWARE_DEVICE_KERNEL:
 -        if (qemuFirmwareMappingKernelParse(path, mapping, &fw->mapping.data.kernel) < 0)
 -            return -1;
 -        break;
     case QEMU_FIRMWARE_DEVICE_MEMORY:
         if (qemuFirmwareMappingMemoryParse(path, mapping, &fw->mapping.data.memory) < 0)
             return -1;
@@ -732,19 +691,6 @@ qemuFirmwareMappingFlashFormat(virJSONValue *mapping,
 }
 -static int
 -qemuFirmwareMappingKernelFormat(virJSONValue *mapping,
 -                                qemuFirmwareMappingKernel *kernel)
 -{
 -    if (virJSONValueObjectAppendString(mapping,
 -                                       "filename",
 -                                       kernel->filename) < 0)
 -        return -1;
 -
 -    return 0;
 -}
 -
 -
 static int
 qemuFirmwareMappingMemoryFormat(virJSONValue *mapping,
                                 qemuFirmwareMappingMemory *memory)
@@ -774,10 +720,6 @@ qemuFirmwareMappingFormat(virJSONValue *doc,
         if (qemuFirmwareMappingFlashFormat(mapping, &fw->mapping.data.flash) < 0)
             return -1;
         break;
 -    case QEMU_FIRMWARE_DEVICE_KERNEL:
 -        if (qemuFirmwareMappingKernelFormat(mapping, &fw->mapping.data.kernel) < 0)
 -            return -1;
 -        break;
     case QEMU_FIRMWARE_DEVICE_MEMORY:
         if (qemuFirmwareMappingMemoryFormat(mapping, &fw->mapping.data.memory) < 0)
             return -1;
@@ -920,21 +862,17 @@ qemuFirmwareMatchesMachineArch(const qemuFirmware *fw,
  * qemuFirmwareMatchesPaths:
  * @fw: firmware definition
  * @loader: loader definition
 - * @kernelPath: path to kernel image
  *
  * Checks whether @fw is compatible with the information provided as
  * part of the domain definition.
  *
 - * Returns: true if @fw is compatible with @loader and @kernelPath,
 - *          false otherwise
 + * Returns: true if @fw is compatible with @loader, false otherwise
  */
 static bool
 qemuFirmwareMatchesPaths(const qemuFirmware *fw,
 -                         const virDomainLoaderDef *loader,
 -                         const char *kernelPath)
 +                         const virDomainLoaderDef *loader)
 {
     const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
 -    const qemuFirmwareMappingKernel *kernel = &fw->mapping.data.kernel;
     const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory;
     switch (fw->mapping.device) {
@@ -954,11 +892,6 @@ qemuFirmwareMatchesPaths(const qemuFirmware *fw,
             !virFileComparePaths(loader->path, memory->filename))
             return false;
         break;
 -    case QEMU_FIRMWARE_DEVICE_KERNEL:
 -        if (kernelPath &&
 -            !virFileComparePaths(kernelPath, kernel->filename))
 -            return false;
 -        break;
     case QEMU_FIRMWARE_DEVICE_NONE:
     case QEMU_FIRMWARE_DEVICE_LAST:
         return false;
@@ -1183,7 +1116,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
         return false;
     }
 -    if (!qemuFirmwareMatchesPaths(fw, def->os.loader, def->os.kernel)) {
 +    if (!qemuFirmwareMatchesPaths(fw, def->os.loader)) {
         VIR_DEBUG("No matching path in '%s'", path);
         return false;
     }
@@ -1424,7 +1357,6 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
                                  const qemuFirmware *fw)
 {
     const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
 -    const qemuFirmwareMappingKernel *kernel = &fw->mapping.data.kernel;
     const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory;
     virDomainLoaderDef *loader = NULL;
     virStorageFileFormat format;
@@ -1482,14 +1414,6 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
                   loader->path, NULLSTR(loader->nvramTemplate));
         break;
 -    case QEMU_FIRMWARE_DEVICE_KERNEL:
 -        VIR_FREE(def->os.kernel);
 -        def->os.kernel = g_strdup(kernel->filename);
 -
 -        VIR_DEBUG("decided on kernel '%s'",
 -                  def->os.kernel);
 -        break;
 -
     case QEMU_FIRMWARE_DEVICE_MEMORY:
         if (!def->os.loader)
             def->os.loader = virDomainLoaderDefNew();
@@ -2056,7 +1980,6 @@ qemuFirmwareGetSupported(const char *machine,
             fwpath = memory->filename;
             break;
 -        case QEMU_FIRMWARE_DEVICE_KERNEL:
         case QEMU_FIRMWARE_DEVICE_NONE:
         case QEMU_FIRMWARE_DEVICE_LAST:
             break;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Fill-in-varstore-information.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Fill-in-varstore-information.patch
@ -0,0 +1,61 @@
 From 5dd010d79cb3625e01e9721cb770a7bf235b561e Mon Sep 17 00:00:00 2001
 Message-ID: <5dd010d79cb3625e01e9721cb770a7bf235b561e.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 21 Jan 2026 19:42:40 +0100
 Subject: [PATCH] qemu_firmware: Fill in varstore information
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If the matching firmware requires the use of varstore, we
 have to bubble up information about it, namely the path to
 the template. If the struct member doesn't exist yet, we need
 to allocate it.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit da7eb72148ce787e719faf2ceeaa7ff3c458a50a)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 60635b559f..5a07e3181f 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1492,6 +1492,7 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
     const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
     const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory;
     virDomainLoaderDef *loader = NULL;
 +    virDomainVarstoreDef *varstore = NULL;
     virStorageFileFormat format;
     bool hasSecureBoot = false;
     bool hasEnrolledKeys = false;
@@ -1552,8 +1553,17 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
         VIR_FREE(loader->path);
         loader->path = g_strdup(memory->filename);
 -        VIR_DEBUG("decided on loader '%s'",
 -                  loader->path);
 +        if (memory->template) {
 +            if (!def->os.varstore)
 +                def->os.varstore = virDomainVarstoreDefNew();
 +            varstore = def->os.varstore;
 +
 +            VIR_FREE(varstore->template);
 +            varstore->template = g_strdup(memory->template);
 +        }
 +
 +        VIR_DEBUG("decided on loader '%s' template '%s'",
 +                  loader->path, NULLSTR(varstore ? varstore->template : NULL));
         break;
     case QEMU_FIRMWARE_DEVICE_NONE:
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Generate-varstore-path-when-necessary.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Generate-varstore-path-when-necessary.patch
@ -0,0 +1,86 @@
 From 5f0e8ea3a876e5bd88f1312cc5ffd90469c1e190 Mon Sep 17 00:00:00 2001
 Message-ID: <5f0e8ea3a876e5bd88f1312cc5ffd90469c1e190.1772815314.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 21 Jan 2026 18:25:37 +0100
 Subject: [PATCH] qemu_firmware: Generate varstore path when necessary
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Introduce qemuFirmwareEnsureVarstore(), which performs the same
 task as the existing qemuFirmwareEnsureNVRAM() but for the
 varstore element.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 0dd118cceee833ff905e6c24785a2acda8ccc80b)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 5a07e3181f..d8633c6b28 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1069,6 +1069,38 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
 }
 +/**
 + * qemuFirmwareEnsureVarstore:
 + * @def: domain definition
 + * @driver: QEMU driver
 + *
 + * Make sure that information for the varstore is present. This might
 + * involve automatically generating the corresponding path.
 + */
 +static void
 +qemuFirmwareEnsureVarstore(virDomainDef *def,
 +                           virQEMUDriver *driver)
 +{
 +    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
 +    virDomainLoaderDef *loader = def->os.loader;
 +    virDomainVarstoreDef *varstore = def->os.varstore;
 +
 +    if (!loader)
 +        return;
 +
 +    if (loader->type != VIR_DOMAIN_LOADER_TYPE_ROM)
 +        return;
 +
 +    if (!varstore)
 +        return;
 +
 +    if (varstore->path)
 +        return;
 +
 +    varstore->path = g_strdup_printf("%s/%s.json",
 +                                     cfg->varstoreDir, def->name);
 +}
 +
 /**
  * qemuFirmwareSetOsFeatures:
@@ -2063,10 +2095,11 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
         }
     }
 -    /* Always ensure that the NVRAM path is present, even if we
 -     * haven't found a match: the configuration might simply be
 -     * referring to a custom firmware build */
 +    /* Always ensure that the NVRAM/varstore is configured where
 +     * appropriate, even if we haven't found a match: the configuration
 +     * might simply be referring to a custom firmware build */
     qemuFirmwareEnsureNVRAM(def, driver, abiUpdate);
 +    qemuFirmwareEnsureVarstore(def, driver);
     return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Ignore-stateless-combined-when-NVRAM-is-configured.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Ignore-stateless-combined-when-NVRAM-is-configured.patch
@ -0,0 +1,72 @@
 From 9c29beb017582822dc341bdc34d78b4b2b95162f Mon Sep 17 00:00:00 2001
 Message-ID: <9c29beb017582822dc341bdc34d78b4b2b95162f.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 26 Nov 2025 19:01:12 +0100
 Subject: [PATCH] qemu_firmware: Ignore stateless/combined when NVRAM is
 configured
 For combined firmware builds, the variable storage is part of the
 same image as the executable code, whereas stateless builds don't
 support variable storage at all.
 In both cases, the use of a separate NVRAM storage area is not
 supported, so if attributes connected to one are present in the
 domain XML, firmware descriptors for stateless/combined builds
 should be ignored.
 ROM firmware builds are stateless by definition, so the same
 handling applies to them as well.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3463e543fec8ac7f8173f8f6712f05bc912319cd)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index a22853361b..47a3987b64 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1285,6 +1285,17 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                           flash->nvram_template.format);
                 return false;
             }
 +        } else {
 +            if (loader && loader->nvram &&
 +                (loader->nvram->path || loader->nvram->format)) {
 +                VIR_DEBUG("Discarding non split loader (nvram configured)");
 +                return false;
 +            }
 +            if (loader &&
 +                (loader->nvramTemplate || loader->nvramTemplateFormat)) {
 +                VIR_DEBUG("Discarding non split loader (nvram template configured)");
 +                return false;
 +            }
         }
     } else if (fw->mapping.device == QEMU_FIRMWARE_DEVICE_MEMORY) {
         if (loader && loader->type &&
@@ -1302,6 +1313,17 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
             VIR_DEBUG("Discarding readonly loader");
             return false;
         }
 +
 +        if (loader && loader->nvram &&
 +            (loader->nvram->path || loader->nvram->format)) {
 +            VIR_DEBUG("Discarding rom loader (nvram configured)");
 +            return false;
 +        }
 +        if (loader &&
 +            (loader->nvramTemplate || loader->nvramTemplateFormat)) {
 +            VIR_DEBUG("Discarding rom loader (nvram template configured)");
 +            return false;
 +        }
     }
     if (def->sec) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Introduce-qemuFirmwareFillDomainCustom.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Introduce-qemuFirmwareFillDomainCustom.patch
@ -0,0 +1,80 @@
 From 139ffa47b64ade1e88dbe17ef049bd1303305a79 Mon Sep 17 00:00:00 2001
 Message-ID: <139ffa47b64ade1e88dbe17ef049bd1303305a79.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 18:53:14 +0100
 Subject: [PATCH] qemu_firmware: Introduce qemuFirmwareFillDomainCustom()
 Simple helper for the case where completely custom firmware paths
 are in use. It's quite trivial right now, but it will be expanded
 slightly in an upcoming commit.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3acdcd2eb78a7cc8a17acc279dfbddf873dea1f8)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 38 ++++++++++++++++++++++++++++++--------
 1 file changed, 30 insertions(+), 8 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 9dff3828a2..9b6c14701f 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1601,6 +1601,32 @@ qemuFirmwareFetchParsedConfigs(bool privileged,
 }
 +/**
 + * qemuFirmwareFillDomainCustom:
 + * @def: domain definition
 + *
 + * Fill in whatever information we can when totally custom firmware
 + * paths are in use.
 + *
 + * Should only be used as a fallback in case looking at the firmware
 + * descriptors yielded no results, and neither did going through the
 + * legacy list of CODE:VARS pairs.
 + */
 +static void
 +qemuFirmwareFillDomainCustom(virDomainDef *def)
 +{
 +    virDomainLoaderDef *loader = def->os.loader;
 +
 +    if (!loader)
 +        return;
 +
 +    if (!loader->format)
 +        loader->format = VIR_STORAGE_FILE_RAW;
 +
 +    return;
 +}
 +
 +
 /**
  * qemuFirmwareFillDomainLegacy:
  * @driver: QEMU driver
@@ -1890,15 +1916,11 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
             if ((ret = qemuFirmwareFillDomainLegacy(driver, def)) < 0)
                 return -1;
 -            /* If we've gotten this far without finding a match, it
 -             * means that we're dealing with a set of completely
 -             * custom paths. In that case, unless the user has
 -             * specified otherwise, we have to assume that they're in
 -             * raw format */
             if (ret == 1) {
 -                if (loader && !loader->format) {
 -                    loader->format = VIR_STORAGE_FILE_RAW;
 -                }
 +                /* If we've gotten this far without finding a match,
 +                 * it means that we're dealing with a set of completely
 +                 * custom paths. We can still fill in some information */
 +                qemuFirmwareFillDomainCustom(def);
             }
         } else {
             virReportError(VIR_ERR_OPERATION_FAILED,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Move-copying-of-nvram.format-to-loader.format.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Move-copying-of-nvram.format-to-loader.format.patch
@ -0,0 +1,90 @@
 From 66c0e4b7a9b472c539701bede38cbe9278fec830 Mon Sep 17 00:00:00 2001
 Message-ID: <66c0e4b7a9b472c539701bede38cbe9278fec830.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Thu, 27 Nov 2025 19:05:17 +0100
 Subject: [PATCH] qemu_firmware: Move copying of nvram.format to loader.format
 As explained in the comment that comes along with it, this code
 ensures that the user's preference is taken into account when
 nvram.format is the only information that's provided. Currently
 it lives in the parser, but it makes more sense for it to be
 together with the rest of the firmware selection code instead.
 Note that this move is not completely seamless: once the code
 is moved outside of the parser, it can no longer reliably know
 whether the <loader> element actually existed in the domain
 XML. The difference is subtle enough that the test suite is
 completely unaffected, and we are going to rework the handling
 of this scenario in a way that restores the original behavior
 later anyway, so it ultimately doesn't matter.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4df091dea4a41767561bab1bcd28c3fd9ac2dcea)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/domain_conf.c   | 18 +-----------------
 src/qemu/qemu_firmware.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 17 deletions(-)
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index cb047e5a3e..e72cda0048 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -17937,24 +17937,8 @@ virDomainLoaderDefParseXMLLoader(virDomainLoaderDef *loader,
 {
     unsigned int format = 0;
 -    if (!loaderNode) {
 -        /* If there is no <loader> element but the <nvram> element
 -         * was present, copy the format from the latter to the
 -         * former.
 -         *
 -         * This ensures that a configuration such as
 -         *
 -         *   <os>
 -         *     <nvram format='foo'/>
 -         *   </os>
 -         *
 -         * behaves as expected, that is, results in a firmware build
 -         * with format 'foo' being selected */
 -        if (loader->nvram)
 -            loader->format = loader->nvram->format;
 -
 +    if (!loaderNode)
         return 0;
 -    }
     if (virXMLPropTristateBool(loaderNode, "readonly", VIR_XML_PROP_NONE,
                                &loader->readonly) < 0)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 6c609ece6a..a22853361b 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1783,6 +1783,21 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
     bool autoSelection = (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_NONE);
     int ret;
 +    /* If there is no <loader> element but the <nvram> element
 +     * was present, copy the format from the latter to the
 +     * former.
 +     *
 +     * This ensures that a configuration such as
 +     *
 +     *   <os>
 +     *     <nvram format='foo'/>
 +     *   </os>
 +     *
 +     * behaves as expected, that is, results in a firmware build
 +     * with format 'foo' being selected */
 +    if (loader && loader->nvram && !loader->format)
 +        loader->format = loader->nvram->format;
 +
     /* If we're loading an existing configuration from disk, we
      * should try as hard as possible to preserve historical
      * behavior. In particular, firmware autoselection being enabled
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Move-format-raw-compat-exception.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Move-format-raw-compat-exception.patch
@ -0,0 +1,86 @@
 From 053f28978ec5f7b3648ccb9b0b7af16b17a4c87a Mon Sep 17 00:00:00 2001
 Message-ID: <053f28978ec5f7b3648ccb9b0b7af16b17a4c87a.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Thu, 27 Nov 2025 18:25:07 +0100
 Subject: [PATCH] qemu_firmware: Move format=raw compat exception
 We currently apply this exception, which is critical to ensure
 that the correct firmware is selected when working with older VMs,
 in the postparse callback.
 Move it to the firmware selection process instead, where it should
 have been added in the first place.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 5b374c5e3fe621126327aad4398f48da288ba521)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c  | 20 ++++++++++++++++++++
 src/qemu/qemu_postparse.c | 17 -----------------
 2 files changed, 20 insertions(+), 17 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 903b0a984d..6c609ece6a 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1783,6 +1783,26 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
     bool autoSelection = (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_NONE);
     int ret;
 +    /* If we're loading an existing configuration from disk, we
 +     * should try as hard as possible to preserve historical
 +     * behavior. In particular, firmware autoselection being enabled
 +     * could never have resulted, before libvirt 9.2.0, in anything
 +     * but a raw firmware image being selected.
 +     *
 +     * In order to ensure that existing domains keep working even if
 +     * a firmware descriptor for a build with a different format is
 +     * given higher priority, explicitly add this requirement to the
 +     * definition before performing firmware selection */
 +    if (!abiUpdate && autoSelection) {
 +        if (!loader) {
 +            def->os.loader = virDomainLoaderDefNew();
 +            loader = def->os.loader;
 +        }
 +        if (!loader->format) {
 +            loader->format = VIR_STORAGE_FILE_RAW;
 +        }
 +    }
 +
     /* Start by performing a thorough validation of the input.
      *
      * We need to do this here because the firmware selection logic
 diff --git a/src/qemu/qemu_postparse.c b/src/qemu/qemu_postparse.c
 index 840d6a1174..8940cb09b3 100644
 --- a/src/qemu/qemu_postparse.c
 +++ b/src/qemu/qemu_postparse.c
@@ -1051,23 +1051,6 @@ qemuDomainDefBootPostParse(virDomainDef *def,
 {
     bool abiUpdate = !!(parseFlags & VIR_DOMAIN_DEF_PARSE_ABI_UPDATE);
 -    /* If we're loading an existing configuration from disk, we
 -     * should try as hard as possible to preserve historical
 -     * behavior. In particular, firmware autoselection being enabled
 -     * could never have resulted, before libvirt 9.2.0, in anything
 -     * but a raw firmware image being selected.
 -     *
 -     * In order to ensure that existing domains keep working even if
 -     * a firmware descriptor for a build with a different format is
 -     * given higher priority, explicitly add this requirement to the
 -     * definition before performing firmware selection */
 -    if (!abiUpdate && def->os.firmware) {
 -        if (!def->os.loader)
 -            def->os.loader = virDomainLoaderDefNew();
 -        if (!def->os.loader->format)
 -            def->os.loader->format = VIR_STORAGE_FILE_RAW;
 -    }
 -
     /* Firmware selection can fail for a number of reasons, but the
      * most likely one is that the requested configuration contains
      * mistakes or includes constraints that are impossible to
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Only-set-format-for-custom-loader-if-path-is-present.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Only-set-format-for-custom-loader-if-path-is-present.patch
@ -0,0 +1,45 @@
 From 9298881a07f0e25ec594d4157421eb61c9014c85 Mon Sep 17 00:00:00 2001
 Message-ID: <9298881a07f0e25ec594d4157421eb61c9014c85.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 3 Feb 2026 16:05:05 +0100
 Subject: [PATCH] qemu_firmware: Only set format for custom loader if path is
 present
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We only set the template format if the template path is present,
 and we should be consistent with that. The format on its own is
 not very interesting anyway.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 375c82a0f8e61f3762f0a7ffa26624f841a79d76)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 436b06c388..519828f6f9 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1662,8 +1662,10 @@ qemuFirmwareFillDomainCustom(virDomainDef *def)
     if (!loader)
         return;
 -    if (!loader->format)
 +    if (loader->path &&
 +        !loader->format) {
         loader->format = VIR_STORAGE_FILE_RAW;
 +    }
     if (loader->nvramTemplate &&
         !loader->nvramTemplateFormat) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Parse-host-uefi-vars-firmware-feature.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Parse-host-uefi-vars-firmware-feature.patch
@ -0,0 +1,80 @@
 From eb8df5502f4a047e93faa872047b56f047e055a4 Mon Sep 17 00:00:00 2001
 Message-ID: <eb8df5502f4a047e93faa872047b56f047e055a4.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 14:14:36 +0100
 Subject: [PATCH] qemu_firmware: Parse host-uefi-vars firmware feature
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 When present in a firmware descriptor, this feature indicates that
 the corresponding executable expects to access variable storage
 through the uefi-vars QEMU device.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 83679d7338869aaf19b59077164cd2da391c2283)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 6a074055ca..8b9b0d91ff 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -145,6 +145,7 @@ typedef enum {
     QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS,
     QEMU_FIRMWARE_FEATURE_REQUIRES_SMM,
     QEMU_FIRMWARE_FEATURE_SECURE_BOOT,
 +    QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS,
     QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC,
     QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC,
@@ -164,6 +165,7 @@ VIR_ENUM_IMPL(qemuFirmwareFeature,
               "enrolled-keys",
               "requires-smm",
               "secure-boot",
 +              "host-uefi-vars",
               "verbose-dynamic",
               "verbose-static"
 );
@@ -1181,6 +1183,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
             hasEnrolledKeys = true;
             break;
 +        case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC:
         case QEMU_FIRMWARE_FEATURE_NONE:
@@ -1515,6 +1518,7 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
         case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES:
         case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP:
         case QEMU_FIRMWARE_FEATURE_INTEL_TDX:
 +        case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC:
         case QEMU_FIRMWARE_FEATURE_NONE:
@@ -1570,6 +1574,7 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
         case QEMU_FIRMWARE_FEATURE_NONE:
         case QEMU_FIRMWARE_FEATURE_ACPI_S3:
         case QEMU_FIRMWARE_FEATURE_ACPI_S4:
 +        case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC:
         case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC:
         case QEMU_FIRMWARE_FEATURE_LAST:
@@ -2084,6 +2089,7 @@ qemuFirmwareGetSupported(const char *machine,
             case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES:
             case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP:
             case QEMU_FIRMWARE_FEATURE_INTEL_TDX:
 +            case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS:
             case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC:
             case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC:
             case QEMU_FIRMWARE_FEATURE_LAST:
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Prefer-template-format-to-loader-format.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Prefer-template-format-to-loader-format.patch
@ -0,0 +1,39 @@
 From 8c34553e1e77dcea4f86ee2c2668de251876b42e Mon Sep 17 00:00:00 2001
 Message-ID: <8c34553e1e77dcea4f86ee2c2668de251876b42e.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 28 Nov 2025 17:00:09 +0100
 Subject: [PATCH] qemu_firmware: Prefer template format to loader format
 In the vast majority of cases they will match, but it just makes
 more logical sense to copy the format from the NVRAM template to
 the NVRAM file itself.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit a92c1409568ac70bfa0a29099181452ef625d937)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index f32e46cc8c..b08fb95585 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -991,7 +991,10 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
          * NVRAM format if that's missing though */
         if (!virStorageSourceIsEmpty(loader->nvram)) {
             if (!loader->nvram->format) {
 -                loader->nvram->format = loader->format;
 +                if (loader->nvramTemplateFormat)
 +                    loader->nvram->format = loader->nvramTemplateFormat;
 +                else
 +                    loader->nvram->format = loader->format;
             }
             return;
         }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-ROM-firmware-is-always-in-raw-format.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-ROM-firmware-is-always-in-raw-format.patch
@ -0,0 +1,33 @@
 From 4b9e4bf49a5891cae82bfbc4476b4046c8ee362d Mon Sep 17 00:00:00 2001
 Message-ID: <4b9e4bf49a5891cae82bfbc4476b4046c8ee362d.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 17 Nov 2025 20:17:45 +0100
 Subject: [PATCH] qemu_firmware: ROM firmware is always in raw format
 By definition.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 1b78d647da26b101267eb86401ad0a7d722a773d)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 70ac88c373..9ba5d899fa 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1470,6 +1470,7 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def,
         loader = def->os.loader;
         loader->type = VIR_DOMAIN_LOADER_TYPE_ROM;
 +        loader->format = VIR_STORAGE_FILE_RAW;
         VIR_FREE(loader->path);
         loader->path = g_strdup(memory->filename);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Refactor-setting-NVRAM-format.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Refactor-setting-NVRAM-format.patch
@ -0,0 +1,53 @@
 From d03ee871a69a16ff2975e925150fa361a5b283b4 Mon Sep 17 00:00:00 2001
 Message-ID: <d03ee871a69a16ff2975e925150fa361a5b283b4.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 17 Dec 2025 01:12:35 +0100
 Subject: [PATCH] qemu_firmware: Refactor setting NVRAM format
 Instead of setting the format every single time, knowing that we
 might throw away the entire definition immediately afterwards,
 and duplicating a check, only set it if we are going to perform
 an early return due to the rest of the definition being properly
 filled in already.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ab8efe6fd076d5e944902e4b2194a7db35a85101)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index a7bb8f7e45..f32e46cc8c 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -985,15 +985,16 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
     if (loader->stateless == VIR_TRISTATE_BOOL_YES)
         return;
 -    /* If the NVRAM format hasn't been set yet, inherit the same as
 -     * the loader */
 -    if (loader->nvram && !loader->nvram->format)
 -        loader->nvram->format = loader->format;
 -
     if (loader->nvram) {
 -        /* Nothing to do if a proper NVRAM backend is already configured */
 -        if (!virStorageSourceIsEmpty(loader->nvram))
 +        /* If a proper NVRAM backend is already configured, we are
 +         * done for the most part. We might still need to set the
 +         * NVRAM format if that's missing though */
 +        if (!virStorageSourceIsEmpty(loader->nvram)) {
 +            if (!loader->nvram->format) {
 +                loader->nvram->format = loader->format;
 +            }
             return;
 +        }
         /* otherwise we want to reset and re-populate the definition */
         virObjectUnref(loader->nvram);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Remove-NVRAM-to-loader-format-copy-hack.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Remove-NVRAM-to-loader-format-copy-hack.patch
@ -0,0 +1,331 @@
 From 0af887be667a15eff3c7aa50f51a679786fec38b Mon Sep 17 00:00:00 2001
 Message-ID: <0af887be667a15eff3c7aa50f51a679786fec38b.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 28 Nov 2025 15:53:00 +0100
 Subject: [PATCH] qemu_firmware: Remove NVRAM to loader format copy hack
 Now that the hack is gone, a few test cases that were failing
 before start succeeding instead.
 The firmware-auto-efi-format-nvramtemplate-qcow2 test case
 originally passed but produced wrong results, then started
 failing once we began taking templateFormat into account, and now
 passes once again, finally producing the correct results.
 The firmware-auto-efi-format-nvram-raw-loader-path and
 firmware-auto-efi-format-nvram-raw-nvramtemplate-path test cases,
 on the other hand, never passed before now, because the hack
 resulted in information contradicting those provided by the user
 being injected into the configuration, which in turn made it
 impossible to successfully pick a firmware build. With the hack
 gone they can finally succeed, as they should have in the first
 place.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 0aa3fa2d621fe6e0c3063be0d74f339f5852ac8a)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 19 ++--------
 ...t-nvram-raw-loader-path.x86_64-latest.args | 37 ++++++++++++++++++
 ...at-nvram-raw-loader-path.x86_64-latest.err |  1 -
 ...at-nvram-raw-loader-path.x86_64-latest.xml |  9 ++++-
 ...-raw-nvramtemplate-path.x86_64-latest.args | 37 ++++++++++++++++++
 ...m-raw-nvramtemplate-path.x86_64-latest.err |  1 -
 ...m-raw-nvramtemplate-path.x86_64-latest.xml |  9 ++++-
 ...mat-nvramtemplate-qcow2.x86_64-latest.args | 38 +++++++++++++++++++
 ...rmat-nvramtemplate-qcow2.x86_64-latest.err |  1 -
 ...rmat-nvramtemplate-qcow2.x86_64-latest.xml |  9 ++++-
 tests/qemuxmlconftest.c                       |  6 +--
 11 files changed, 139 insertions(+), 28 deletions(-)
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.args
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.err
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.args
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.err
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 8714538ba3..70ac88c373 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1859,21 +1859,6 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
     bool autoSelection = (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_NONE);
     int ret;
 -    /* If there is no <loader> element but the <nvram> element
 -     * was present, copy the format from the latter to the
 -     * former.
 -     *
 -     * This ensures that a configuration such as
 -     *
 -     *   <os>
 -     *     <nvram format='foo'/>
 -     *   </os>
 -     *
 -     * behaves as expected, that is, results in a firmware build
 -     * with format 'foo' being selected */
 -    if (loader && loader->nvram && !loader->format)
 -        loader->format = loader->nvram->format;
 -
     /* If we're loading an existing configuration from disk, we
      * should try as hard as possible to preserve historical
      * behavior. In particular, firmware autoselection being enabled
@@ -1889,7 +1874,9 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
             def->os.loader = virDomainLoaderDefNew();
             loader = def->os.loader;
         }
 -        if (!loader->format) {
 +        if (!loader->format &&
 +            !loader->nvramTemplateFormat &&
 +            (!loader->nvram || !loader->nvram->format)) {
             loader->format = VIR_STORAGE_FILE_RAW;
         }
     }
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.args
 new file mode 100644
 index 0000000000..14027c21db
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.args
@@ -0,0 +1,37 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"qcow2","file":"libvirt-pflash0-storage","backing":null}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 +-machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 +-accel kvm \
 +-cpu qemu64 \
 +-global driver=cfi.pflash01,property=secure,value=on \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.err
 deleted file mode 100644
 index 3edb2b3451..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.xml
 index 6bb1ad1507..a02714d7b9 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-loader-path.x86_64-latest.xml
@@ -6,12 +6,17 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <loader type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
 -    <nvram format='raw'/>
 +    <firmware>
 +      <feature enabled='yes' name='enrolled-keys'/>
 +      <feature enabled='yes' name='secure-boot'/>
 +    </firmware>
 +    <loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
 +    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 +    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.args
 new file mode 100644
 index 0000000000..14027c21db
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.args
@@ -0,0 +1,37 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"qcow2","file":"libvirt-pflash0-storage","backing":null}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 +-machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 +-accel kvm \
 +-cpu qemu64 \
 +-global driver=cfi.pflash01,property=secure,value=on \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.err
 deleted file mode 100644
 index 3edb2b3451..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.xml
 index 8bb8f1b26c..a02714d7b9 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-raw-nvramtemplate-path.x86_64-latest.xml
@@ -6,12 +6,17 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <loader format='raw'/>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' format='raw'/>
 +    <firmware>
 +      <feature enabled='yes' name='enrolled-keys'/>
 +      <feature enabled='yes' name='secure-boot'/>
 +    </firmware>
 +    <loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
 +    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 +    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
 new file mode 100644
 index 0000000000..468ad4326c
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
@@ -0,0 +1,38 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"qcow2","file":"libvirt-pflash0-storage","backing":null}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"qcow2","file":"libvirt-pflash1-storage","backing":null}' \
 +-machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-accel kvm \
 +-cpu qemu64 \
 +-global driver=cfi.pflash01,property=secure,value=on \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
 deleted file mode 100644
 index 3edb2b3451..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
 index 1f039061ba..4061a0ae35 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
@@ -6,12 +6,17 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <loader format='raw'/>
 -    <nvram templateFormat='qcow2'/>
 +    <firmware>
 +      <feature enabled='yes' name='enrolled-keys'/>
 +      <feature enabled='yes' name='secure-boot'/>
 +    </firmware>
 +    <loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
 +    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' templateFormat='qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 +    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 03b3aeef86..0091840731 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1659,11 +1659,11 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-qcow2-network-nbd");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-raw");
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-format-nvram-raw");
 -    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-raw-loader-path");
 -    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-raw-nvramtemplate-path");
 +    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-raw-loader-path");
 +    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-raw-nvramtemplate-path");
     DO_TEST_CAPS_ARCH_LATEST("firmware-auto-efi-format-loader-raw", "aarch64");
     DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE("firmware-auto-efi-format-loader-raw", "aarch64");
 -    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvramtemplate-qcow2");
 +    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvramtemplate-qcow2");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch");
     DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-mismatch-nvramtemplate");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Report-NVRAM-template-path-for-ROMs.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Report-NVRAM-template-path-for-ROMs.patch
@ -0,0 +1,49 @@
 From f4180272d119d8267d81d50035b421b06fd3a75c Mon Sep 17 00:00:00 2001
 Message-ID: <f4180272d119d8267d81d50035b421b06fd3a75c.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 17 Nov 2025 16:59:40 +0100
 Subject: [PATCH] qemu_firmware: Report NVRAM template path for ROMs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This was not necessary until now since ROMs couldn't have an
 associate NVRAM template, and technically speaking they still
 can't; however, the varstore template serves essentialy the
 same purpose.
 The qemuFirmwareGetSupported() helper is used in two places:
 one is the code that is responsible for filling in domaincaps,
 where templates are ignored so this change has no impact on it;
 the other is the qemufirmware test program, where this value
 being reported is useful as it will allow us to confirm that
 the JSON firmware descriptors for uefi-vars enabled builds are
 parsed correctly.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit a440ada2148951c4abb105d5d19f7b3583243325)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 7af3f32b85..72aae73dcb 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -2161,6 +2161,7 @@ qemuFirmwareGetSupported(const char *machine,
         case QEMU_FIRMWARE_DEVICE_MEMORY:
             fwpath = memory->filename;
 +            nvrampath = memory->template;
             break;
         case QEMU_FIRMWARE_DEVICE_NONE:
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Retain-user-specified-NVRAM-format.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Retain-user-specified-NVRAM-format.patch
@ -0,0 +1,108 @@
 From b853a05f7fcf8c6c1a4f5b51071ab951d174e041 Mon Sep 17 00:00:00 2001
 Message-ID: <b853a05f7fcf8c6c1a4f5b51071ab951d174e041.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 1 Dec 2025 16:30:43 +0100
 Subject: [PATCH] qemu_firmware: Retain user-specified NVRAM format
 Right now we throw the entire definition away if the path is
 not present, including the format. This effectively results in
 discarding user-provided information.
 This change fixes the firmware-auto-efi-format-mismatch test
 case. Until now, the NVRAM format ended up being raw (matching
 the NVRAM template) despite the user explicitly asking for it
 to be qcow2 instead.
 While this means that libvirt will no longer be able to start
 such a VM without user intervention, since it does not
 automatically perform conversion between formats, that's still
 preferrable to silently overriding an explicit user's request.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 91b6dee6d14cd804529d1cd7fdd010af58643543)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                       | 18 +++++++++++++-----
 ...auto-efi-format-mismatch.x86_64-latest.args |  5 +++--
 ...-auto-efi-format-mismatch.x86_64-latest.xml |  2 +-
 3 files changed, 17 insertions(+), 8 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index b08fb95585..dca0a79868 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -971,6 +971,7 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
 {
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     virDomainLoaderDef *loader = def->os.loader;
 +    virStorageFileFormat nvramFormat = VIR_STORAGE_FILE_NONE;
     const char *ext = NULL;
     if (!loader)
@@ -999,19 +1000,26 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
             return;
         }
 -        /* otherwise we want to reset and re-populate the definition */
 +        /* Otherwise we want to reset and re-populate the definition.
 +         * In this case we still retain a single piece of information:
 +         * the user-provided NVRAM format */
 +        nvramFormat = loader->nvram->format;
 +
         virObjectUnref(loader->nvram);
     }
     loader->nvram = virStorageSourceNew();
     loader->nvram->type = VIR_STORAGE_TYPE_FILE;
 +    loader->nvram->format = nvramFormat;
     /* The nvram template format should be always present but as a failsafe,
      * duplicate the loader format if it is not available. */
 -    if (loader->nvramTemplateFormat > VIR_STORAGE_FILE_NONE)
 -        loader->nvram->format = loader->nvramTemplateFormat;
 -    else
 -        loader->nvram->format = loader->format;
 +    if (!loader->nvram->format) {
 +        if (loader->nvramTemplateFormat)
 +            loader->nvram->format = loader->nvramTemplateFormat;
 +        else
 +            loader->nvram->format = loader->format;
 +    }
     if (loader->nvram->format == VIR_STORAGE_FILE_RAW) {
         /* The extension used by raw edk2 builds has historically
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
 index e7c9110c95..468d7ee048 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
@@ -12,8 +12,9 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 -blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 --machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"qcow2","file":"libvirt-pflash1-storage","backing":null}' \
 +-machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 -accel kvm \
 -cpu qemu64 \
 -global driver=cfi.pflash01,property=secure,value=on \
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.xml
 index f4df8c07ed..3a7536db2a 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch.x86_64-latest.xml
@@ -11,7 +11,7 @@
       <feature enabled='yes' name='secure-boot'/>
     </firmware>
     <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Set-templateFormat-for-custom-paths.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Set-templateFormat-for-custom-paths.patch
@ -0,0 +1,65 @@
 From b69d8a93d56c991e8d25059d241f845258008239 Mon Sep 17 00:00:00 2001
 Message-ID: <b69d8a93d56c991e8d25059d241f845258008239.1772815312.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 18:59:03 +0100
 Subject: [PATCH] qemu_firmware: Set templateFormat for custom paths
 If an NVRAM template is used, its format should be set too.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3e1c110a4d409a32d2407df0e2c77e24d50b7d32)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                                     | 5 +++++
 ...ware-manual-efi-loader-path-nonstandard.x86_64-latest.xml | 2 +-
 ...e-manual-efi-nvram-template-nonstandard.x86_64-latest.xml | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 9b6c14701f..2b16d66818 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1623,6 +1623,11 @@ qemuFirmwareFillDomainCustom(virDomainDef *def)
     if (!loader->format)
         loader->format = VIR_STORAGE_FILE_RAW;
 +    if (loader->nvramTemplate &&
 +        !loader->nvramTemplateFormat) {
 +        loader->nvramTemplateFormat = loader->format;
 +    }
 +
     return;
 }
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
 index c17834b5e6..7baf6ebd40 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
@@ -7,7 +7,7 @@
   <os>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
     <loader readonly='yes' type='pflash' format='raw'>/path/to/OVMF_CODE.fd</loader>
 -    <nvram template='/path/to/OVMF_VARS.fd' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <nvram template='/path/to/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
 index cbadd0f0c8..beb146d35a 100644
 --- a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
@@ -7,7 +7,7 @@
   <os>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
     <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
 -    <nvram template='/path/to/OVMF_VARS.fd' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <nvram template='/path/to/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Simplify-handling-of-legacy-paths.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Simplify-handling-of-legacy-paths.patch
@ -0,0 +1,132 @@
 From 5843ef0b8e0939f2d8728d4760b1040751057ca0 Mon Sep 17 00:00:00 2001
 Message-ID: <5843ef0b8e0939f2d8728d4760b1040751057ca0.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 5 Dec 2025 16:44:09 +0100
 Subject: [PATCH] qemu_firmware: Simplify handling of legacy paths
 Currently we're doing a weird dance to avoid overwriting the
 user-provided path to the NVRAM template, which might potentially
 be one we actually know about but just so happens not to be
 listed first. Explaining why we're doing things this way requires
 a fairly long comment.
 We can make things simpler: if the NVRAM template path is present
 in the domain XML, include it into the matching criteria. This is
 consistent with how we match firmware descriptors.
 Handling of format, both for the firmware executable and the
 NVRAM template, is improved too. Legacy paths were used before
 non-raw firmware builds existed, so we can set the format to raw
 unconditionally.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ee4c619b0924508682285e6aa445914f68b13a7a)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 69 +++++++++++++++++++---------------------
 1 file changed, 32 insertions(+), 37 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 2b16d66818..a7bb8f7e45 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1653,6 +1653,7 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
 {
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     virDomainLoaderDef *loader = def->os.loader;
 +    virFirmware *theone = NULL;
     size_t i;
     if (!loader)
@@ -1681,6 +1682,13 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         return 1;
     }
 +    if (loader->nvramTemplateFormat &&
 +        loader->nvramTemplateFormat != VIR_STORAGE_FILE_RAW) {
 +        VIR_DEBUG("Ignoring legacy entries for loader with nvram template format '%s'",
 +                  virStorageFileFormatTypeToString(loader->nvramTemplateFormat));
 +        return 1;
 +    }
 +
     for (i = 0; i < cfg->nfirmwares; i++) {
         virFirmware *fw = cfg->firmwares[i];
@@ -1690,47 +1698,34 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
             continue;
         }
 -        loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
 -        loader->readonly = VIR_TRISTATE_BOOL_YES;
 -        loader->format = VIR_STORAGE_FILE_RAW;
 -
 -        /* Only use the default template path if one hasn't been
 -         * provided by the user. Assume that the template is in 'raw' format.
 -         *
 -         * In addition to fully-custom templates, which are a valid
 -         * use case, we could simply be in a situation where
 -         * qemu.conf contains
 -         *
 -         *   nvram = [
 -         *     "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.fd",
 -         *     "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.secboot.fd"
 -         *   ]
 -         *
 -         * and the domain has been configured as
 -         *
 -         *   <os>
 -         *     <loader readonly='yes' type='pflash'>/path/to/OVMF_CODE.secboot.fd</loader>
 -         *     <nvram template='/path/to/OVMF/OVMF_VARS.secboot.fd'>
 -         *   </os>
 -         *
 -         * In this case, the global default is to have Secure Boot
 -         * disabled, but the domain configuration explicitly enables
 -         * it, and we shouldn't overrule this choice */
 -        if (!loader->nvramTemplate) {
 -            loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
 -            loader->nvramTemplateFormat = VIR_STORAGE_FILE_RAW;
 +        if (loader->nvramTemplate &&
 +            !virFileComparePaths(fw->nvram, loader->nvramTemplate)) {
 +            VIR_DEBUG("Not matching nvram template path '%s' for user provided path '%s'",
 +                      fw->nvram, loader->nvramTemplate);
 +            continue;
         }
 -        if (loader->nvramTemplateFormat == VIR_STORAGE_FILE_NONE)
 -            loader->nvramTemplateFormat = VIR_STORAGE_FILE_RAW;
 -
 -        VIR_DEBUG("decided on firmware '%s' template '%s'",
 -                  loader->path, NULLSTR(loader->nvramTemplate));
 -
 -        return 0;
 +        theone = fw;
 +        break;
     }
 -    return 1;
 +    if (!theone)
 +        return 1;
 +
 +    loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
 +    loader->readonly = VIR_TRISTATE_BOOL_YES;
 +
 +    loader->format = VIR_STORAGE_FILE_RAW;
 +    loader->nvramTemplateFormat = VIR_STORAGE_FILE_RAW;
 +
 +    if (!loader->nvramTemplate) {
 +        loader->nvramTemplate = g_strdup(theone->nvram);
 +    }
 +
 +    VIR_DEBUG("decided on firmware '%s' template '%s'",
 +              loader->path, loader->nvramTemplate);
 +
 +    return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Split-sanity-check.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Split-sanity-check.patch
@ -0,0 +1,66 @@
 From 7909339d97bca3113e521d07c1f3e876d2f0a9a2 Mon Sep 17 00:00:00 2001
 Message-ID: <7909339d97bca3113e521d07c1f3e876d2f0a9a2.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 24 Nov 2025 14:36:55 +0100
 Subject: [PATCH] qemu_firmware: Split sanity check
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The two checks are semantically different, so it makes sense to
 perform them separately. We will soon extend the first one.
 While at it, start printing out the value of isConfidential. We
 could print the value of each firmware feature it's derived from,
 but that would make things unnecessarily verbose; at the same
 time, knowing that libvirt believes that the firmware build is
 targeting the confidential use case can be useful for debugging
 so it's worth including it.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 91337ee06d8f8a1e34d59c21840ceeb6904aed70)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 8b9b0d91ff..5c923b5a02 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1589,16 +1589,23 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw,
      * VMs also don't support EFI variable storage in NVRAM, instead
      * the secureboot state is hardcoded to enabled.
      */
 -    if ((!isConfidential &&
 -         (supportsSecureBoot != requiresSMM)) ||
 -        (hasEnrolledKeys && !supportsSecureBoot)) {
 +    if (!isConfidential &&
 +        supportsSecureBoot != requiresSMM) {
         VIR_WARN("Firmware description '%s' has invalid set of features: "
 -                 "%s = %d, %s = %d, %s = %d",
 +                 "%s = %d, %s = %d (isConfidential = %d)",
                  filename,
                  qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_REQUIRES_SMM),
                  requiresSMM,
                  qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_SECURE_BOOT),
                  supportsSecureBoot,
 +                 isConfidential);
 +    }
 +    if (hasEnrolledKeys && !supportsSecureBoot) {
 +        VIR_WARN("Firmware description '%s' has invalid set of features: "
 +                 "%s = %d, %s = %d",
 +                 filename,
 +                 qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_SECURE_BOOT),
 +                 supportsSecureBoot,
                  qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS),
                  hasEnrolledKeys);
     }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Support-extended-syntax-for-ROM-firmware-descriptors.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Support-extended-syntax-for-ROM-firmware-descriptors.patch
@ -0,0 +1,99 @@
 From 560b1e9ff0dd80b473894993371614df3c71a118 Mon Sep 17 00:00:00 2001
 Message-ID: <560b1e9ff0dd80b473894993371614df3c71a118.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 19 Jan 2026 17:34:23 +0100
 Subject: [PATCH] qemu_firmware: Support extended syntax for ROM firmware
 descriptors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The existing syntax can only describe stateless firmware builds,
 while the extended one can additionally describe builds intended
 for use with the uefi-vars device. This involves including the
 path to the corresponding varstore template.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit cab5b6532d5f102b33af642a0a67b29477b44b0a)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index f9cb9058ac..7af3f32b85 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -95,6 +95,7 @@ struct _qemuFirmwareMappingFlash {
 typedef struct _qemuFirmwareMappingMemory qemuFirmwareMappingMemory;
 struct _qemuFirmwareMappingMemory {
     char *filename;
 +    char *template;
 };
@@ -219,6 +220,7 @@ static void
 qemuFirmwareMappingMemoryFreeContent(qemuFirmwareMappingMemory *memory)
 {
     g_free(memory->filename);
 +    g_free(memory->template);
 }
@@ -406,7 +408,11 @@ qemuFirmwareMappingMemoryParse(const char *path,
                                virJSONValue *doc,
                                qemuFirmwareMappingMemory *memory)
 {
 +    virJSONValue *uefi_vars;
     const char *filename;
 +    const char *template;
 +
 +    uefi_vars = virJSONValueObjectGet(doc, "uefi-vars");
     if (!(filename = virJSONValueObjectGetString(doc, "filename"))) {
         VIR_DEBUG("missing 'filename' in '%s'", path);
@@ -415,6 +421,15 @@ qemuFirmwareMappingMemoryParse(const char *path,
     memory->filename = g_strdup(filename);
 +    if (uefi_vars) {
 +        if (!(template = virJSONValueObjectGetString(uefi_vars, "template"))) {
 +            VIR_DEBUG("missing 'template' for 'uefi-vars' in '%s'", path);
 +            return -1;
 +        }
 +
 +        memory->template = g_strdup(template);
 +    }
 +
     return 0;
 }
@@ -702,6 +717,20 @@ qemuFirmwareMappingMemoryFormat(virJSONValue *mapping,
                                        memory->filename) < 0)
         return -1;
 +    if (memory->template) {
 +        g_autoptr(virJSONValue) uefi_vars = virJSONValueNewObject();
 +
 +        if (virJSONValueObjectAppendString(uefi_vars,
 +                                           "template",
 +                                           memory->template) < 0)
 +            return -1;
 +
 +        if (virJSONValueObjectAppend(mapping,
 +                                     "uefi-vars",
 +                                     &uefi_vars) < 0)
 +            return -1;
 +    }
 +
     return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Take-NVRAM-format-into-account-when-matching.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Take-NVRAM-format-into-account-when-matching.patch
@ -0,0 +1,66 @@
 From 5bf3d3a12744a55ab362d0d9aff41e9d0d217bf8 Mon Sep 17 00:00:00 2001
 Message-ID: <5bf3d3a12744a55ab362d0d9aff41e9d0d217bf8.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 28 Nov 2025 15:18:35 +0100
 Subject: [PATCH] qemu_firmware: Take NVRAM format into account when matching
 Commit d3016e47be5f removed a hunk very similar to the one we're
 adding with the rationale that there is no actual requirement for
 the NVRAM file and the NVRAM template to have the same format,
 which is completely correct: while libvirt will not perform the
 format conversion itself, the user can do that on their own and
 everything (except RESET_NVRAM) will work just fine.
 That said, we also need <nvram format='foo'/> specified on its
 own with no <loader> element to result in a firmware build with a
 foo-formatted NVRAM template to be picked. Right now this works
 thanks to the hack at the top of qemuFirmwareFillDomain() which
 copies nvram.format to loader.format, but we want to get rid of
 that because it has additional side effects that can lead to
 confusing outcomes in certain specific scenarios.
 So reintroduce this check, but make it extremely narrow: if any
 other information that can influence firmware selection is
 present in the domain XML, ignore the NVRAM format entirely; if
 however the NVRAM format is the only information that was
 provided, consider it when looking for a match.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 798528d2b64db88368c61e7e904e0b7d46de9bd4)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index e13cce0887..8714538ba3 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1304,6 +1304,21 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                           virStorageFileFormatTypeToString(loader->nvramTemplateFormat));
                 return false;
             }
 +            /* If nvram.format was specified and no other information
 +             * that can influence firmware selection was, then treat it
 +             * the same as if nvram.templateFormat had been specified.
 +             * This ensures that <nvram format='foo'/> continues to work
 +             * as a shorthand while not getting in the way otherwise */
 +            if (loader && loader->nvram && loader->nvram->format &&
 +                !loader->readonly && !loader->type && !loader->secure &&
 +                !loader->stateless && !loader->format && !loader->path &&
 +                !loader->nvramTemplateFormat && !loader->nvramTemplate &&
 +                STRNEQ(flash->nvram_template.format, virStorageFileFormatTypeToString(loader->nvram->format))) {
 +                VIR_DEBUG("Discarding loader with mismatching nvram template format '%s' != '%s'",
 +                          flash->nvram_template.format,
 +                          virStorageFileFormatTypeToString(loader->nvram->format));
 +                return false;
 +            }
         } else {
             if (loader && loader->nvram &&
                 (loader->nvram->path || loader->nvram->format)) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Take-templateFormat-into-account-when-matching.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Take-templateFormat-into-account-when-matching.patch
@ -0,0 +1,231 @@
 From c42ea0c6e181c2702bc0e0809a7ad43f96b9a909 Mon Sep 17 00:00:00 2001
 Message-ID: <c42ea0c6e181c2702bc0e0809a7ad43f96b9a909.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 26 Nov 2025 19:05:18 +0100
 Subject: [PATCH] qemu_firmware: Take templateFormat into account when matching
 If the user has specified a desired format for the NVRAM
 template, we should take that information into account when
 looking for a suitable firmware build instead of ignoring it.
 Two test cases start failing as a result of this change.
 For firmware-auto-efi-format-nvramtemplate-qcow2, the failure
 is temporary and the test case will pass once again with an
 upcoming commit. It should be noted that, until now, the selected
 firmware used raw, not qcow2, as the NVRAM template format,
 meaning that though the test case passed the outcome was not the
 desired one.
 For firmware-auto-efi-format-mismatch-nvramtemplate, the failure
 is desired and the test case should not have succeeded in the
 first place, as there are no firmware descriptors for a build
 that uses raw format for the executable and qcow2 format for the
 NVRAM template.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 623fc1b4b5ee93e946d9928aced498dde0421ace)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      |  7 ++++
 ...-mismatch-nvramtemplate.x86_64-latest.args | 37 -------------------
 ...t-mismatch-nvramtemplate.x86_64-latest.err |  1 +
 ...t-mismatch-nvramtemplate.x86_64-latest.xml |  9 +----
 ...mat-nvramtemplate-qcow2.x86_64-latest.args | 37 -------------------
 ...rmat-nvramtemplate-qcow2.x86_64-latest.err |  1 +
 ...rmat-nvramtemplate-qcow2.x86_64-latest.xml |  9 +----
 tests/qemuxmlconftest.c                       |  4 +-
 8 files changed, 15 insertions(+), 90 deletions(-)
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.args
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.err
 delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index dca0a79868..e13cce0887 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1297,6 +1297,13 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                           flash->nvram_template.format);
                 return false;
             }
 +            if (loader && loader->nvramTemplateFormat &&
 +                STRNEQ(flash->nvram_template.format, virStorageFileFormatTypeToString(loader->nvramTemplateFormat))) {
 +                VIR_DEBUG("Discarding loader with mismatching nvram template format '%s' != '%s'",
 +                          flash->nvram_template.format,
 +                          virStorageFileFormatTypeToString(loader->nvramTemplateFormat));
 +                return false;
 +            }
         } else {
             if (loader && loader->nvram &&
                 (loader->nvram->path || loader->nvram->format)) {
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.args
 deleted file mode 100644
 index e7c9110c95..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.args
 +++ /dev/null
@@ -1,37 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 --machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --global driver=cfi.pflash01,property=secure,value=on \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.err
 new file mode 100644
 index 0000000000..3edb2b3451
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.err
@@ -0,0 +1 @@
 +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.xml
 index f4df8c07ed..1f039061ba 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-mismatch-nvramtemplate.x86_64-latest.xml
@@ -6,17 +6,12 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='enrolled-keys'/>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader format='raw'/>
 +    <nvram templateFormat='qcow2'/>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 -    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
 deleted file mode 100644
 index e7c9110c95..0000000000
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.args
 +++ /dev/null
@@ -1,37 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
 --machine pc-q35-10.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --global driver=cfi.pflash01,property=secure,value=on \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
 new file mode 100644
 index 0000000000..3edb2b3451
 --- /dev/null
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.err
@@ -0,0 +1 @@
 +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration
 diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
 index f4df8c07ed..1f039061ba 100644
 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
 +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvramtemplate-qcow2.x86_64-latest.xml
@@ -6,17 +6,12 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-10.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='enrolled-keys'/>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='yes' secure='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader format='raw'/>
 +    <nvram templateFormat='qcow2'/>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 -    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index b46caf9139..03b3aeef86 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -1663,9 +1663,9 @@ mymain(void)
     DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-raw-nvramtemplate-path");
     DO_TEST_CAPS_ARCH_LATEST("firmware-auto-efi-format-loader-raw", "aarch64");
     DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE("firmware-auto-efi-format-loader-raw", "aarch64");
 -    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvramtemplate-qcow2");
 +    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvramtemplate-qcow2");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch");
 -    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch-nvramtemplate");
 +    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-mismatch-nvramtemplate");
     /* This test passes, but the outcome is not the desired one: the
      * generic edk2 build gets selected instead of the AMD SEV one */
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_firmware-Use-of-NVRAM-implies-stateful-firmware.patch
+++ b/centos-10/SOURCES/libvirt-qemu_firmware-Use-of-NVRAM-implies-stateful-firmware.patch
@ -0,0 +1,54 @@
 From ca225465b1d7c3e931b319aad262a0c65d240cbc Mon Sep 17 00:00:00 2001
 Message-ID: <ca225465b1d7c3e931b319aad262a0c65d240cbc.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 3 Feb 2026 18:47:04 +0100
 Subject: [PATCH] qemu_firmware: Use of NVRAM implies stateful firmware
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Currently we only look at the value for the stateless attribute
 itself when matching, but the <nvram> element being included in
 the input XML is likewise a clear sign that a stateless firmware
 build will not satisfy the user's requirements.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit ffe37c698948b926bace57dc16106d3acb08c3ac)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 60cc92e46a..1851ed4a80 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1288,13 +1288,19 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
         /* Explicit requests for either a stateless or stateful
          * firmware should be fulfilled, but if no preference is
          * provided either one is fine as long as the other match
 -         * criteria are satisfied */
 +         * criteria are satisfied. NVRAM implies stateful */
         if (loader &&
             loader->stateless == VIR_TRISTATE_BOOL_NO &&
             flash->mode == QEMU_FIRMWARE_FLASH_MODE_STATELESS) {
             VIR_DEBUG("Discarding stateless loader");
             return false;
         }
 +        if (loader &&
 +            loader->nvram &&
 +            flash->mode == QEMU_FIRMWARE_FLASH_MODE_STATELESS) {
 +            VIR_DEBUG("Discarding stateless loader");
 +            return false;
 +        }
         if (loader &&
             loader->stateless == VIR_TRISTATE_BOOL_YES &&
             flash->mode != QEMU_FIRMWARE_FLASH_MODE_STATELESS) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_hotplug-Add-support-to-hotplug-host-device-with-IOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-qemu_hotplug-Add-support-to-hotplug-host-device-with-IOMMUFD.patch
@ -0,0 +1,134 @@
 From 598a0e9ee5f59faea21f03ccb02d0830e73f975f Mon Sep 17 00:00:00 2001
 Message-ID: <598a0e9ee5f59faea21f03ccb02d0830e73f975f.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 21:21:53 +0100
 Subject: [PATCH] qemu_hotplug: Add support to hotplug host device with IOMMUFD
 For first host device we need to add iommufd object as well.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 5d16bef1a69500791be454239e3b9ac68ec53ace)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_hotplug.c | 39 +++++++++++++++++++++++++++++++++++++++
 src/qemu/qemu_process.c |  4 ++--
 src/qemu/qemu_process.h |  3 +++
 3 files changed, 44 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index 10ad13a416..a455c2cd53 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -1561,13 +1561,16 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
     virDomainDeviceDef dev = { VIR_DOMAIN_DEVICE_HOSTDEV,
                                { .hostdev = hostdev } };
     virDomainDeviceInfo *info = hostdev->info;
 +    qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
     int ret;
     g_autoptr(virJSONValue) devprops = NULL;
 +    g_autoptr(virJSONValue) objprops = NULL;
     bool releaseaddr = false;
     bool teardowncgroup = false;
     bool teardownlabel = false;
     bool teardowndevice = false;
     bool teardownmemlock = false;
 +    bool removeiommufd = false;
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     unsigned int flags = 0;
@@ -1617,11 +1620,38 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
         goto error;
     }
 +    if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +        if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
 +            goto error;
 +
 +        if (!priv->iommufdState) {
 +            if (qemuProcessOpenIommuFd(vm) < 0)
 +                goto error;
 +
 +            if (!(objprops = qemuBuildIOMMUFDProps(priv->iommufd)))
 +                goto error;
 +        }
 +    }
 +
     if (!(devprops = qemuBuildPCIHostdevDevProps(vm->def, hostdev)))
         goto error;
     qemuDomainObjEnterMonitor(vm);
 +    if (objprops) {
 +        if ((ret = qemuFDPassDirectTransferMonitor(priv->iommufd, priv->mon)) < 0)
 +            goto exit_monitor;
 +
 +        if ((ret = qemuMonitorAddObject(priv->mon, &objprops, NULL)) < 0)
 +            goto exit_monitor;
 +
 +        priv->iommufdState = true;
 +        removeiommufd = true;
 +    }
 +
 +    if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0)
 +        goto exit_monitor;
 +
     if ((ret = qemuDomainAttachExtensionDevice(priv->mon, hostdev->info)) < 0)
         goto exit_monitor;
@@ -1652,6 +1682,15 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
     if (teardownmemlock && qemuDomainAdjustMaxMemLock(vm) < 0)
         VIR_WARN("Unable to reset maximum locked memory on hotplug fail");
 +    if (removeiommufd) {
 +        qemuDomainObjEnterMonitor(vm);
 +        ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false));
 +        qemuDomainObjExitMonitor(vm);
 +    }
 +
 +    qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon);
 +    qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon);
 +
     if (releaseaddr)
         qemuDomainReleaseDeviceAddress(vm, info);
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 59fff1aa19..1aff3a277b 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7681,7 +7681,7 @@ qemuProcessPrepareHostBackendChardevHotplug(virDomainObj *vm,
  *
  * Returns: 0 on success, -1 on failure
  */
 -static int
 +int
 qemuProcessOpenIommuFd(virDomainObj *vm)
 {
     qemuDomainObjPrivate *priv = vm->privateData;
@@ -7705,7 +7705,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm)
  *
  * Returns: 0 on success, -1 on failure
  */
 -static int
 +int
 qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 {
     qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 diff --git a/src/qemu/qemu_process.h b/src/qemu/qemu_process.h
 index df78b00abb..1023b7cb25 100644
 --- a/src/qemu/qemu_process.h
 +++ b/src/qemu/qemu_process.h
@@ -134,6 +134,9 @@ int qemuProcessPrepareHostBackendChardevHotplug(virDomainObj *vm,
                                                 virDomainDeviceDef *dev)
     ATTRIBUTE_MOCKABLE;
 +int qemuProcessOpenIommuFd(virDomainObj *vm);
 +
 +int qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev);
 int qemuProcessPrepareHost(virQEMUDriver *driver,
                            virDomainObj *vm,
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_hotplug-Fix-crash-when-attaching-network-inteface-with-hostdev-network.patch
+++ b/centos-10/SOURCES/libvirt-qemu_hotplug-Fix-crash-when-attaching-network-inteface-with-hostdev-network.patch
@ -0,0 +1,96 @@
 From e7ad692e2f55a08db011f12a888a0156ef983ecd Mon Sep 17 00:00:00 2001
 Message-ID: <e7ad692e2f55a08db011f12a888a0156ef983ecd.1773154803.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Tue, 10 Mar 2026 09:34:48 +0100
 Subject: [PATCH] qemu_hotplug: Fix crash when attaching network inteface with
 hostdev network
 The following interface XML will crash libvirt when attached to
 running VM:
  <interface type='network'>
    <source network='hostdev_net'/>
  </interface>
 Instead of trying to figure out every single place where hostdev is used
 as struct directly and allocating empty private data check if iommufd
 is configured as that will happen only for <hostdev> device where the
 private data are correctly allocated.
 This patch is best viewed with `git show -w`.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit 25662b3700da9c32b5083d46ff3831aa4afc2eab)
 Resolves: https://issues.redhat.com/browse/RHEL-151916
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_hotplug.c | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index bb88815e27..845f42bf20 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -1638,20 +1638,23 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
     qemuDomainObjEnterMonitor(vm);
 -    if (objprops) {
 -        if ((ret = qemuFDPassDirectTransferMonitor(priv->iommufd, priv->mon)) < 0)
 -            goto exit_monitor;
 -        if ((ret = qemuMonitorAddObject(priv->mon, &objprops, NULL)) < 0)
 -            goto exit_monitor;
 +    if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +        if (objprops) {
 +            if ((ret = qemuFDPassDirectTransferMonitor(priv->iommufd, priv->mon)) < 0)
 +                goto exit_monitor;
 -        priv->iommufdState = true;
 -        removeiommufd = true;
 +            if ((ret = qemuMonitorAddObject(priv->mon, &objprops, NULL)) < 0)
 +                goto exit_monitor;
 +
 +            priv->iommufdState = true;
 +            removeiommufd = true;
 +        }
 +
 +        if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0)
 +            goto exit_monitor;
     }
 -    if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0)
 -        goto exit_monitor;
 -
     if ((ret = qemuDomainAttachExtensionDevice(priv->mon, hostdev->info)) < 0)
         goto exit_monitor;
@@ -1682,15 +1685,17 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
     if (teardownmemlock && qemuDomainAdjustMaxMemLock(vm) < 0)
         VIR_WARN("Unable to reset maximum locked memory on hotplug fail");
 -    qemuDomainObjEnterMonitor(vm);
 +    if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +        qemuDomainObjEnterMonitor(vm);
 -    if (removeiommufd)
 -        ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false));
 +        if (removeiommufd)
 +            ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false));
 -    qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon);
 -    qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon);
 +        qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon);
 +        qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon);
 -    qemuDomainObjExitMonitor(vm);
 +        qemuDomainObjExitMonitor(vm);
 +    }
     if (releaseaddr)
         qemuDomainReleaseDeviceAddress(vm, info);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_hotplug-Remove-iommufd-object-if-no-longer-needed.patch
+++ b/centos-10/SOURCES/libvirt-qemu_hotplug-Remove-iommufd-object-if-no-longer-needed.patch
@ -0,0 +1,40 @@
 From 2274a02bd1b2cefb48d7d66fe8db10e5c9cd853d Mon Sep 17 00:00:00 2001
 Message-ID: <2274a02bd1b2cefb48d7d66fe8db10e5c9cd853d.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:57:12 +0100
 Subject: [PATCH] qemu_hotplug: Remove iommufd object if no longer needed
 When removing last host device using IOMMUFD remove the iommufd object
 as well.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 300ebf01b88d154312c1a5a684be2add95dd7f31)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_hotplug.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index 9445599d2c..10ad13a416 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -4986,6 +4986,14 @@ qemuDomainRemoveHostDevice(virQEMUDriver *driver,
         }
     }
 +    if (priv->iommufdState &&
 +        !virDomainDefHasPCIHostdevWithIOMMUFD(vm->def)) {
 +        qemuDomainObjEnterMonitor(vm);
 +        ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false));
 +        qemuDomainObjExitMonitor(vm);
 +        priv->iommufdState = false;
 +    }
 +
     virDomainAuditHostdev(vm, hostdev, "detach", true);
     if (!virHostdevIsPCIDevice(hostdev) &&
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_hotplug-enter-monitor-in-order-to-rollback-passed-FD.patch
+++ b/centos-10/SOURCES/libvirt-qemu_hotplug-enter-monitor-in-order-to-rollback-passed-FD.patch
@ -0,0 +1,46 @@
 From 1312b576ca64ad07aaee6fae9024bbdfa621c609 Mon Sep 17 00:00:00 2001
 Message-ID: <1312b576ca64ad07aaee6fae9024bbdfa621c609.1772815314.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Thu, 26 Feb 2026 10:54:18 +0100
 Subject: [PATCH] qemu_hotplug: enter monitor in order to rollback passed FD
 Reported-by: Peter Krempa <pkrempa@redhat.com>
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit 4374dbbbf0d87f0052dd96be96baad6c20963713)
 https://issues.redhat.com/browse/RHEL-151916
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_hotplug.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
 index a455c2cd53..bb88815e27 100644
 --- a/src/qemu/qemu_hotplug.c
 +++ b/src/qemu/qemu_hotplug.c
@@ -1682,15 +1682,16 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver,
     if (teardownmemlock && qemuDomainAdjustMaxMemLock(vm) < 0)
         VIR_WARN("Unable to reset maximum locked memory on hotplug fail");
 -    if (removeiommufd) {
 -        qemuDomainObjEnterMonitor(vm);
 +    qemuDomainObjEnterMonitor(vm);
 +
 +    if (removeiommufd)
         ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false));
 -        qemuDomainObjExitMonitor(vm);
 -    }
     qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon);
     qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon);
 +    qemuDomainObjExitMonitor(vm);
 +
     if (releaseaddr)
         qemuDomainReleaseDeviceAddress(vm, info);
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_process-Fix-FD-leak-with-multiple-host-devices-using-IOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-qemu_process-Fix-FD-leak-with-multiple-host-devices-using-IOMMUFD.patch
@ -0,0 +1,48 @@
 From e42d8373633488a6d67b6c895953de183b1dd495 Mon Sep 17 00:00:00 2001
 Message-ID: <e42d8373633488a6d67b6c895953de183b1dd495.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:13:19 +0100
 Subject: [PATCH] qemu_process: Fix FD leak with multiple host devices using
 IOMMUFD
 We would open IOMMU device for each host device with IOMMUFD backend
 leaking FD except for the last one. Since we are adding only single
 iommufd object we need to open it only once.
 Fixes: 2f0999a161910e3992458902ce90d37f8b8f2642
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit d194f362f342c22731670e365e8a2681759dbc57)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_process.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 3bd81c55b3..da7a9fc11f 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7736,13 +7736,15 @@ qemuProcessOpenVfioFds(virDomainObj *vm)
             /* Open VFIO device FD */
             if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
                 return -1;
 -
 -            /* Open IOMMU FD */
 -            if (qemuProcessOpenIommuFd(vm) < 0)
 -                return -1;
         }
     }
 +    /* Open IOMMU FD */
 +    if (virDomainDefHasPCIHostdevWithIOMMUFD(vm->def) &&
 +        qemuProcessOpenIommuFd(vm) < 0) {
 +        return -1;
 +    }
 +
     return 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenIommuFd.patch
+++ b/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenIommuFd.patch
@ -0,0 +1,72 @@
 From da301bafb4eb4658a0b4aae8d8b633bc9a1ef2f9 Mon Sep 17 00:00:00 2001
 Message-ID: <da301bafb4eb4658a0b4aae8d8b633bc9a1ef2f9.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:01:35 +0100
 Subject: [PATCH] qemu_process: Refactor qemuProcessOpenIommuFd
 This will allow us reusing same code for hotplug.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ff2848827f42578115ef54a389a41798a96fd338)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_process.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index dd165512f3..71770d2099 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7676,24 +7676,23 @@ qemuProcessPrepareHostBackendChardevHotplug(virDomainObj *vm,
 /**
  * qemuProcessOpenIommuFd:
  * @vm: domain object
 - * @iommuFd: returned file descriptor
  *
  * Opens /dev/iommu file descriptor for the VM.
  *
 - * Returns: FD on success, -1 on failure
 + * Returns: 0 on success, -1 on failure
  */
 static int
 qemuProcessOpenIommuFd(virDomainObj *vm)
 {
 -    int fd = -1;
 +    qemuDomainObjPrivate *priv = vm->privateData;
     VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name);
 -    if ((fd = virIOMMUFDOpenDevice()) < 0)
 +    if ((priv->iommufd = virIOMMUFDOpenDevice()) < 0)
         return -1;
 -    VIR_DEBUG("Opened IOMMU FD %d for domain %s", fd, vm->def->name);
 -    return fd;
 +    VIR_DEBUG("Opened IOMMU FD %d for domain %s", priv->iommufd, vm->def->name);
 +    return 0;
 }
 /**
@@ -7750,7 +7749,6 @@ qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 static int
 qemuProcessOpenVfioFds(virDomainObj *vm)
 {
 -    qemuDomainObjPrivate *priv = vm->privateData;
     size_t i;
     /* Check if we have any hostdevs that need VFIO FDs */
@@ -7768,8 +7766,7 @@ qemuProcessOpenVfioFds(virDomainObj *vm)
                  return -1;
             /* Open IOMMU FD */
 -            priv->iommufd = qemuProcessOpenIommuFd(vm);
 -            if (priv->iommufd == -1)
 +            if (qemuProcessOpenIommuFd(vm) < 0)
                 return -1;
         }
     }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenVfioDeviceFd.patch
+++ b/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenVfioDeviceFd.patch
@ -0,0 +1,75 @@
 From 24f32b0d564d4c782b4a39990ef6508d9260774a Mon Sep 17 00:00:00 2001
 Message-ID: <24f32b0d564d4c782b4a39990ef6508d9260774a.1771423658.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:09:23 +0100
 Subject: [PATCH] qemu_process: Refactor qemuProcessOpenVfioDeviceFd
 This will allow us reusing same code for hotplug support.
 As part of refactor remove redundant checks.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 76b720168bee49497519bbca2147cbd65ae7fcbf)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_process.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 55cd930df8..7e32325fa0 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7698,23 +7698,21 @@ qemuProcessOpenIommuFd(virDomainObj *vm)
 /**
  * qemuProcessOpenVfioDeviceFd:
  * @hostdev: host device definition
 - * @vfioFd: returned file descriptor
  *
  * Opens the VFIO device file descriptor for a hostdev.
  *
 - * Returns: FD on success, -1 on failure
 + * Returns: 0 on success, -1 on failure
  */
 static int
 qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
 {
 -    if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS ||
 -        hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI) {
 -        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 -                       _("VFIO FD only supported for PCI hostdevs"));
 -        return -1;
 -    }
 +    qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 +    virDomainHostdevSubsysPCI *pci = &hostdev->source.subsys.u.pci;
 -    return virPCIDeviceOpenVfioFd(&hostdev->source.subsys.u.pci.addr);
 +    if ((hostdevPriv->vfioDeviceFd = virPCIDeviceOpenVfioFd(&pci->addr)) < 0)
 +        return -1;
 +
 +    return 0;
 }
 /**
@@ -7733,16 +7731,14 @@ qemuProcessOpenVfioFds(virDomainObj *vm)
     /* Check if we have any hostdevs that need VFIO FDs */
     for (i = 0; i < vm->def->nhostdevs; i++) {
         virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 -        qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
         if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
             hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI &&
             hostdev->source.subsys.u.pci.driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
             hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
             /* Open VFIO device FD */
 -            hostdevPriv->vfioDeviceFd = qemuProcessOpenVfioDeviceFd(hostdev);
 -            if (hostdevPriv->vfioDeviceFd == -1)
 -                 return -1;
 +            if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
 +                return -1;
             /* Open IOMMU FD */
             if (qemuProcessOpenIommuFd(vm) < 0)
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenVfioFds.patch
+++ b/centos-10/SOURCES/libvirt-qemu_process-Refactor-qemuProcessOpenVfioFds.patch
@ -0,0 +1,77 @@
 From a3696f1e0ba8ddf997e54fccd945593272635762 Mon Sep 17 00:00:00 2001
 Message-ID: <a3696f1e0ba8ddf997e54fccd945593272635762.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sun, 15 Feb 2026 19:15:52 +0100
 Subject: [PATCH] qemu_process: Refactor qemuProcessOpenVfioFds
 Follow our switch pattern to simplify the code logic
 and rename the function to follow our naming pattern.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit c83b4f367f23868793fc6b071771d0e641b7a546)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 src/qemu/qemu_process.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index da7a9fc11f..3729edcd7e 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -7715,27 +7715,28 @@ qemuProcessOpenVfioDeviceFd(virDomainHostdevDef *hostdev)
     return 0;
 }
 -/**
 - * qemuProcessOpenVfioFds:
 - * @vm: domain object
 - *
 - * Opens all necessary VFIO file descriptors for the domain.
 - *
 - * Returns: 0 on success, -1 on failure
 - */
 static int
 -qemuProcessOpenVfioFds(virDomainObj *vm)
 +qemuProcessPrepareHostHostdev(virDomainObj *vm)
 {
     size_t i;
 -    /* Check if we have any hostdevs that need VFIO FDs */
     for (i = 0; i < vm->def->nhostdevs; i++) {
         virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 -        if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 -            /* Open VFIO device FD */
 -            if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
 -                return -1;
 +        switch (hostdev->source.subsys.type) {
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI:
 +            if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +                /* Open VFIO device FD */
 +                if (qemuProcessOpenVfioDeviceFd(hostdev) < 0)
 +                    return -1;
 +            }
 +            break;
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI_HOST:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_LAST:
 +            break;
         }
     }
@@ -7803,7 +7804,7 @@ qemuProcessPrepareHost(virQEMUDriver *driver,
         hostdev_flags |= VIR_HOSTDEV_COLD_BOOT;
     if (qemuHostdevPrepareDomainDevices(driver, vm->def, hostdev_flags) < 0)
         return -1;
 -    if (qemuProcessOpenVfioFds(vm) < 0)
 +    if (qemuProcessPrepareHostHostdev(vm) < 0)
         return -1;
     VIR_DEBUG("Preparing chr device backends");
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemublocktest-Iterate-all-nodenames-in-testQemuDetectBitmaps.patch
+++ b/centos-10/SOURCES/libvirt-qemublocktest-Iterate-all-nodenames-in-testQemuDetectBitmaps.patch
@ -0,0 +1,175 @@
 From 65beee7622ce4f110dbd56c631502444197756e6 Mon Sep 17 00:00:00 2001
 Message-ID: <65beee7622ce4f110dbd56c631502444197756e6.1770203422.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 27 Jan 2026 22:49:09 +0100
 Subject: [PATCH] qemublocktest: Iterate all nodenames in
 'testQemuDetectBitmaps'
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rather than looking for 30 specific nodenames (via a loop) iterate
 everything in the hash table (in a sorted order). This simplifies the
 code and provides more test outputs on previously-ignored nodenames.
 The listing of internal snapshots in the output was also missing a
 newline, which would now cause problems with multiple images reproted.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 71643c197e86a3adc792c0b2a378a245ae6c5756)
 https://issues.redhat.com/browse/RHEL-145769 [rhel-10.2]
 https://issues.redhat.com/browse/RHEL-145770 [rhel-9.8]
 ---
 tests/qemublocktest.c                         | 24 +++++++------------
 tests/qemublocktestdata/bitmap/basic.out      |  1 +
 tests/qemublocktestdata/bitmap/empty.out      |  1 +
 .../bitmap/snapshots-internal.out             |  7 ++++++
 tests/qemublocktestdata/bitmap/snapshots.out  |  5 ++++
 tests/qemublocktestdata/bitmap/synthetic.out  |  5 ++++
 6 files changed, 28 insertions(+), 15 deletions(-)
 diff --git a/tests/qemublocktest.c b/tests/qemublocktest.c
 index 47746207cc..51d9268cdd 100644
 --- a/tests/qemublocktest.c
 +++ b/tests/qemublocktest.c
@@ -575,17 +575,15 @@ testQemuImageCreate(const void *opaque)
 static const char *bitmapDetectPrefix = "qemublocktestdata/bitmap/";
 -static void
 -testQemuDetectBitmapsWorker(GHashTable *nodedata,
 +static int
 +testQemuDetectBitmapsWorker(void *payload,
                             const char *nodename,
 -                            virBuffer *buf)
 +                            void *opaque)
 {
 -    qemuBlockNamedNodeData *data;
 +    qemuBlockNamedNodeData *data = payload;
 +    virBuffer *buf = opaque;
     size_t i;
 -    if (!(data = virHashLookup(nodedata, nodename)))
 -        return;
 -
     virBufferAsprintf(buf, "%s:\n", nodename);
     if (data->qcow2v2)
         virBufferAddLit(buf, " qcow2 v2\n");
@@ -617,9 +615,12 @@ testQemuDetectBitmapsWorker(GHashTable *nodedata,
             virBufferAsprintf(buf, " '%s'%s", (const char *) n->key, vms);
         }
 +
 +        virBufferAddLit(buf, "\n");
     }
     virBufferAdjustIndent(buf, -1);
 +    return 0;
 }
@@ -632,7 +633,6 @@ testQemuDetectBitmaps(const void *opaque)
     g_autofree char *actual = NULL;
     g_autofree char *expectpath = NULL;
     g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
 -    size_t i;
     expectpath = g_strdup_printf("%s/%s%s.out", abs_srcdir,
                                  bitmapDetectPrefix, name);
@@ -646,13 +646,7 @@ testQemuDetectBitmaps(const void *opaque)
         return -1;
     }
 -    /* we detect for the first 30 nodenames for simplicity */
 -    for (i = 0; i < 30; i++) {
 -        g_autofree char *nodename = g_strdup_printf("libvirt-%zu-format", i);
 -
 -        testQemuDetectBitmapsWorker(nodedata, nodename, &buf);
 -    }
 -
 +    virHashForEachSorted(nodedata, testQemuDetectBitmapsWorker, &buf);
     actual = virBufferContentAndReset(&buf);
     return virTestCompareToFile(actual, expectpath);
 diff --git a/tests/qemublocktestdata/bitmap/basic.out b/tests/qemublocktestdata/bitmap/basic.out
 index 5c4c35b3f0..b96ffe3d39 100644
 --- a/tests/qemublocktestdata/bitmap/basic.out
 +++ b/tests/qemublocktestdata/bitmap/basic.out
@@ -4,3 +4,4 @@ libvirt-1-format:
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-1-storage:
 diff --git a/tests/qemublocktestdata/bitmap/empty.out b/tests/qemublocktestdata/bitmap/empty.out
 index 3787cbd354..c9a5be4f07 100644
 --- a/tests/qemublocktestdata/bitmap/empty.out
 +++ b/tests/qemublocktestdata/bitmap/empty.out
@@ -1 +1,2 @@
 libvirt-1-format:
 +libvirt-1-storage:
 diff --git a/tests/qemublocktestdata/bitmap/snapshots-internal.out b/tests/qemublocktestdata/bitmap/snapshots-internal.out
 index dbb3cfded4..cf7bde96a5 100644
 --- a/tests/qemublocktestdata/bitmap/snapshots-internal.out
 +++ b/tests/qemublocktestdata/bitmap/snapshots-internal.out
@@ -1,2 +1,9 @@
 libvirt-1-format:
  internal snapshots: '1727868651'(*) '1727872064'(*)
 +libvirt-1-storage:
 +libvirt-2-storage:
 +libvirt-pflash0-format:
 +libvirt-pflash0-storage:
 +libvirt-pflash1-format:
 + internal snapshots: '1727868651' '1727872064'
 +libvirt-pflash1-storage:
 diff --git a/tests/qemublocktestdata/bitmap/snapshots.out b/tests/qemublocktestdata/bitmap/snapshots.out
 index 24ca27e4d8..29c586be7e 100644
 --- a/tests/qemublocktestdata/bitmap/snapshots.out
 +++ b/tests/qemublocktestdata/bitmap/snapshots.out
@@ -4,16 +4,21 @@ libvirt-1-format:
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
   current: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-1-storage:
 libvirt-2-format:
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-2-storage:
 libvirt-3-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         b: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         c: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-3-storage:
 libvirt-4-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-4-storage:
 libvirt-5-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-5-storage:
 diff --git a/tests/qemublocktestdata/bitmap/synthetic.out b/tests/qemublocktestdata/bitmap/synthetic.out
 index 45423903a0..2f4ae2b217 100644
 --- a/tests/qemublocktestdata/bitmap/synthetic.out
 +++ b/tests/qemublocktestdata/bitmap/synthetic.out
@@ -6,12 +6,17 @@ libvirt-1-format:
  top-inactive: record:0 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
  top-transient: record:1 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
  top-transient-inactive: record:0 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
 +libvirt-1-storage:
 libvirt-2-format:
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-2-storage:
 libvirt-3-format:
         b: record:1 busy:0 persist:0 inconsist:0 gran:65536 dirty:0
         c: record:0 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
         d: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-3-storage:
 libvirt-4-format:
 +libvirt-4-storage:
 libvirt-5-format:
         a: record:1 busy:0 persist:1 inconsist:0 gran:65536 dirty:0
 +libvirt-5-storage:
 -- 
 2.52.0
--- a/centos-10/SOURCES/libvirt-qemuxmlconftest-Refactor-host-device-preparation.patch
+++ b/centos-10/SOURCES/libvirt-qemuxmlconftest-Refactor-host-device-preparation.patch
@ -0,0 +1,101 @@
 From d851b46d3794d4ad2d0f9b74c0e0cf1a10d06682 Mon Sep 17 00:00:00 2001
 Message-ID: <d851b46d3794d4ad2d0f9b74c0e0cf1a10d06682.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 11:39:19 +0100
 Subject: [PATCH] qemuxmlconftest: Refactor host device preparation
 Create a single place for host device preparation code.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit cb23831c020a5fab33be417426b2746a73ecdd10)
 Conflicts:
  - missing upstream commit b97afe28f54dae1d122baa33d1a371b68775b7b2
    tests/qemuxmlconftest.c
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 tests/qemuxmlconftest.c | 59 ++++++++++++++++++++++++++++++-----------
 1 file changed, 43 insertions(+), 16 deletions(-)
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 757f0a9fc0..0c146601ed 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -378,6 +378,48 @@ testSetupHostdevPrivateData(virDomainDef *def)
 }
 +static void
 +testQemuPrepareHostdevUSB(virDomainHostdevDef *hostdev)
 +{
 +    virDomainHostdevSubsysUSB *usb = &hostdev->source.subsys.u.usb;
 +
 +    if (!usb->device && !usb->bus) {
 +        if (usb->vendor == 0x1234 && usb->product == 0x4321) {
 +            usb->bus = 42;
 +            usb->device = 0x1234;
 +        } else {
 +            g_assert_not_reached();
 +        }
 +    }
 +}
 +
 +
 +static void
 +testQemuPrepareHostdev(virDomainObj *vm)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < vm->def->nhostdevs; i++) {
 +        virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 +
 +        if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
 +            continue;
 +
 +        switch (hostdev->source.subsys.type) {
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB:
 +            testQemuPrepareHostdevUSB(hostdev);
 +            break;
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI_HOST:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV:
 +        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_LAST:
 +            break;
 +        }
 +    }
 +}
 +
 +
 static virNetworkDriver fakeNetworkDriver = {
     .networkLookupByName = fakeNetworkLookupByName,
     .networkGetXMLDesc = fakeNetworkGetXMLDesc,
@@ -524,22 +566,7 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv,
         }
     }
 -    for (i = 0; i < vm->def->nhostdevs; i++) {
 -        virDomainHostdevDef *hostdev = vm->def->hostdevs[i];
 -
 -        if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
 -            hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB) {
 -            virDomainHostdevSubsysUSB *usb = &hostdev->source.subsys.u.usb;
 -            if (!usb->device && !usb->bus) {
 -                if (usb->vendor == 0x1234 && usb->product == 0x4321) {
 -                    usb->bus = 42;
 -                    usb->device = 0x1234;
 -                } else {
 -                    g_assert_not_reached();
 -                }
 -            }
 -        }
 -    }
 +    testQemuPrepareHostdev(vm);
     if (flags & FLAG_SLIRP_HELPER) {
         for (i = 0; i < vm->def->nnets; i++) {
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemuxmlconftest-Rename-and-refactor-testSetupHostdevPrivateData.patch
+++ b/centos-10/SOURCES/libvirt-qemuxmlconftest-Rename-and-refactor-testSetupHostdevPrivateData.patch
@ -0,0 +1,78 @@
 From ef36f155015cd42f1f631d4955b76173ca16b9f3 Mon Sep 17 00:00:00 2001
 Message-ID: <ef36f155015cd42f1f631d4955b76173ca16b9f3.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 11:48:53 +0100
 Subject: [PATCH] qemuxmlconftest: Rename and refactor
 testSetupHostdevPrivateData
 There is no need to call qemuDomainHostdevPrivateNew() because
 privateData is allocated on creation by virDomainHostdevDefNew().
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 15ad45758bcb674924ddb2ebb86a767cf40b990d)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 tests/qemuxmlconftest.c | 29 +++++++----------------------
 1 file changed, 7 insertions(+), 22 deletions(-)
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index 0c146601ed..f7e50dc655 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -352,28 +352,13 @@ fakeNetworkPortGetXMLDesc(virNetworkPortPtr port,
 static void
 -testSetupHostdevPrivateData(virDomainDef *def)
 +testQemuPrepareHostdevPCI(virDomainHostdevDef *hostdev)
 {
 -    size_t i;
 +    qemuDomainHostdevPrivate *hostdevPriv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 -    for (i = 0; i < def->nhostdevs; i++) {
 -        virDomainHostdevDef *hostdev = def->hostdevs[i];
 -
 -        if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
 -            hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI &&
 -            hostdev->source.subsys.u.pci.driver.name == VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO &&
 -            hostdev->source.subsys.u.pci.driver.iommufd == VIR_TRISTATE_BOOL_YES) {
 -
 -            qemuDomainHostdevPrivate *priv;
 -
 -            if (!hostdev->privateData) {
 -                hostdev->privateData = qemuDomainHostdevPrivateNew();
 -            }
 -
 -            priv = QEMU_DOMAIN_HOSTDEV_PRIVATE(hostdev);
 -            /* Use a placeholder FD value for tests */
 -            priv->vfioDeviceFd = 0;
 -        }
 +    if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) {
 +        /* Use a placeholder FD value for tests */
 +        hostdevPriv->vfioDeviceFd = 0;
     }
 }
@@ -410,6 +395,8 @@ testQemuPrepareHostdev(virDomainObj *vm)
             testQemuPrepareHostdevUSB(hostdev);
             break;
         case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI:
 +            testQemuPrepareHostdevPCI(hostdev);
 +            break;
         case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI:
         case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI_HOST:
         case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV:
@@ -473,8 +460,6 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv,
     if (testQemuPrepareHostBackendChardevOne(NULL, priv->monConfig, vm) < 0)
         return NULL;
 -    testSetupHostdevPrivateData(vm->def);
 -
     for (i = 0; i < vm->def->ndisks; i++) {
         virDomainDiskDef *disk = vm->def->disks[i];
         virStorageSource *src;
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-qemuxmlconftest-Set-fake-FD-for-IOMMUFD.patch
+++ b/centos-10/SOURCES/libvirt-qemuxmlconftest-Set-fake-FD-for-IOMMUFD.patch
@ -0,0 +1,98 @@
 From fc19eece815873aa653d733494294f4b83a9416e Mon Sep 17 00:00:00 2001
 Message-ID: <fc19eece815873aa653d733494294f4b83a9416e.1771423659.git.jdenemar@redhat.com>
 From: Pavel Hrdina <phrdina@redhat.com>
 Date: Sat, 14 Feb 2026 17:11:44 +0100
 Subject: [PATCH] qemuxmlconftest: Set fake FD for IOMMUFD
 Same as for VFIO FD for host device.
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4a80a0468e21866d11f08bd64888f399cff98d94)
 Resolves: https://issues.redhat.com/browse/RHEL-150351
 Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
 ---
 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args          | 2 +-
 .../iommufd-virt-pci-bus-single.aarch64-latest.args           | 2 +-
 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args        | 2 +-
 tests/qemuxmlconfdata/iommufd.x86_64-latest.args              | 2 +-
 tests/qemuxmlconftest.c                                       | 4 ++++
 5 files changed, 8 insertions(+), 4 deletions(-)
 diff --git a/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args b/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
 index 7d819e141b..d5fe704021 100644
 --- a/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args
@@ -35,7 +35,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"vram64_size_mb":0,"vgamem_mb":8,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
 --object '{"qom-type":"iommufd","id":"iommufd0","fd":"-1"}' \
 +-object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x3"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args b/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
 index dbfd395168..99886468fb 100644
 --- a/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args
@@ -27,7 +27,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -no-shutdown \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
 --object '{"qom-type":"iommufd","id":"iommufd0","fd":"-1"}' \
 +-object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pcie.0","addr":"0x1"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args b/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
 index d5713ff826..e3695c6982 100644
 --- a/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args
@@ -30,7 +30,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -device '{"driver":"pcie-root-port","port":9,"chassis":2,"id":"pci.2","bus":"pcie.0","addr":"0x1.0x1"}' \
 -device '{"driver":"pcie-root-port","port":10,"chassis":3,"id":"pci.3","bus":"pcie.0","addr":"0x1.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 --object '{"qom-type":"iommufd","id":"iommufd0","fd":"-1"}' \
 +-object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.1","addr":"0x0"}' \
 -device '{"driver":"vfio-pci","host":"0000:07:12.5","id":"hostdev1","iommufd":"iommufd0","fd":"0","bus":"pci.2","addr":"0x0"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 diff --git a/tests/qemuxmlconfdata/iommufd.x86_64-latest.args b/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
 index 3130ba2e3a..15dabe197c 100644
 --- a/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
 +++ b/tests/qemuxmlconfdata/iommufd.x86_64-latest.args
@@ -28,7 +28,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -boot strict=on \
 -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 --object '{"qom-type":"iommufd","id":"iommufd0","fd":"-1"}' \
 +-object '{"qom-type":"iommufd","id":"iommufd0","fd":"0"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","iommufd":"iommufd0","fd":"0","bus":"pci.0","addr":"0x3"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
 index f7e50dc655..6f16b6cee8 100644
 --- a/tests/qemuxmlconftest.c
 +++ b/tests/qemuxmlconftest.c
@@ -382,6 +382,7 @@ testQemuPrepareHostdevUSB(virDomainHostdevDef *hostdev)
 static void
 testQemuPrepareHostdev(virDomainObj *vm)
 {
 +    qemuDomainObjPrivate *priv = QEMU_DOMAIN_PRIVATE(vm);
     size_t i;
     for (i = 0; i < vm->def->nhostdevs; i++) {
@@ -404,6 +405,9 @@ testQemuPrepareHostdev(virDomainObj *vm)
             break;
         }
     }
 +
 +    if (virDomainDefHasPCIHostdevWithIOMMUFD(vm->def))
 +        priv->iommufd = 0;
 }
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-schema-Add-firmwareFeatures-element-for-domaincaps.patch
+++ b/centos-10/SOURCES/libvirt-schema-Add-firmwareFeatures-element-for-domaincaps.patch
@ -0,0 +1,49 @@
 From e80e42974e03a8c18bda11714608271d372558ae Mon Sep 17 00:00:00 2001
 Message-ID: <e80e42974e03a8c18bda11714608271d372558ae.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 9 Feb 2026 19:18:32 +0100
 Subject: [PATCH] schema: Add firmwareFeatures element for domaincaps
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 463322ec48d48886ac38604565923cb283dca26e)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/schemas/domaincaps.rng | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng
 index 8d0380951d..3b24caeca6 100644
 --- a/src/conf/schemas/domaincaps.rng
 +++ b/src/conf/schemas/domaincaps.rng
@@ -68,6 +68,15 @@
     </element>
   </define>
 +  <define name="firmwareFeatures">
 +    <element name="firmwareFeatures">
 +      <ref name="supported"/>
 +      <optional>
 +        <ref name="enum"/>
 +      </optional>
 +    </element>
 +  </define>
 +
   <define name="loader">
     <element name="loader">
       <ref name="supported"/>
@@ -83,6 +92,9 @@
       <interleave>
         <ref name="supported"/>
         <ref name="enum"/>
 +        <optional>
 +          <ref name="firmwareFeatures"/>
 +        </optional>
         <optional>
           <ref name="loader"/>
         </optional>
 -- 
 2.53.0
--- a/centos-10/SOURCES/libvirt-schema-Introduce-osnvram-define.patch
+++ b/centos-10/SOURCES/libvirt-schema-Introduce-osnvram-define.patch
@ -0,0 +1,100 @@
 From b6ec9f3779a824879defc43172e1cc6e3aac4c29 Mon Sep 17 00:00:00 2001
 Message-ID: <b6ec9f3779a824879defc43172e1cc6e3aac4c29.1772815313.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Mon, 23 Feb 2026 13:57:32 +0100
 Subject: [PATCH] schema: Introduce osnvram define
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This moves the definition of the <nvram> element out of the
 fairly complex oshvm define and will make it easier to later
 add the <varstore> element without making things unmanageable.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit b5da97c5b9b95b8b099e1c5aa7f04c17df636e70)
 https://issues.redhat.com/browse/RHEL-82645
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/conf/schemas/domaincommon.rng | 54 +++++++++++++++++--------------
 1 file changed, 29 insertions(+), 25 deletions(-)
 diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
 index 152aa489f5..92f82c8fbf 100644
 --- a/src/conf/schemas/domaincommon.rng
 +++ b/src/conf/schemas/domaincommon.rng
@@ -349,31 +349,7 @@
             </element>
           </optional>
           <optional>
 -            <element name="nvram">
 -              <optional>
 -                <attribute name="template">
 -                  <ref name="absFilePath"/>
 -                </attribute>
 -              </optional>
 -              <optional>
 -                <attribute name="templateFormat">
 -                  <ref name="pflashFormatTypes"/>
 -                </attribute>
 -              </optional>
 -              <optional>
 -                <ref name="pflashFormat"/>
 -              </optional>
 -              <optional>
 -                <choice>
 -                  <group>
 -                    <ref name="absFilePath"/>
 -                  </group>
 -                  <group>
 -                    <ref name="diskSource"/>
 -                  </group>
 -                </choice>
 -              </optional>
 -            </element>
 +            <ref name="osnvram"/>
           </optional>
           <optional>
             <ref name="osbootkernel"/>
@@ -452,6 +428,34 @@
     </element>
   </define>
 +  <define name="osnvram">
 +    <element name="nvram">
 +      <optional>
 +        <attribute name="template">
 +          <ref name="absFilePath"/>
 +        </attribute>
 +      </optional>
 +      <optional>
 +        <attribute name="templateFormat">
 +          <ref name="pflashFormatTypes"/>
 +        </attribute>
 +      </optional>
 +      <optional>
 +        <ref name="pflashFormat"/>
 +      </optional>
 +      <optional>
 +        <choice>
 +          <group>
 +            <ref name="absFilePath"/>
 +          </group>
 +          <group>
 +            <ref name="diskSource"/>
 +          </group>
 +        </choice>
 +      </optional>
 +    </element>
 +  </define>
 +
   <define name="osexe">
     <element name="os">
       <interleave>
 -- 
 2.53.0