From f6166cab2da8f1af1ecdb08d28319e2e5159fec9 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Thu, 27 Aug 2026 19:40:24 -0300 Subject: [PATCH 1/2] chore(vm): update QEMU to 11.1.1 and kernel to 7.2.1 Bump the pinned QEMU and kernel versions and carry the guest config forward. The kernel config is committed as the fully resolved 7.2.1 config rather than letting olddefconfig reinterpret the 7.1 one on every build, because that reinterpretation silently changed the preemption model: 7.2 adds `depends on !ARCH_HAS_PREEMPT_LAZY` to PREEMPT_VOLUNTARY, which x86 sets, so the previous PREEMPT_VOLUNTARY=y became unavailable and olddefconfig fell through to full PREEMPT=y. PREEMPT_LAZY is the intended successor for that trade-off (full-preempt latency, near-voluntary throughput), so it is now pinned explicitly. PREEMPT_DYNAMIC stays on, so the model can still be overridden at runtime with preempt= on the cmdline. Verified: QEMU 11.1.1 and kernel 7.2.1 build, and a VM boots to vminitd with vsock reachable from the host. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CcXUA5oay5BiEcFKdhCEht --- Dockerfile | 2 +- Dockerfile.qemu | 2 +- Taskfile.yml | 6 +- ...{config-7.1-x86_64 => config-7.2.1-x86_64} | 207 +++++++++--------- 4 files changed, 103 insertions(+), 114 deletions(-) rename build/kernel/{config-7.1-x86_64 => config-7.2.1-x86_64} (97%) diff --git a/Dockerfile b/Dockerfile index a58d25d..94d002b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,7 +36,7 @@ RUN --mount=type=cache,sharing=locked,id=kernel-aptlib,target=/var/lib/apt \ --mount=type=cache,sharing=locked,id=kernel-aptcache,target=/var/cache/apt \ apt-get update && apt-get install -y build-essential libncurses-dev flex bison libssl-dev libelf-dev bc cpio git wget xz-utils curl lz4 -ARG KERNEL_VERSION="7.1" +ARG KERNEL_VERSION="7.2.1" ARG KERNEL_ARCH="x86_64" ARG KERNEL_NPROC="16" diff --git a/Dockerfile.qemu b/Dockerfile.qemu index 83272e4..addef69 100644 --- a/Dockerfile.qemu +++ b/Dockerfile.qemu @@ -4,7 +4,7 @@ FROM ubuntu:26.04 AS builder # Build arguments -ARG QEMU_VERSION=11.0.1 +ARG QEMU_VERSION=11.1.1 ARG JOBS=8 ARG DEBIAN_FRONTEND=noninteractive diff --git a/Taskfile.yml b/Taskfile.yml index af3eff6..3437455 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -151,7 +151,7 @@ tasks: --platform linux/amd64 \ --cache-from type=local,src={{.BUILDKIT_CACHE_INITRD}} \ --cache-to type=local,dest={{.BUILDKIT_CACHE_INITRD}},mode=max,compression=zstd \ - --build-arg KERNEL_VERSION=7.1 \ + --build-arg KERNEL_VERSION=7.2.1 \ --build-arg KERNEL_ARCH=x86_64 \ --build-arg KERNEL_NPROC=8 \ --build-arg VMINITD_CACHE_BUST="${COMMIT_SHA}" \ @@ -171,7 +171,7 @@ tasks: --platform linux/amd64 \ --cache-from type=local,src={{.BUILDKIT_CACHE_KERNEL}} \ --cache-to type=local,dest={{.BUILDKIT_CACHE_KERNEL}},mode=max,compression=zstd \ - --build-arg KERNEL_VERSION=7.1 \ + --build-arg KERNEL_VERSION=7.2.1 \ --build-arg KERNEL_ARCH=x86_64 \ --build-arg KERNEL_NPROC=8 \ --output type=local,dest={{.OUTPUT_DIR}} \ @@ -190,7 +190,7 @@ tasks: --platform linux/amd64 \ --cache-from type=local,src={{.BUILDKIT_CACHE_QEMU}} \ --cache-to type=local,dest={{.BUILDKIT_CACHE_QEMU}},mode=max,compression=zstd \ - --build-arg QEMU_VERSION=11.0.1 \ + --build-arg QEMU_VERSION=11.1.1 \ --build-arg QEMU_JOBS=8 \ --output type=local,dest={{.OUTPUT_DIR}} \ . diff --git a/build/kernel/config-7.1-x86_64 b/build/kernel/config-7.2.1-x86_64 similarity index 97% rename from build/kernel/config-7.1-x86_64 rename to build/kernel/config-7.2.1-x86_64 index 1693f16..7014b49 100644 --- a/build/kernel/config-7.1-x86_64 +++ b/build/kernel/config-7.2.1-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 6.18.0 Kernel Configuration +# Linux/x86_64 7.2.1 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (Debian 12.2.0-14+deb12u1) 12.2.0" CONFIG_CC_IS_GCC=y @@ -13,6 +13,7 @@ CONFIG_LD_VERSION=24000 CONFIG_LLD_VERSION=0 CONFIG_RUSTC_VERSION=0 CONFIG_RUSTC_LLVM_VERSION=0 +CONFIG_RUSTC_LLVM_MAJOR_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_GCC_ASM_GOTO_OUTPUT_BROKEN=y CONFIG_TOOLS_SUPPORT_RELR=y @@ -80,12 +81,15 @@ CONFIG_SPARSE_IRQ=y CONFIG_CLOCKSOURCE_WATCHDOG=y CONFIG_ARCH_CLOCKSOURCE_INIT=y -CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CLOCKEVENTS_COUPLED=y +CONFIG_GENERIC_CLOCKEVENTS_COUPLED_INLINE=y CONFIG_GENERIC_CMOS_UPDATE=y +CONFIG_HRTIMER_REARM_DEFERRED=y CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y CONFIG_CONTEXT_TRACKING=y @@ -101,7 +105,6 @@ CONFIG_NO_HZ_IDLE=y # CONFIG_NO_HZ_FULL is not set CONFIG_NO_HZ=y CONFIG_HIGH_RES_TIMERS=y -CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=125 # CONFIG_POSIX_AUX_CLOCKS is not set # end of Timers subsystem @@ -120,10 +123,8 @@ CONFIG_BPF_UNPRIV_DEFAULT_OFF=y CONFIG_PREEMPT_BUILD=y CONFIG_ARCH_HAS_PREEMPT_LAZY=y -# CONFIG_PREEMPT_NONE is not set -CONFIG_PREEMPT_VOLUNTARY=y # CONFIG_PREEMPT is not set -# CONFIG_PREEMPT_LAZY is not set +CONFIG_PREEMPT_LAZY=y # CONFIG_PREEMPT_RT is not set CONFIG_PREEMPT_COUNT=y CONFIG_PREEMPTION=y @@ -181,11 +182,13 @@ CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_HAS_INT128=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" +CONFIG_CC_MS_EXTENSIONS="-fms-extensions" CONFIG_GCC10_NO_ARRAY_BOUNDS=y CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_GCC_NO_STRINGOP_OVERFLOW=y CONFIG_CC_NO_STRINGOP_OVERFLOW=y CONFIG_ARCH_SUPPORTS_INT128=y +CONFIG_SCHED_CACHE=y CONFIG_SLAB_OBJ_EXT=y CONFIG_CGROUPS=y CONFIG_PAGE_COUNTER=y @@ -218,6 +221,7 @@ CONFIG_SOCK_CGROUP_DATA=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_TIME_NS=y +CONFIG_TIME_NS_VDSO=y CONFIG_IPC_NS=y CONFIG_USER_NS=y CONFIG_PID_NS=y @@ -235,6 +239,7 @@ CONFIG_RD_GZIP=y # CONFIG_RD_LZ4 is not set # CONFIG_RD_ZSTD is not set # CONFIG_BOOT_CONFIG is not set +CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021 CONFIG_INITRAMFS_PRESERVE_MTIME=y CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set @@ -257,6 +262,8 @@ CONFIG_ELF_CORE=y CONFIG_FUTEX=y CONFIG_FUTEX_PI=y CONFIG_FUTEX_PRIVATE_HASH=y +CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y +CONFIG_FUTEX_ROBUST_UNLOCK=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y @@ -269,7 +276,9 @@ CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y CONFIG_KCMP=y CONFIG_RSEQ=y -# CONFIG_DEBUG_RSEQ is not set +# CONFIG_RSEQ_SLICE_EXTENSION is not set +# CONFIG_RSEQ_STATS is not set +# CONFIG_RSEQ_DEBUG_DEFAULT_ENABLE is not set CONFIG_CACHESTAT_SYSCALL=y CONFIG_KALLSYMS=y # CONFIG_KALLSYMS_SELFTEST is not set @@ -294,8 +303,13 @@ CONFIG_TRACEPOINTS=y CONFIG_VMCORE_INFO=y # CONFIG_KEXEC is not set # CONFIG_KEXEC_FILE is not set -# CONFIG_KEXEC_HANDOVER is not set # end of Kexec and crash features + +# +# Live Update and Kexec HandOver +# +# CONFIG_KEXEC_HANDOVER is not set +# end of Live Update and Kexec HandOver # end of General setup CONFIG_64BIT=y @@ -344,7 +358,6 @@ CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y CONFIG_SCHED_OMIT_FRAME_POINTER=y CONFIG_HYPERVISOR_GUEST=y CONFIG_PARAVIRT=y -# CONFIG_PARAVIRT_DEBUG is not set # CONFIG_PARAVIRT_SPINLOCKS is not set CONFIG_X86_HV_CALLBACK_VECTOR=y # CONFIG_XEN is not set @@ -369,12 +382,12 @@ CONFIG_X86_DEBUGCTLMSR=y CONFIG_IA32_FEAT_CTL=y CONFIG_X86_VMX_FEATURE_NAMES=y # CONFIG_PROCESSOR_SELECT is not set -CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_CPU_SUP_INTEL=y CONFIG_CPU_SUP_AMD=y CONFIG_CPU_SUP_HYGON=y CONFIG_CPU_SUP_CENTAUR=y CONFIG_CPU_SUP_ZHAOXIN=y +CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_HPET_TIMER=y CONFIG_HPET_EMULATE_RTC=y CONFIG_DMI=y @@ -472,6 +485,7 @@ CONFIG_LEGACY_VSYSCALL_XONLY=y CONFIG_MODIFY_LDT_SYSCALL=y # CONFIG_STRICT_SIGALTSTACK_SIZE is not set CONFIG_HAVE_LIVEPATCH=y +CONFIG_HAVE_KLP_BUILD=y CONFIG_X86_BUS_LOCK_DETECT=y # end of Processor type and features @@ -486,7 +500,6 @@ CONFIG_FUNCTION_PADDING_BYTES=16 CONFIG_CALL_PADDING=y CONFIG_HAVE_CALL_THUNKS=y CONFIG_CALL_THUNKS=y -CONFIG_PREFIX_SYMBOLS=y CONFIG_CPU_MITIGATIONS=y CONFIG_MITIGATION_PAGE_TABLE_ISOLATION=y CONFIG_MITIGATION_RETPOLINE=y @@ -519,6 +532,7 @@ CONFIG_ARCH_HAS_ADD_PAGES=y # # CONFIG_SUSPEND is not set # CONFIG_HIBERNATION is not set +# CONFIG_PM_QOS_CPU_SYSTEM_WAKEUP is not set CONFIG_PM=y # CONFIG_PM_DEBUG is not set # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set @@ -528,7 +542,6 @@ CONFIG_ACPI=y CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y -CONFIG_ACPI_THERMAL_LIB=y # CONFIG_ACPI_DEBUGGER is not set CONFIG_ACPI_SPCR_TABLE=y # CONFIG_ACPI_FPDT is not set @@ -549,6 +562,7 @@ CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_HOTPLUG_CPU=y # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set # CONFIG_ACPI_THERMAL is not set +CONFIG_ACPI_PLATFORM_PROFILE=y CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set @@ -647,6 +661,7 @@ CONFIG_X86_REQUIRED_FEATURE_ALWAYS=y CONFIG_X86_REQUIRED_FEATURE_NOPL=y CONFIG_X86_REQUIRED_FEATURE_CX8=y CONFIG_X86_REQUIRED_FEATURE_CMOV=y +CONFIG_X86_REQUIRED_FEATURE_SYSFAST32=y CONFIG_X86_REQUIRED_FEATURE_CPUID=y CONFIG_X86_REQUIRED_FEATURE_FPU=y CONFIG_X86_REQUIRED_FEATURE_PAE=y @@ -721,6 +736,7 @@ CONFIG_ARCH_HAS_CPU_PASID=y CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y CONFIG_ARCH_WANTS_NO_INSTR=y +CONFIG_ARCH_MEMORY_ORDER_TSO=y CONFIG_HAVE_ASM_MODVERSIONS=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_RSEQ=y @@ -731,6 +747,8 @@ CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y CONFIG_HAVE_USER_RETURN_NOTIFIER=y CONFIG_HAVE_PERF_EVENTS_NMI=y CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y +CONFIG_UNWIND_USER=y +CONFIG_HAVE_UNWIND_USER_FP=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y @@ -758,14 +776,13 @@ CONFIG_STACKPROTECTOR_STRONG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y -CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG=y -CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG=y CONFIG_ARCH_SUPPORTS_CFI=y CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y CONFIG_HAVE_CONTEXT_TRACKING_USER=y CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y +CONFIG_HAVE_PV_STEAL_CLOCK_GEN=y CONFIG_HAVE_MOVE_PUD=y CONFIG_HAVE_MOVE_PMD=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y @@ -868,6 +885,7 @@ CONFIG_EFI_PARTITION=y # end of Partition Types CONFIG_BLK_PM=y +# CONFIG_BLK_ERROR_INJECTION is not set # # IO Schedulers @@ -942,8 +960,7 @@ CONFIG_SLAB_MERGE_DEFAULT=y # CONFIG_SLAB_FREELIST_HARDENED is not set # CONFIG_SLAB_BUCKETS is not set # CONFIG_SLUB_STATS is not set -CONFIG_SLUB_CPU_PARTIAL=y -# CONFIG_RANDOM_KMALLOC_CACHES is not set +# CONFIG_KMALLOC_PARTITION_CACHES is not set # end of Slab allocator options # CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set @@ -964,8 +981,8 @@ CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y CONFIG_SPLIT_PTE_PTLOCKS=y CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y CONFIG_SPLIT_PMD_PTLOCKS=y -CONFIG_MEMORY_BALLOON=y -CONFIG_BALLOON_COMPACTION=y +CONFIG_BALLOON=y +CONFIG_BALLOON_MIGRATION=y CONFIG_COMPACTION=y CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 CONFIG_PAGE_REPORTING=y @@ -987,12 +1004,20 @@ CONFIG_TRANSPARENT_HUGEPAGE=y # CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y # CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set +CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_NEVER=y +# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS is not set +# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_WITHIN_SIZE is not set +# CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ADVISE is not set +CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER=y +# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS is not set +# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set +# CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE is not set CONFIG_THP_SWAP=y -# CONFIG_READ_ONLY_THP_FOR_FS is not set # CONFIG_NO_PAGE_MAPCOUNT is not set CONFIG_PAGE_MAPCOUNT=y CONFIG_PGTABLE_HAS_HUGE_LEAVES=y CONFIG_HAVE_GIGANTIC_FOLIOS=y +CONFIG_ASYNC_KERNEL_PGTABLE_FREE=y CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y @@ -1027,7 +1052,6 @@ CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y CONFIG_IOMMU_MM_DATA=y CONFIG_EXECMEM=y -CONFIG_ARCH_SUPPORTS_PT_RECLAIM=y CONFIG_PT_RECLAIM=y # @@ -1117,7 +1141,6 @@ CONFIG_TCP_CONG_CUBIC=y CONFIG_DEFAULT_CUBIC=y # CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_TCP_CONG="cubic" -CONFIG_TCP_SIGPOOL=y # CONFIG_TCP_AO is not set CONFIG_TCP_MD5SIG=y CONFIG_IPV6=y @@ -1175,7 +1198,6 @@ CONFIG_NF_CONNTRACK_SECMARK=y # CONFIG_NF_CONNTRACK_TIMESTAMP is not set # CONFIG_NF_CONNTRACK_LABELS is not set CONFIG_NF_CT_PROTO_SCTP=y -CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_AMANDA is not set CONFIG_NF_CONNTRACK_FTP=y # CONFIG_NF_CONNTRACK_H323 is not set @@ -1457,7 +1479,6 @@ CONFIG_VLAN_8021Q=y # CONFIG_VLAN_8021Q_MVRP is not set CONFIG_LLC=y # CONFIG_LLC2 is not set -# CONFIG_ATALK is not set # CONFIG_X25 is not set # CONFIG_LAPB is not set # CONFIG_PHONET is not set @@ -1580,7 +1601,6 @@ CONFIG_NET_FLOW_LIMIT=y # end of Network testing # end of Networking options -# CONFIG_HAMRADIO is not set # CONFIG_CAN is not set # CONFIG_BT is not set # CONFIG_AF_RXRPC is not set @@ -1593,7 +1613,6 @@ CONFIG_NET_9P=y CONFIG_NET_9P_FD=y CONFIG_NET_9P_VIRTIO=y # CONFIG_NET_9P_DEBUG is not set -# CONFIG_CAIF is not set # CONFIG_CEPH_LIB is not set # CONFIG_NFC is not set # CONFIG_PSAMPLE is not set @@ -1630,6 +1649,7 @@ CONFIG_PCI_QUIRKS=y # CONFIG_PCI_DEBUG is not set # CONFIG_PCI_STUB is not set CONFIG_PCI_ATS=y +# CONFIG_PCI_TSM is not set # CONFIG_PCI_DOE is not set CONFIG_PCI_LOCKLESS_CONFIG=y # CONFIG_PCI_IOV is not set @@ -1637,11 +1657,6 @@ CONFIG_PCI_PRI=y CONFIG_PCI_PASID=y # CONFIG_PCIE_TPH is not set CONFIG_PCI_LABEL=y -# CONFIG_PCIE_BUS_TUNE_OFF is not set -CONFIG_PCIE_BUS_DEFAULT=y -# CONFIG_PCIE_BUS_SAFE is not set -# CONFIG_PCIE_BUS_PERFORMANCE is not set -# CONFIG_PCIE_BUS_PEER2PEER is not set CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 CONFIG_HOTPLUG_PCI=y @@ -1690,7 +1705,7 @@ CONFIG_HOTPLUG_PCI=y # CONFIG_PCI_SW_SWITCHTEC is not set # end of PCI switch controller drivers -# CONFIG_PCI_PWRCTRL_SLOT is not set +# CONFIG_PCI_PWRCTRL_GENERIC is not set # CONFIG_CXL_BUS is not set # CONFIG_PCCARD is not set # CONFIG_RAPIDIO is not set @@ -1699,10 +1714,12 @@ CONFIG_HOTPLUG_PCI=y # # Generic Driver Options # +CONFIG_AUXILIARY_BUS=y # CONFIG_UEVENT_HELPER is not set CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y # CONFIG_DEVTMPFS_SAFE is not set +CONFIG_DRIVER_DEFERRED_PROBE_TIMEOUT=0 CONFIG_STANDALONE=y CONFIG_PREVENT_FIRMWARE_BUILD=y @@ -1736,11 +1753,6 @@ CONFIG_DMA_SHARED_BUFFER=y # CONFIG_MHI_BUS_EP is not set # end of Bus devices -# -# Cache Drivers -# -# end of Cache Drivers - CONFIG_CONNECTOR=y CONFIG_PROC_EVENTS=y @@ -1817,6 +1829,7 @@ CONFIG_VIRTIO_BLK=y # CONFIG_DUMMY_IRQ is not set # CONFIG_IBM_ASM is not set # CONFIG_PHANTOM is not set +# CONFIG_RPMB is not set # CONFIG_TIFM_CORE is not set # CONFIG_ENCLOSURE_SERVICES is not set # CONFIG_HP_ILO is not set @@ -1842,6 +1855,7 @@ CONFIG_EEPROM_93CX6=y CONFIG_INTEL_MEI=y CONFIG_INTEL_MEI_ME=y # CONFIG_INTEL_MEI_TXE is not set +# CONFIG_INTEL_MEI_CSC is not set # CONFIG_VMWARE_VMCI is not set # CONFIG_GENWQE is not set # CONFIG_BCM_VK is not set @@ -1969,7 +1983,6 @@ CONFIG_NET_CORE=y CONFIG_MACVLAN=y # CONFIG_MACVTAP is not set # CONFIG_IPVLAN is not set -# CONFIG_IPVTAP is not set CONFIG_VXLAN=y # CONFIG_GENEVE is not set # CONFIG_BAREUDP is not set @@ -1992,7 +2005,8 @@ CONFIG_ETHERNET=y # CONFIG_NET_VENDOR_ADAPTEC is not set # CONFIG_NET_VENDOR_AGERE is not set # CONFIG_NET_VENDOR_ALACRITECH is not set -# CONFIG_NET_VENDOR_ALTEON is not set +CONFIG_NET_VENDOR_ALIBABA=y +# CONFIG_ALIBABA_EEA is not set # CONFIG_ALTERA_TSE is not set CONFIG_NET_VENDOR_AMAZON=y # CONFIG_ENA_ETHERNET is not set @@ -2009,7 +2023,6 @@ CONFIG_NET_VENDOR_AMAZON=y # CONFIG_NET_VENDOR_CISCO is not set # CONFIG_NET_VENDOR_CORTINA is not set # CONFIG_NET_VENDOR_DAVICOM is not set -# CONFIG_DNET is not set # CONFIG_NET_VENDOR_DEC is not set # CONFIG_NET_VENDOR_DLINK is not set # CONFIG_NET_VENDOR_EMULEX is not set @@ -2032,16 +2045,16 @@ CONFIG_NET_VENDOR_META=y # CONFIG_NET_VENDOR_MICROCHIP is not set # CONFIG_NET_VENDOR_MICROSEMI is not set # CONFIG_NET_VENDOR_MICROSOFT is not set +CONFIG_NET_VENDOR_MUCSE=y +# CONFIG_MGBE is not set # CONFIG_NET_VENDOR_MYRI is not set # CONFIG_FEALNX is not set # CONFIG_NET_VENDOR_NI is not set # CONFIG_NET_VENDOR_NATSEMI is not set -# CONFIG_NET_VENDOR_NETERION is not set # CONFIG_NET_VENDOR_NETRONOME is not set # CONFIG_NET_VENDOR_NVIDIA is not set # CONFIG_NET_VENDOR_OKI is not set # CONFIG_ETHOC is not set -# CONFIG_NET_VENDOR_PACKET_ENGINES is not set # CONFIG_NET_VENDOR_PENSANDO is not set # CONFIG_NET_VENDOR_QLOGIC is not set # CONFIG_NET_VENDOR_BROCADE is not set @@ -2068,16 +2081,16 @@ CONFIG_NET_VENDOR_META=y # CONFIG_NET_VENDOR_WIZNET is not set # CONFIG_NET_VENDOR_XILINX is not set # CONFIG_FDDI is not set -# CONFIG_HIPPI is not set -CONFIG_MDIO_BUS=y CONFIG_PHYLIB=y CONFIG_SWPHY=y +CONFIG_PHY_PACKAGE=y CONFIG_FIXED_PHY=y # # MII PHY device drivers # # CONFIG_AS21XXX_PHY is not set +# CONFIG_AIR_AN8801_PHY is not set # CONFIG_AIR_EN8811H_PHY is not set # CONFIG_AMD_PHY is not set # CONFIG_ADIN_PHY is not set @@ -2135,6 +2148,7 @@ CONFIG_FWNODE_MDIO=y CONFIG_ACPI_MDIO=y # CONFIG_MDIO_BITBANG is not set # CONFIG_MDIO_BCM_UNIMAC is not set +# CONFIG_MDIO_MSCC_MIIM is not set # CONFIG_MDIO_THUNDER is not set # @@ -2166,7 +2180,6 @@ CONFIG_ACPI_MDIO=y # CONFIG_FUJITSU_ES is not set # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=y -# CONFIG_ISDN is not set # # Input device support @@ -2175,7 +2188,6 @@ CONFIG_INPUT=y CONFIG_INPUT_FF_MEMLESS=y CONFIG_INPUT_SPARSEKMAP=y # CONFIG_INPUT_MATRIXKMAP is not set -CONFIG_INPUT_VIVALDIFMAP=y # # Userland interfaces @@ -2209,7 +2221,6 @@ CONFIG_SERIO=y CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y # CONFIG_SERIO_I8042 is not set CONFIG_SERIO_SERPORT=y -# CONFIG_SERIO_CT82C710 is not set # CONFIG_SERIO_PCIPS2 is not set CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_RAW is not set @@ -2239,7 +2250,6 @@ CONFIG_LDISC_AUTOLOAD=y # CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y -CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y CONFIG_SERIAL_8250_PNP=y # CONFIG_SERIAL_8250_16550A_VARIANTS is not set # CONFIG_SERIAL_8250_FINTEK is not set @@ -2251,18 +2261,18 @@ CONFIG_SERIAL_8250_EXAR=y CONFIG_SERIAL_8250_NR_UARTS=32 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 CONFIG_SERIAL_8250_EXTENDED=y -CONFIG_SERIAL_8250_MANY_PORTS=y -# CONFIG_SERIAL_8250_PCI1XXXX is not set CONFIG_SERIAL_8250_SHARE_IRQ=y CONFIG_SERIAL_8250_DETECT_IRQ=y CONFIG_SERIAL_8250_RSA=y -CONFIG_SERIAL_8250_DWLIB=y +CONFIG_SERIAL_8250_MANY_PORTS=y +# CONFIG_SERIAL_8250_PCI1XXXX is not set # CONFIG_SERIAL_8250_DW is not set # CONFIG_SERIAL_8250_RT288X is not set CONFIG_SERIAL_8250_LPSS=y CONFIG_SERIAL_8250_MID=y CONFIG_SERIAL_8250_PERICOM=y # CONFIG_SERIAL_8250_NI is not set +CONFIG_SERIAL_8250_DWLIB=y # # Non-8250 serial port support @@ -2302,8 +2312,6 @@ CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_VIA=y CONFIG_HW_RANDOM_VIRTIO=y # CONFIG_HW_RANDOM_XIPHERA is not set -# CONFIG_APPLICOM is not set -# CONFIG_MWAVE is not set CONFIG_DEVMEM=y CONFIG_NVRAM=y CONFIG_DEVPORT=y @@ -2363,6 +2371,7 @@ CONFIG_GPIOLIB_LEGACY=y # CONFIG_W1 is not set CONFIG_POWER_RESET=y CONFIG_POWER_RESET_RESTART=y +# CONFIG_POWER_RESET_QEMU_VIRT_CTRL is not set # CONFIG_POWER_SEQUENCING is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set @@ -2464,7 +2473,6 @@ CONFIG_WATCHDOG_OPEN_TIMEOUT=0 # CONFIG_W83627HF_WDT is not set # CONFIG_W83877F_WDT is not set # CONFIG_W83977F_WDT is not set -# CONFIG_MACHZ_WDT is not set # CONFIG_SBC_EPX_C3_WATCHDOG is not set # CONFIG_INTEL_MEI_WDT is not set # CONFIG_NI903X_WDT is not set @@ -2518,7 +2526,6 @@ CONFIG_BCMA_POSSIBLE=y CONFIG_SCREEN_INFO=y # CONFIG_AUXDISPLAY is not set # CONFIG_AGP is not set -# CONFIG_VGA_SWITCHEROO is not set # CONFIG_DRM is not set # @@ -2592,10 +2599,10 @@ CONFIG_HID_GENERIC=y # CONFIG_HID_TWINHAN is not set # CONFIG_HID_KENSINGTON is not set # CONFIG_HID_LCPOWER is not set -# CONFIG_HID_LENOVO is not set # CONFIG_HID_MAGICMOUSE is not set # CONFIG_HID_MALTRON is not set # CONFIG_HID_MAYFLASH is not set +# CONFIG_HID_RAKK is not set # CONFIG_HID_REDRAGON is not set # CONFIG_HID_MICROSOFT is not set # CONFIG_HID_MONTEREY is not set @@ -2755,6 +2762,7 @@ CONFIG_DMA_ACPI=y # CONFIG_INTEL_IDXD_COMPAT is not set # CONFIG_INTEL_IOATDMA is not set # CONFIG_PLX_DMA is not set +# CONFIG_SWITCHTEC_DMA is not set # CONFIG_XILINX_DMA is not set # CONFIG_XILINX_XDMA is not set # CONFIG_AMD_PTDMA is not set @@ -2781,11 +2789,8 @@ CONFIG_HSU_DMA=y CONFIG_SYNC_FILE=y # CONFIG_SW_SYNC is not set # CONFIG_UDMABUF is not set -# CONFIG_DMABUF_MOVE_NOTIFY is not set # CONFIG_DMABUF_DEBUG is not set -# CONFIG_DMABUF_SELFTESTS is not set # CONFIG_DMABUF_HEAPS is not set -# CONFIG_DMABUF_SYSFS_STATS is not set # end of DMABUF options # CONFIG_UIO is not set @@ -2826,6 +2831,7 @@ CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y # CONFIG_GREYBUS is not set # CONFIG_COMEDI is not set +# CONFIG_GPIB is not set # CONFIG_STAGING is not set # CONFIG_GOLDFISH is not set # CONFIG_CHROME_PLATFORMS is not set @@ -2834,10 +2840,8 @@ CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_GPE is not set # CONFIG_SURFACE_PRO3_BUTTON is not set CONFIG_X86_PLATFORM_DEVICES=y -CONFIG_ACPI_WMI=y -# CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set CONFIG_WMI_BMOF=y -# CONFIG_HUAWEI_WMI is not set +# CONFIG_X86_PLATFORM_DRIVERS_UNIWILL is not set # CONFIG_MXM_WMI is not set # CONFIG_XIAOMI_WMI is not set # CONFIG_REDMI_WMI is not set @@ -2882,6 +2886,7 @@ CONFIG_WMI_BMOF=y # CONFIG_INTEL_UNCORE_FREQ_CONTROL is not set # end of Intel Uncore Frequency Control +# CONFIG_INTEL_EHL_PSE_IO is not set # CONFIG_INTEL_PUNIT_IPC is not set # CONFIG_INTEL_RST is not set # CONFIG_INTEL_SMARTCONNECT is not set @@ -2891,15 +2896,12 @@ CONFIG_WMI_BMOF=y # CONFIG_LENOVO_WMI_CAMERA is not set # CONFIG_THINKPAD_LMI is not set # CONFIG_LENOVO_WMI_GAMEZONE is not set -# CONFIG_LENOVO_WMI_TUNING is not set # CONFIG_ACPI_QUICKSTART is not set -# CONFIG_MSI_EC is not set # CONFIG_SAMSUNG_Q10 is not set # CONFIG_TOSHIBA_BT_RFKILL is not set # CONFIG_TOSHIBA_HAPS is not set # CONFIG_TOSHIBA_WMI is not set # CONFIG_ACPI_CMPC is not set -# CONFIG_LG_LAPTOP is not set # CONFIG_TOPSTAR_LAPTOP is not set # CONFIG_INSPUR_PLATFORM_PROFILE is not set # CONFIG_INTEL_IPS is not set @@ -2908,6 +2910,8 @@ CONFIG_WMI_BMOF=y # CONFIG_SIEMENS_SIMATIC_IPC is not set # CONFIG_WINMATE_FM07_KEYS is not set # CONFIG_TUXEDO_NB04_WMI_AB is not set +CONFIG_ACPI_WMI=y +# CONFIG_ACPI_WMI_LEGACY_DEVICE_NAMES is not set # CONFIG_COMMON_CLK is not set # CONFIG_HWSPINLOCK is not set @@ -2928,7 +2932,6 @@ CONFIG_IOMMU_SUPPORT=y # # Generic IOMMU Pagetable Support # -CONFIG_IOMMU_IO_PGTABLE=y # end of Generic IOMMU Pagetable Support # CONFIG_IOMMU_DEBUGFS is not set @@ -2943,12 +2946,18 @@ CONFIG_DMAR_TABLE=y CONFIG_INTEL_IOMMU=y # CONFIG_INTEL_IOMMU_SVM is not set # CONFIG_INTEL_IOMMU_DEFAULT_ON is not set -CONFIG_INTEL_IOMMU_FLOPPY_WA=y CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON=y CONFIG_INTEL_IOMMU_PERF_EVENTS=y # CONFIG_IOMMUFD is not set # CONFIG_IRQ_REMAP is not set CONFIG_VIRTIO_IOMMU=y +CONFIG_GENERIC_PT=y +# CONFIG_DEBUG_GENERIC_PT is not set +CONFIG_IOMMU_PT=y +CONFIG_IOMMU_PT_AMDV1=y +CONFIG_IOMMU_PT_VTDSS=y +# CONFIG_IOMMU_PT_RISCV64 is not set +CONFIG_IOMMU_PT_X86_64=y # # Remoteproc drivers @@ -3062,8 +3071,8 @@ CONFIG_IRQ_MSI_LIB=y # PHY Subsystem # # CONFIG_GENERIC_PHY is not set -# CONFIG_USB_LGM_PHY is not set # CONFIG_PHY_CAN_TRANSCEIVER is not set +# CONFIG_USB_LGM_PHY is not set # # PHY drivers for Broadcom platforms @@ -3071,9 +3080,9 @@ CONFIG_IRQ_MSI_LIB=y # CONFIG_BCM_KONA_USB2_PHY is not set # end of PHY drivers for Broadcom platforms +# CONFIG_PHY_INTEL_LGM_EMMC is not set # CONFIG_PHY_PXA_28NM_HSIC is not set # CONFIG_PHY_PXA_28NM_USB2 is not set -# CONFIG_PHY_INTEL_LGM_EMMC is not set # end of PHY Subsystem # CONFIG_POWERCAP is not set @@ -3115,6 +3124,7 @@ CONFIG_NVMEM_SYSFS=y # CONFIG_FPGA is not set # CONFIG_TEE is not set +# CONFIG_MUX_CORE is not set # CONFIG_SIOX is not set # CONFIG_SLIMBUS is not set # CONFIG_INTERCONNECT is not set @@ -3206,8 +3216,8 @@ CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_FAT_DEFAULT_UTF8 is not set # CONFIG_EXFAT_FS is not set -# CONFIG_NTFS3_FS is not set # CONFIG_NTFS_FS is not set +# CONFIG_NTFS3_FS is not set # end of DOS/FAT/EXFAT/NT Filesystems # @@ -3265,11 +3275,12 @@ CONFIG_EROFS_FS_SECURITY=y CONFIG_EROFS_FS_BACKED_BY_FILE=y CONFIG_EROFS_FS_ZIP=y CONFIG_EROFS_FS_ZIP_LZMA=y +CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS=16 CONFIG_EROFS_FS_ZIP_DEFLATE=y CONFIG_EROFS_FS_ZIP_ZSTD=y # CONFIG_EROFS_FS_ZIP_ACCEL is not set -# CONFIG_EROFS_FS_ONDEMAND is not set # CONFIG_EROFS_FS_PCPU_KTHREAD is not set +# CONFIG_EROFS_FS_PAGE_CACHE_SHARE is not set CONFIG_NETWORK_FILESYSTEMS=y # CONFIG_NFS_FS is not set # CONFIG_NFSD is not set @@ -3411,10 +3422,8 @@ CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y -CONFIG_CRYPTO_RNG_DEFAULT=y CONFIG_CRYPTO_AKCIPHER2=y CONFIG_CRYPTO_AKCIPHER=y -CONFIG_CRYPTO_KPP2=y CONFIG_CRYPTO_ACOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y @@ -3436,20 +3445,19 @@ CONFIG_CRYPTO_RSA=y # CONFIG_CRYPTO_ECDH is not set # CONFIG_CRYPTO_ECDSA is not set # CONFIG_CRYPTO_ECRDSA is not set +# CONFIG_CRYPTO_MLDSA is not set # end of Public-key cryptography # # Block ciphers # CONFIG_CRYPTO_AES=y -# CONFIG_CRYPTO_AES_TI is not set # CONFIG_CRYPTO_ARIA is not set # CONFIG_CRYPTO_BLOWFISH is not set # CONFIG_CRYPTO_CAMELLIA is not set # CONFIG_CRYPTO_CAST5 is not set # CONFIG_CRYPTO_CAST6 is not set # CONFIG_CRYPTO_DES is not set -# CONFIG_CRYPTO_FCRYPT is not set # CONFIG_CRYPTO_SERPENT is not set # CONFIG_CRYPTO_SM4_GENERIC is not set # CONFIG_CRYPTO_TWOFISH is not set @@ -3466,7 +3474,6 @@ CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_ECB=y # CONFIG_CRYPTO_HCTR2 is not set # CONFIG_CRYPTO_LRW is not set -# CONFIG_CRYPTO_PCBC is not set # CONFIG_CRYPTO_XTS is not set # end of Length-preserving ciphers and modes @@ -3488,17 +3495,15 @@ CONFIG_CRYPTO_ECHAINIV=y # # CONFIG_CRYPTO_BLAKE2B is not set CONFIG_CRYPTO_CMAC=y -CONFIG_CRYPTO_GHASH=y CONFIG_CRYPTO_HMAC=y # CONFIG_CRYPTO_MD4 is not set CONFIG_CRYPTO_MD5=y -# CONFIG_CRYPTO_MICHAEL_MIC is not set # CONFIG_CRYPTO_RMD160 is not set CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_SHA3=y -# CONFIG_CRYPTO_SM3_GENERIC is not set +# CONFIG_CRYPTO_SM3 is not set # CONFIG_CRYPTO_STREEBOG is not set # CONFIG_CRYPTO_WP512 is not set # CONFIG_CRYPTO_XCBC is not set @@ -3526,11 +3531,6 @@ CONFIG_CRYPTO_LZO=y # # Random number generation # -# CONFIG_CRYPTO_ANSI_CPRNG is not set -CONFIG_CRYPTO_DRBG_MENU=y -CONFIG_CRYPTO_DRBG_HMAC=y -# CONFIG_CRYPTO_DRBG_HASH is not set -# CONFIG_CRYPTO_DRBG_CTR is not set CONFIG_CRYPTO_DRBG=y CONFIG_CRYPTO_JITTERENTROPY=y CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64 @@ -3539,13 +3539,13 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # end of Random number generation # -# Userspace interface +# Userspace interface (deprecated) # # CONFIG_CRYPTO_USER_API_HASH is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set -# end of Userspace interface +# end of Userspace interface (deprecated) # # Accelerated Cryptographic Algorithms for CPU (x86) @@ -3557,7 +3557,6 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set # CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set -# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set # CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set # CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set @@ -3570,11 +3569,6 @@ CONFIG_CRYPTO_JITTERENTROPY_OSR=1 # CONFIG_CRYPTO_ARIA_AESNI_AVX2_X86_64 is not set # CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64 is not set # CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set -# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set -# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set -# CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set -# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set -# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set # end of Accelerated Cryptographic Algorithms for CPU (x86) CONFIG_CRYPTO_HW=y @@ -3618,6 +3612,7 @@ CONFIG_BINARY_PRINTF=y # # CONFIG_PACKING is not set CONFIG_BITREVERSE=y +CONFIG_GENERIC_BITREVERSE=y CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y @@ -3632,15 +3627,14 @@ CONFIG_CRC16=y CONFIG_CRC32=y CONFIG_CRC32_ARCH=y CONFIG_CRC_OPTIMIZATIONS=y - -# -# Crypto library routines -# CONFIG_CRYPTO_HASH_INFO=y CONFIG_CRYPTO_LIB_UTILS=y CONFIG_CRYPTO_LIB_AES=y -CONFIG_CRYPTO_LIB_GF128MUL=y +CONFIG_CRYPTO_LIB_AES_ARCH=y +CONFIG_CRYPTO_LIB_AES_CBC_MACS=y CONFIG_CRYPTO_LIB_BLAKE2S_ARCH=y +CONFIG_CRYPTO_LIB_GF128HASH=y +CONFIG_CRYPTO_LIB_GF128HASH_ARCH=y CONFIG_CRYPTO_LIB_MD5=y CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 CONFIG_CRYPTO_LIB_SHA1=y @@ -3649,8 +3643,7 @@ CONFIG_CRYPTO_LIB_SHA256=y CONFIG_CRYPTO_LIB_SHA256_ARCH=y CONFIG_CRYPTO_LIB_SHA512=y CONFIG_CRYPTO_LIB_SHA512_ARCH=y -# end of Crypto library routines - +CONFIG_CRYPTO_LIB_SHA3=y CONFIG_XXHASH=y # CONFIG_RANDOM32_SELFTEST is not set CONFIG_ZLIB_INFLATE=y @@ -3671,12 +3664,6 @@ CONFIG_XZ_DEC_MICROLZMA=y CONFIG_XZ_DEC_BCJ=y # CONFIG_XZ_DEC_TEST is not set CONFIG_DECOMPRESS_GZIP=y -CONFIG_DECOMPRESS_BZIP2=y -CONFIG_DECOMPRESS_LZMA=y -CONFIG_DECOMPRESS_XZ=y -CONFIG_DECOMPRESS_LZO=y -CONFIG_DECOMPRESS_LZ4=y -CONFIG_DECOMPRESS_ZSTD=y CONFIG_GENERIC_ALLOCATOR=y CONFIG_INTERVAL_TREE=y CONFIG_XARRAY_MULTI=y @@ -3699,7 +3686,6 @@ CONFIG_SGL_ALLOC=y CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y -# CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y CONFIG_CLZ_TAB=y # CONFIG_IRQ_POLL is not set @@ -3742,6 +3728,7 @@ CONFIG_DYNAMIC_DEBUG=y CONFIG_DYNAMIC_DEBUG_CORE=y CONFIG_SYMBOLIC_ERRNAME=y CONFIG_DEBUG_BUGVERBOSE=y +# CONFIG_DEBUG_BUGVERBOSE_DETAILED is not set # end of printk and dmesg options CONFIG_DEBUG_KERNEL=y @@ -3778,7 +3765,6 @@ CONFIG_MAGIC_SYSRQ_SERIAL=y CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" CONFIG_DEBUG_FS=y CONFIG_DEBUG_FS_ALLOW_ALL=y -# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set # CONFIG_DEBUG_FS_ALLOW_NONE is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set @@ -3866,6 +3852,7 @@ CONFIG_SCHEDSTATS=y # end of Scheduler Debugging # CONFIG_DEBUG_PREEMPT is not set +# CONFIG_DEBUG_ATOMIC is not set # # Lock Debugging (spinlocks, mutexes, etc...) @@ -3890,7 +3877,6 @@ CONFIG_LOCK_DEBUGGING_SUPPORT=y # CONFIG_NMI_CHECK_CPU is not set # CONFIG_DEBUG_IRQFLAGS is not set CONFIG_STACKTRACE=y -# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set # @@ -3931,6 +3917,7 @@ CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS=y CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_JMP=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_OBJTOOL_MCOUNT=y @@ -3978,7 +3965,9 @@ CONFIG_PROBE_EVENTS=y # CONFIG_FTRACE_STARTUP_TEST is not set # CONFIG_RING_BUFFER_STARTUP_TEST is not set # CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set +# CONFIG_RING_BUFFER_PERSISTENT_INJECT is not set # CONFIG_RV is not set +# CONFIG_TRACE_REMOTE_TEST is not set CONFIG_PROVIDE_OHCI1394_DMA_INIT=y # CONFIG_SAMPLES is not set CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y @@ -4025,7 +4014,6 @@ CONFIG_ARCH_HAS_KCOV=y CONFIG_RUNTIME_TESTING_MENU=y # CONFIG_TEST_DHRY is not set # CONFIG_LKDTM is not set -# CONFIG_TEST_MIN_HEAP is not set # CONFIG_TEST_DIV64 is not set # CONFIG_TEST_MULDIV64 is not set # CONFIG_BACKTRACE_SELF_TEST is not set @@ -4037,7 +4025,6 @@ CONFIG_RUNTIME_TESTING_MENU=y # CONFIG_TEST_HEXDUMP is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_BITMAP is not set -# CONFIG_TEST_UUID is not set # CONFIG_TEST_XARRAY is not set # CONFIG_TEST_MAPLE_TREE is not set # CONFIG_TEST_RHASHTABLE is not set @@ -4047,6 +4034,7 @@ CONFIG_RUNTIME_TESTING_MENU=y # CONFIG_FIND_BIT_BENCHMARK is not set # CONFIG_TEST_FIRMWARE is not set # CONFIG_TEST_SYSCTL is not set +# CONFIG_CONTEXT_ANALYSIS_TEST is not set # CONFIG_TEST_UDELAY is not set # CONFIG_TEST_DYNAMIC_DEBUG is not set # CONFIG_TEST_MEMCAT_P is not set @@ -4065,3 +4053,4 @@ CONFIG_ARCH_USE_MEMTEST=y # end of Kernel hacking CONFIG_IO_URING_ZCRX=y +CONFIG_IO_URING_BPF=y From 9866a04f5bf78d0df3ce3ca8fa67cf49bdc87c80 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Thu, 27 Aug 2026 19:40:38 -0300 Subject: [PATCH 2/2] feat(vm): pin virtio devices to fixed PCI slots and harden QEMU Take the parts of a libvirt-style command line that fit a microVM, and leave out the parts that cost boot time or break shim assumptions. Virtio devices now set disable-legacy=on. Sitting on pcie.0 was not enough on its own: QEMU still realized them as transitional (device id 0x1001 with a 128-byte legacy I/O BAR); modern-only drops that BAR and the transitional id (verified via query-pci, and in-guest: the devices come up as 0x1042/0x1044 with memory BARs only). This was measured neutral for boot time - the win is a smaller device surface, not speed. Each device also gets a fixed slot on pcie.0 instead of QEMU's auto-assignment, so guest enumeration order no longer depends on the order of builder calls. This deliberately avoids PCIe root ports: they would force enumeration of buses 1-4 plus pciehp bring-up, and would invalidate the pci=lastbus=0 cmdline optimization, to buy PCI hotplug that spinbox does not use (CPU and memory hotplug go through ACPI/QMP). The slot ranges bound how many disks and NICs fit, checked before building the command line so the failure names the limit instead of surfacing as a QEMU slot collision at exec time. Also enables the seccomp sandbox (the binary is built with --enable-seccomp) and drops S3/S4 from the ACPI tables, which a microVM never uses. Not adopted from that command line: PCIe root ports, virtio-scsi (dead weight next to virtio-blk), virtio-balloon (overlaps the pc-dimm memory hotplug accounting), the qemu-guest-agent channel (vminitd over vsock already is the control plane), -no-shutdown (the shim relies on QEMU exiting), and -S/-boot strict/bootindex (we direct-boot the kernel). The -drive to -blockdev migration is left for its own change: it must preserve file.locking=on on the rwlayer or the snapshotter's commit gate stops detecting running containers. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CcXUA5oay5BiEcFKdhCEht --- internal/host/vm/qemu/qemu_command.go | 86 +++++++++++++++-- internal/host/vm/qemu/qemu_command_test.go | 103 ++++++++++++--------- internal/host/vm/qemu/start.go | 23 ++++- 3 files changed, 155 insertions(+), 57 deletions(-) diff --git a/internal/host/vm/qemu/qemu_command.go b/internal/host/vm/qemu/qemu_command.go index 411bf71..d80822a 100644 --- a/internal/host/vm/qemu/qemu_command.go +++ b/internal/host/vm/qemu/qemu_command.go @@ -5,6 +5,47 @@ import ( "strings" ) +// Fixed PCI slot assignments on the q35 root complex (pcie.0). +// +// Every virtio device sits directly on bus 0 - there are no PCIe root ports - +// which is what lets the kernel cmdline carry pci=lastbus=0 and skip scanning +// buses 1-255 (see kernel_cmdline.go). Pinning each device to a slot instead of +// letting QEMU auto-assign makes guest enumeration order deterministic: it no +// longer depends on the order of builder calls, so reordering code here cannot +// silently renumber devices inside the guest. +// +// The q35 machine owns both ends of the bus: 0x00 is the host bridge and 0x1f +// the ICH9 LPC/SATA/SMBus function block. 0x01 is left free (q35 convention +// places VGA there; we run -nodefaults with no display). +const ( + pciSlotVsock = 0x02 + pciSlotRNG = 0x03 + pciSlotVirtioSerial = 0x04 // boot-profiling console only + + pciSlotDiskBase = 0x05 + pciSlotDiskMax = 0x0f + + pciSlotNICBase = 0x10 + pciSlotNICMax = 0x1e +) + +// maxDisks and maxNICs bound the fixed slot ranges above. Exceeding either is a +// configuration error, caught before the command line is built. +const ( + maxDisks = pciSlotDiskMax - pciSlotDiskBase + 1 + maxNICs = pciSlotNICMax - pciSlotNICBase + 1 +) + +// virtioModern forces virtio 1.0 (modern-only) on a PCI virtio device. +// +// disable-legacy=on drops the legacy I/O BAR and the transitional device ID, so +// the guest skips the legacy probe path entirely. Every kernel we boot is +// virtio 1.0 capable, so the transitional mode QEMU would otherwise negotiate +// buys nothing. Note this was measured neutral for boot time (time-to-PID1 is +// unchanged within run-to-run noise); the win is a smaller device surface, not +// speed. +const virtioModern = "disable-legacy=on" + // qemuCommandBuilder constructs QEMU command-line arguments using a fluent builder pattern. // This provides type safety, validation, and clearer intent compared to raw string building. // @@ -43,6 +84,30 @@ func (b *qemuCommandBuilder) setNoDefaults() *qemuCommandBuilder { return b } +// setSandbox enables QEMU's seccomp sandbox (-sandbox option). +// +// The binary is built with --enable-seccomp, so all four restrictions apply: +// - obsolete=deny block obsolete syscalls +// - elevateprivileges=deny block setuid/setgid family; QEMU never drops into +// another user here (the shim starts it with the identity it keeps) +// - spawn=deny block fork/exec; nothing is spawned - TAP arrives +// as a file descriptor, and slirp (which uses helpers) is not compiled in +// - resourcecontrol=deny block sched_setaffinity and friends. vCPU pinning, +// if ever needed, must then be done from the host side rather than from +// inside QEMU. +func (b *qemuCommandBuilder) setSandbox() *qemuCommandBuilder { + b.args = append(b.args, + "-sandbox", "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny") + return b +} + +// addGlobal sets a global device property (-global option). +// Example: addGlobal("ICH9-LPC.disable_s3=1") +func (b *qemuCommandBuilder) addGlobal(property string) *qemuCommandBuilder { + b.args = append(b.args, "-global", property) + return b +} + // setMachine sets the machine type and options (-machine option). // Example: setMachine("q35", "accel=kvm", "kernel-irqchip=on") func (b *qemuCommandBuilder) setMachine(machineType string, options ...string) *qemuCommandBuilder { @@ -150,12 +215,13 @@ func (b *qemuCommandBuilder) addChardevFile(id, path string) *qemuCommandBuilder // addVsockDevice adds a vhost-vsock device for guest communication. func (b *qemuCommandBuilder) addVsockDevice(guestCID int) *qemuCommandBuilder { - return b.addDevice(fmt.Sprintf("vhost-vsock-pci,guest-cid=%d", guestCID)) + return b.addDevice(fmt.Sprintf("vhost-vsock-pci,guest-cid=%d,%s,addr=0x%x", + guestCID, virtioModern, pciSlotVsock)) } // addVirtioRNG adds a virtio-rng device for entropy. func (b *qemuCommandBuilder) addVirtioRNG() *qemuCommandBuilder { - return b.addDevice("virtio-rng-pci") + return b.addDevice(fmt.Sprintf("virtio-rng-pci,%s,addr=0x%x", virtioModern, pciSlotRNG)) } // setQMP sets QMP socket configuration (-qmp option). @@ -173,13 +239,14 @@ func (b *qemuCommandBuilder) setQMPUnixSocket(socketPath string) *qemuCommandBui // addDisk adds a disk drive with virtio-blk device. // // Parameters: +// - index: 0-based disk index, mapped to a fixed PCI slot (pciSlotDiskBase+index) // - id: Drive identifier (e.g., "blk0") // - disk: Disk configuration // // This generates both -drive and -device options: // // -drive file=,if=none,id=,format=[,readonly=on|,file.locking=on] -// -device virtio-blk-pci,drive= +// -device virtio-blk-pci,drive=,disable-legacy=on,addr=0x // // Format is auto-detected from file extension: // - .vmdk → vmdk @@ -191,7 +258,7 @@ func (b *qemuCommandBuilder) setQMPUnixSocket(socketPath string) *qemuCommandBui // on rwlayer.img to detect a running container; that only works if QEMU locks // the same inode. Setting it explicitly avoids depending on QEMU's // locking=auto default, which a shared-storage setup might globally disable. -func (b *qemuCommandBuilder) addDisk(id string, disk *DiskConfig) *qemuCommandBuilder { +func (b *qemuCommandBuilder) addDisk(index int, id string, disk *DiskConfig) *qemuCommandBuilder { // Detect format based on file extension format := "raw" if strings.HasSuffix(disk.Path, ".vmdk") { @@ -208,7 +275,8 @@ func (b *qemuCommandBuilder) addDisk(id string, disk *DiskConfig) *qemuCommandBu } b.args = append(b.args, "-drive", driveArgs) - deviceArgs := fmt.Sprintf("virtio-blk-pci,drive=%s", id) + deviceArgs := fmt.Sprintf("virtio-blk-pci,drive=%s,%s,addr=0x%x", + id, virtioModern, pciSlotDiskBase+index) // Expose a stable serial so the guest can resolve this device via // /sys/block//serial instead of relying on PCI enumeration order. if disk.Serial != "" { @@ -227,19 +295,21 @@ type NICConfig struct { // addNIC adds a network interface using TAP device via file descriptor. // // Parameters: +// - index: 0-based NIC index, mapped to a fixed PCI slot (pciSlotNICBase+index) // - id: Network identifier (e.g., "net0") // - nic: NIC configuration // // This generates both -netdev and -device options: // // -netdev tap,id=,fd= -// -device virtio-net-pci,netdev=,mac=,romfile= +// -device virtio-net-pci,netdev=,mac=,romfile=,disable-legacy=on,addr=0x // // Note: romfile= disables option ROM loading (e.g., efi-virtio.rom) to avoid firmware dependency. -func (b *qemuCommandBuilder) addNIC(id string, nic NICConfig) *qemuCommandBuilder { +func (b *qemuCommandBuilder) addNIC(index int, id string, nic NICConfig) *qemuCommandBuilder { b.args = append(b.args, "-netdev", fmt.Sprintf("tap,id=%s,fd=%d", id, nic.TapFD), - "-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,romfile=", id, nic.MAC), + "-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,romfile=,%s,addr=0x%x", + id, nic.MAC, virtioModern, pciSlotNICBase+index), ) return b } diff --git a/internal/host/vm/qemu/qemu_command_test.go b/internal/host/vm/qemu/qemu_command_test.go index 5f2b89a..c085b73 100644 --- a/internal/host/vm/qemu/qemu_command_test.go +++ b/internal/host/vm/qemu/qemu_command_test.go @@ -305,12 +305,12 @@ func TestAddVsockDevice(t *testing.T) { { name: "standard CID 3", guestCID: 3, - want: []string{"-device", "vhost-vsock-pci,guest-cid=3"}, + want: []string{"-device", "vhost-vsock-pci,guest-cid=3,disable-legacy=on,addr=0x2"}, }, { name: "custom CID", guestCID: 42, - want: []string{"-device", "vhost-vsock-pci,guest-cid=42"}, + want: []string{"-device", "vhost-vsock-pci,guest-cid=42,disable-legacy=on,addr=0x2"}, }, } @@ -329,7 +329,7 @@ func TestAddVirtioRNG(t *testing.T) { addVirtioRNG(). build() - want := []string{"-device", "virtio-rng-pci"} + want := []string{"-device", "virtio-rng-pci,disable-legacy=on,addr=0x3"} assertArgs(t, args, want) } @@ -353,74 +353,81 @@ func TestSetQMPUnixSocket(t *testing.T) { func TestAddDisk(t *testing.T) { tests := []struct { - name string - id string - disk *DiskConfig - want []string + name string + index int + id string + disk *DiskConfig + want []string }{ { - name: "raw disk", - id: "blk0", + name: "raw disk", + index: 0, + id: "blk0", disk: &DiskConfig{ Path: "/var/lib/vm/disk.raw", Readonly: false, }, want: []string{ "-drive", "file=/var/lib/vm/disk.raw,if=none,id=blk0,format=raw,file.locking=on", - "-device", "virtio-blk-pci,drive=blk0", + "-device", "virtio-blk-pci,drive=blk0,disable-legacy=on,addr=0x5", }, }, { - name: "raw disk readonly", - id: "blk0", + name: "raw disk readonly", + index: 0, + id: "blk0", disk: &DiskConfig{ Path: "/var/lib/vm/disk.raw", Readonly: true, }, want: []string{ "-drive", "file=/var/lib/vm/disk.raw,if=none,id=blk0,format=raw,readonly=on", - "-device", "virtio-blk-pci,drive=blk0", + "-device", "virtio-blk-pci,drive=blk0,disable-legacy=on,addr=0x5", }, }, { - name: "vmdk disk", - id: "blk1", + name: "vmdk disk", + index: 1, + id: "blk1", disk: &DiskConfig{ Path: "/var/lib/vm/rootfs.vmdk", Readonly: true, }, want: []string{ "-drive", "file=/var/lib/vm/rootfs.vmdk,if=none,id=blk1,format=vmdk,readonly=on", - "-device", "virtio-blk-pci,drive=blk1", + "-device", "virtio-blk-pci,drive=blk1,disable-legacy=on,addr=0x6", }, }, { - name: "qcow2 disk", - id: "data", + name: "qcow2 disk", + index: 2, + id: "data", disk: &DiskConfig{ Path: "/var/lib/vm/data.qcow2", Readonly: false, }, want: []string{ "-drive", "file=/var/lib/vm/data.qcow2,if=none,id=data,format=qcow2,file.locking=on", - "-device", "virtio-blk-pci,drive=data", + "-device", "virtio-blk-pci,drive=data,disable-legacy=on,addr=0x7", }, }, { - name: "no extension defaults to raw", - id: "blk0", + name: "no extension defaults to raw", + index: 0, + id: "blk0", disk: &DiskConfig{ Path: "/dev/sda", Readonly: false, }, want: []string{ "-drive", "file=/dev/sda,if=none,id=blk0,format=raw,file.locking=on", - "-device", "virtio-blk-pci,drive=blk0", + "-device", "virtio-blk-pci,drive=blk0,disable-legacy=on,addr=0x5", }, }, { - name: "disk with serial", - id: "blk2", + name: "disk with serial", + index: 3, + id: "blk2", disk: &DiskConfig{ Path: "/var/lib/vm/layer.erofs", Readonly: true, @@ -428,21 +435,22 @@ func TestAddDisk(t *testing.T) { }, want: []string{ "-drive", "file=/var/lib/vm/layer.erofs,if=none,id=blk2,format=raw,readonly=on", - "-device", "virtio-blk-pci,drive=blk2,serial=sbxblk2", + "-device", "virtio-blk-pci,drive=blk2,disable-legacy=on,addr=0x8,serial=sbxblk2", }, }, { // The writable rwlayer must pin file.locking=on so the snapshotter's // OFD lock on rwlayer.img reliably gates commit of a running container. - name: "writable rwlayer pins file.locking", - id: "blk3", + name: "writable rwlayer pins file.locking", + index: 4, + id: "blk3", disk: &DiskConfig{ Path: "/var/lib/spinbox/rwlayer.img", Readonly: false, }, want: []string{ "-drive", "file=/var/lib/spinbox/rwlayer.img,if=none,id=blk3,format=raw,file.locking=on", - "-device", "virtio-blk-pci,drive=blk3", + "-device", "virtio-blk-pci,drive=blk3,disable-legacy=on,addr=0x9", }, }, } @@ -450,7 +458,7 @@ func TestAddDisk(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { args := newQemuCommandBuilder(). - addDisk(tt.id, tt.disk). + addDisk(tt.index, tt.id, tt.disk). build() assertArgs(t, args, tt.want) }) @@ -459,33 +467,36 @@ func TestAddDisk(t *testing.T) { func TestAddNIC(t *testing.T) { tests := []struct { - name string - id string - nic NICConfig - want []string + name string + index int + id string + nic NICConfig + want []string }{ { - name: "basic NIC", - id: "net0", + name: "basic NIC", + index: 0, + id: "net0", nic: NICConfig{ TapFD: 3, MAC: "52:54:00:12:34:56", }, want: []string{ "-netdev", "tap,id=net0,fd=3", - "-device", "virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56,romfile=", + "-device", "virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56,romfile=,disable-legacy=on,addr=0x10", }, }, { - name: "second NIC", - id: "net1", + name: "second NIC", + index: 1, + id: "net1", nic: NICConfig{ TapFD: 4, MAC: "52:54:00:12:34:57", }, want: []string{ "-netdev", "tap,id=net1,fd=4", - "-device", "virtio-net-pci,netdev=net1,mac=52:54:00:12:34:57,romfile=", + "-device", "virtio-net-pci,netdev=net1,mac=52:54:00:12:34:57,romfile=,disable-legacy=on,addr=0x11", }, }, } @@ -493,7 +504,7 @@ func TestAddNIC(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { args := newQemuCommandBuilder(). - addNIC(tt.id, tt.nic). + addNIC(tt.index, tt.id, tt.nic). build() assertArgs(t, args, tt.want) }) @@ -515,8 +526,8 @@ func TestBuilderChaining(t *testing.T) { addVsockDevice(3). addVirtioRNG(). setQMPUnixSocket("/tmp/qmp.sock"). - addDisk("blk0", &DiskConfig{Path: "/var/lib/vm/disk.raw", Readonly: true}). - addNIC("net0", NICConfig{TapFD: 3, MAC: "52:54:00:12:34:56"}). + addDisk(0, "blk0", &DiskConfig{Path: "/var/lib/vm/disk.raw", Readonly: true}). + addNIC(0, "net0", NICConfig{TapFD: 3, MAC: "52:54:00:12:34:56"}). build() // Verify essential components are present @@ -561,10 +572,10 @@ func TestBuilderChaining(t *testing.T) { func TestMultipleDevices(t *testing.T) { args := newQemuCommandBuilder(). - addDisk("blk0", &DiskConfig{Path: "/disk1.raw"}). - addDisk("blk1", &DiskConfig{Path: "/disk2.vmdk", Readonly: true}). - addNIC("net0", NICConfig{TapFD: 3, MAC: "52:54:00:00:00:01"}). - addNIC("net1", NICConfig{TapFD: 4, MAC: "52:54:00:00:00:02"}). + addDisk(0, "blk0", &DiskConfig{Path: "/disk1.raw"}). + addDisk(1, "blk1", &DiskConfig{Path: "/disk2.vmdk", Readonly: true}). + addNIC(0, "net0", NICConfig{TapFD: 3, MAC: "52:54:00:00:00:01"}). + addNIC(1, "net1", NICConfig{TapFD: 4, MAC: "52:54:00:00:00:02"}). build() // Count -drive and -device occurrences diff --git a/internal/host/vm/qemu/start.go b/internal/host/vm/qemu/start.go index bf45206..751de4d 100644 --- a/internal/host/vm/qemu/start.go +++ b/internal/host/vm/qemu/start.go @@ -506,12 +506,28 @@ func (q *Instance) buildQemuCommandLine(cmdlineArgs string, debug bool) ([]strin memorySlots = 0 // No hotplug needed if max equals initial } + // Fixed PCI slots bound how many devices fit on the root complex; check + // before building so the failure names the limit instead of surfacing as a + // QEMU slot collision at exec time. + if len(q.disks) > maxDisks { + return nil, fmt.Errorf("too many disks: %d configured, %d PCI slots available", len(q.disks), maxDisks) + } + if len(q.nets) > maxNICs { + return nil, fmt.Errorf("too many NICs: %d configured, %d PCI slots available", len(q.nets), maxNICs) + } + // Build QEMU command using fluent builder pattern builder := newQemuCommandBuilder(). setNoDefaults(). // Disable default devices (prevents e1000e NIC needing ROM files) + // Seccomp sandbox: cheap hardening around the VM isolation boundary. + setSandbox(). setBIOSPath(paths.QemuSharePath(cfg.Paths)). // Optimize: use kernel IRQ chip, disable HPET setMachine("q35", "accel=kvm", "kernel-irqchip=on", "hpet=off", "acpi=on"). + // Drop S3/S4 from the ACPI tables. A microVM never suspends or + // hibernates, and the guest skips the corresponding ACPI setup. + addGlobal("ICH9-LPC.disable_s3=1"). + addGlobal("ICH9-LPC.disable_s4=1"). setCPU("host", "migratable=on"). // CPU configuration for hotplug: // Simple topology: just specify initial CPUs and max CPUs, let QEMU handle the rest @@ -543,14 +559,15 @@ func (q *Instance) buildQemuCommandLine(cmdlineArgs string, debug bool) ([]strin // the still-present -serial carries nothing once the kernel targets hvc0. if debug { builder. - addDevice("virtio-serial-pci,id=virtio-serial0"). + addDevice(fmt.Sprintf("virtio-serial-pci,id=virtio-serial0,%s,addr=0x%x", + virtioModern, pciSlotVirtioSerial)). addChardevFile("hvc0", q.consoleFifoPath). addDevice("virtconsole,chardev=hvc0,id=hvc0port") } // Add disks for i, disk := range q.disks { - builder.addDisk(fmt.Sprintf("blk%d", i), disk) + builder.addDisk(i, fmt.Sprintf("blk%d", i), disk) } // Add NICs @@ -563,7 +580,7 @@ func (q *Instance) buildQemuCommandLine(cmdlineArgs string, debug bool) ([]strin return nil, fmt.Errorf("internal error: NIC %s has no TAP file descriptor (openTapFiles not called?)", nic.TapName) } fd := 3 + i - builder.addNIC(fmt.Sprintf("net%d", i), NICConfig{ + builder.addNIC(i, fmt.Sprintf("net%d", i), NICConfig{ TapFD: fd, MAC: nic.MAC, })