February 2026 - Devel - libvirt List Archives

[PATCH v2] qemu: Store tapfd path in domstatus XML
by Wesley Hershberger 16 Feb '26

16 Feb '26

Introduce a read-only `tapfd` element for direct interfaces (macvtap), which contains the path to the backing tapfd for that interface (e.g. `/dev/tapXX`). The element is only included when the domain is being formatted for internal consumption (VIR_DOMAIN_DEF_FORMAT_STATUS) and is not accepted in user-provided XML (!VIR_DOMAIN_DEF_PARSE_INACTIVE). This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: #692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger <wesley.hershberger(a)canonical.com> --- This submission is a partial revision of a previous series with a fix for the macvtap component of gitlab#692 [1][2]. I haven't had bandwidth to resolve the blockcommit component since the complexity there is somewhat higher (and is also lower priority for us). I kept the separate `tapfd` element rather than reusing the existing `backend` element (virDomainNetBackend.tap) to avoid making a user-visible change [3]. I'd be happy to use the existing field instead if you think that would make more sense. I opted not to introduce/modify a security driver API for FD+path as the patch here is sufficient to resolve the bug, but would be willing to do so if that would make this change more palatable. I've opened a MR to libvirt-tck with test cases that demonstrate the bugs that this fixes [4]. apparmor/110-macvtap.t passes with this patch applied. Thanks for the reviews and continued consideration. ~Wesley [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… [2] https://gitlab.com/libvirt/libvirt/-/issues/692 [3] https://libvirt.org/formatdomain.html#setting-network-backend-specific-opti… [4] https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/73 --- Changes in v2: - Drop `virt-aa-helper: Ask for no deny rule...` as it was applied - Drop `qemu: Store blockcommit permissions...` due to unresolved concerns - Pass tapfd path through netdef instead of resolving from fd - Link to v1: https://lore.kernel.org/r/20260105-apparmor-races-v1-0-932cf0e990b7@canonic… --- src/conf/domain_conf.c | 8 ++++++++ src/conf/domain_conf.h | 1 + src/hypervisor/domain_interface.c | 2 +- src/lxc/lxc_process.c | 1 + src/qemu/qemu_interface.c | 1 + src/security/security_apparmor.c | 1 + src/security/virt-aa-helper.c | 5 +++++ src/util/virnetdevmacvlan.c | 18 +++++++++++------- src/util/virnetdevmacvlan.h | 4 +++- 9 files changed, 32 insertions(+), 9 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 02e23f78667a775637c710b651ba5fc7a127226f..1d7921e0de6f097ffaf86a9197d629e67dc213d7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2939,6 +2939,7 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->virtio); g_free(def->coalesce); g_free(def->sourceDev); + g_free(def->tapfdpath); virNetDevIPInfoClear(&def->guestIP); virNetDevIPInfoClear(&def->hostIP); @@ -10440,6 +10441,10 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, return NULL; } + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) { + def->tapfdpath = virXPathString("string(./tapfd/@path)", ctxt); + } + if (virNetworkPortOptionsParseXML(ctxt, &def->isolatedPort) < 0) return NULL; @@ -25664,6 +25669,9 @@ virDomainNetDefFormat(virBuffer *buf, if (def->mtu) virBufferAsprintf(buf, "<mtu size='%u'/>\n", def->mtu); + if (def->tapfdpath && (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)) + virBufferAsprintf(buf, "<tapfd path='%s'/>\n", def->tapfdpath); + virDomainNetDefCoalesceFormatXML(buf, def->coalesce); virDomainDeviceInfoFormat(buf, &def->info, flags | VIR_DOMAIN_DEF_FORMAT_ALLOW_BOOT diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 66dc4e3417b8cb5bce60217a4e529add61149962..ba2bf1f750dcd7f4f25ef3bf55fd63629d3b5222 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1203,6 +1203,7 @@ struct _virDomainNetDef { char *downscript; char *domain_name; /* backend domain name */ char *ifname; /* interface name on the host (<target dev='x'/>) */ + char *tapfdpath; /* Path in /dev for macvtap (<tapfd path="/dev/tapXX">) */ virTristateBool managed_tap; virNetDevIPInfo hostIP; char *ifname_guest_actual; diff --git a/src/hypervisor/domain_interface.c b/src/hypervisor/domain_interface.c index 5bc698d2727e1142e9c5dc30ac00975f268f98e8..37e3d453a03943ee5729ad2d4b087b5e0ca37408 100644 --- a/src/hypervisor/domain_interface.c +++ b/src/hypervisor/domain_interface.c @@ -111,7 +111,7 @@ virDomainInterfaceEthernetConnect(virDomainDef *def, if (virNetDevMacVLanIsMacvtap(net->ifname)) { auditdev = net->ifname; - if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize, &net->tapfdpath) < 0) goto cleanup; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, virDomainInterfaceIsVnetCompatModel(net)) < 0) { diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 1bca9e8daea2cb8f63bcf5c0a735252ff57af6f1..c731b28871b18329e633c42f2141d22063208d9f 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -379,6 +379,7 @@ virLXCProcessSetupInterfaceDirect(virLXCDriver *driver, VIR_NETDEV_VPORT_PROFILE_OP_CREATE, cfg->stateDir, NULL, 0, + &net->tapfdpath, macvlan_create_flags) < 0) return NULL; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 23a23d201aec31a36431646551ae03a233606e30..edc53d53b3b34afbfb8662e809bc0898076fdfc5 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -81,6 +81,7 @@ qemuInterfaceDirectConnect(virDomainDef *def, &res_ifname, vmop, cfg->stateDir, tapfd, tapfdSize, + &net->tapfdpath, macvlan_create_flags) < 0) goto cleanup; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 934acfb46198401d84d47cc6266a9403eda5a3b0..dec271721641c811944f98464cebebca6ed6a159 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -157,6 +157,7 @@ load_profile(virSecurityManager *mgr G_GNUC_UNUSED, if (virDomainDefFormatInternal(def, NULL, &buf, VIR_DOMAIN_DEF_FORMAT_SECURE | + VIR_DOMAIN_DEF_FORMAT_STATUS | VIR_DOMAIN_DEF_FORMAT_VOLUME_TRANSLATED) < 0) return -1; diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index f4ec6b7826ba532f0dbac2dcd4ed89f7f98e6be6..e904d5e8292ae5e7d4acbec2062a91861a9535f5 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1176,6 +1176,11 @@ get_files(vahControl * ctl) vhu->type) != 0) return -1; } + + if (net->tapfdpath) { + if (vah_add_file(&buf, net->tapfdpath, "rwk") != 0) + return -1; + } } for (i = 0; i < ctl->def->nmems; i++) { diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c index cde9d70eefd047dc5c16056f6697cf4d05bc0795..fcf63e08ff07eca22a122a2532cea1b0c9a95c9e 100644 --- a/src/util/virnetdevmacvlan.c +++ b/src/util/virnetdevmacvlan.c @@ -152,24 +152,24 @@ int virNetDevMacVLanDelete(const char *ifname) int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) { int retries = 10; int ret = -1; int ifindex; size_t i = 0; - g_autofree char *tapname = NULL; if (virNetDevGetIndex(ifname, &ifindex) < 0) return -1; - tapname = g_strdup_printf("/dev/tap%d", ifindex); + *tapname = g_strdup_printf("/dev/tap%d", ifindex); for (i = 0; i < tapfdSize; i++) { int fd = -1; while (fd < 0) { - if ((fd = open(tapname, O_RDWR)) >= 0) { + if ((fd = open(*tapname, O_RDWR)) >= 0) { tapfd[i] = fd; } else if (retries-- > 0) { /* may need to wait for udev to be done */ @@ -178,7 +178,7 @@ virNetDevMacVLanTapOpen(const char *ifname, /* However, if haven't succeeded, quit. */ virReportSystemError(errno, _("cannot open macvtap tap device %1$s"), - tapname); + *tapname); goto cleanup; } } @@ -188,6 +188,7 @@ virNetDevMacVLanTapOpen(const char *ifname, cleanup: if (ret < 0) { + g_free(*tapname); while (i--) VIR_FORCE_CLOSE(tapfd[i]); } @@ -659,6 +660,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) { g_autofree char *ifname = NULL; @@ -729,7 +731,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, } if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { - if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize, tapfdpath) < 0) goto disassociate_exit; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, vnet_hdr) < 0) @@ -888,7 +890,8 @@ int virNetDevMacVLanDelete(const char *ifname G_GNUC_UNUSED) int virNetDevMacVLanTapOpen(const char *ifname G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, - size_t tapfdSize G_GNUC_UNUSED) + size_t tapfdSize G_GNUC_UNUSED, + char **tapname G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Cannot create macvlan devices on this platform")); @@ -917,6 +920,7 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname G_GNUC_UNUSED, char *stateDir G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, size_t tapfdSize G_GNUC_UNUSED, + char **tapfdpath G_GNUC_UNUSED, unsigned int unused_flags G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h index 31e4804cdc0d7c4beb74ba66d204d0ff7ad83151..7424b8796529d6c6d1909eee81c88e8ded0ea84b 100644 --- a/src/util/virnetdevmacvlan.h +++ b/src/util/virnetdevmacvlan.h @@ -72,13 +72,15 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(6) ATTRIBUTE_NONNULL(8) ATTRIBUTE_NONNULL(10) G_GNUC_WARN_UNUSED_RESULT; int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; --- base-commit: 74fc02d792f7ee55d2e0a7b9ad4e6d751c36ceb8 change-id: 20260105-apparmor-races-d03238ee4d93 Best regards, -- Wesley Hershberger <wesley.hershberger(a)canonical.com>

1 1

[libvirt PATCH] tests: properly mock VFIO and IOMMU checks
by Pavel Hrdina 16 Feb '26

16 Feb '26

Fixes: 63434db800b921e96fec424a667b7161af1f02de Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- Pushed as tests breaker. src/util/virutil.h | 2 +- tests/domaincapsdata/qemu_9.0.0.sparc.xml | 5 +---- tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml | 5 +---- tests/domaincapsmock.c | 10 ++++++++++ tests/domaincapstest.c | 8 -------- 5 files changed, 13 insertions(+), 17 deletions(-) diff --git a/src/util/virutil.h b/src/util/virutil.h index ca6fd95363..7e1705e7ce 100644 --- a/src/util/virutil.h +++ b/src/util/virutil.h @@ -141,7 +141,7 @@ unsigned long long virMemoryLimitTruncate(unsigned long long value); bool virMemoryLimitIsSet(unsigned long long value); unsigned long long virMemoryMaxValue(bool ulong) ATTRIBUTE_MOCKABLE; -bool virHostHasIOMMU(void); +bool virHostHasIOMMU(void) ATTRIBUTE_MOCKABLE; char *virHostGetDRMRenderNode(void) ATTRIBUTE_MOCKABLE; diff --git a/tests/domaincapsdata/qemu_9.0.0.sparc.xml b/tests/domaincapsdata/qemu_9.0.0.sparc.xml index 062e55718b..93d8d40c2c 100644 --- a/tests/domaincapsdata/qemu_9.0.0.sparc.xml +++ b/tests/domaincapsdata/qemu_9.0.0.sparc.xml @@ -86,10 +86,7 @@ <value>scsi</value> </enum> <enum name='capsType'/> - <enum name='pciBackend'> - <value>default</value> - <value>vfio</value> - </enum> + <enum name='pciBackend'/> <enum name='iommufd'> <value>no</value> </enum> diff --git a/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml b/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml index db51e7b120..a65d9d36fd 100644 --- a/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml +++ b/tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml @@ -147,10 +147,7 @@ <value>scsi</value> </enum> <enum name='capsType'/> - <enum name='pciBackend'> - <value>default</value> - <value>vfio</value> - </enum> + <enum name='pciBackend'/> <enum name='iommufd'> <value>no</value> </enum> diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c index 370ce35709..aa13deb324 100644 --- a/tests/domaincapsmock.c +++ b/tests/domaincapsmock.c @@ -21,6 +21,7 @@ #include "virhostmem.h" #include "viriommufd.h" #include "virmock.h" +#include "virutil.h" #if WITH_QEMU # include "qemu/qemu_capabilities.h" @@ -91,5 +92,14 @@ virFileExists(const char *path) if (STREQ(path, VIR_IOMMU_DEV_PATH)) return true; + if (STREQ(path, "/dev/vfio/vfio")) + return true; + return real_virFileExists(path); } + +bool +virHostHasIOMMU(void) +{ + return true; +} diff --git a/tests/domaincapstest.c b/tests/domaincapstest.c index 71e181d179..5b2fc80f0a 100644 --- a/tests/domaincapstest.c +++ b/tests/domaincapstest.c @@ -104,14 +104,6 @@ fillQemuCaps(virDomainCaps *domCaps, false) < 0) return -1; - /* The function above tries to query host's VFIO capabilities by calling - * virHostdevHostSupportsPassthroughVFIO() which, however, can't be - * successfully mocked as they are not exposed as internal APIs. Therefore, - * instead of mocking set the expected values here by hand. */ - VIR_DOMAIN_CAPS_ENUM_SET(domCaps->hostdev.pciBackend, - VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_DEFAULT, - VIR_DEVICE_HOSTDEV_PCI_DRIVER_NAME_VFIO); - /* As of f05b6a918e28 we are expecting to see OVMF_CODE.fd file which * may not exists everywhere. */ while (loader->values.nvalues) -- 2.53.0

1 0

[libvirt PATCH 00/24] IOMMUFD fixes and hotplug support
by Pavel Hrdina 16 Feb '26

16 Feb '26

Fix some FD leaks in the code, code refactor and improvements as preparation for implementing hotplug support. Add domain capability to report if IOMMUFD is supported. Pavel Hrdina (24): qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD qemu: Move IOMMUFD validation to qemu_validate util: Move openning IOMMU device to viriommufd qemu_process: Refactor qemuProcessOpenIommuFd util: Move openning VFIO device to virpci qemu_process: Refactor qemuProcessOpenVfioDeviceFd util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD qemu_domain: Add missing IOMMUFD cleanup qemu_process: Fix FD leak with multiple host devices using IOMMUFD qemu_process: Refactor qemuProcessOpenVfioFds qemuxmlconftest: Refactor host device preparation qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData qemuxmlconftest: Set fake FD for IOMMUFD qemu: Convert IOMMUFD to qemuFDPassDirect qemu: Convert vfioDeviceFd to qemuFDPassDirect qemu_command: Don't use host property if IOMMUFD is used qemu: Save IOMMUFD state into status XML qemu_hotplug: Remove iommufd object if no longer needed qemu_command: Extract building IOMMUFD props to function qemu_hotplug: Add support to hotplug host device with IOMMUFD conf: Introduce iommufd enum for domaincaps qemu: Fill iommufd domain capability docs/formatdomaincaps.rst | 7 ++ src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 29 +++++ src/conf/domain_conf.h | 6 + src/libvirt_private.syms | 6 +- src/qemu/qemu_capabilities.c | 23 +++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 86 ++++++-------- src/qemu/qemu_command.h | 3 + src/qemu/qemu_domain.c | 14 ++- src/qemu/qemu_domain.h | 5 +- src/qemu/qemu_hotplug.c | 47 ++++++++ src/qemu/qemu_process.c | 111 ++++++------------ src/qemu/qemu_process.h | 3 + src/qemu/qemu_validate.c | 15 +++ src/security/security_apparmor.c | 2 +- src/security/security_dac.c | 4 +- src/security/security_selinux.c | 4 +- src/util/viriommufd.c | 35 +++++- src/util/viriommufd.h | 4 +- src/util/virpci.c | 40 ++++++- src/util/virpci.h | 4 +- .../qemu_10.0.0-q35.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 4 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 4 + .../qemu_10.0.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 4 + .../qemu_10.0.0.x86_64+amdsev.xml | 4 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 4 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 4 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 4 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 4 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 4 + .../qemu_10.1.0.x86_64+inteltdx.xml | 4 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 4 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 4 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 4 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 4 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 4 + .../qemu_10.2.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 4 + .../qemu_10.2.0.x86_64+mshv.xml | 4 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 4 + .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 4 + .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 4 + .../qemu_11.0.0-virt.aarch64.xml | 4 + tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 4 + tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 4 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 3 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 3 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 3 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 3 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 3 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 3 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 3 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 3 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 3 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 3 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 3 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 3 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 3 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 3 + .../qemu_8.2.0-virt.aarch64.xml | 3 + .../qemu_8.2.0-virt.loongarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 3 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 3 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 3 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 4 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 3 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 4 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 4 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 3 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 4 + .../qemu_9.1.0-virt.riscv64.xml | 3 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 4 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 4 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 3 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 4 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 4 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 4 + .../qemu_9.2.0.x86_64+amdsev.xml | 4 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 4 + tests/domaincapsmock.c | 17 ++- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + .../iommufd-q35.x86_64-latest.args | 4 +- ...fd-virt-pci-bus-single.aarch64-latest.args | 4 +- .../iommufd-virt.aarch64-latest.args | 6 +- .../iommufd.x86_64-latest.args | 4 +- tests/qemuxmlconftest.c | 100 +++++++++------- 129 files changed, 694 insertions(+), 199 deletions(-) -- 2.53.0

2 25

[PATCH] scripts: avoid matching 'char **' as string for systemtap
by Daniel P. Berrangé 16 Feb '26

16 Feb '26

From: Daniel P. Berrangé <berrange(a)redhat.com> When a probe argument is declared "char *" we reference the userspace string value using 'user_string(...)' for systemtap. Unfortunately our code generator also matches on args declared "char **" and generates bogus code *cert = user_string($arg4); which is a syntax error for systemtap. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- scripts/dtrace2systemtap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/dtrace2systemtap.py b/scripts/dtrace2systemtap.py index 506db9c503..361dab1075 100755 --- a/scripts/dtrace2systemtap.py +++ b/scripts/dtrace2systemtap.py @@ -124,7 +124,7 @@ for file in filelist: for idx in range(len(argbits)): arg = argbits[idx] isstr = False - if 'char *' in arg: + if re.match(r'''.*char\s\*[^\*].*''', arg) is not None: isstr = True m = re.search(r'''^.*\s\*?(\S+)$''', arg) -- 2.53.0

2 1

[PATCH v5 0/3] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 16 Feb '26

16 Feb '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (3): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2668 ++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 310 ++ .../ah-linux.nftables.args | 304 ++ .../all-ipv6-linux.nftables.args | 292 ++ .../all-linux.nftables.args | 286 ++ .../arp-linux.nftables.args | 231 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 510 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 310 ++ .../esp-linux.nftables.args | 304 ++ .../example-1-linux.nftables.args | 268 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 384 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 256 ++ .../icmpv6-linux.nftables.args | 328 ++ .../igmp-linux.nftables.args | 304 ++ .../ip-linux.nftables.args | 205 + .../ipt-no-macspoof-linux.nftables.args | 172 + .../ipv6-linux.nftables.args | 511 +++ .../iter1-linux.nftables.args | 304 ++ .../iter2-linux.nftables.args | 3760 +++++++++++++++++ .../iter3-linux.nftables.args | 430 ++ .../mac-linux.nftables.args | 184 + .../rarp-linux.nftables.args | 215 + .../sctp-ipv6-linux.nftables.args | 328 ++ .../sctp-linux.nftables.args | 328 ++ .../target-linux.nftables.args | 466 ++ .../target2-linux.nftables.args | 322 ++ .../tcp-ipv6-linux.nftables.args | 328 ++ .../tcp-linux.nftables.args | 476 +++ .../udp-ipv6-linux.nftables.args | 328 ++ .../udp-linux.nftables.args | 328 ++ .../udplite-ipv6-linux.nftables.args | 310 ++ .../udplite-linux.nftables.args | 304 ++ .../vlan-linux.nftables.args | 271 ++ .../ah-ipv6-linux.args | 304 ++ .../nwfilterxml2nftfirewalldata/ah-linux.args | 298 ++ .../all-ipv6-linux.args | 286 ++ .../all-linux.args | 280 ++ .../arp-linux.args | 215 + tests/nwfilterxml2nftfirewalldata/arp.xml | 27 + .../comment-linux.args | 483 +++ .../conntrack-linux.args | 198 + .../esp-ipv6-linux.args | 304 ++ .../esp-linux.args | 298 ++ .../example-1-linux.args | 266 ++ .../example-2-linux.args | 348 ++ .../hex-data-linux.args | 357 ++ .../icmp-direction-linux.args | 238 ++ .../icmp-direction2-linux.args | 238 ++ .../icmp-direction3-linux.args | 184 + .../icmp-linux.args | 252 ++ .../icmpv6-linux.args | 322 ++ .../igmp-linux.args | 298 ++ .../nwfilterxml2nftfirewalldata/ip-linux.args | 198 + .../ipt-no-macspoof-linux.args | 169 + .../ipv6-linux.args | 474 +++ .../iter1-linux.args | 298 ++ .../iter2-linux.args | 3598 ++++++++++++++++ .../iter3-linux.args | 418 ++ .../mac-linux.args | 180 + .../rarp-linux.args | 215 + .../sctp-ipv6-linux.args | 314 ++ .../sctp-linux.args | 314 ++ .../target-linux.args | 452 ++ .../target2-linux.args | 316 ++ .../tcp-ipv6-linux.args | 314 ++ .../tcp-linux.args | 468 ++ .../udp-ipv6-linux.args | 314 ++ .../udp-linux.args | 314 ++ .../udplite-ipv6-linux.args | 304 ++ .../udplite-linux.args | 298 ++ .../vlan-linux.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 96 files changed, 33369 insertions(+), 102 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/arp-linux.args create mode 100644 tests/nwfilterxml2nftfirewalldata/arp.xml create mode 100755 tests/nwfilterxml2nftfirewalldata/comment-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/conntrack-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/hex-data-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmpv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/igmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ip-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipt-no-macspoof-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/mac-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/rarp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/vlan-linux.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

1 3

[PATCH v4 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 16 Feb '26

16 Feb '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename generic names to virNWFilter* and CamelCase nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 671 +-- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2518 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 55 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 310 ++ .../ah-linux.nftables.args | 304 ++ .../all-ipv6-linux.nftables.args | 292 ++ .../all-linux.nftables.args | 286 ++ .../arp-linux.nftables.args | 231 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 510 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 310 ++ .../esp-linux.nftables.args | 304 ++ .../example-1-linux.nftables.args | 268 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 384 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 256 ++ .../icmpv6-linux.nftables.args | 328 ++ .../igmp-linux.nftables.args | 304 ++ .../ip-linux.nftables.args | 205 + .../ipt-no-macspoof-linux.nftables.args | 172 + .../ipv6-linux.nftables.args | 511 +++ .../iter1-linux.nftables.args | 304 ++ .../iter2-linux.nftables.args | 3760 +++++++++++++++++ .../iter3-linux.nftables.args | 430 ++ .../mac-linux.nftables.args | 184 + .../rarp-linux.nftables.args | 231 + .../sctp-ipv6-linux.nftables.args | 328 ++ .../sctp-linux.nftables.args | 328 ++ .../target-linux.nftables.args | 466 ++ .../target2-linux.nftables.args | 322 ++ .../tcp-ipv6-linux.nftables.args | 328 ++ .../tcp-linux.nftables.args | 476 +++ .../udp-ipv6-linux.nftables.args | 328 ++ .../udp-linux.nftables.args | 328 ++ .../udplite-ipv6-linux.nftables.args | 310 ++ .../udplite-linux.nftables.args | 304 ++ .../vlan-linux.nftables.args | 271 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 59 files changed, 19320 insertions(+), 569 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 15

[PATCH 0/5] conf: Add firmwareFeatures element for domaincaps
by Andrea Bolognani 13 Feb '26

13 Feb '26

This is primarily intended to as a companion to my series that makes it possible to use Secure Boot on aarch64[1], but I'm posting it separately because it's independently useful and could be pushed before it. Depending on which one of the two series is merged first, some minor conflict resolution will need to be applied to the other. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WVWT… Andrea Bolognani (5): schema: Add firmwareFeatures element for domaincaps conf: Add firmwareFeatures element for domaincaps qemu: Fill in firmwareFeature element for domaincaps docs: Document firmwareFeature element for domaincaps news: Mention firmwareFeatures element for domaincaps NEWS.rst | 7 +++ docs/formatdomaincaps.rst | 51 +++++++++++++++++++ src/conf/domain_capabilities.c | 15 ++++++ src/conf/domain_capabilities.h | 8 +++ src/conf/schemas/domaincaps.rng | 12 +++++ src/qemu/qemu_capabilities.c | 21 +++++++- src/qemu/qemu_firmware.c | 28 +++++++++- src/qemu/qemu_firmware.h | 2 + .../qemu_10.0.0-q35.x86_64+amdsev.xml | 10 ++++ .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 10 ++++ .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 8 +++ .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 8 +++ .../qemu_10.0.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 4 ++ .../qemu_10.0.0.x86_64+amdsev.xml | 8 +++ tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 8 +++ .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 10 ++++ .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 10 ++++ .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 8 +++ .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_10.1.0.s390x.xml | 4 ++ .../qemu_10.1.0.x86_64+inteltdx.xml | 8 +++ tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 8 +++ .../qemu_10.2.0-q35.x86_64+mshv.xml | 10 ++++ .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 10 ++++ .../qemu_10.2.0-tcg.x86_64+mshv.xml | 8 +++ .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 8 +++ .../qemu_10.2.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 8 +++ .../qemu_10.2.0.x86_64+mshv.xml | 8 +++ tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 8 +++ .../qemu_11.0.0-virt.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 4 ++ tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 8 +++ .../qemu_7.2.0-hvf.x86_64+hvf.xml | 8 +++ .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 10 ++++ .../qemu_7.2.0-tcg.x86_64+hvf.xml | 8 +++ .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_7.2.0.ppc.xml | 4 ++ tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_8.1.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 10 ++++ .../qemu_8.2.0-tcg-virt.loongarch64.xml | 8 +++ .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 8 +++ .../qemu_8.2.0-virt.aarch64.xml | 8 +++ .../qemu_8.2.0-virt.loongarch64.xml | 8 +++ tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 8 +++ tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 4 ++ tests/domaincapsdata/qemu_8.2.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 10 ++++ .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_9.0.0.sparc.xml | 4 ++ tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 8 +++ .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 10 ++++ .../qemu_9.1.0-tcg-virt.riscv64.xml | 8 +++ .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 8 +++ .../qemu_9.1.0-virt.riscv64.xml | 8 +++ tests/domaincapsdata/qemu_9.1.0.s390x.xml | 4 ++ tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 8 +++ .../qemu_9.2.0-hvf.aarch64+hvf.xml | 8 +++ .../qemu_9.2.0-q35.x86_64+amdsev.xml | 10 ++++ .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 10 ++++ .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 8 +++ .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 8 +++ tests/domaincapsdata/qemu_9.2.0.s390x.xml | 4 ++ .../qemu_9.2.0.x86_64+amdsev.xml | 8 +++ tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 8 +++ tests/qemufirmwaretest.c | 7 ++- 91 files changed, 786 insertions(+), 5 deletions(-) -- 2.53.0

2 6

[PATCH 0/9] qemu: add support for block latency histogram collection
by Peter Krempa 13 Feb '26

13 Feb '26

This patchset introduces configuration of the block latency histogram feature in qemu as well as exposes the histograms via bulk domain stats. The feature was in qemu for a long time so no capabilities are needed. Peter Krempa (9): qemu: Extract disk setup done via QMP into a separate helper qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' Expose latency histograms via 'virConnectGetAllDomainStats' qemu: monitor: Add handlers for 'block-latency-histogram-set' docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element docs: formatdomain: Reword section about the '<statistics>' element under disk driver Introduce support for disk operation latency histogram collection qemu: Setup disk latency histograms on startup/hotplug/update docs/formatdomain.rst | 77 ++++++++-- docs/manpages/virsh.rst | 7 + include/libvirt/libvirt-domain.h | 113 +++++++++++++++ src/conf/domain_conf.c | 133 +++++++++++++++++- src/conf/domain_conf.h | 7 + src/conf/schemas/domaincommon.rng | 37 ++++- src/qemu/qemu_domain.c | 17 +++ src/qemu/qemu_domain.h | 3 + src/qemu/qemu_driver.c | 43 ++++++ src/qemu/qemu_hotplug.c | 52 ++++--- src/qemu/qemu_monitor.c | 41 ++++++ src/qemu/qemu_monitor.h | 27 ++++ src/qemu/qemu_monitor_json.c | 115 +++++++++++++++ src/qemu/qemu_monitor_json.h | 9 ++ src/qemu/qemu_process.c | 63 ++++++--- src/qemu/qemu_process.h | 3 + tests/qemumonitorjsontest.c | 9 ++ ...isk-statistics-intervals.x86_64-latest.xml | 29 ++++ .../disk-statistics-intervals.xml | 25 ++++ 19 files changed, 748 insertions(+), 62 deletions(-) -- 2.52.0

2 11

[PATCH 0/2] Extend hyperv host-model mode
by Michal Privoznik 13 Feb '26

13 Feb '26

Turns out, KubeVirt wants host-model mode for hyperv enlightenments to allow finer control over each enlightenment. For instance, set different number of spinlock than QEMU's default. Fair enough. Michal Prívozník (2): conf: Parse hyperv features even for host-model qemu: Wire up new hyperv host-model mode behavior docs/formatdomain.rst | 3 +++ src/conf/domain_conf.c | 3 +-- src/conf/schemas/domaincommon.rng | 8 +++---- src/qemu/qemu_process.c | 24 ++++++++++++------- .../hyperv-host-model.x86_64-latest.args | 2 +- .../hyperv-host-model.x86_64-latest.xml | 6 ++++- tests/qemuxmlconfdata/hyperv-host-model.xml | 6 ++++- 7 files changed, 35 insertions(+), 17 deletions(-) -- 2.52.0

3 6

[PATCH v6 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 12 Feb '26

12 Feb '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v6: - changes to use obj->secretValueFile as base - does local suffix lookups - refactors code so that the base64 encoding is in common code paths - moves local variable declaration inside blocks using them - refactors loader to use virFileReadAll instead of open-coding - fixes virSecretObjDeleteData to not rely on the actual filename Changes in v5: - Fix the bug of updating old secrets, prior to 12.1.0. Old secrets, when updated, now are stored with the latest encryption scheme if encryption is on. - Remove any logic in setting the secretValueFile in virSecretObjListAdd. Move it to virSecretLoadValue and virSecretObjSetValue. - Change urandom to random. Change default permission bits to 0077. - Update the documentation. Changes in v4: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 105 +++++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 210 +++++++++++++----- src/conf/virsecretobj.h | 14 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 179 +++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 29 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 ++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 ++++++ 24 files changed, 840 insertions(+), 68 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 8