April 2026 - Devel - libvirt List Archives

[PATCH] virfile: safezero: handle posix_fallocate()'s EOPNOTSUPP
by Roman Bogorodskiy 21 Apr '26

21 Apr '26

FreeBSD 15.x updated posix_fallocate() to return EOPNOTSUPP instead of EINVAL when the operation is not supported. Quoting posix_fallocate(2): Previous versions of posix_fallocate used EINVAL to indicate that the operation is not supported by the file system, as specified in IEEE Std 1003.1 (“POSIX.1”) Base Specifications, Issue 7. IEEE Std 1003.1 (“POSIX.1”) Base Specifications, Issue 8 switched to requiring EOPNOTSUPP for this error case. ZFS adopted the latter convention in FreeBSD 15.0, and the remaining filesystems in base adopted it in FreeBSD 15.1. Update safezero_posix_fallocate() to handle this return value along with EINVAL to fix the waterfall down to safezero_slow() for filesystems that do not support that. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/util/virfile.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index e3c0026841..a0c6cb8048 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -1301,13 +1301,16 @@ safezero_posix_fallocate(int fd, off_t offset, off_t len) int ret = posix_fallocate(fd, offset, len); if (ret == 0) { return 0; - } else if (ret == EINVAL) { + } else if (ret == EINVAL || ret == EOPNOTSUPP) { /* EINVAL is returned when either: - Operation is not supported by the underlying filesystem, - offset or len argument values are invalid. Assuming that offset and len are valid, this error means the operation is not supported, and we need to fall back to other methods. + + Newer versions of FreeBSD return EOPNOTSUPP when the + operation is not supported. */ return -2; } -- 2.52.0

2 1

[PATCH v6 02/22] vhost: drop backend_features field
by Vladimir Sementsov-Ogievskiy 21 Apr '26

21 Apr '26

This field is mostly unused and sometimes confusing. We even have a TODO-like comment to drop it, the comment is removed in this commit. The field is used to held VHOST_USER_F_PROTOCOL_FEATURES for vhost-user and/or VHOST_NET_F_VIRTIO_NET_HDR for vhost-net (which may be vhost-user-net). But we can simply recalculate these two flags in place from hdev->features, and from net-client for VHOST_NET_F_VIRTIO_NET_HDR. Note: removing field from x-query-virtio-status result is incompatible change. We can do it because the command is unstable. Cc: devel(a)lists.libvirt.org Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Acked-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Daniil Tatianin <d-tatianin(a)yandex-team.ru> Acked-by: Raphael Norwitz <raphael.s.norwitz(a)gmail.com> --- hw/block/vhost-user-blk.c | 1 - hw/net/vhost_net.c | 26 ++++++++++++++------------ hw/scsi/vhost-scsi.c | 1 - hw/scsi/vhost-user-scsi.c | 1 - hw/virtio/vdpa-dev.c | 1 - hw/virtio/vhost-user.c | 17 ++++++++--------- hw/virtio/virtio-hmp-cmds.c | 2 -- hw/virtio/virtio-qmp.c | 4 ---- include/hw/virtio/vhost.h | 7 ------- qapi/virtio.json | 3 --- 10 files changed, 22 insertions(+), 41 deletions(-) diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index c151e836770..dc99de02635 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -348,7 +348,6 @@ static int vhost_user_blk_connect(DeviceState *dev, Error **errp) s->dev.nvqs = s->num_queues; s->dev.vqs = s->vhost_vqs; s->dev.vq_index = 0; - s->dev.backend_features = 0; vhost_dev_set_config_notifier(&s->dev, &blk_ops); diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c index 25e9f1fd244..fda90e231e6 100644 --- a/hw/net/vhost_net.c +++ b/hw/net/vhost_net.c @@ -52,8 +52,14 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data, void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features) { - virtio_features_copy(net->dev.acked_features_ex, - net->dev.backend_features_ex); + virtio_features_clear(net->dev.acked_features_ex); + if (net->backend == -1) { + net->dev.acked_features = + net->dev.features & (1ULL << VHOST_USER_F_PROTOCOL_FEATURES); + } else if (!qemu_has_vnet_hdr(net->nc)) { + net->dev.acked_features = 1ULL << VHOST_NET_F_VIRTIO_NET_HDR; + } + vhost_ack_features_ex(&net->dev, net->feature_bits, features); } @@ -258,12 +264,9 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) if (r < 0) { goto fail; } - net->dev.backend_features = qemu_has_vnet_hdr(options->net_backend) - ? 0 : (1ULL << VHOST_NET_F_VIRTIO_NET_HDR); net->backend = r; net->dev.protocol_features = 0; } else { - virtio_features_clear(net->dev.backend_features_ex); net->dev.protocol_features = 0; net->backend = -1; @@ -284,13 +287,12 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options) net->dev.features &= ~(1ULL << VIRTIO_NET_F_MRG_RXBUF); } - if (virtio_features_andnot(missing_features, - net->dev.backend_features_ex, - net->dev.features_ex)) { - fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT - " for backend\n", VIRTIO_FEATURES_PR(missing_features)); - goto fail; - } + if (!qemu_has_vnet_hdr(options->net_backend) && + (~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR))) { + fprintf(stderr, "vhost lacks feature mask 0x%llx for backend\n", + ~net->dev.features & (1ULL << VHOST_NET_F_VIRTIO_NET_HDR)); + goto fail; + } } /* Set sane init value. Override when guest acks. */ diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c index 699863cc109..859888fdbaf 100644 --- a/hw/scsi/vhost-scsi.c +++ b/hw/scsi/vhost-scsi.c @@ -275,7 +275,6 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp) vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vqs = vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, (void *)(uintptr_t)vhostfd, VHOST_BACKEND_TYPE_KERNEL, 0, errp); diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c index 3612897d4b9..5070178dc28 100644 --- a/hw/scsi/vhost-user-scsi.c +++ b/hw/scsi/vhost-user-scsi.c @@ -159,7 +159,6 @@ static int vhost_user_scsi_connect(DeviceState *dev, Error **errp) vsc->dev.nvqs = VIRTIO_SCSI_VQ_NUM_FIXED + vs->conf.num_queues; vsc->dev.vqs = s->vhost_vqs; vsc->dev.vq_index = 0; - vsc->dev.backend_features = 0; ret = vhost_dev_init(&vsc->dev, &s->vhost_user, VHOST_BACKEND_TYPE_USER, 0, errp); diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 4532d63653e..06179e402e4 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -104,7 +104,6 @@ static void vhost_vdpa_device_realize(DeviceState *dev, Error **errp) v->dev.vqs = vqs; v->dev.vq_index = 0; v->dev.vq_index_end = v->dev.nvqs; - v->dev.backend_features = 0; v->started = false; ret = vhost_vdpa_get_iova_range(v->vhostfd, &iova_range); diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 13c73e7b178..7ce17c5b2d8 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1465,14 +1465,15 @@ static int vhost_user_set_features(struct vhost_dev *dev, int ret; /* - * We need to include any extra backend only feature bits that - * might be needed by our device. Currently this includes the - * VHOST_USER_F_PROTOCOL_FEATURES bit for enabling protocol - * features. + * Don't lose VHOST_USER_F_PROTOCOL_FEATURES, which is vhost-user + * specific. */ - ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, - features | dev->backend_features, - log_enabled); + if (virtio_has_feature(dev->features, VHOST_USER_F_PROTOCOL_FEATURES)) { + features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; + } + + ret = vhost_user_set_u64(dev, VHOST_USER_SET_FEATURES, features, + log_enabled); if (virtio_has_feature(dev->protocol_features, VHOST_USER_PROTOCOL_F_STATUS)) { @@ -2192,8 +2193,6 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque, (dev->config_ops && dev->config_ops->vhost_dev_config_notifier); uint64_t protocol_features; - dev->backend_features |= 1ULL << VHOST_USER_F_PROTOCOL_FEATURES; - err = vhost_user_get_u64(dev, VHOST_USER_GET_PROTOCOL_FEATURES, &protocol_features); if (err < 0) { diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c index 1daae482d37..4bf9a3109d4 100644 --- a/hw/virtio/virtio-hmp-cmds.c +++ b/hw/virtio/virtio-hmp-cmds.c @@ -176,8 +176,6 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict) hmp_virtio_dump_features(mon, s->vhost_dev->features); monitor_printf(mon, " Acked features:\n"); hmp_virtio_dump_features(mon, s->vhost_dev->acked_features); - monitor_printf(mon, " Backend features:\n"); - hmp_virtio_dump_features(mon, s->vhost_dev->backend_features); monitor_printf(mon, " Protocol features:\n"); hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); } diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c index f9cdca50d99..71717c56a41 100644 --- a/hw/virtio/virtio-qmp.c +++ b/hw/virtio/virtio-qmp.c @@ -710,8 +710,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) vdev->guest_features_ex); status->host_features = qmp_decode_features(vdev->device_id, vdev->host_features_ex); - status->backend_features = qmp_decode_features(vdev->device_id, - vdev->backend_features_ex); switch (vdev->device_endian) { case VIRTIO_DEVICE_ENDIAN_LITTLE: @@ -752,8 +750,6 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) qmp_decode_features(vdev->device_id, hdev->features_ex); status->vhost_dev->acked_features = qmp_decode_features(vdev->device_id, hdev->acked_features_ex); - status->vhost_dev->backend_features = - qmp_decode_features(vdev->device_id, hdev->backend_features_ex); status->vhost_dev->protocol_features = qmp_decode_protocols(hdev->protocol_features); diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h index 3dfec5e15cc..e139e059857 100644 --- a/include/hw/virtio/vhost.h +++ b/include/hw/virtio/vhost.h @@ -100,16 +100,9 @@ struct vhost_dev { * * @features: available features provided by the backend * @acked_features: final negotiated features with front-end driver - * - * @backend_features: this is used in a couple of places to either - * store VHOST_USER_F_PROTOCOL_FEATURES to apply to - * VHOST_USER_SET_FEATURES or VHOST_NET_F_VIRTIO_NET_HDR. Its - * future use should be discouraged and the variable retired as - * its easy to confuse with the VirtIO backend_features. */ VIRTIO_DECLARE_FEATURES(features); VIRTIO_DECLARE_FEATURES(acked_features); - VIRTIO_DECLARE_FEATURES(backend_features); /** * @protocol_features: is the vhost-user only feature set by diff --git a/qapi/virtio.json b/qapi/virtio.json index 09dd0e6d05a..671f1ad793c 100644 --- a/qapi/virtio.json +++ b/qapi/virtio.json @@ -85,8 +85,6 @@ # # @acked-features: vhost_dev acked_features # -# @backend-features: vhost_dev backend_features -# # @protocol-features: vhost_dev protocol_features # # @max-queues: vhost_dev max_queues @@ -106,7 +104,6 @@ 'vq-index': 'int', 'features': 'VirtioDeviceFeatures', 'acked-features': 'VirtioDeviceFeatures', - 'backend-features': 'VirtioDeviceFeatures', 'protocol-features': 'VhostDeviceProtocols', 'max-queues': 'uint64', 'backend-cap': 'uint64', -- 2.52.0

1 0

[PATCH v4] libvirt: configure TPM device in the XML
by Srihari Parimi 20 Apr '26

20 Apr '26

Parses vtpm.present from VMX files and converts to libvirt TPM device with CRB model and emulator backend. VMware vTPM uses TPM 2.0 as specified in the document below https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-… Default to the CRB interface for TPM 2.0 systems to improve performance and follow industry standards over legacy TIS. Signed-off-by: Srihari Parimi <sparimi(a)redhat.com> --- src/vmx/vmx.c | 31 +++++++++++++++++++++++++++++++ tests/vmx2xmldata/vtpm.vmx | 22 ++++++++++++++++++++++ tests/vmx2xmldata/vtpm.xml | 32 ++++++++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 ++ 4 files changed, 87 insertions(+) create mode 100644 tests/vmx2xmldata/vtpm.vmx create mode 100644 tests/vmx2xmldata/vtpm.xml diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 57dfd57cfc..bec985aef3 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -599,6 +599,7 @@ static int virVMXParseSerial(virVMXContext *ctx, virConf *conf, int port, static int virVMXParseParallel(virVMXContext *ctx, virConf *conf, int port, virDomainChrDef **def); static int virVMXParseSVGA(virConf *conf, virDomainVideoDef **def); +static int virVMXParseTPM(virConf *conf, virDomainTPMDef **def); static int virVMXFormatVNC(virDomainGraphicsDef *def, virBuffer *buffer); static int virVMXFormatDisk(virVMXContext *ctx, virDomainDiskDef *def, @@ -1938,6 +1939,15 @@ virVMXParseConfig(virVMXContext *ctx, def->nvideos = 1; + /* def:tpms */ + { + virDomainTPMDef *tpm = NULL; + if (virVMXParseTPM(conf, &tpm) < 0) + goto cleanup; + if (tpm) + VIR_APPEND_ELEMENT(def->tpms, def->ntpms, tpm); + } + /* def:sounds */ /* FIXME */ @@ -3367,6 +3377,27 @@ virVMXParseSVGA(virConf *conf, virDomainVideoDef **def) return result; } +static int +virVMXParseTPM(virConf *conf, virDomainTPMDef **def) +{ + bool vtpm_present = false; + + /* vmx:vtpm.present */ + if (virVMXGetConfigBoolean(conf, "vtpm.present", &vtpm_present, + false, true) < 0) { + return -1; + } + + if (!vtpm_present) + return 0; + + *def = g_new0(virDomainTPMDef, 1); + (*def)->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + (*def)->model = VIR_DOMAIN_TPM_MODEL_CRB; + (*def)->data.emulator.version = VIR_DOMAIN_TPM_VERSION_2_0; + + return 0; +} /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * diff --git a/tests/vmx2xmldata/vtpm.vmx b/tests/vmx2xmldata/vtpm.vmx new file mode 100644 index 0000000000..6e2fd725b7 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "19" +displayName = "test-vtpm" +memsize = "4096" +numvcpus = "2" +guestOS = "windows9-64" + +# Disk Configuration +scsi0.present = "TRUE" +scsi0.virtualDev = "lsisas1068" +scsi0:0.present = "TRUE" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "test_disk.vmdk" + +# vTPM configuration +vtpm.present = "TRUE" + +# Network Configuration +ethernet0.present = "TRUE" +ethernet0.connectionType = "nat" +ethernet0.virtualDev = "e1000e" +ethernet0.addressType = "generated" diff --git a/tests/vmx2xmldata/vtpm.xml b/tests/vmx2xmldata/vtpm.xml new file mode 100644 index 0000000000..cbb23ce673 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.xml @@ -0,0 +1,32 @@ +<domain type='vmware'> + <name>test-vtpm</name> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <source file='[datastore] directory/test_disk.vmdk'/> + <target dev='sda' bus='scsi'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='scsi' index='0' model='lsisas1068'/> + <interface type='user'> + <mac address='00:00:00:00:00:00' type='generated'/> + <model type='e1000e'/> + </interface> + <tpm model='tpm-crb'> + <backend type='emulator' version='2.0'/> + </tpm> + <video> + <model type='vmvga' vram='4096' primary='yes'/> + </video> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index fcca765bed..3ffc04fda4 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -243,6 +243,8 @@ mymain(void) DO_TEST("firmware-efi"); + DO_TEST("vtpm"); + ctx.datacenterPath = "folder1/folder2/datacenter1"; DO_TEST("datacenterpath"); -- 2.53.0

1 0

[PATCH v3] vmx: configure TPM device in the XML
by Srihari Parimi 20 Apr '26

20 Apr '26

Parses vtpm.present from VMX files and converts to libvirt TPM device with CRB model and emulator backend. VMware vTPM uses TPM 2.0 as described in the link below https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-… Default to the CRB interface for TPM 2.0 systems to improve performance and follow industry standards over legacy TIS. Signed-off-by: Srihari Parimi <sparimi(a)redhat.com> --- src/vmx/vmx.c | 34 ++++++++++++++++++++++++++++++++++ tests/vmx2xmldata/vtpm.vmx | 22 ++++++++++++++++++++++ tests/vmx2xmldata/vtpm.xml | 32 ++++++++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 ++ 4 files changed, 90 insertions(+) create mode 100644 tests/vmx2xmldata/vtpm.vmx create mode 100644 tests/vmx2xmldata/vtpm.xml diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 57dfd57cfc..9873794568 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -599,6 +599,7 @@ static int virVMXParseSerial(virVMXContext *ctx, virConf *conf, int port, static int virVMXParseParallel(virVMXContext *ctx, virConf *conf, int port, virDomainChrDef **def); static int virVMXParseSVGA(virConf *conf, virDomainVideoDef **def); +static int virVMXParseTPM(virConf *conf, virDomainTPMDef **def); static int virVMXFormatVNC(virDomainGraphicsDef *def, virBuffer *buffer); static int virVMXFormatDisk(virVMXContext *ctx, virDomainDiskDef *def, @@ -1938,6 +1939,18 @@ virVMXParseConfig(virVMXContext *ctx, def->nvideos = 1; + /* def:tpms */ + { + virDomainTPMDef *tpm = NULL; + if (virVMXParseTPM(conf, &tpm) < 0) + goto cleanup; + + VIR_DEBUG("Is vtpm present: %s", + (tpm != NULL) ? "yes" : "no"); + if (tpm) + VIR_APPEND_ELEMENT(def->tpms, def->ntpms, tpm); + } + /* def:sounds */ /* FIXME */ @@ -3367,6 +3380,27 @@ virVMXParseSVGA(virConf *conf, virDomainVideoDef **def) return result; } +static int +virVMXParseTPM(virConf *conf, virDomainTPMDef **def) +{ + bool vtpm_present = false; + + /* vmx:vtpm.present */ + if (virVMXGetConfigBoolean(conf, "vtpm.present", &vtpm_present, + false, true) < 0) { + return -1; + } + + if (!vtpm_present) + return 0; + + *def = g_new0(virDomainTPMDef, 1); + (*def)->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + (*def)->model = VIR_DOMAIN_TPM_MODEL_CRB; + (*def)->data.emulator.version = VIR_DOMAIN_TPM_VERSION_2_0; + + return 0; +} /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * diff --git a/tests/vmx2xmldata/vtpm.vmx b/tests/vmx2xmldata/vtpm.vmx new file mode 100644 index 0000000000..6e2fd725b7 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "19" +displayName = "test-vtpm" +memsize = "4096" +numvcpus = "2" +guestOS = "windows9-64" + +# Disk Configuration +scsi0.present = "TRUE" +scsi0.virtualDev = "lsisas1068" +scsi0:0.present = "TRUE" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "test_disk.vmdk" + +# vTPM configuration +vtpm.present = "TRUE" + +# Network Configuration +ethernet0.present = "TRUE" +ethernet0.connectionType = "nat" +ethernet0.virtualDev = "e1000e" +ethernet0.addressType = "generated" diff --git a/tests/vmx2xmldata/vtpm.xml b/tests/vmx2xmldata/vtpm.xml new file mode 100644 index 0000000000..cbb23ce673 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.xml @@ -0,0 +1,32 @@ +<domain type='vmware'> + <name>test-vtpm</name> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <source file='[datastore] directory/test_disk.vmdk'/> + <target dev='sda' bus='scsi'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='scsi' index='0' model='lsisas1068'/> + <interface type='user'> + <mac address='00:00:00:00:00:00' type='generated'/> + <model type='e1000e'/> + </interface> + <tpm model='tpm-crb'> + <backend type='emulator' version='2.0'/> + </tpm> + <video> + <model type='vmvga' vram='4096' primary='yes'/> + </video> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index fcca765bed..3ffc04fda4 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -243,6 +243,8 @@ mymain(void) DO_TEST("firmware-efi"); + DO_TEST("vtpm"); + ctx.datacenterPath = "folder1/folder2/datacenter1"; DO_TEST("datacenterpath"); -- 2.53.0

1 1

[PATCH v2] libvirt: configure TPM device in the XML
by Srihari Parimi 20 Apr '26

20 Apr '26

Parses vtpm.present from VMX files and converts to libvirt TPM device with CRB model and emulator backend. VMware vTPM uses TPM 2.0 with the CRB Signed-off-by: Srihari Parimi <sparimi(a)redhat.com> --- src/vmx/vmx.c | 34 ++++++++++++++++++++++++++++++++++ tests/vmx2xmldata/vtpm.vmx | 22 ++++++++++++++++++++++ tests/vmx2xmldata/vtpm.xml | 32 ++++++++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 ++ 4 files changed, 90 insertions(+) create mode 100644 tests/vmx2xmldata/vtpm.vmx create mode 100644 tests/vmx2xmldata/vtpm.xml diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 57dfd57cfc..9873794568 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -599,6 +599,7 @@ static int virVMXParseSerial(virVMXContext *ctx, virConf *conf, int port, static int virVMXParseParallel(virVMXContext *ctx, virConf *conf, int port, virDomainChrDef **def); static int virVMXParseSVGA(virConf *conf, virDomainVideoDef **def); +static int virVMXParseTPM(virConf *conf, virDomainTPMDef **def); static int virVMXFormatVNC(virDomainGraphicsDef *def, virBuffer *buffer); static int virVMXFormatDisk(virVMXContext *ctx, virDomainDiskDef *def, @@ -1938,6 +1939,18 @@ virVMXParseConfig(virVMXContext *ctx, def->nvideos = 1; + /* def:tpms */ + { + virDomainTPMDef *tpm = NULL; + if (virVMXParseTPM(conf, &tpm) < 0) + goto cleanup; + + VIR_DEBUG("Is vtpm present: %s", + (tpm != NULL) ? "yes" : "no"); + if (tpm) + VIR_APPEND_ELEMENT(def->tpms, def->ntpms, tpm); + } + /* def:sounds */ /* FIXME */ @@ -3367,6 +3380,27 @@ virVMXParseSVGA(virConf *conf, virDomainVideoDef **def) return result; } +static int +virVMXParseTPM(virConf *conf, virDomainTPMDef **def) +{ + bool vtpm_present = false; + + /* vmx:vtpm.present */ + if (virVMXGetConfigBoolean(conf, "vtpm.present", &vtpm_present, + false, true) < 0) { + return -1; + } + + if (!vtpm_present) + return 0; + + *def = g_new0(virDomainTPMDef, 1); + (*def)->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + (*def)->model = VIR_DOMAIN_TPM_MODEL_CRB; + (*def)->data.emulator.version = VIR_DOMAIN_TPM_VERSION_2_0; + + return 0; +} /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * diff --git a/tests/vmx2xmldata/vtpm.vmx b/tests/vmx2xmldata/vtpm.vmx new file mode 100644 index 0000000000..6e2fd725b7 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "19" +displayName = "test-vtpm" +memsize = "4096" +numvcpus = "2" +guestOS = "windows9-64" + +# Disk Configuration +scsi0.present = "TRUE" +scsi0.virtualDev = "lsisas1068" +scsi0:0.present = "TRUE" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "test_disk.vmdk" + +# vTPM configuration +vtpm.present = "TRUE" + +# Network Configuration +ethernet0.present = "TRUE" +ethernet0.connectionType = "nat" +ethernet0.virtualDev = "e1000e" +ethernet0.addressType = "generated" diff --git a/tests/vmx2xmldata/vtpm.xml b/tests/vmx2xmldata/vtpm.xml new file mode 100644 index 0000000000..cbb23ce673 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.xml @@ -0,0 +1,32 @@ +<domain type='vmware'> + <name>test-vtpm</name> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <source file='[datastore] directory/test_disk.vmdk'/> + <target dev='sda' bus='scsi'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='scsi' index='0' model='lsisas1068'/> + <interface type='user'> + <mac address='00:00:00:00:00:00' type='generated'/> + <model type='e1000e'/> + </interface> + <tpm model='tpm-crb'> + <backend type='emulator' version='2.0'/> + </tpm> + <video> + <model type='vmvga' vram='4096' primary='yes'/> + </video> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index fcca765bed..3ffc04fda4 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -243,6 +243,8 @@ mymain(void) DO_TEST("firmware-efi"); + DO_TEST("vtpm"); + ctx.datacenterPath = "folder1/folder2/datacenter1"; DO_TEST("datacenterpath"); -- 2.53.0

2 2

[PATCH v2] virarptable: add FreeBSD support
by Roman Bogorodskiy 20 Apr '26

20 Apr '26

Add a FreeBSD implementation of the virArpTableGet() function. Update the bhyve driver's bhyveDomainInterfaceAddresses() to use it for the VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP source type. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> Reviewed-by: Michal Privoznik <mprivozn(a)redhat.com> --- Changes since v1: - Replaced custom macros with SA_SIZE - Dropped RTF_LLINFO, it's deprecated on all supported FreeBSD releases - Replace g_strdup() with g_steal_pointer() src/bhyve/bhyve_driver.c | 5 ++- src/util/virarptable.c | 89 +++++++++++++++++++++++++++++++++++++++- 2 files changed, 91 insertions(+), 3 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 93c07c6945..c8dd1a728a 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -1868,12 +1868,15 @@ bhyveDomainInterfaceAddresses(virDomainPtr domain, goto cleanup; switch (source) { + case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP: + ret = virDomainNetARPInterfaces(vm->def, ifaces); + break; + case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE: ret = virDomainNetDHCPInterfaces(vm->def, ifaces); break; case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT: - case VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_ARP: virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, _("Unsupported IP address data source %1$d"), source); diff --git a/src/util/virarptable.c b/src/util/virarptable.c index 20d11f97b0..53cfea7dae 100644 --- a/src/util/virarptable.c +++ b/src/util/virarptable.c @@ -1,7 +1,8 @@ /* - * virarptable.c Linux ARP table handling + * virarptable.c ARP table handling * * Copyright (C) 2018 Chen Hanxiao + * Copyright (C) 2026 The FreeBSD Foundation * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -22,6 +23,16 @@ #ifdef __linux__ # include <linux/rtnetlink.h> +#elif defined(__FreeBSD__) +# include <sys/types.h> +# include <sys/socket.h> +# include <sys/sysctl.h> +# include <net/if.h> +# include <net/if_dl.h> +# include <net/if_types.h> +# include <netinet/in.h> +# include <net/route.h> +# include <arpa/inet.h> #endif #include "viralloc.h" @@ -145,6 +156,80 @@ virArpTableGet(void) return NULL; } +#elif defined(__FreeBSD__) + +virArpTable * +virArpTableGet(void) +{ + int num = 0; + int mib[6] = {CTL_NET, PF_ROUTE, 0, AF_INET, NET_RT_FLAGS, 0}; + size_t needed; + g_autofree char *buf = NULL; + char *next, *lim; + struct rt_msghdr *rtm; + struct sockaddr_in *sin; + struct sockaddr_dl *sdl; + virArpTable *table = NULL; + + if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0) { + virReportSystemError(errno, "%s", _("failed to get ARP table via sysctl")); + return NULL; + } + + if (needed == 0) + return NULL; + + buf = g_new0(char, needed); + + if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) { + virReportSystemError(errno, "%s", _("failed to get ARP table via sysctl")); + return NULL; + } + + table = g_new0(virArpTable, 1); + + lim = buf + needed; + VIR_WARNINGS_NO_CAST_ALIGN + for (next = buf; next < lim; next += rtm->rtm_msglen) { + rtm = (struct rt_msghdr *)next; + + if (rtm->rtm_msglen == 0) + break; + + sin = (struct sockaddr_in *)(rtm + 1); + sdl = (struct sockaddr_dl *)((char *)sin + SA_SIZE(sin)); + + if (sdl->sdl_alen && + (sdl->sdl_type == IFT_ETHER || sdl->sdl_type == IFT_BRIDGE)) { + char *ipstr = NULL; + virSocketAddr virAddr = { 0 }; + virMacAddr macaddr; + char ifmac[VIR_MAC_STRING_BUFLEN]; + + VIR_REALLOC_N(table->t, num + 1); + table->n = num + 1; + + virAddr.len = sizeof(virAddr.data.inet4); + virAddr.data.inet4.sin_family = AF_INET; + virAddr.data.inet4.sin_addr = sin->sin_addr; + ipstr = virSocketAddrFormat(&virAddr); + + table->t[num].ipaddr = g_steal_pointer(&ipstr); + + memcpy(macaddr.addr, LLADDR(sdl), VIR_MAC_BUFLEN); + + virMacAddrFormat(&macaddr, ifmac); + + table->t[num].mac = g_strdup(ifmac); + + num++; + } + } + VIR_WARNINGS_RESET + + return table; +} + #else virArpTable * @@ -155,7 +240,7 @@ virArpTableGet(void) return NULL; } -#endif /* __linux__ */ +#endif void virArpTableFree(virArpTable *table) -- 2.52.0

2 1

[PATCH] libvirt: configure TPM device in the XML
by Srihari Parimi 20 Apr '26

20 Apr '26

Parses vtpm.present from VMX files and converts to libvirt TPM device with CRB model and emulator backend. VMware vTPM uses TPM 2.0 with the CRB Signed-off-by: Srihari Parimi <sparimi(a)redhat.com> --- src/vmx/vmx.c | 50 ++++++++++++++++++++++++++++++++++++++ tests/vmx2xmldata/vtpm.vmx | 22 +++++++++++++++++ tests/vmx2xmldata/vtpm.xml | 32 ++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 ++ 4 files changed, 106 insertions(+) create mode 100644 tests/vmx2xmldata/vtpm.vmx create mode 100644 tests/vmx2xmldata/vtpm.xml diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 57dfd57cfc..9231968175 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -599,6 +599,7 @@ static int virVMXParseSerial(virVMXContext *ctx, virConf *conf, int port, static int virVMXParseParallel(virVMXContext *ctx, virConf *conf, int port, virDomainChrDef **def); static int virVMXParseSVGA(virConf *conf, virDomainVideoDef **def); +static int virVMXParseTPM(virConf *conf, virDomainTPMDef **def); static int virVMXFormatVNC(virDomainGraphicsDef *def, virBuffer *buffer); static int virVMXFormatDisk(virVMXContext *ctx, virDomainDiskDef *def, @@ -1403,6 +1404,7 @@ virVMXParseConfig(virVMXContext *ctx, char *guestOS = NULL; bool smbios_reflecthost = false; bool uefi_secureboot = false; + bool vtpm_present = false; int controller; int bus; int port; @@ -1938,6 +1940,16 @@ virVMXParseConfig(virVMXContext *ctx, def->nvideos = 1; + /* def:tpms */ + { + virDomainTPMDef *tpm = NULL; + if (virVMXParseTPM(conf, &tpm) < 0) + goto cleanup; + + if (tpm) + VIR_APPEND_ELEMENT(def->tpms, def->ntpms, tpm); + } + /* def:sounds */ /* FIXME */ @@ -2001,6 +2013,18 @@ virVMXParseConfig(virVMXContext *ctx, } } + /* vmx: vtpm.present (optional) */ + if (virVMXGetConfigBoolean(conf, "vtpm.present", + &vtpm_present, false, true) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Unable to parse vtpm.present")); + goto cleanup; + } + if (vtpm_present) { + VIR_DEBUG("Processing vtpm_present: %s", + (vtpm_present == true) ? "yes" : "no"); + } + /* vmx:uefi.secureBoot.enabled */ if (virVMXGetConfigBoolean(conf, "uefi.secureBoot.enabled", &uefi_secureboot, false, true) < 0) { @@ -3367,6 +3391,32 @@ virVMXParseSVGA(virConf *conf, virDomainVideoDef **def) return result; } +static int +virVMXParseTPM(virConf *conf, virDomainTPMDef **def) +{ + bool vtpm_present = false; + + if (def == NULL || *def != NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + /* vmx:vtpm.present */ + if (virVMXGetConfigBoolean(conf, "vtpm.present", &vtpm_present, + false, true) < 0) { + return -1; + } + + if (!vtpm_present) + return 0; + + *def = g_new0(virDomainTPMDef, 1); + (*def)->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + (*def)->model = VIR_DOMAIN_TPM_MODEL_CRB; + (*def)->data.emulator.version = VIR_DOMAIN_TPM_VERSION_2_0; + + return 0; +} /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * diff --git a/tests/vmx2xmldata/vtpm.vmx b/tests/vmx2xmldata/vtpm.vmx new file mode 100644 index 0000000000..6e2fd725b7 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "19" +displayName = "test-vtpm" +memsize = "4096" +numvcpus = "2" +guestOS = "windows9-64" + +# Disk Configuration +scsi0.present = "TRUE" +scsi0.virtualDev = "lsisas1068" +scsi0:0.present = "TRUE" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "test_disk.vmdk" + +# vTPM configuration +vtpm.present = "TRUE" + +# Network Configuration +ethernet0.present = "TRUE" +ethernet0.connectionType = "nat" +ethernet0.virtualDev = "e1000e" +ethernet0.addressType = "generated" diff --git a/tests/vmx2xmldata/vtpm.xml b/tests/vmx2xmldata/vtpm.xml new file mode 100644 index 0000000000..cbb23ce673 --- /dev/null +++ b/tests/vmx2xmldata/vtpm.xml @@ -0,0 +1,32 @@ +<domain type='vmware'> + <name>test-vtpm</name> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <source file='[datastore] directory/test_disk.vmdk'/> + <target dev='sda' bus='scsi'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='scsi' index='0' model='lsisas1068'/> + <interface type='user'> + <mac address='00:00:00:00:00:00' type='generated'/> + <model type='e1000e'/> + </interface> + <tpm model='tpm-crb'> + <backend type='emulator' version='2.0'/> + </tpm> + <video> + <model type='vmvga' vram='4096' primary='yes'/> + </video> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index fcca765bed..3ffc04fda4 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -243,6 +243,8 @@ mymain(void) DO_TEST("firmware-efi"); + DO_TEST("vtpm"); + ctx.datacenterPath = "folder1/folder2/datacenter1"; DO_TEST("datacenterpath"); -- 2.53.0

3 3

[PATCH] Add MemAvailable to node memory stats
by Takashi Kajinami 17 Apr '26

17 Apr '26

MemAvailable was introduced in kernel version 3.10 (and it was even backported to older kernels in some distributions) and has been a quite popular method to estimate the available method (totally fully amount + reclaimable amount). Signed-off-by: Takashi Kajinami <kajinamit(a)oss.nttdata.com> --- include/libvirt/libvirt-host.h | 10 ++++++++++ src/libvirt-host.c | 2 ++ src/util/virhostmem.c | 3 ++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-host.h b/include/libvirt/libvirt-host.h index 398b40c35a..5b448e7954 100644 --- a/include/libvirt/libvirt-host.h +++ b/include/libvirt/libvirt-host.h @@ -364,6 +364,16 @@ typedef enum { */ # define VIR_NODE_MEMORY_STATS_CACHED "cached" +/** + * VIR_NODE_MEMORY_STATS_AVAILABLE: + * + * Macro for the available memory: On Linux, it is only returned in case of + * VIR_NODE_MEMORY_STATS_ALL_CELLS. + * + * Since: 12.3.0 + */ +# define VIR_NODE_MEMORY_STATS_AVAILABLE "available" + /** * virNodeMemoryStats: * diff --git a/src/libvirt-host.c b/src/libvirt-host.c index da75f5f30b..6b4345b09d 100644 --- a/src/libvirt-host.c +++ b/src/libvirt-host.c @@ -633,6 +633,8 @@ virNodeGetCPUStats(virConnectPtr conn, * The buffers memory usage.(KB) * VIR_NODE_MEMORY_STATS_CACHED: * The cached memory usage.(KB) + * VIR_NODE_MEMORY_STATS_AVAILABLE: + * The available memory usage.(KB) * * Returns -1 in case of error, 0 in case of success. * diff --git a/src/util/virhostmem.c b/src/util/virhostmem.c index a7027af835..09a322fdea 100644 --- a/src/util/virhostmem.c +++ b/src/util/virhostmem.c @@ -136,7 +136,7 @@ virHostMemGetStatsFreeBSD(virNodeMemoryStatsPtr params, # define SYSFS_MEMORY_SHARED_PATH "/sys/kernel/mm/ksm" # define SYSFS_THREAD_SIBLINGS_LIST_LENGTH_MAX 8192 -# define LINUX_NB_MEMORY_STATS_ALL 4 +# define LINUX_NB_MEMORY_STATS_ALL 5 # define LINUX_NB_MEMORY_STATS_CELL 2 static int @@ -159,6 +159,7 @@ virHostMemGetStatsLinux(FILE *meminfo, {"MemFree:", VIR_NODE_MEMORY_STATS_FREE}, {"Buffers:", VIR_NODE_MEMORY_STATS_BUFFERS}, {"Cached:", VIR_NODE_MEMORY_STATS_CACHED}, + {"MemAvailable:", VIR_NODE_MEMORY_STATS_AVAILABLE}, {NULL, NULL} }; -- 2.49.0

2 1

[PATCH v2] bhyve: add blkiotune support
by Roman Bogorodskiy 17 Apr '26

17 Apr '26

FreeBSD supports resource limiting with the rctl(4) framework. It supports various resource types, including I/O resources. It allows to limit resources for users, processes, login classes, and jails. To apply blkiotune limits set limits for the bhyve process. I/O related resources supported by rctl(4) are: readbps filesystem reads, in bytes per second writebps filesystem writes, in bytes per second readiops filesystem reads, in operations per second writeiops filesystem writes, in operations per second Thus, the actual commands look like: rctl -a process:$bhyvepid:writebps:throttle=10000000 rctl -a process:$bhyvepid:readbps:throttle=10000000 rctl -a process:$bhyvepid:writeiops:throttle=20000 rctl -a process:$bhyvepid:readiops:throttle=20000 This is different from the current blkiotune modeling in libvirt as it requires specific device to apply limits to. To adapt this model to per-domain I/O limits, update domain schema to specify "*" as a device name. The rctl(8) may be not available or not enabled, so add a capability check for that. Per process rules get removed when the process disappears, so no special clean up is necessary. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- Changes since v1: - Documented the "*" device name value in formatdomain.rst - Extended bhyve driver validation to allow only "*" devices and do no allow specifying device weight, added tests for these cases - Updated the RCTL macro to execute the rctl(8) command right away instead of building an array of rules and looping through it once again - Minor formatting fixes docs/formatdomain.rst | 13 ++++-- src/bhyve/bhyve_capabilities.c | 23 ++++++++++ src/bhyve/bhyve_capabilities.h | 1 + src/bhyve/bhyve_domain.c | 20 +++++++++ src/bhyve/bhyve_process.c | 45 +++++++++++++++++++ src/conf/schemas/domaincommon.rng | 5 ++- ...bhyvexml2argv-blkiotune-invalid-device.xml | 32 +++++++++++++ ...yvexml2argv-blkiotune-multiple-devices.xml | 39 ++++++++++++++++ .../x86_64/bhyvexml2argv-blkiotune-weight.xml | 33 ++++++++++++++ .../x86_64/bhyvexml2argv-blkiotune.args | 10 +++++ .../x86_64/bhyvexml2argv-blkiotune.ldargs | 4 ++ .../x86_64/bhyvexml2argv-blkiotune.xml | 32 +++++++++++++ tests/bhyvexml2argvtest.c | 4 ++ .../x86_64/bhyvexml2xmlout-blkiotune.xml | 42 +++++++++++++++++ tests/bhyvexml2xmltest.c | 4 ++ 15 files changed, 302 insertions(+), 5 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-invalid-device.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-weight.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 1a4bd4c6e9..6c4e067072 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -1367,10 +1367,15 @@ Block I/O Tuning associated with each guest disk device (contrast this to the <iotune> element of a disk definition (See `Hard drives, floppy disks, CDROMs`_) which can applies to an individual disk). Each ``device`` element has - two mandatory sub-elements, ``path`` describing the absolute path of the - device, and ``weight`` giving the relative weight of that device, in the - range [100, 1000]. After kernel 2.6.39, the value could be in the range [10, - 1000]. :since:`Since 0.9.8` + a mandatory ``path`` sub-element describing the absolute path of the + device. + + A special value ``*`` can be used to throttle all domain + devices. :since:`Since 12.3.0, bhyve` + + An optional ``weight`` sub-element specifies the relative + weight of the device, in the range [100, 1000]. After kernel 2.6.39, + the value could be in the range [10, 1000]. :since:`Since 0.9.8` Additionally, the following optional sub-elements can be used: ``read_bytes_sec`` diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index c3fb88fe9f..1fe0a3ad77 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -24,6 +24,7 @@ #include <config.h> #include <sys/utsname.h> #include <dirent.h> +#include <sys/sysctl.h> #include <sys/types.h> #include "viralloc.h" @@ -334,6 +335,27 @@ bhyveProbeCapsVNCPassword(unsigned int *caps, char *binary) } +static void +bhyveProbeCapsRctl(unsigned int *caps) +{ + bool racct_enable; + size_t racct_enable_len; + g_autofree char *rctl = NULL; + + if (!(rctl = virFindFileInPath("rctl"))) + return; + + racct_enable_len = sizeof(racct_enable); + if (sysctlbyname("kern.racct.enable", &racct_enable, + &racct_enable_len, NULL, 0) < 0) + return; + + if (racct_enable) + *caps |= BHYVE_CAP_RCTL; + + return; +} + int virBhyveProbeCaps(unsigned int *caps) { @@ -356,6 +378,7 @@ virBhyveProbeCaps(unsigned int *caps) if ((ret = bhyveProbeCapsVNCPassword(caps, binary))) goto out; + bhyveProbeCapsRctl(caps); out: VIR_FREE(binary); diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 31fd9ab86a..0302b68e22 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -57,6 +57,7 @@ typedef enum { BHYVE_CAP_NVME = 1 << 11, BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, + BHYVE_CAP_RCTL = 1 << 14, } virBhyveCapsFlags; int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps); diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 4594d7673f..7bce6a4bc0 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -464,6 +464,26 @@ bhyveDomainDefValidate(const virDomainDef *def, } } + if (def->blkio.ndevices > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Per device I/O tuning is not supported")); + return -1; + } else if (def->blkio.ndevices == 1) { + virBlkioDevice *device = &def->blkio.devices[0]; + + if (STRNEQ(device->path, "*")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Per device I/O tuning is not supported")); + return -1; + } + + if (device->weight != 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Only \"*\" is supported as a device path for I/O tuning")); + return -1; + } + } + if (!def->os.loader) return 0; diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 1d436da609..3eb807b9fe 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -34,6 +34,7 @@ #include "bhyve_device.h" #include "bhyve_driver.h" +#include "bhyve_capabilities.h" #include "bhyve_command.h" #include "bhyve_firmware.h" #include "bhyve_monitor.h" @@ -132,6 +133,47 @@ bhyveProcessStopHook(struct _bhyveConn *driver, VIR_HOOK_SUBOP_END, NULL, xml, NULL); } +static int +bhyveSetResourceLimits(struct _bhyveConn *driver, virDomainObj *vm) +{ + virBlkioDevice *device; + + if (vm->def->blkio.ndevices != 1) + return 0; + + if ((bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_RCTL) == 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Cannot set resource limits: RACCT/RCTL is either not supported or not enabled")); + return -1; + } + + device = &vm->def->blkio.devices[0]; + +#define BHYVE_APPLY_RCTL_RULE(field, type, format) \ + do { \ + if ((field)) { \ + g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; \ + g_autofree char *rule = NULL; \ + g_autoptr(virCommand) cmd = virCommandNew("rctl"); \ + virBufferAsprintf(&buf, "process:%d:" type ":throttle=" format, \ + vm->pid, (field)); \ + rule = virBufferContentAndReset(&buf); \ + virCommandAddArgList(cmd, "-a", rule, NULL); \ + if (virCommandRun(cmd, NULL) < 0) \ + return -1; \ + } \ + } while (0) + + BHYVE_APPLY_RCTL_RULE(device->riops, "readiops", "%u"); + BHYVE_APPLY_RCTL_RULE(device->wiops, "writeiops", "%u"); + BHYVE_APPLY_RCTL_RULE(device->rbps, "readbps", "%llu"); + BHYVE_APPLY_RCTL_RULE(device->wbps, "writebps", "%llu"); + +#undef BHYVE_APPLY_RCTL_RULE + + return 0; +} + static int virBhyveProcessStartImpl(struct _bhyveConn *driver, virDomainObj *vm, @@ -258,6 +300,9 @@ virBhyveProcessStartImpl(struct _bhyveConn *driver, BHYVE_STATE_DIR) < 0) goto cleanup; + if (bhyveSetResourceLimits(driver, vm) < 0) + goto cleanup; + if (bhyveProcessStartHook(driver, vm, VIR_HOOK_BHYVE_OP_STARTED) < 0) goto cleanup; diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index db1dcd3bb7..c7f442a4c1 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -1049,7 +1049,10 @@ <element name="device"> <interleave> <element name="path"> - <ref name="absFilePath"/> + <choice> + <ref name="absFilePath"/> + <value>*</value> + </choice> </element> <optional> <element name="weight"> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-invalid-device.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-invalid-device.xml new file mode 100644 index 0000000000..68d6871e0c --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-invalid-device.xml @@ -0,0 +1,32 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>/dev/sda</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml new file mode 100644 index 0000000000..a6b689ad9a --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-multiple-devices.xml @@ -0,0 +1,39 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>*</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + <device> + <path>/dev/hda</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-weight.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-weight.xml new file mode 100644 index 0000000000..f7603828e0 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune-weight.xml @@ -0,0 +1,33 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>*</path> + <weight>100</weight> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args new file mode 100644 index 0000000000..507e0be668 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml new file mode 100644 index 0000000000..956d96cf18 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-blkiotune.xml @@ -0,0 +1,32 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <blkiotune> + <device> + <path>*</path> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + </device> + </blkiotune> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index b7749fec6f..71c67ba2a2 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -289,6 +289,10 @@ mymain(void) DO_TEST_FAILURE("slirp-ip"); DO_TEST("virtio-scsi"); DO_TEST("vcpupin"); + DO_TEST("blkiotune"); + DO_TEST_FAILURE("blkiotune-invalid-device"); + DO_TEST_FAILURE("blkiotune-multiple-devices"); + DO_TEST_FAILURE("blkiotune-weight"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml new file mode 100644 index 0000000000..4170303a6e --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-blkiotune.xml @@ -0,0 +1,42 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <blkiotune> + <device> + <path>*</path> + <read_iops_sec>20000</read_iops_sec> + <write_iops_sec>20000</write_iops_sec> + <read_bytes_sec>10000</read_bytes_sec> + <write_bytes_sec>10000</write_bytes_sec> + </device> + </blkiotune> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <source bridge='virbr0'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 950aaea672..9fa8a9765d 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -133,6 +133,10 @@ mymain(void) DO_TEST_DIFFERENT("slirp"); DO_TEST_DIFFERENT("virtio-scsi"); DO_TEST_DIFFERENT("numa"); + DO_TEST_DIFFERENT("blkiotune"); + DO_TEST_FAILURE("blkiotune-invalid-device"); + DO_TEST_FAILURE("blkiotune-weight"); + DO_TEST_FAILURE("blkiotune-multiple-devices"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.52.0

2 1

[PATCH v6 0/3] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 17 Apr '26

17 Apr '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (3): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2884 ++++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ 58 files changed, 18765 insertions(+), 102 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

3 12