May 2026 - Devel - libvirt List Archives

[PATCH RFC 0/6] Add qemu-vnc support
by marcandre.lureau＠redhat.com 04 Jun '26

04 Jun '26

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> Hi, This series allows to run the QEMU VNC server in a standalone process. The qemu-vnc binary is aimed to be released with QEMU 11.1. It is still being reviewed (https://patchew.org/QEMU/20260410-qemu-vnc-v2-0-231416f76dc3@redhat.com/) The standalone VNC activates automatically when a domain has both <graphics type='dbus'/> (bus mode) and <graphics type='vnc'/>, and the qemu-vnc binary is available. Comments welcome! Marc-André Lureau (6): qemu: add standalone VNC state directory qemu: add qemu-vnc configuration qemu: add qemu-vnc helper unit qemu: integrate standalone VNC in domain lifecycle qemu: wire up standalone VNC in driver APIs qemu: add tests for standalone VNC graphics po/POTFILES | 1 + src/qemu/libvirtd_qemu.aug | 1 + src/qemu/meson.build | 1 + src/qemu/qemu.conf.in | 8 + src/qemu/qemu_command.c | 2 + src/qemu/qemu_conf.c | 8 + src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 2 + src/qemu/qemu_driver.c | 68 ++- src/qemu/qemu_extdevice.c | 13 +- src/qemu/qemu_hotplug.c | 12 + src/qemu/qemu_process.c | 40 +- src/qemu/qemu_vnc.c | 407 ++++++++++++++++++ src/qemu/qemu_vnc.h | 41 ++ src/qemu/test_libvirtd_qemu.aug.in | 1 + ...hics-vnc-standalone-p2p.x86_64-latest.args | 34 ++ ...phics-vnc-standalone-p2p.x86_64-latest.xml | 40 ++ .../graphics-vnc-standalone-p2p.xml | 39 ++ ...s-vnc-standalone-socket.x86_64-latest.args | 33 ++ ...cs-vnc-standalone-socket.x86_64-latest.xml | 40 ++ .../graphics-vnc-standalone-socket.xml | 40 ++ ...graphics-vnc-standalone.x86_64-latest.args | 33 ++ .../graphics-vnc-standalone.x86_64-latest.xml | 40 ++ .../graphics-vnc-standalone.xml | 40 ++ tests/qemuxmlconftest.c | 4 + tests/testutilsqemu.c | 9 + 27 files changed, 950 insertions(+), 10 deletions(-) create mode 100644 src/qemu/qemu_vnc.c create mode 100644 src/qemu/qemu_vnc.h create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-p2p.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-p2p.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-p2p.xml create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-socket.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-socket.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone-socket.xml create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/graphics-vnc-standalone.xml -- 2.53.0

3 10

[PATCH v2 00/16] qemu: Fix CPU feature reporting on AMD CPUs
by Jiri Denemark 02 Jun '26

02 Jun '26

See the last patch for detailed description and individual patches for specific changes in v2. Important changes in version 2: - tests - the functionality uses a new flag for virConnectGetDomainCapabilities Jiri Denemark (16): cpu_conf: Introduce virCPUDefSortFeatures qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel qemu_capabilities: Always sort features in host-model CPU qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel qemu_capabilities: Cache expanded CPU domaincapstest: Test EXPAND_CPU_FEATURES flag util: Publish and mock virHostCPUGetMSRFromKVM cpu_x86: Introduce virCPUx86DataAddMSR cpu: Introduce virCPUUpdateFeatures Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag virsh: Add --supported-cpu-features option for domcapabilities domaincapstest: Test SUPPORTED_CPU_FEATURES flag qemu_capabilities: Fix domain capabilities on AMD CPUs docs/manpages/virsh.rst | 12 +- include/libvirt/libvirt-domain.h | 3 + src/conf/cpu_conf.c | 20 + src/conf/cpu_conf.h | 3 + src/cpu/cpu.c | 48 +- src/cpu/cpu.h | 12 + src/cpu/cpu_x86.c | 54 +- src/cpu/cpu_x86.h | 4 + src/libvirt-domain.c | 14 +- src/libvirt_private.syms | 4 + src/qemu/qemu_capabilities.c | 214 +- src/qemu/qemu_capabilities.h | 6 +- src/qemu/qemu_conf.c | 6 +- src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_driver.c | 18 +- src/util/virhostcpu.c | 16 +- src/util/virhostcpu.h | 3 + ...qemu_10.0.0-q35.x86_64+amdsev-expanded.xml | 1123 ++++++++ ...emu_10.0.0-q35.x86_64+amdsev-supported.xml | 1015 +++++++ .../qemu_10.0.0-q35.x86_64+amdsev.xml | 48 +- .../qemu_10.0.0-q35.x86_64-expanded.xml | 1979 ++++++++++++++ .../qemu_10.0.0-q35.x86_64-supported.xml | 1903 ++++++++++++++ .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 50 +- .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 60 +- .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 60 +- tests/domaincapsdata/qemu_10.0.0.s390x.xml | 94 +- .../qemu_10.0.0.x86_64+amdsev.xml | 48 +- tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 50 +- ...mu_10.1.0-q35.x86_64+inteltdx-expanded.xml | 1250 +++++++++ ...u_10.1.0-q35.x86_64+inteltdx-supported.xml | 1064 ++++++++ .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 56 +- .../qemu_10.1.0-q35.x86_64-expanded.xml | 2328 +++++++++++++++++ .../qemu_10.1.0-q35.x86_64-supported.xml | 2259 ++++++++++++++++ .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 40 +- .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 66 +- .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 66 +- tests/domaincapsdata/qemu_10.1.0.s390x.xml | 106 +- .../qemu_10.1.0.x86_64+inteltdx.xml | 56 +- tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 40 +- .../qemu_10.2.0-q35.x86_64+mshv-expanded.xml | 237 ++ .../qemu_10.2.0-q35.x86_64+mshv-supported.xml | 237 ++ .../qemu_10.2.0-q35.x86_64-expanded.xml | 1483 +++++++++++ .../qemu_10.2.0-q35.x86_64-supported.xml | 1365 ++++++++++ .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 24 +- .../qemu_10.2.0-tcg.x86_64+mshv.xml | 66 +- .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 66 +- tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 24 +- .../qemu_11.0.0-q35.x86_64+sgx-expanded.xml | 1865 +++++++++++++ .../qemu_11.0.0-q35.x86_64+sgx-supported.xml | 1747 +++++++++++++ .../qemu_11.0.0-q35.x86_64+sgx.xml | 24 +- .../qemu_11.0.0-q35.x86_64-expanded.xml | 1856 +++++++++++++ .../qemu_11.0.0-q35.x86_64-supported.xml | 1738 ++++++++++++ .../domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 24 +- .../qemu_11.0.0-tcg.x86_64+sgx.xml | 66 +- .../domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 66 +- tests/domaincapsdata/qemu_11.0.0.s390x.xml | 106 +- .../domaincapsdata/qemu_11.0.0.x86_64+sgx.xml | 24 +- tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 24 +- .../qemu_7.2.0-hvf.x86_64+hvf.xml | 36 +- .../qemu_7.2.0-q35.x86_64-expanded.xml | 1257 +++++++++ .../qemu_7.2.0-q35.x86_64-supported.xml | 1181 +++++++++ .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 36 +- .../qemu_7.2.0-tcg.x86_64+hvf.xml | 46 +- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 46 +- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 36 +- .../qemu_8.0.0-q35.x86_64-expanded.xml | 1366 ++++++++++ .../qemu_8.0.0-q35.x86_64-supported.xml | 1290 +++++++++ .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 36 +- .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 54 +- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 36 +- .../qemu_8.1.0-q35.x86_64-expanded.xml | 1624 ++++++++++++ .../qemu_8.1.0-q35.x86_64-supported.xml | 1548 +++++++++++ .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 38 +- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 60 +- tests/domaincapsdata/qemu_8.1.0.s390x.xml | 62 +- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 38 +- .../qemu_8.2.0-q35.x86_64-expanded.xml | 1626 ++++++++++++ .../qemu_8.2.0-q35.x86_64-supported.xml | 1550 +++++++++++ .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 40 +- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 58 +- tests/domaincapsdata/qemu_8.2.0.s390x.xml | 62 +- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 40 +- .../qemu_9.0.0-q35.x86_64-expanded.xml | 1627 ++++++++++++ .../qemu_9.0.0-q35.x86_64-supported.xml | 1551 +++++++++++ .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 40 +- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 62 +- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 40 +- .../qemu_9.1.0-q35.x86_64-expanded.xml | 1763 +++++++++++++ .../qemu_9.1.0-q35.x86_64-supported.xml | 1687 ++++++++++++ .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 48 +- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 60 +- tests/domaincapsdata/qemu_9.1.0.s390x.xml | 94 +- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 48 +- .../qemu_9.2.0-q35.x86_64+amdsev-expanded.xml | 1003 +++++++ ...qemu_9.2.0-q35.x86_64+amdsev-supported.xml | 895 +++++++ .../qemu_9.2.0-q35.x86_64+amdsev.xml | 48 +- .../qemu_9.2.0-q35.x86_64-expanded.xml | 1821 +++++++++++++ .../qemu_9.2.0-q35.x86_64-supported.xml | 1745 ++++++++++++ .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 50 +- .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 60 +- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 60 +- tests/domaincapsdata/qemu_9.2.0.s390x.xml | 94 +- .../qemu_9.2.0.x86_64+amdsev.xml | 48 +- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 50 +- tests/domaincapstest.c | 56 +- tests/qemucpumock.c | 22 + tools/virsh-host.c | 7 + 107 files changed, 48819 insertions(+), 1569 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.0.0-q35.x86_64+amdsev-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.0.0-q35.x86_64+amdsev-supported.xml create mode 100644 tests/domaincapsdata/qemu_10.0.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.0.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx-supported.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0-q35.x86_64+mshv-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0-q35.x86_64+mshv-supported.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx-expanded.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx-supported.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_11.0.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_7.2.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_7.2.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_8.0.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_8.0.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_8.1.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_8.1.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_8.2.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_8.2.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_9.0.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_9.0.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_9.1.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_9.1.0-q35.x86_64-supported.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0-q35.x86_64+amdsev-expanded.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0-q35.x86_64+amdsev-supported.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0-q35.x86_64-expanded.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0-q35.x86_64-supported.xml -- 2.54.0

2 32

[PATCH v1 0/7] Add TLS-PSK support for migration
by Abhisek Panda 01 Jun '26

01 Jun '26

QEMU provides the ability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, the patch series introduce the alternative pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. During a migration, the parties negotiate which unique key to utilize for encrypting the migration data. To improve the security further, we utilize different key files for each migration session. Abhisek Panda (7): conf: Add configuration params for TLS-PSK include: define VIR_MIGRATE_TLS_PSK flag qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects include: define VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY include/libvirt/libvirt-domain.h | 31 ++- src/qemu/libvirtd_qemu.aug | 2 + src/qemu/qemu.conf.in | 27 ++- src/qemu/qemu_alias.c | 19 +- src/qemu/qemu_alias.h | 5 +- src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_command.c | 31 ++- src/qemu/qemu_command.h | 8 + src/qemu/qemu_conf.c | 55 ++++- src/qemu/qemu_conf.h | 3 + src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_driver.c | 24 ++- src/qemu/qemu_hotplug.c | 125 +++++++---- src/qemu/qemu_hotplug.h | 43 ++-- src/qemu/qemu_migration.c | 194 ++++++++++++------ src/qemu/qemu_migration.h | 3 + src/qemu/qemu_migration_params.c | 138 ++++++++++--- src/qemu/qemu_migration_params.h | 28 ++- src/qemu/qemu_postparse.c | 2 +- src/qemu/test_libvirtd_qemu.aug.in | 2 + tests/qemumigparamsdata/tls-enabled.json | 2 +- tests/qemumigparamsdata/tls-enabled.reply | 2 +- tests/qemumigparamsdata/tls-enabled.xml | 2 +- tests/qemumigparamsdata/tls-hostname.json | 2 +- tests/qemumigparamsdata/tls-hostname.reply | 2 +- tests/qemumigparamsdata/tls-hostname.xml | 2 +- tests/qemumonitorjsontest.c | 4 +- tests/qemustatusxml2xmldata/upgrade-out.xml | 2 +- .../chardev-backends-json.x86_64-9.1.0.args | 8 +- .../chardev-backends-json.x86_64-latest.args | 8 +- .../chardev-backends.x86_64-9.1.0.args | 8 +- .../chardev-backends.x86_64-latest.args | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 6 +- ...isk-network-tlsx509-nbd.x86_64-latest.args | 6 +- ...-tlsx509-chardev-verify.x86_64-latest.args | 4 +- ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 4 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 4 +- tests/testutilsqemu.c | 2 + tools/virsh-domain.c | 12 ++ 39 files changed, 623 insertions(+), 209 deletions(-) -- 2.39.3

3 13

[PATCH v8 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 01 Jun '26

01 Jun '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently. Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2864 +++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18845 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.43.0

1 4

[RFC patch 00/17] qemu: Unlock VM object while accessing storage (in certain cases)
by Peter Krempa 29 May '26

29 May '26

If a thread is blocked while holding the VM lock, other operations become impossible. This is due to the fact that both listing domains of a daemon requires locking the objects (for accessing the name/uuid/id, but also for filtering). Similarly even if a user has a virDomainPtr instace already looked up invoking an API results into trying to fetch a locked VM object instance which will simply block. This patchset is a path for being able to identify stuff which colud block and similarly to how monitor is accessed unlocking @vm while doing such operation. To show how it's used, we use it when probing disk size data. The patchset obviously needed to refactor stuff first for this to happen. Peter Krempa (17): storage_source: Don't modify @src in 'virStorageSourceUpdatePhysicalSize' virStorageSourceGetSize: Return also 'allocation' value if needed virStorageFileProbeFormatFromBuf: Allow NULL 'path' argument virStorageFileProbeGetMetadata: Allow NULL 'meta->path' virStorageSourceGetMetadataFromBuf: Refactor cleanup virStorageSourceUpdateCapacity: Factor out size probing to 'virStorageSourceProbeCapacityFromBuf' qemu: domain: Introduce 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainGetStatsOneBlock: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuMigrationDstPrepareStorage: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainBlockResize: Rewrite to 'qemuDomainStorageSourceProbeSize' qemu: domain: Remove 'qemuDomainStorageUpdatePhysical' qemuDomainGetStatsOneBlockFallback: Rewrite using 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite using 'qemuDomainStorageSourceProbeSize' qemu: domain: Fix coding style of domain object locking helpers qemu: domain: Introduce APIs for unlocking domain object during potentially long running operations qemuDomainStorageSourceProbeSize: Yield domain object while accessing storage src/libvirt_private.syms | 3 +- src/qemu/qemu_domain.c | 140 ++++++++++++++++++++++--- src/qemu/qemu_domain.h | 19 +++- src/qemu/qemu_driver.c | 143 +++++++------------------- src/qemu/qemu_migration.c | 5 +- src/storage_file/storage_file_probe.c | 20 +++- src/storage_file/storage_source.c | 98 +++++++++++++----- src/storage_file/storage_source.h | 16 ++- 8 files changed, 279 insertions(+), 165 deletions(-) -- 2.54.0

1 17

KVM Forum 2026: Call For Presentations
by Peter Maydell 29 May '26

29 May '26

#################### KVM Forum 2026 November 12-13, 2026 Vancouver, Canada #################### On behalf of the program committee for the KVM Forum, I am pleased to announce the KVM Forum 2026 Call for Presentations. CALL FOR PRESENTATIONS ====================== We encourage you to submit presentations via Pretalx at https://kvm-forum.qemu.org/2026/cfp/ All presentation slots will be 25 minutes + 5 minutes for questions. Suggested topics: - Scalability and Optimization - Hardening and security - Confidential computing KVM and the Linux Kernel - New Features and Architecture Ports - Device Passthrough: VFIO, mdev, vDPA - Network Virtualization - Virtio and vhost Virtual Machine Monitors and Management - VMM Implementation: APIs, Live Migration, Performance Tuning, etc. - Multi-process VMMs: vhost-user, vfio-user, QEMU Storage Daemon - QEMU without KVM: Hypervisor.framework, Hyper-V, etc. - Managing KVM: Libvirt, KubeVirt, Kata Containers Emulation - New Devices, Boards and Architectures - CPU Emulation and Binary Translation Developer-focused content - Tooling improvements - Enabling Rust - Testing frameworks and strategies Speakers are expected to attend in person. IMPORTANT DATES =============== The deadline for submitting presentations is: 2026-08-01 00:00 (Canada/Pacific) Accepted speakers will be notified on August 21, 2026. ATTENDING KVM FORUM =================== The cost of admission to KVM Forum 2026 is $75. You can get your ticket at https://kvm-forum.qemu.org/2026/register/ Admission is free for accepted speakers. The conference will be held at Coast Coal Harbour Hotel Vancouver by APA in Vancouver, Canada. More details about the location, and about the reduced price rooms available for attendees at the conference hotel, can be found at: https://kvm-forum.qemu.org/location/ If you need a visa invitation letter in order to attend, please reach out to the organizers at kvm-forum-pc(a)redhat.com. We are committed to fostering an open and welcoming environment at our conference. Participants are expected to abide by our code of conduct and media policy: https://kvm-forum.qemu.org/coc/ https://kvm-forum.qemu.org/media-policy/ CONTACTS ======== Reach out to us should you have any questions. The program committee may be contacted as a group via email: kvm-forum-pc(a)redhat.com. -- Peter Maydell

1 0

[PATCH] examples: Improved shell output of showDomains
by Daniel Hora 29 May '26

29 May '26

From: Daniel Hora <dhora(a)redhat.com> Improved formatting of the shell output of the function showDomains based on length of the longest domain. Signed-off-by: Daniel Hora <dhora(a)redhat.com> --- examples/c/misc/hellolibvirt.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/examples/c/misc/hellolibvirt.c b/examples/c/misc/hellolibvirt.c index 39cefe934c..77098d7be3 100644 --- a/examples/c/misc/hellolibvirt.c +++ b/examples/c/misc/hellolibvirt.c @@ -4,6 +4,7 @@ #include <stdio.h> #include <stdlib.h> +#include <string.h> #include <libvirt/libvirt.h> #include <libvirt/virterror.h> @@ -44,11 +45,34 @@ showHypervisorInfo(virConnectPtr conn) return 0; } +static int +longestDomain(virDomainPtr *nameList, int numNames) +{ + int longestDomainLength; + size_t i; + + longestDomainLength = 0; + + for (i = 0; i < numNames; i++) { + const char *currentDomain = virDomainGetName(nameList[i]); + + if (currentDomain != NULL) { + int currentDomainLength = strlen(currentDomain); + + if (currentDomainLength > longestDomainLength) { + longestDomainLength = currentDomainLength; + } + } + } + + return longestDomainLength; + +} static int showDomains(virConnectPtr conn) { - int numNames, numInactiveDomains, numActiveDomains; + int numNames, numInactiveDomains, numActiveDomains, longestDomainLength; ssize_t i; int flags = VIR_CONNECT_LIST_DOMAINS_ACTIVE | VIR_CONNECT_LIST_DOMAINS_INACTIVE; @@ -88,9 +112,12 @@ showDomains(virConnectPtr conn) return 1; } + longestDomainLength = longestDomain(nameList, numNames); + for (i = 0; i < numNames; i++) { int active = virDomainIsActive(nameList[i]); - printf(" %8s (%s)\n", + printf(" %-*s (%s)\n", + longestDomainLength, virDomainGetName(nameList[i]), (active == 1 ? "active" : "non-active")); /* must free the returned named per the API documentation */ -- 2.54.0

2 1

Entering freeze for libvirt-12.4.0
by Jiri Denemark 28 May '26

28 May '26

I have just tagged v12.4.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[PATCH 00/10] qemu: Fix CPU feature reporting on AMD CPUs
by Jiri Denemark 28 May '26

28 May '26

See the last patch for detailed description. Jiri Denemark (10): qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel qemu_capabilities: Cache expanded CPU util: Publish and mock virHostCPUGetMSRFromKVM cpu_x86: Introduce virCPUx86DataAddMSR cpu: Introduce virCPUUpdateFeatures Clarify documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES qemu_capabilities: Fix domain capabilities on AMD CPUs docs/manpages/virsh.rst | 4 +- include/libvirt/libvirt-domain.h | 2 +- src/cpu/cpu.c | 33 +++++ src/cpu/cpu.h | 12 ++ src/cpu/cpu_x86.c | 54 ++++++-- src/cpu/cpu_x86.h | 4 + src/libvirt-domain.c | 7 +- src/libvirt_private.syms | 3 + src/qemu/qemu_capabilities.c | 223 ++++++++++++++++++++++--------- src/qemu/qemu_capabilities.h | 7 +- src/qemu/qemu_conf.c | 6 +- src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_driver.c | 15 +-- src/util/virhostcpu.c | 16 ++- src/util/virhostcpu.h | 3 + tests/domaincapstest.c | 2 +- tests/qemucpumock.c | 22 +++ tools/virsh-host.c | 2 +- 18 files changed, 319 insertions(+), 99 deletions(-) -- 2.54.0

3 12

[PATCH] qemu_nbdkit: Fix format when printing time_t values
by Michal Privoznik 28 May '26

28 May '26

From: Michal Privoznik <mprivozn(a)redhat.com> The time_t type can be 32bit or 64bit signed integer. There are systems where it's defined as long, or long long (32bit systems usually). Therefore, using just 'l' length modifier is not good enough. Also, using 'u' conversion specifier is also wrong (though, values stored in qemuNbdkitCaps struct reflect mtime of some files, so there won't be a negative value). Anyway, do what we already do for virQEMUCaps - use '%lld' printf format and typecast to long long. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Spotted this on the following pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/jobs/14580340190 in which I was testing moving our CI from Debian 12 to 13. Apparently, in Debian they decided to -D_TIME_BITS=64 for everything [1] and only when compiling on a 32bit arch it's when time_t expands to 'long long'. 1: https://wiki.debian.org/ReleaseGoals/64bit-time src/qemu/qemu_nbdkit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_nbdkit.c b/src/qemu/qemu_nbdkit.c index 542a6b1f44..6918fc6631 100644 --- a/src/qemu/qemu_nbdkit.c +++ b/src/qemu/qemu_nbdkit.c @@ -544,18 +544,18 @@ qemuNbdkitCapsFormatCache(qemuNbdkitCaps *nbdkitCaps) virBufferEscapeString(&buf, "<path>%s</path>\n", nbdkitCaps->path); - virBufferAsprintf(&buf, "<nbdkitctime>%lu</nbdkitctime>\n", - nbdkitCaps->ctime); + virBufferAsprintf(&buf, "<nbdkitctime>%lld</nbdkitctime>\n", + (long long)nbdkitCaps->ctime); virBufferEscapeString(&buf, "<plugindir>%s</plugindir>\n", nbdkitCaps->pluginDir); - virBufferAsprintf(&buf, "<plugindirmtime>%lu</plugindirmtime>\n", - nbdkitCaps->pluginDirMtime); + virBufferAsprintf(&buf, "<plugindirmtime>%lld</plugindirmtime>\n", + (long long)nbdkitCaps->pluginDirMtime); virBufferEscapeString(&buf, "<filterdir>%s</filterdir>\n", nbdkitCaps->filterDir); - virBufferAsprintf(&buf, "<filterdirmtime>%lu</filterdirmtime>\n", - nbdkitCaps->filterDirMtime); - virBufferAsprintf(&buf, "<selfctime>%lu</selfctime>\n", - nbdkitCaps->libvirtCtime); + virBufferAsprintf(&buf, "<filterdirmtime>%lld</filterdirmtime>\n", + (long long)nbdkitCaps->filterDirMtime); + virBufferAsprintf(&buf, "<selfctime>%lld</selfctime>\n", + (long long)nbdkitCaps->libvirtCtime); virBufferAsprintf(&buf, "<selfvers>%u</selfvers>\n", nbdkitCaps->libvirtVersion); @@ -593,10 +593,10 @@ virNbdkitCapsSaveFile(void *data, return -1; } - VIR_DEBUG("Saved caps '%s' for '%s' with (%lu, %lu)", + VIR_DEBUG("Saved caps '%s' for '%s' with (%lld, %lld)", filename, nbdkitCaps->path, - nbdkitCaps->ctime, - nbdkitCaps->libvirtCtime); + (long long)nbdkitCaps->ctime, + (long long)nbdkitCaps->libvirtCtime); return 0; } -- 2.53.0

2 1