- Devel - libvirt List Archives

[PATCH] bhyve: workaround for the lack of UTC clock on ARM64
by Roman Bogorodskiy 19 Jan '26

19 Jan '26

Currently, bhyve does not support UTC clock offset on ARM64. However, when <clock offset= > is not specified in the domain XML, UTC offset is used by default. That results in an incorrect configuration for the bhyve ARM64 guests by default. Workaround is to extend bhyveDomainDefPostParse() to fall back to the LOCALTIME clock offset when UTC clock offset is not supported by bhyve. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_domain.c | 6 ++++++ tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args | 1 - .../bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args | 1 - tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args | 1 - tests/bhyvexml2argvtest.c | 2 ++ tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml | 2 +- .../aarch64/bhyvexml2xmlout-bootloader.xml | 2 +- .../bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml | 2 +- tests/bhyvexml2xmltest.c | 4 +++- 9 files changed, 14 insertions(+), 7 deletions(-) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 0c33a67ca6..df0a008ecd 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -106,6 +106,12 @@ bhyveDomainDefPostParse(virDomainDef *def, VIR_DOMAIN_CONTROLLER_MODEL_ISA_DEFAULT); } + /* When not specified in the domain XML, clock.offset defaults to UTC which is + * not supported by bhyve on ARM64. So force it to LOCALTIME. */ + if ((def->clock.offset == VIR_DOMAIN_CLOCK_OFFSET_UTC) && + !(bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_RTC_UTC)) + def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + return 0; } diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args index 51eef94fd0..aef3ebd017 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-base.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ -s 2:0,virtio-blk,/tmp/freebsd.img \ diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args index a07e70d7d4..1079beee52 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-bootloader.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -o bootrom=/usr/local/share/u-boot/u-boot-bhyve-arm64/u-boot.bin \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ diff --git a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args index ae0e6bc1b3..4a031afb71 100644 --- a/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args +++ b/tests/bhyvexml2argvdata/aarch64/bhyvexml2argv-console.args @@ -1,7 +1,6 @@ bhyve \ -c 1 \ -m 214 \ --u \ -s 0:0,hostbridge \ -s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ -s 2:0,virtio-blk,/tmp/freebsd.img \ diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 47b2726b14..c7c18c3690 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -333,6 +333,8 @@ mymain(void) /* arm64 tests */ virTestSetHostArch(VIR_ARCH_AARCH64); driver.caps = virBhyveCapsBuild(); + /* bhyve does not support UTC clock on ARM */ + driver.bhyvecaps ^= BHYVE_CAP_RTC_UTC; DO_TEST("base"); DO_TEST("console"); diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml index 573e42bfa9..ee72370047 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-base.xml @@ -8,7 +8,7 @@ <type arch='aarch64'>hvm</type> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml index 67047040bb..8c7ca5826e 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-bootloader.xml @@ -9,7 +9,7 @@ <loader readonly='yes' type='rom'>/usr/local/share/u-boot/u-boot-bhyve-arm64/u-boot.bin</loader> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml index 2bea620cbe..d43ce8fd6f 100644 --- a/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml +++ b/tests/bhyvexml2xmloutdata/aarch64/bhyvexml2xmlout-console.xml @@ -8,7 +8,7 @@ <type arch='aarch64'>hvm</type> <boot dev='hd'/> </os> - <clock offset='utc'/> + <clock offset='localtime'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 1d01436511..5df1f2b6ba 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -77,7 +77,7 @@ mymain(void) # define DO_TEST_FAILURE(name) \ DO_TEST_FULL(name, FLAG_EXPECT_FAILURE) - driver.bhyvecaps = BHYVE_CAP_AHCI32SLOT; + driver.bhyvecaps = BHYVE_CAP_AHCI32SLOT | BHYVE_CAP_RTC_UTC; DO_TEST_DIFFERENT("acpiapic"); DO_TEST_DIFFERENT("base"); @@ -146,6 +146,8 @@ mymain(void) virTestSetHostArch(VIR_ARCH_AARCH64); driver.caps = virBhyveCapsBuild(); + /* bhyve does not support UTC clock on ARM */ + driver.bhyvecaps ^= BHYVE_CAP_RTC_UTC; DO_TEST_DIFFERENT("base"); DO_TEST_DIFFERENT("console"); -- 2.52.0

2 1

[PATCH 0/4] qemuDomainSetThrottleGroup: Fix group name related issues
by Peter Krempa 19 Jan '26

19 Jan '26

Peter Krempa (4): qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice src/qemu/qemu_driver.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-) -- 2.52.0

2 5

[PATCH] scripts: don't import shutil in meson-warnings.py
by Laine Stump 19 Jan '26

19 Jan '26

From: Laine Stump <laine(a)redhat.com> It's never used, which makes flake8 complain. Fixes: 50ad6026adc227f5d364fd088c7c1b770e37eddb Signed-off-by: Laine Stump <laine(a)redhat.com> --- Pushed to fix the build scripts/meson-warnings.py | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/meson-warnings.py b/scripts/meson-warnings.py index d6e9539603..76949bc7e3 100644 --- a/scripts/meson-warnings.py +++ b/scripts/meson-warnings.py @@ -1,6 +1,5 @@ #!/usr/bin/env python3 -import shutil import sys with open(sys.argv[1], "w") as out: -- 2.52.0

2 1

[PATCH v4 0/7] qemu: Implement support for iommufd
by Nathan Chen 17 Jan '26

17 Jan '26

Hi, This is a follow up to the third patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from v3: - Resolved issue from v2 where stale FD from previous VM boot was in use - Remove second approach for retrieving VFIO device path in virPCIDeviceGetVfioPath() - Resolve broken build of libvirt on non-Linux platforms - Conditionally define iommufd headers and use system headers where possible - Add non-fatal handling + warning print for EPERM for the IOMMU_OPTION_RLIMIT_MODE ioctl - Replace references to /dev/iommu with VIR_IOMMU_DEV_PATH - Implement virIOMMUFDSupported(void) to check for existence of /dev/iommu on host - Include tests for multiple hostdevs Changes from v2: - Set per-process memory accounting mode for iommufd - Separated out formatting of iommufd object from qemuBuildHostdevCommandLine - Placed hostdev private data implementation in a separate commit - Allocate hostdev private data unconditionally - Compare FDs against -1 - Integrated callback function in virQEMUDriverPrivateDataCallbacks for qemuDomainHostdevPrivateNew - Dropped qemuProcessCloseVfioFds - Addressed other feedback from v2 (formatting, includes, etc.) - Revised seclabel logic to be device-specific for AppArmor and to allow paths for SELinux/DAC This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/iommufd-01-26 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WIBZ… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (7): qemu: Implement support for associating iommufd to hostdev qemu: Introduce privateData for hostdevs qemu: Set per-process memory accounting for iommufd qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 7 + po/POTFILES | 1 + src/bhyve/bhyve_parse_command.c | 2 +- src/conf/device_conf.c | 11 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 5 +- src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 5 + src/libxl/xen_common.c | 2 +- src/libxl/xen_xl.c | 2 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_cgroup.c | 26 ++-- src/qemu/qemu_command.c | 76 +++++++++++ src/qemu/qemu_domain.c | 41 ++++++ src/qemu/qemu_domain.h | 20 +++ src/qemu/qemu_namespace.c | 16 ++- src/qemu/qemu_process.c | 118 ++++++++++++++++ src/security/security_apparmor.c | 32 ++++- src/security/security_dac.c | 59 ++++++-- src/security/security_selinux.c | 57 ++++++-- src/security/virt-aa-helper.c | 33 ++++- src/util/meson.build | 1 + src/util/viriommufd.c | 127 ++++++++++++++++++ src/util/viriommufd.h | 27 ++++ src/util/virpci.c | 42 ++++++ src/util/virpci.h | 2 + src/vbox/vbox_common.c | 2 +- .../iommufd-q35.x86_64-latest.args | 41 ++++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++++ ...fd-virt-pci-bus-single.aarch64-latest.args | 33 +++++ ...ufd-virt-pci-bus-single.aarch64-latest.xml | 34 +++++ .../iommufd-virt-pci-bus-single.xml | 22 +++ .../iommufd-virt.aarch64-latest.args | 37 +++++ .../iommufd-virt.aarch64-latest.xml | 56 ++++++++ tests/qemuxmlconfdata/iommufd-virt.xml | 29 ++++ .../iommufd.x86_64-latest.args | 35 +++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++++ tests/qemuxmlconftest.c | 34 +++++ tests/virhostdevtest.c | 2 +- 42 files changed, 1162 insertions(+), 62 deletions(-) create mode 100644 src/util/viriommufd.c create mode 100644 src/util/viriommufd.h create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt-pci-bus-single.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

3 17

[PATCH 0/3] Fix uninitialized variable in virSocketAddrFormatWithPrefix
by Julio Faracco 17 Jan '26

17 Jan '26

This series fixes a bug in virSocketAddrFormatWithPrefix() where an uninitialized variable was being used when masked=false, adds comprehensive test coverage to prevent regressions, and includes a minor code cleanup for consistency. The bug was discovered in the virSocketAddrFormatWithPrefix() function, which is used to format IP addresses with prefix notation (e.g., "1.2.3.4/24"). When the 'masked' parameter was false (meaning the caller wanted to format the original address with a prefix, not the network address), the 'network' variable was left uninitialized, leading to undefined behavior. Julio Faracco (3): util: Fix uninitialized variable in virSocketAddrFormatWithPrefix tests: Add tests for virSocketAddrFormatWithPrefix util: Standardize macro usage to check socket family src/util/virsocketaddr.c | 14 +++++--- tests/sockettest.c | 70 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 5 deletions(-) -- 2.52.0

2 8

[PATCH 0/8] Add multitouch input device support
by Julio Faracco 17 Jan '26

17 Jan '26

This patch series implements support for multitouch input devices in libvirt, addressing the multitouch feature request in [1]. Currently, libvirt supports various input devices including mouse, tablet, and keyboard, but lacks support for multitouch devices. This limitation prevents users from configuring VMs with proper multitouch capabilities, which is increasingly important for modern applications and touch-enabled displays. This series adds comprehensive multitouch support by: 1. Introducing the necessary data structures and enumerations to represent multitouch devices in the domain configuration 2. Extending the domain XML schema to allow users to specify multitouch input devices in their VM definitions 3. Implementing QEMU driver support to properly map multitouch devices to the virtio-input-host-multitouch QEMU device 4. Adding capability detection to identify when QEMU supports multitouch devices 5. Updating all relevant enumerations and mappings throughout the codebase to handle the new device type 6. Including test coverage to validate the XML parsing and QEMU command line generation After this series, users will be able to configure multitouch input devices in their domain XML like: <input type='multitouch' bus='virtio'/>. [1] https://gitlab.com/libvirt/libvirt/-/issues/808 Julio Faracco (8): conf: Add multitouch input type enum conf: Update the type name mapping in the VIR_ENUM_IMPL macro schemas: Update domain schema to support multitouch qemu: Add the multitouch case to map to the QEMU virtio device qemu: Add device properties for multitouch input qemu: Add the multitouch device capability Complete remaining enums with multitouch input type tests: Add multitouch support to virtio-input tests src/conf/domain_audit.c | 1 + src/conf/domain_conf.c | 2 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 1 + src/conf/schemas/domaincommon.rng | 1 + src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 8 ++++++++ src/qemu/qemu_validate.c | 5 +++++ src/security/security_dac.c | 2 ++ src/security/security_selinux.c | 2 ++ tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml | 1 + tests/qemuxmlconfdata/virtio-input.x86_64-latest.args | 1 + tests/qemuxmlconfdata/virtio-input.x86_64-latest.xml | 3 +++ tests/qemuxmlconfdata/virtio-input.xml | 1 + 15 files changed, 33 insertions(+) -- 2.52.0

3 13

[PATCH] util: Fix max socket calculation
by Alexandr Semenikhin 17 Jan '26

17 Jan '26

This patch changes how the maximum socket count is calculated. On some systems (e.g. GB200), physical_package_id values are not contiguous or zero-based. Instead of 0..N, they may contain large arbitrary identifiers (e.g. 256123234). The previous implementation assumed a 0..N range and used the maximum ID value directly. This caused: excessive memory allocation extremely large loop bounds OOM / DoS scenarios unnecessary CPU time consumption The new implementation computes the socket count as the number of unique package IDs present on the node, rather than relying on the maximum numeric value. Signed-off-by: Alexandr Semenikhin <alexandr2e78(a)gmail.com> --- src/util/virhostcpu.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 09395ddb04..113aa6881e 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -331,6 +331,8 @@ virHostCPUParseNode(const char *node, int siblings; unsigned int cpu; int direrr; + g_autoptr(GHashTable) st = g_hash_table_new(g_direct_hash, g_direct_equal); + gpointer sock_resolved; *threads = 0; *cores = 0; @@ -356,15 +358,29 @@ virHostCPUParseNode(const char *node, if (virHostCPUGetSocket(cpu, &sock) < 0) goto cleanup; - virBitmapSetBitExpand(sockets_map, sock); + if (!g_hash_table_lookup_extended(st, + GUINT_TO_POINTER(sock), + NULL, + &sock_resolved)) { + g_hash_table_insert(st, + GUINT_TO_POINTER(sock), + GUINT_TO_POINTER(sock_max)); + sock = sock_max; + sock_max++; + } else { + sock = GPOINTER_TO_UINT(sock_resolved); + } - if (sock > sock_max) - sock_max = sock; + virBitmapSetBitExpand(sockets_map, sock); } if (direrr < 0) goto cleanup; + if (sock_max == 0) { + g_hash_table_insert(st, GUINT_TO_POINTER(0), GUINT_TO_POINTER(sock_max)); + } + sock_max++; /* allocate cores maps for each socket */ @@ -400,6 +416,16 @@ virHostCPUParseNode(const char *node, if (virHostCPUGetSocket(cpu, &sock) < 0) goto cleanup; + + if (!g_hash_table_lookup_extended(st, + GUINT_TO_POINTER(sock), + NULL, + &sock_resolved)) { + goto cleanup; + } + + sock = GPOINTER_TO_UINT(sock_resolved); + if (!virBitmapIsBitSet(sockets_map, sock)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("CPU socket topology has changed")); -- 2.47.3

2 1

[PATCH v2 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 17 Jan '26

17 Jan '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename ebiptables unit tests and data files nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 37 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 26 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 210 + src/nwfilter/nwfilter_driver_conf.h | 66 + src/nwfilter/nwfilter_ebiptables_driver.c | 262 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 63 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2374 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 51 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 5 + tests/meson.build | 4 +- tests/nwfilternftablestest.c | 428 ++ ...ltest.c => nwfilterxml2ebipfirewalltest.c} | 4 +- ...nux.args => ah-ipv6-linux.ebiptables.args} | 0 .../ah-ipv6-linux.nftables.args | 304 ++ ...ah-linux.args => ah-linux.ebiptables.args} | 0 .../ah-linux.nftables.args | 298 ++ ...ux.args => all-ipv6-linux.ebiptables.args} | 0 .../all-ipv6-linux.nftables.args | 286 ++ ...l-linux.args => all-linux.ebiptables.args} | 0 .../all-linux.nftables.args | 280 ++ ...p-linux.args => arp-linux.ebiptables.args} | 0 .../arp-linux.nftables.args | 215 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + ...nux.args => comment-linux.ebiptables.args} | 0 .../comment-linux.nftables.args | 483 +++ ...x.args => conntrack-linux.ebiptables.args} | 0 .../conntrack-linux.nftables.args | 198 + ...ux.args => esp-ipv6-linux.ebiptables.args} | 0 .../esp-ipv6-linux.nftables.args | 304 ++ ...p-linux.args => esp-linux.ebiptables.args} | 0 .../esp-linux.nftables.args | 298 ++ ...x.args => example-1-linux.ebiptables.args} | 0 .../example-1-linux.nftables.args | 266 ++ ...x.args => example-2-linux.ebiptables.args} | 0 .../example-2-linux.nftables.args | 348 ++ ...ux.args => hex-data-linux.ebiptables.args} | 0 .../hex-data-linux.nftables.args | 357 ++ ...s => icmp-direction-linux.ebiptables.args} | 0 .../icmp-direction-linux.nftables.args | 238 ++ ... => icmp-direction2-linux.ebiptables.args} | 0 .../icmp-direction2-linux.nftables.args | 238 ++ ... => icmp-direction3-linux.ebiptables.args} | 0 .../icmp-direction3-linux.nftables.args | 184 + ...-linux.args => icmp-linux.ebiptables.args} | 0 .../icmp-linux.nftables.args | 252 ++ ...inux.args => icmpv6-linux.ebiptables.args} | 0 .../icmpv6-linux.nftables.args | 322 ++ ...-linux.args => igmp-linux.ebiptables.args} | 0 .../igmp-linux.nftables.args | 298 ++ ...ip-linux.args => ip-linux.ebiptables.args} | 0 .../ip-linux.nftables.args | 198 + ...linux.args => ipset-linux.ebiptables.args} | 0 ... => ipt-no-macspoof-linux.ebiptables.args} | 0 .../ipt-no-macspoof-linux.nftables.args | 169 + ...-linux.args => ipv6-linux.ebiptables.args} | 0 .../ipv6-linux.nftables.args | 474 +++ ...linux.args => iter1-linux.ebiptables.args} | 0 .../iter1-linux.nftables.args | 298 ++ ...linux.args => iter2-linux.ebiptables.args} | 0 .../iter2-linux.nftables.args | 3598 +++++++++++++++++ ...linux.args => iter3-linux.ebiptables.args} | 0 .../iter3-linux.nftables.args | 418 ++ ...c-linux.args => mac-linux.ebiptables.args} | 0 .../mac-linux.nftables.args | 180 + ...-linux.args => rarp-linux.ebiptables.args} | 0 .../rarp-linux.nftables.args | 215 + ...x.args => sctp-ipv6-linux.ebiptables.args} | 0 .../sctp-ipv6-linux.nftables.args | 314 ++ ...-linux.args => sctp-linux.ebiptables.args} | 0 .../sctp-linux.nftables.args | 314 ++ ...p-linux.args => stp-linux.ebiptables.args} | 0 ...inux.args => target-linux.ebiptables.args} | 0 .../target-linux.nftables.args | 452 +++ ...nux.args => target2-linux.ebiptables.args} | 0 .../target2-linux.nftables.args | 316 ++ ...ux.args => tcp-ipv6-linux.ebiptables.args} | 0 .../tcp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => tcp-linux.ebiptables.args} | 0 .../tcp-linux.nftables.args | 468 +++ ...ux.args => udp-ipv6-linux.ebiptables.args} | 0 .../udp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => udp-linux.ebiptables.args} | 0 .../udp-linux.nftables.args | 314 ++ ...rgs => udplite-ipv6-linux.ebiptables.args} | 0 .../udplite-ipv6-linux.nftables.args | 304 ++ ...nux.args => udplite-linux.ebiptables.args} | 0 .../udplite-linux.nftables.args | 298 ++ ...-linux.args => vlan-linux.ebiptables.args} | 0 .../vlan-linux.nftables.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 98 files changed, 18433 insertions(+), 365 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c rename tests/{nwfilterxml2firewalltest.c => nwfilterxml2ebipfirewalltest.c} (99%) rename tests/nwfilterxml2firewalldata/{ah-ipv6-linux.args => ah-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ah-linux.args => ah-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-ipv6-linux.args => all-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-linux.args => all-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args rename tests/nwfilterxml2firewalldata/{arp-linux.args => arp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml rename tests/nwfilterxml2firewalldata/{comment-linux.args => comment-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args rename tests/nwfilterxml2firewalldata/{conntrack-linux.args => conntrack-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-ipv6-linux.args => esp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-linux.args => esp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-1-linux.args => example-1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-2-linux.args => example-2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{hex-data-linux.args => hex-data-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction-linux.args => icmp-direction-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction2-linux.args => icmp-direction2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction3-linux.args => icmp-direction3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-linux.args => icmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmpv6-linux.args => icmpv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{igmp-linux.args => igmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ip-linux.args => ip-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipset-linux.args => ipset-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{ipt-no-macspoof-linux.args => ipt-no-macspoof-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipv6-linux.args => ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter1-linux.args => iter1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter2-linux.args => iter2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter3-linux.args => iter3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{mac-linux.args => mac-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args rename tests/nwfilterxml2firewalldata/{rarp-linux.args => rarp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-ipv6-linux.args => sctp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-linux.args => sctp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{stp-linux.args => stp-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{target-linux.args => target-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args rename tests/nwfilterxml2firewalldata/{target2-linux.args => target2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-ipv6-linux.args => tcp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-linux.args => tcp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-ipv6-linux.args => udp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-linux.args => udp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-ipv6-linux.args => udplite-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-linux.args => udplite-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args rename tests/nwfilterxml2firewalldata/{vlan-linux.args => vlan-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 11

[PATCH 0/4] Fix a few vlan-related issues
by Laine Stump 17 Jan '26

17 Jan '26

The main fix here is Patch 1, which adds the code necessary to support live update of the vlan tag for a direct (macvtap) passthrough interface, thus resolving two separate issues. The other three are just small annoyances that I found while testing. Laine Stump (4): qemu: update vlan tag of macvtap (direct) passthrough devices during update-device qemu: use actual/effective vlan when updating OVS-based interface vlan tag conf: validate that specified interface type supports vlan tags conf: simplify check for vlan tagging support in virDomainActualNetDefValidate() src/conf/domain_validate.c | 52 +++++++++++++++++++++++++++++++++----- src/qemu/qemu_hotplug.c | 14 ++++++++-- 2 files changed, 57 insertions(+), 9 deletions(-) -- 2.52.0

2 7

[PATCH 0/3] ci: massively cut down the build log sizes
by Daniel P. Berrangé 17 Jan '26

17 Jan '26

The build logs for the Fedora jobs in gitlab CI are all getting truncated with a message: [1278/1650] gcc -o te Job's log exceeded limit of 4194304 bytes. Job execution will continue but no more output will be collected. when we're only 3/4 of the way through the build process this is massively unhelpful if something fails at the end...like unit tests. Removing some -D flags and cutting down logs from the package install phase remove about 1 MB of log file output. Moving -W flags off the compiler command line, to a separate file, removes about another 2 MB of log file output. IOW, the overall log drops from 5.7 MB to 2.7 MB and are thus fully captured by gitlab. Patch 3 depends on: https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/563 Daniel P. Berrangé (3): src: remove some -D defines from compiler args meson: write all warning flags to 'c-warnings.txt' ci: regenerate with 'lcitool manifest' ci/buildenv/almalinux-10.sh | 142 +++++++++-------- ci/buildenv/almalinux-9.sh | 144 ++++++++--------- ci/buildenv/centos-stream-10.sh | 138 ++++++++-------- ci/buildenv/centos-stream-9.sh | 144 ++++++++--------- ci/buildenv/fedora-42.sh | 142 ++++++++--------- ci/buildenv/fedora-43-cross-mingw32.sh | 94 +++++------ ci/buildenv/fedora-43-cross-mingw64.sh | 94 +++++------ ci/buildenv/fedora-43.sh | 142 ++++++++--------- ci/buildenv/fedora-rawhide-cross-mingw32.sh | 96 +++++------ ci/buildenv/fedora-rawhide-cross-mingw64.sh | 96 +++++------ ci/buildenv/fedora-rawhide.sh | 144 ++++++++--------- ci/containers/almalinux-10.Dockerfile | 146 ++++++++--------- ci/containers/almalinux-9.Dockerfile | 148 ++++++++--------- ci/containers/centos-stream-10.Dockerfile | 142 ++++++++--------- ci/containers/centos-stream-9.Dockerfile | 148 ++++++++--------- ci/containers/fedora-42.Dockerfile | 148 ++++++++--------- .../fedora-43-cross-mingw32.Dockerfile | 102 ++++++------ .../fedora-43-cross-mingw64.Dockerfile | 102 ++++++------ ci/containers/fedora-43.Dockerfile | 148 ++++++++--------- .../fedora-rawhide-cross-mingw32.Dockerfile | 104 ++++++------ .../fedora-rawhide-cross-mingw64.Dockerfile | 104 ++++++------ ci/containers/fedora-rawhide.Dockerfile | 150 +++++++++--------- ci/gitlab/build-templates.yml | 6 +- meson.build | 114 ++++++------- scripts/meson-warnings.py | 9 ++ src/internal.h | 2 + src/meson.build | 6 +- src/remote/remote_protocol.x | 1 + 28 files changed, 1490 insertions(+), 1466 deletions(-) create mode 100644 scripts/meson-warnings.py -- 2.52.0

2 5