Backport fix for IPv6 connections to ESXi

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

0001-esx-Allow-connecting-to-IPv6-server.patch

@@ -0,0 +1,41 @@
+From 845210011a9ffd9d17e30c51cbc81ba67c5d3166 Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Tue, 20 Jan 2026 10:08:29 +0100
+Subject: [PATCH] esx: Allow connecting to IPv6 server
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When connecting to a VMWare server, the hostname from URI is
+resolved using esxUtil_ResolveHostname() which in turn calls
+getaddrinfo(). But in the hints argument, we restrict the return
+address to be IPv4 (AF_INET) which obviously fails if the address
+to resolve is an IPv6 address. Set the hint to AF_UNSPEC which
+allows both IPv4 and IPv6. While at it, also allow IPv4 addresses
+mapped in IPv6 by setting AI_V4MAPPED flag.
+
+Resolves: https://issues.redhat.com/browse/RHEL-138300
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ src/esx/esx_util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c
+index 88b3dc893f..a6275babd5 100644
+--- a/src/esx/esx_util.c
++++ b/src/esx/esx_util.c
+@@ -275,8 +275,8 @@ esxUtil_ResolveHostname(const char *hostname, char **ipAddress)
+     int errcode;
+     g_autofree char *address = NULL;
+ 
+-    hints.ai_flags = AI_ADDRCONFIG;
+-    hints.ai_family = AF_INET;
++    hints.ai_flags = AI_ADDRCONFIG | AI_V4MAPPED;
++    hints.ai_family = AF_UNSPEC;
+     hints.ai_socktype = SOCK_STREAM;
+     hints.ai_protocol = 0;
+ 
+-- 
+2.52.0
+

0001-virarptable-Properly-calculate-rtattr-length.patch

@@ -1,29 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 13:56:51 +0200
-Subject: [PATCH] virarptable: Properly calculate rtattr length
-Content-type: text/plain
-
-Use convenience macro which does almost the same thing we were doing,
-but also pads out the payload length to a multiple of NLMSG_ALIGNTO (4)
-bytes.
-
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index 299dddd664..d8e41c5a86 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -102,8 +102,7 @@ virArpTableGet(void)
-             return table;
- 
-         VIR_WARNINGS_NO_CAST_ALIGN
--        parse_rtattr(tb, NDA_MAX, NDA_RTA(r),
--                     nh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
-+        parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
-         VIR_WARNINGS_RESET
- 
-         if (tb[NDA_DST] == NULL || tb[NDA_LLADDR] == NULL)

0002-virarptable-Fix-check-for-message-length.patch

@@ -1,34 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 13:59:15 +0200
-Subject: [PATCH] virarptable: Fix check for message length
-Content-type: text/plain
-
-The previous check was all wrong since it calculated the how long would
-the netlink message be if the netlink header was the payload and then
-subtracted that from the whole message length, a variable that was not
-used later in the code.  This check can fail if there are no additional
-payloads, struct rtattr in particular, which we are parsing later,
-however the RTA_OK macro would've caught that anyway.
-
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index d8e41c5a86..45ee76766f 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -81,10 +81,9 @@ virArpTableGet(void)
-     for (; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen)) {
-         VIR_WARNINGS_RESET
-         struct ndmsg *r = NLMSG_DATA(nh);
--        int len = nh->nlmsg_len;
-         void *addr;
- 
--        if ((len -= NLMSG_LENGTH(sizeof(*nh))) < 0) {
-+        if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
-             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                            _("wrong nlmsg len"));
-             goto cleanup;

0003-virarptable-End-parsing-earlier-in-case-of-NLMSG_DON.patch

@@ -1,46 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 14:02:48 +0200
-Subject: [PATCH] virarptable: End parsing earlier in case of NLMSG_DONE
-Content-type: text/plain
-
-Check for the last multipart message right as the first thing.  The
-presumption probably was that the last message might still contain a
-payload we want to parse.  However that cannot be true since that would
-have to be a type RTM_NEWNEIGH.  This was not caught because older
-kernels were note sending NLMSG_DONE and probably relied on the fact
-that the parsing just stops after all the messages are walked through,
-which the NLMSG_OK macro successfully did.
-
-Resolves: https://issues.redhat.com/browse/RHEL-52449
-Resolves: https://bugzilla.redhat.com/2302245
-Fixes: a176d67cdfaf5b8237a7e3a80d8be0e6bdf2d8fd
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index 45ee76766f..20d11f97b0 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -83,6 +83,9 @@ virArpTableGet(void)
-         struct ndmsg *r = NLMSG_DATA(nh);
-         void *addr;
- 
-+        if (nh->nlmsg_type == NLMSG_DONE)
-+            break;
-+
-         if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
-             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                            _("wrong nlmsg len"));
-@@ -97,9 +100,6 @@ virArpTableGet(void)
-             (!(r->ndm_state == NUD_STALE || r->ndm_state == NUD_REACHABLE)))
-             continue;
- 
--        if (nh->nlmsg_type == NLMSG_DONE)
--            return table;
--
-         VIR_WARNINGS_NO_CAST_ALIGN
-         parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
-         VIR_WARNINGS_RESET

0004-util-use-a-single-flags-arg-for-virNetDevBandwidthSe.patch

@@ -1,315 +0,0 @@
-From 807e2670f2704c41f0a1dca81a5d2f2f9336137c Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:44 -0500
-Subject: [PATCH 4/9] util: use a single flags arg for virNetDevBandwidthSet(),
- not multiple bools
-
-Having two bools in the arg list is on the borderline of being
-confusing to anyone trying to read the code, but we're about to add a
-3rd. This patch replaces the two bools with a single flags argument
-which will instead have one or more bits from virNetDevBandwidthFlags
-set.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/lxc/lxc_driver.c           |  8 ++++++--
- src/lxc/lxc_process.c          |  8 ++++++--
- src/network/bridge_driver.c    | 10 ++++++++--
- src/qemu/qemu_command.c        | 11 ++++++++---
- src/qemu/qemu_driver.c         | 29 ++++++++++++++-------------
- src/qemu/qemu_hotplug.c        | 22 +++++++++++++++------
- src/util/virnetdevbandwidth.c  | 36 ++++++++++++++++++++--------------
- src/util/virnetdevbandwidth.h  |  9 +++++++--
- tests/virnetdevbandwidthtest.c |  8 +++++++-
- 9 files changed, 94 insertions(+), 47 deletions(-)
-
-diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
-index 534e257f30..b693980dbb 100644
---- a/src/lxc/lxc_driver.c
-+++ b/src/lxc/lxc_driver.c
-@@ -3570,8 +3570,12 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
-     actualBandwidth = virDomainNetGetActualBandwidth(net);
-     if (actualBandwidth) {
-         if (virNetDevSupportsBandwidth(actualType)) {
--            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                      !virDomainNetTypeSharesHostView(net)) < 0)
-+            unsigned int flags = 0;
-+
-+            if (!virDomainNetTypeSharesHostView(net))
-+                flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-                 goto cleanup;
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
-index f5eb5383ec..0e689fbb70 100644
---- a/src/lxc/lxc_process.c
-+++ b/src/lxc/lxc_process.c
-@@ -605,8 +605,12 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
-         actualBandwidth = virDomainNetGetActualBandwidth(net);
-         if (actualBandwidth) {
-             if (virNetDevSupportsBandwidth(type)) {
--                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                          !virDomainNetTypeSharesHostView(net)) < 0)
-+                unsigned int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-                     goto cleanup;
-             } else {
-                 VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
-index 32572c755f..1c53636450 100644
---- a/src/network/bridge_driver.c
-+++ b/src/network/bridge_driver.c
-@@ -2058,8 +2058,11 @@ networkStartNetworkVirtual(virNetworkDriverState *driver,
-         }
-     }
- 
--    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
-+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
-+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
-         goto error;
-+    }
- 
-     return 0;
- 
-@@ -2141,8 +2144,11 @@ networkStartNetworkBridge(virNetworkObj *obj)
-      * type BRIDGE, is started. On failure, undo anything you've done,
-      * and return -1. On success return 0.
-      */
--    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
-+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
-+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
-         goto error;
-+    }
- 
-     if (networkStartHandleMACTableManagerMode(obj) < 0)
-         goto error;
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index f15e6bda1e..b4815e5e71 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -8840,9 +8840,14 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
-                                                         def->uuid,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                             !virDomainNetTypeSharesHostView(net)) < 0) {
--                goto cleanup;
-+            } else {
-+                unsigned int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 736602333e..14929616e5 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -9941,21 +9941,22 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
-                 virErrorRestore(&orig_err);
-                 goto endjob;
-             }
--        } else if (virNetDevBandwidthSet(net->ifname, newBandwidth, false,
--                                         !virDomainNetTypeSharesHostView(net)) < 0) {
--            virErrorPtr orig_err;
--
--            virErrorPreserveLast(&orig_err);
--            ignore_value(virNetDevBandwidthSet(net->ifname,
--                                               net->bandwidth,
--                                               false,
--                                               !virDomainNetTypeSharesHostView(net)));
--            if (net->bandwidth) {
--                ignore_value(virDomainNetBandwidthUpdate(net,
--                                                         net->bandwidth));
-+        } else {
-+            unsigned int bwflags = 0;
-+
-+            if (!virDomainNetTypeSharesHostView(net))
-+                bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+            if (virNetDevBandwidthSet(net->ifname, newBandwidth, bwflags) < 0) {
-+                virErrorPtr orig_err;
-+
-+                virErrorPreserveLast(&orig_err);
-+                ignore_value(virNetDevBandwidthSet(net->ifname, net->bandwidth, bwflags));
-+                if (net->bandwidth)
-+                    ignore_value(virDomainNetBandwidthUpdate(net, net->bandwidth));
-+                virErrorRestore(&orig_err);
-+                goto endjob;
-             }
--            virErrorRestore(&orig_err);
--            goto endjob;
-         }
- 
-         /* If the old bandwidth was cleared out, restore qdisc. */
-diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
-index 7cb1800504..d5e7e99359 100644
---- a/src/qemu/qemu_hotplug.c
-+++ b/src/qemu/qemu_hotplug.c
-@@ -1279,9 +1279,14 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
-                                                         vm->def->uuid,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                             !virDomainNetTypeSharesHostView(net)) < 0) {
--                goto cleanup;
-+            } else {
-+                int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-@@ -4082,9 +4087,14 @@ qemuDomainChangeNet(virQEMUDriver *driver,
-                                                         vm->def->uuid,
-                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(newdev->ifname, newb, false,
--                                             !virDomainNetTypeSharesHostView(newdev)) < 0) {
--                goto cleanup;
-+            } else {
-+                int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(newdev))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(newdev->ifname, newb, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             if (virDomainInterfaceClearQoS(vm->def, olddev) < 0)
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 2b58c58d3e..1baad849c6 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -173,30 +173,35 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
-  * virNetDevBandwidthSet:
-  * @ifname: on which interface
-  * @bandwidth: rates to set (may be NULL)
-- * @hierarchical_class: whether to create hierarchical class
-- * @swapped: true if IN/OUT should be set contrariwise
-+ * @flags: bits indicating certain optional actions
-  *
-+
-  * This function enables QoS on specified interface
-  * and set given traffic limits for both, incoming
-- * and outgoing traffic. Any previous setting get
-- * overwritten. If @hierarchical_class is TRUE, create
-- * hierarchical class. It is used to guarantee minimal
-- * throughput ('floor' attribute in NIC).
-+ * and outgoing traffic.
-+ *
-+ * @flags bits and their meanings:
-+ *
-+ *   VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+ *     whether to create a hierarchical class
-+ *     A hiearchical class structure is used to implement a minimal
-+ *     throughput guarantee ('floor' attribute in NIC).
-  *
-- * If @swapped is set, the IN part of @bandwidth is set on
-- * @ifname's TX, and vice versa. If it is not set, IN is set on
-- * RX and OUT on TX. This is because for some types of interfaces
-- * domain and the host live on the same side of the interface (so
-- * domain's RX/TX is host's RX/TX), and for some it's swapped
-- * (domain's RX/TX is hosts's TX/RX).
-+ *   VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED
-+ *     set if IN/OUT should be set backwards from what's indicated in
-+ *     the bandwidth, i.e. the IN part of @bandwidth is set on
-+ *     @ifname's TX, and the OUT part of @bandwidth is set on
-+ *     @ifname's RX.  This is needed because for some types of
-+ *     interfaces the domain and the host live on the same side of the
-+ *     interface (so domain's RX/TX is host's RX/TX), and for some
-+ *     it's swapped (domain's RX/TX is hosts's TX/RX).
-  *
-  * Return 0 on success, -1 otherwise.
-  */
- int
- virNetDevBandwidthSet(const char *ifname,
-                       const virNetDevBandwidth *bandwidth,
--                      bool hierarchical_class,
--                      bool swapped)
-+                      unsigned int flags)
- {
-     int ret = -1;
-     virNetDevBandwidthRate *rx = NULL; /* From domain POV */
-@@ -205,6 +210,7 @@ virNetDevBandwidthSet(const char *ifname,
-     char *average = NULL;
-     char *peak = NULL;
-     char *burst = NULL;
-+    bool hierarchical_class = flags & VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
- 
-     if (!bandwidth) {
-         /* nothing to be enabled */
-@@ -224,7 +230,7 @@ virNetDevBandwidthSet(const char *ifname,
-         return -1;
-     }
- 
--    if (swapped) {
-+    if (flags & VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) {
-         rx = bandwidth->out;
-         tx = bandwidth->in;
-     } else {
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 6d268fb119..80dc654486 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -39,11 +39,16 @@ void virNetDevBandwidthFree(virNetDevBandwidth *def);
- 
- G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
- 
-+typedef enum {
-+    VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
-+    VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
-+} virNetDevBandwidthSetFlags;
-+
- int virNetDevBandwidthSet(const char *ifname,
-                           const virNetDevBandwidth *bandwidth,
--                          bool hierarchical_class,
--                          bool swapped)
-+                          unsigned int flags)
-     G_GNUC_WARN_UNUSED_RESULT;
-+
- int virNetDevBandwidthClear(const char *ifname);
- int virNetDevBandwidthCopy(virNetDevBandwidth **dest,
-                            const virNetDevBandwidth *src)
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index f7c38faa2e..6529ff4026 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -82,8 +82,14 @@ testVirNetDevBandwidthSet(const void *data)
-         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
-             return -1;
-     } else {
-+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+        if (info->hierarchical_class)
-+            flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
-+
-         exp_cmd = info->exp_cmd_tc;
--        if (virNetDevBandwidthSet(iface, band, info->hierarchical_class, true) < 0)
-+
-+        if (virNetDevBandwidthSet(iface, band, flags) < 0)
-             return -1;
-     }
- 
--- 
-2.47.1
-

0005-util-make-it-optional-to-clear-existing-tc-qdiscs-fi.patch

@@ -1,185 +0,0 @@
-From 490f58382dca2a415a5f16b6133f298d853bb379 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:45 -0500
-Subject: [PATCH 5/9] util: make it optional to clear existing tc
- qdiscs/filters in virNetDevBandwidthSet()
-
-virNetDevBandwidthSet() always clears all existing qdiscs and their
-subordinate filters before adding all the new qdiscs/filters. This is
-normally exactly what we want, but there is one case (the network
-driver) where the Qdisc added by virNetDevBandwidthSet() may already
-be in use by the nftables backend (which will add a rule to fix the
-checksum of dhcp packets); in that case, we *don't* want
-virNetDevBandwidthSet() to clear out the qdisc that was already added
-for nftables, and none of the bandwidth filters have been added yet,
-so there already aren't any "old" filters that need to be removed
-either - it is safe to just skip virNetDevBandwidthClear() in this
-case.
-
-To allow the network driver to set bandwidth without first clearing
-it, this patch adds the flag VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL to the
-virNetDevBandwidthSetFlags enum, and recognizes it in
-virNetDevBandwidthSet() - if the flag is set, then
-virNetDevBandwidth() will call virNetDevBandwidthClear() just as it
-always has. But if the flag isn't set it *won't* call
-virNetDevBandwidthClear().
-
-As suggested above, VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set for all
-calls to virNetdevBandwidthSet() except for two places in the network
-driver.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/lxc/lxc_driver.c           |  2 +-
- src/lxc/lxc_process.c          |  2 +-
- src/qemu/qemu_command.c        |  2 +-
- src/qemu/qemu_driver.c         |  2 +-
- src/qemu/qemu_hotplug.c        |  4 ++--
- src/util/virnetdevbandwidth.c  | 21 ++++++++++++++++++++-
- src/util/virnetdevbandwidth.h  |  1 +
- tests/virnetdevbandwidthtest.c |  3 ++-
- 8 files changed, 29 insertions(+), 8 deletions(-)
-
-diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
-index b693980dbb..81581c74df 100644
---- a/src/lxc/lxc_driver.c
-+++ b/src/lxc/lxc_driver.c
-@@ -3570,7 +3570,7 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
-     actualBandwidth = virDomainNetGetActualBandwidth(net);
-     if (actualBandwidth) {
-         if (virNetDevSupportsBandwidth(actualType)) {
--            unsigned int flags = 0;
-+            unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-             if (!virDomainNetTypeSharesHostView(net))
-                 flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
-index 0e689fbb70..081ce03a57 100644
---- a/src/lxc/lxc_process.c
-+++ b/src/lxc/lxc_process.c
-@@ -605,7 +605,7 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
-         actualBandwidth = virDomainNetGetActualBandwidth(net);
-         if (actualBandwidth) {
-             if (virNetDevSupportsBandwidth(type)) {
--                unsigned int flags = 0;
-+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index b4815e5e71..ed54fd4c5b 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -8841,7 +8841,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
-             } else {
--                unsigned int flags = 0;
-+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 14929616e5..9549065b1f 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -9942,7 +9942,7 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
-                 goto endjob;
-             }
-         } else {
--            unsigned int bwflags = 0;
-+            unsigned int bwflags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-             if (!virDomainNetTypeSharesHostView(net))
-                 bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
-index d5e7e99359..ceda4119cd 100644
---- a/src/qemu/qemu_hotplug.c
-+++ b/src/qemu/qemu_hotplug.c
-@@ -1280,7 +1280,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
-             } else {
--                int flags = 0;
-+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-@@ -4088,7 +4088,7 @@ qemuDomainChangeNet(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
-                     goto cleanup;
-             } else {
--                int flags = 0;
-+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(newdev))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 1baad849c6..9c48844c5d 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -196,6 +196,21 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
-  *     interface (so domain's RX/TX is host's RX/TX), and for some
-  *     it's swapped (domain's RX/TX is hosts's TX/RX).
-  *
-+ *   VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL
-+ *     If VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set, then the root
-+ *     qdisc is deleted before adding any new qdisc/class/filter,
-+ *     which causes any pre-existing filters to also be deleted. If
-+ *     not set, then it's assumed that there are no existing rules (or
-+ *     that those already there need to be kept). The caller should
-+ *     set this flag for an existing interface that is having its
-+ *     bandwidth settings modified, but can leave it unset if the
-+ *     interface was newly created and this is the first time
-+ *     bandwidth has been set, but someone else might have already
-+ *     added the qdisc (e.g. this is the case when the network driver
-+ *     is setting bandwidth for a virtual network bridge device - the
-+ *     nftables backend may have already added qdisc handle 1:0 and a
-+ *     filter, and we don't want to delete them)
-+ *
-  * Return 0 on success, -1 otherwise.
-  */
- int
-@@ -238,7 +253,11 @@ virNetDevBandwidthSet(const char *ifname,
-         tx = bandwidth->out;
-     }
- 
--    virNetDevBandwidthClear(ifname);
-+    /* Only if the caller requests, clear everything including root
-+     * qdisc and all filters before adding everything.
-+     */
-+    if (flags & VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL)
-+        virNetDevBandwidthClear(ifname);
- 
-     if (tx && tx->average) {
-         average = g_strdup_printf("%llukbps", tx->average);
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 80dc654486..744aa4c826 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -42,6 +42,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
- typedef enum {
-     VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
-     VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
-+    VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL = (1 << 2),
- } virNetDevBandwidthSetFlags;
- 
- int virNetDevBandwidthSet(const char *ifname,
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index 6529ff4026..6d5c847ad7 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -82,7 +82,8 @@ testVirNetDevBandwidthSet(const void *data)
-         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
-             return -1;
-     } else {
--        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED |
-+                             VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-         if (info->hierarchical_class)
-             flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
--- 
-2.47.1
-

0006-util-put-the-command-that-adds-a-tx-filter-qdisc-int.patch

@@ -1,98 +0,0 @@
-From faebbbbfa3b1bd4120852b3f416c8073ab82d5c5 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:46 -0500
-Subject: [PATCH 6/9] util: put the command that adds a tx filter qdisc into a
- separate function
-
-virNetDevBandwidthSet() adds a queue discipline (qdisc) for each
-interface that it will need to add tc transmit filters to, and the
-filters are then attached to the qdisc.
-
-There are other circumstances where some other function will need to
-add tc transmit filters to an interface (in particular an upcoming
-patch to the network driver nftables backend that will use a tc tx
-filter to fix the checksum of dhcp packets), so that function will
-also need a qdisc for the tx filter. To assure both always use exactly
-the same qdisc, this patch puts the command that adds the tx filter
-qdisc into a separate helper function that can (and will) be called
-from either place
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/libvirt_private.syms      |  1 +
- src/util/virnetdevbandwidth.c | 30 +++++++++++++++++++++++++-----
- src/util/virnetdevbandwidth.h |  3 +++
- 3 files changed, 29 insertions(+), 5 deletions(-)
-
-diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
-index d15d6a6a9d..0211cee967 100644
---- a/src/libvirt_private.syms
-+++ b/src/libvirt_private.syms
-@@ -2859,6 +2859,7 @@ virNetDevVFInterfaceStats;
- 
- 
- # util/virnetdevbandwidth.h
-+virNetDevBandWidthAddTxFilterParentQdisc;
- virNetDevBandwidthClear;
- virNetDevBandwidthCopy;
- virNetDevBandwidthEqual;
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 9c48844c5d..90eebe6576 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -266,11 +266,7 @@ virNetDevBandwidthSet(const char *ifname,
-         if (tx->burst)
-             burst = g_strdup_printf("%llukb", tx->burst);
- 
--        cmd = virCommandNew(TC);
--        virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
--                             "handle", "1:", "htb", "default",
--                             hierarchical_class ? "2" : "1", NULL);
--        if (virCommandRun(cmd, NULL) < 0)
-+        if (virNetDevBandWidthAddTxFilterParentQdisc(ifname, hierarchical_class) < 0)
-             goto cleanup;
- 
-         /* If we are creating a hierarchical class, all non guaranteed traffic
-@@ -794,3 +790,27 @@ virNetDevBandwidthSetRootQDisc(const char *ifname,
- 
-     return 0;
- }
-+
-+/**
-+ * virNetDevBandwidthAddTxFilterParentQdisc:
-+ * @ifname: name of interface that needs a qdisc to attach tx filters to
-+ * @hierarchical_class: true if hierarchical classes will be used on this interface
-+ *
-+ * Add a root Qdisc (Queueing Discipline) for attaching Tx filters to
-+ * @ifname.
-+ *
-+ * returns 0 on success, -1 on failure
-+ */
-+int
-+virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-+                                         bool hierarchical_class)
-+{
-+    g_autoptr(virCommand) cmd = NULL;
-+
-+    cmd = virCommandNew(TC);
-+    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
-+                         "handle", "1:", "htb", "default",
-+                         hierarchical_class ? "2" : "1", NULL);
-+
-+    return virCommandRun(cmd, NULL);
-+}
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 744aa4c826..65c1500637 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -84,3 +84,6 @@ int virNetDevBandwidthUpdateFilter(const char *ifname,
- int virNetDevBandwidthSetRootQDisc(const char *ifname,
-                                    const char *qdisc)
-     G_NO_INLINE;
-+
-+int virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-+                                             bool hierarchical_class);
--- 
-2.47.1
-

0007-util-don-t-re-add-the-qdisc-used-for-tx-filters-if-i.patch

@@ -1,107 +0,0 @@
-From 73c0fb19ce5b816ee81ede691252855c75391c9a Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:47 -0500
-Subject: [PATCH 7/9] util: don't re-add the qdisc used for tx filters if it
- already exists
-
-There will soon be two separate users of tc on virtual networks, and
-both will use the "qdisc root handle 1: htb" to add tx filters. One or the
-other could get the first chance to add the qdisc, and then if at a
-later time the other decides to use it, we need to prevent the 2nd
-user from attempting to re-add the qdisc (because that just generates
-an error).
-
-We do this by running "tc qdisc show dev $bridge handle 1:" then
-checking if the output of that command contains both "qdisc" and " 1:
-".[*] If it does then the qdisc has already been added. If not then we
-need to add it now.
-
-[*]As of this writing, the output more exactly starts with "qdisc
-htb 1: root", but our comparison is made purposefully generous to
-increase the chances that it will continue to work properly if tc
-modifies the format of its output.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/util/virnetdevbandwidth.c  | 35 ++++++++++++++++++++++++++++------
- tests/virnetdevbandwidthtest.c |  3 +++
- 2 files changed, 32 insertions(+), 6 deletions(-)
-
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 90eebe6576..5c6a65528c 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -805,12 +805,35 @@ int
- virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-                                          bool hierarchical_class)
- {
--    g_autoptr(virCommand) cmd = NULL;
-+    g_autoptr(virCommand) testCmd = NULL;
-+    g_autofree char *testResult = NULL;
- 
--    cmd = virCommandNew(TC);
--    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
--                         "handle", "1:", "htb", "default",
--                         hierarchical_class ? "2" : "1", NULL);
-+    /* first check it the qdisc with handle 1: was already added for
-+     * this interface by someone else
-+     */
-+    testCmd = virCommandNew(TC);
-+    virCommandAddArgList(testCmd, "qdisc", "show", "dev", ifname,
-+                         "handle", "1:", NULL);
-+    virCommandSetOutputBuffer(testCmd, &testResult);
- 
--    return virCommandRun(cmd, NULL);
-+    if (virCommandRun(testCmd, NULL) < 0)
-+        return -1;
-+
-+    /* output will be something like: "qdisc htb 1: root refcnt ..."
-+     * if the qdisc was already added. We just search for "qdisc" and
-+     * " 1: " anywhere in the output to allow for tc changing its
-+     * output format.
-+     */
-+    if (!(testResult && strstr(testResult, "qdisc") && strstr(testResult, " 1: "))) {
-+        /* didn't find qdisc in output, so we need to add one */
-+        g_autoptr(virCommand) addCmd = virCommandNew(TC);
-+
-+        virCommandAddArgList(addCmd, "qdisc", "add", "dev", ifname, "root",
-+                             "handle", "1:", "htb", "default",
-+                             hierarchical_class ? "2" : "1", NULL);
-+
-+        return virCommandRun(addCmd, NULL);
-+    }
-+
-+    return 0;
- }
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index 6d5c847ad7..31aa7f469d 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -147,6 +147,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1024kbps quantum 87\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
-@@ -177,6 +178,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1kbps ceil 2kbps burst 4kb quantum 1\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
-@@ -199,6 +201,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 4294967295kbps quantum 366503875\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
--- 
-2.47.1
-

0008-util-add-new-tc-layer-for-virFirewallCmd-objects.patch

@@ -1,171 +0,0 @@
-From dac9cb9030ac03d18f59884864a0a253e3c9f8f1 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:48 -0500
-Subject: [PATCH 8/9] util: add new "tc" layer for virFirewallCmd objects
-
-If the layer of a virFirewallCmd is "tc", then the "tc" utility will
-be executed using the arguments that had been added to the
-virFirewallCmd
-
-tc layer doesn't support auto-rollback command creation (any rollback
-needs to be added manually with virFirewallAddRollbackCmd()), and also
-tc layer isn't supported by the iptables backend (it would have been
-straightforward to add, but the iptables backend doesn't need it, and
-I didn't want to take the chance of causing a regression in that
-code for no good reason).
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/network/network_nftables.c |  1 +
- src/util/virfirewall.c         | 66 +++++++++++++++++++++-------------
- src/util/virfirewall.h         |  1 +
- src/util/virfirewalld.c        |  1 +
- 4 files changed, 44 insertions(+), 25 deletions(-)
-
-diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
-index 268d1f12ca..cc184105c3 100644
---- a/src/network/network_nftables.c
-+++ b/src/network/network_nftables.c
-@@ -73,6 +73,7 @@ VIR_ENUM_IMPL(nftablesLayer,
-               "",
-               "ip",
-               "ip6",
-+              "",
- );
- 
- 
-diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
-index 811b787ecc..9389bcf541 100644
---- a/src/util/virfirewall.c
-+++ b/src/util/virfirewall.c
-@@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virFirewallLayer,
-               "ethernet",
-               "ipv4",
-               "ipv6",
-+              "tc",
- );
- 
- typedef struct _virFirewallGroup virFirewallGroup;
-@@ -57,6 +58,7 @@ VIR_ENUM_IMPL(virFirewallLayerCommand,
-               EBTABLES,
-               IPTABLES,
-               IP6TABLES,
-+              TC,
- );
- 
- struct _virFirewallCmd {
-@@ -591,6 +593,7 @@ virFirewallCmdIptablesApply(virFirewall *firewall,
-     case VIR_FIREWALL_LAYER_IPV6:
-         virCommandAddArg(cmd, "-w");
-         break;
-+    case VIR_FIREWALL_LAYER_TC:
-     case VIR_FIREWALL_LAYER_LAST:
-         break;
-     }
-@@ -672,39 +675,52 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED,
-     size_t i;
-     int status;
- 
--    cmd = virCommandNew(NFT);
-+    if (fwCmd->layer == VIR_FIREWALL_LAYER_TC) {
- 
--    if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
--        fwCmd->argsLen > 1) {
--        /* skip any leading options to get to command verb */
--        for (i = 0; i < fwCmd->argsLen - 1; i++) {
--            if (fwCmd->args[i][0] != '-')
--                break;
--        }
-+        /* for VIR_FIREWALL_LAYER_TC, we run the 'tc' (traffic control) command with
-+         * the supplied args.
-+         */
-+        cmd = virCommandNew(TC);
- 
--        if (i + 1 < fwCmd->argsLen &&
--            VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
-+        /* NB: RAW commands don't support auto-rollback command creation */
- 
--            cmdIdx = i;
--            objectType = fwCmd->args[i + 1];
-+    } else {
- 
--            /* we currently only handle auto-rollback for rules,
--             * chains, and tables, and those all can be "rolled
--             * back" by a delete command using the handle that is
--             * returned when "-ae" is added to the add/insert
--             * command.
--             */
--            if (STREQ_NULLABLE(objectType, "rule") ||
--                STREQ_NULLABLE(objectType, "chain") ||
--                STREQ_NULLABLE(objectType, "table")) {
-+        cmd = virCommandNew(NFT);
- 
--                needRollback = true;
--                /* this option to nft instructs it to add the
--                 * "handle" of the created object to stdout
-+        if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
-+            fwCmd->argsLen > 1) {
-+            /* skip any leading options to get to command verb */
-+            for (i = 0; i < fwCmd->argsLen - 1; i++) {
-+                if (fwCmd->args[i][0] != '-')
-+                    break;
-+            }
-+
-+            if (i + 1 < fwCmd->argsLen &&
-+                VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
-+
-+                cmdIdx = i;
-+                objectType = fwCmd->args[i + 1];
-+
-+                /* we currently only handle auto-rollback for rules,
-+                 * chains, and tables, and those all can be "rolled
-+                 * back" by a delete command using the handle that is
-+                 * returned when "-ae" is added to the add/insert
-+                 * command.
-                  */
--                virCommandAddArg(cmd, "-ae");
-+                if (STREQ_NULLABLE(objectType, "rule") ||
-+                    STREQ_NULLABLE(objectType, "chain") ||
-+                    STREQ_NULLABLE(objectType, "table")) {
-+
-+                    needRollback = true;
-+                    /* this option to nft instructs it to add the
-+                     * "handle" of the created object to stdout
-+                     */
-+                    virCommandAddArg(cmd, "-ae");
-+                }
-             }
-         }
-+
-     }
- 
-     for (i = 0; i < fwCmd->argsLen; i++)
-diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
-index bce51259d2..d42e60884b 100644
---- a/src/util/virfirewall.h
-+++ b/src/util/virfirewall.h
-@@ -39,6 +39,7 @@ typedef enum {
-     VIR_FIREWALL_LAYER_ETHERNET,
-     VIR_FIREWALL_LAYER_IPV4,
-     VIR_FIREWALL_LAYER_IPV6,
-+    VIR_FIREWALL_LAYER_TC,
- 
-     VIR_FIREWALL_LAYER_LAST,
- } virFirewallLayer;
-diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c
-index 827e201dbb..124523c420 100644
---- a/src/util/virfirewalld.c
-+++ b/src/util/virfirewalld.c
-@@ -43,6 +43,7 @@ VIR_LOG_INIT("util.firewalld");
- VIR_ENUM_DECL(virFirewallLayerFirewallD);
- VIR_ENUM_IMPL(virFirewallLayerFirewallD,
-               VIR_FIREWALL_LAYER_LAST,
-+              "",
-               "eb",
-               "ipv4",
-               "ipv6",
--- 
-2.47.1
-

0009-network-add-tc-filter-rule-to-nftables-backend-to-fi.patch

@@ -1,687 +0,0 @@
-From b1e2318a0d609fcdff04fcf88953ea87cdd02b95 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:49 -0500
-Subject: [PATCH 9/9] network: add tc filter rule to nftables backend to fix
- checksum of DHCP responses
-
-Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the
-history and explanation of the problem that this patch is fixing.
-
-A shorter explanation is that when a guest is connected to a libvirt
-virtual network using a virtio-net adapter with in-kernel "vhost-net"
-packet processing enabled, it will fail to acquire an IP address from
-a DHCP seever running on the host.
-
-In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing
-out* the checksums of these packets with an nftables rule (nftables
-can't recompute the checksum, but it can set it to 0) . This
-*appeared* to work initially, but it turned out that zeroing the
-checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest
-interfaces. That attempt was reverted in commit v10.9.0-rc2.
-
-Fortunately, there is an existing way to recompute the checksum of a
-packet as it leaves an interface - the "tc" (traffic control) utility
-that libvirt already uses for bandwidth management. This patch uses a
-tc filter rule to match dhcp response packets on the bridge and
-recompute their checksum.
-
-The filter rule must be attached to a tc qdisc, which may also have a
-filter attached for bandwidth management (in the <bandwidth> element
-of the network config). Not only must we add the qdisc only once
-(which was already handled by the patch two prior to this one), but
-also the filter rule for checksum fixing and the filter rule for
-bandwidth management must be different priorities so they don't clash;
-this is solved by adding the checksum-fix filter with "priority 2",
-while the bandwidth management filter remains "priority 1" (both will
-always be evaluated anyway, it's just a matter of which is evaluated
-first).
-
-So far this method has worked with every different guest we could
-throw at it, including several that failed with the previous method.
-
-Fixes: b89c4991daa0ee9371f10937fab3b03c5ffdabc6
-Reported-by: Rich Jones <rjones@redhat.com>
-Reported-by: Andrea Bolognani <abologna@redhat.com>
-Fix-Suggested-by: Eric Garver <egarver@redhat.com>
-Fix-Suggested-by: Phil Sutter <psutter@redhat.com>
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/network/network_nftables.c                | 68 +++++++++++++++++++
- .../forward-dev-linux.nftables                | 40 +++++++++++
- .../isolated-linux.nftables                   | 40 +++++++++++
- .../nat-default-linux.nftables                | 40 +++++++++++
- .../nat-ipv6-linux.nftables                   | 40 +++++++++++
- .../nat-ipv6-masquerade-linux.nftables        | 40 +++++++++++
- .../nat-many-ips-linux.nftables               | 40 +++++++++++
- .../nat-no-dhcp-linux.nftables                | 40 +++++++++++
- .../nat-port-range-ipv6-linux.nftables        | 40 +++++++++++
- .../nat-port-range-linux.nftables             | 40 +++++++++++
- .../nat-tftp-linux.nftables                   | 40 +++++++++++
- .../route-default-linux.nftables              | 40 +++++++++++
- 12 files changed, 508 insertions(+)
-
-diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
-index cc184105c3..748edb0273 100644
---- a/src/network/network_nftables.c
-+++ b/src/network/network_nftables.c
-@@ -29,6 +29,7 @@
- 
- #include "internal.h"
- #include "virfirewalld.h"
-+#include "vircommand.h"
- #include "virerror.h"
- #include "virlog.h"
- #include "virhash.h"
-@@ -924,6 +925,67 @@ nftablesAddIPSpecificFirewallRules(virFirewall *fw,
- }
- 
- 
-+/**
-+ * nftablesAddUdpChecksumFixWithTC:
-+ *
-+ * Add a tc filter rule to @ifname (the bridge device of this network)
-+ * that will recompute the checksum of udp packets output from @iface with
-+ * destination port @port.
-+ *
-+ * Normally the checksum should be filled by some part of the basic
-+ * network stack, but there are cases (e.g. DHCP response packets sent
-+ * from virtualization host to a QEMU guest when the guest NIC uses
-+ * vhost-net packet processing) when the host (sender) thinks that
-+ * packet checksums will be computed elsewhere (and so leaves a
-+ * partially computed checksum in the packet header) while the guest
-+ * (receiver) thinks that the checksum has already been fully
-+ * computed; in the meantime none of the code in between has actually
-+ * finished computing the checksum.
-+ *
-+ * An example of this is DHCP response packets from host to guest. If
-+ * the checksum of each of these packets isn't properly computed, then
-+ * many guests (e.g. FreeBSD) will drop them with reason BAD CHECKSUM;
-+ * this tc filter rule will fix the ip and udp checksums, and the
-+ * FreeBSD dhcp client will happily accept the packet.
-+ *
-+ * (NB: if you're wondering how the tc qdisc and filter are removed
-+ * when the network is destroyed, the answer is that the kernel
-+ * automatically (and properly) removes them for us, so we don't need
-+ * to worry about keeping track/deleting as we do with nftables rules)
-+ */
-+static int
-+nftablesAddUdpChecksumFixWithTC(virFirewall *fw,
-+                                const char *iface,
-+                                int port)
-+{
-+    g_autofree char *portstr = g_strdup_printf("%d", port);
-+
-+    /* this will add the qdisc (that the filter below is attached to)
-+     * unless it already exists
-+     */
-+    if (virNetDevBandWidthAddTxFilterParentQdisc(iface, true) < 0)
-+        return -1;
-+
-+    /* add a filter to catch all udp packets with dst "port" and
-+     * recompute their checksum
-+     */
-+    virFirewallAddCmd(fw, VIR_FIREWALL_LAYER_TC,
-+                      "filter", "add", "dev", iface,
-+                      "prio", "2", "protocol", "ip", "parent", "1:",
-+                      "u32", "match", "ip", "dport", portstr, "ffff",
-+                      "action", "csum", "ip", "and", "udp",
-+                      NULL);
-+
-+    virFirewallAddRollbackCmd(fw, VIR_FIREWALL_LAYER_TC,
-+                              "filter", "del", "dev", iface,
-+                              "prio", "2", "protocol", "ip", "parent", "1:",
-+                              "u32", "match", "ip", "dport", portstr, "ffff",
-+                              "action", "csum", "ip", "and", "udp",
-+                              NULL);
-+    return 0;
-+}
-+
-+
- /* nftablesAddFirewallrules:
-  *
-  * @def - the network that needs an nftables firewall added
-@@ -944,6 +1006,12 @@ nftablesAddFirewallRules(virNetworkDef *def, virFirewall **fwRemoval)
- 
-     virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK);
- 
-+    /* add the tc filter rule needed to fixup the checksum of dhcp
-+     * response packets going from host to guest.
-+     */
-+    if (nftablesAddUdpChecksumFixWithTC(fw, def->bridge, 68) < 0)
-+        return -1;
-+
-     nftablesAddGeneralFirewallRules(fw, def);
- 
-     for (i = 0;
-diff --git a/tests/networkxml2firewalldata/forward-dev-linux.nftables b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-index 8badb74beb..6772383b37 100644
---- a/tests/networkxml2firewalldata/forward-dev-linux.nftables
-+++ b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/isolated-linux.nftables b/tests/networkxml2firewalldata/isolated-linux.nftables
-index d1b4dac178..546a18b75a 100644
---- a/tests/networkxml2firewalldata/isolated-linux.nftables
-+++ b/tests/networkxml2firewalldata/isolated-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-default-linux.nftables b/tests/networkxml2firewalldata/nat-default-linux.nftables
-index 28508292f9..08623c1381 100644
---- a/tests/networkxml2firewalldata/nat-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-default-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-index d8a9ba706d..3fd6b94eef 100644
---- a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-index a7f09cda59..2811e098d1 100644
---- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-index b826fe6134..5409d5b552 100644
---- a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-index d8a9ba706d..3fd6b94eef 100644
---- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-index ceaed6fa40..d74417cdb3 100644
---- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-index 1dc37a26ec..b55bb287a9 100644
---- a/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.nftables b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-index 28508292f9..08623c1381 100644
---- a/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/route-default-linux.nftables b/tests/networkxml2firewalldata/route-default-linux.nftables
-index 282c9542a5..76d6902517 100644
---- a/tests/networkxml2firewalldata/route-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/route-default-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
--- 
-2.47.1
-

0010-network-permit-forward-mode-open-when-a-network-has-.patch

@@ -1,51 +0,0 @@
-From 114c0ec656e879ab4d67919914bb24cf5993106d Mon Sep 17 00:00:00 2001
-Message-ID: <114c0ec656e879ab4d67919914bb24cf5993106d.1734201785.git.crobinso@redhat.com>
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 2 Sep 2024 16:13:08 -0400
-Subject: [PATCH] network: permit <forward mode='open'/> when a network has no
- IP address
-Content-type: text/plain
-
-The whole point of <forward mode='open'/> is to supress libvirt from
-adding any firewall rules for a network, and someone might want to
-create a network with no IP address (i.e. they don't want the guests
-to have connectivity to the host via this interface) and no firewall
-rules (they don't want any, or they want to add their own). So there's
-no reason to fail when a network has <forward mode='open'/> and also
-has no IP address.
-
-Kind-of-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/588
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- src/conf/network_conf.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
-index 5cf419acf1..320e1b089a 100644
---- a/src/conf/network_conf.c
-+++ b/src/conf/network_conf.c
-@@ -1789,7 +1789,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
- 
-     case VIR_NETWORK_FORWARD_ROUTE:
-     case VIR_NETWORK_FORWARD_NAT:
--    case VIR_NETWORK_FORWARD_OPEN:
-         /* It's pointless to specify L3 forwarding without specifying
-          * the network we're on.
-          */
-@@ -1806,8 +1805,10 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
-                            def->name);
-             return NULL;
-         }
-+        break;
- 
--        if (def->forward.type == VIR_NETWORK_FORWARD_OPEN && def->forward.nifs) {
-+    case VIR_NETWORK_FORWARD_OPEN:
-+        if (def->forward.nifs) {
-             /* an open network by definition can't place any restrictions
-              * on what traffic is allowed or where it goes, so specifying
-              * a forwarding device is nonsensical.
--- 
-2.47.1
-

0011-qemu-snapshot-delete-disk-image-only-if-parent-snaps.patch

@@ -1,64 +0,0 @@
-From d51179fa82448f4720f1645f0b7100df80508cc4 Mon Sep 17 00:00:00 2001
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Thu, 9 Jan 2025 16:23:44 +0100
-Subject: [PATCH] qemu: snapshot: delete disk image only if parent snapshot is
- external
-Content-type: text/plain
-
-When we are deleting external snapshot that is not active we only need
-to delete overlay disk image of the parent snapshot. This works
-correctly even if parent snapshot is external and active as it will have
-another overlay created when user reverted to that snapshot.
-
-In case the parent snapshot is internal there are no overlay disk images
-created as everything is stored internally within the disk image. In
-this case we would delete the actual disk image storing internal
-snapshots and most likely the original disk image as well resulting in
-data loss once the VM is shutoff.
-
-Fixes: https://gitlab.com/libvirt/libvirt/-/issues/734
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-Reviewed-by: Peter Krempa <pkrempa@redhat.com>
----
- src/qemu/qemu_snapshot.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
-index 18b2e478f6..80cd54bf33 100644
---- a/src/qemu/qemu_snapshot.c
-+++ b/src/qemu/qemu_snapshot.c
-@@ -3144,6 +3144,8 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
-             return -1;
-         }
- 
-+        data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
-+
-         if (data->merge) {
-             virStorageSource *snapDiskSrc = NULL;
- 
-@@ -3185,8 +3187,6 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
-                 qemuSnapshotGetDisksWithBackingStore(vm, snap, data);
-             }
- 
--            data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
--
-             if (data->parentSnap && !virDomainSnapshotIsExternal(data->parentSnap)) {
-                 virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
-                                _("deleting external snapshot that has internal snapshot as parent not supported"));
-@@ -3642,10 +3642,12 @@ qemuSnapshotDiscardExternal(virDomainObj *vm,
-             if (!data->job)
-                 goto error;
-         } else {
--            if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
--                virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
--                VIR_WARN("Failed to remove snapshot image '%s'",
--                         data->snapDisk->name);
-+            if (data->parentSnap && virDomainSnapshotIsExternal(data->parentSnap)) {
-+                if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
-+                    virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
-+                    VIR_WARN("Failed to remove snapshot image '%s'",
-+                             data->snapDisk->name);
-+                }
-             }
-         }
-     }

libvirt.spec

@@ -3,15 +3,15 @@
 # This spec file assumes you are building on a Fedora or RHEL version
 # that's still supported by the vendor. It may work on other distros
 # or versions, but no effort will be made to ensure that going forward.
-%define min_rhel 8
-%define min_fedora 37
+%define min_rhel 9
+%define min_fedora 41
 
-%define arches_qemu_kvm         %{ix86} x86_64 %{power64} %{arm} aarch64 s390x riscv64
+%define arches_qemu_kvm         %{ix86} x86_64 %{power64} aarch64 s390x riscv64
 %if 0%{?rhel}
-    %if 0%{?rhel} > 8
-        %define arches_qemu_kvm     x86_64 aarch64 s390x
+    %if 0%{?rhel} >= 10
+        %define arches_qemu_kvm     x86_64 aarch64 s390x riscv64
     %else
-        %define arches_qemu_kvm     x86_64 %{power64} aarch64 s390x
+        %define arches_qemu_kvm     x86_64 aarch64 s390x
     %endif
 %endif
 
@@ -19,7 +19,7 @@
 %define arches_x86              %{ix86} x86_64
 
 %define arches_systemtap_64bit  %{arches_64bit}
-%define arches_dmidecode        %{arches_x86}
+%define arches_dmidecode        %{arches_x86} aarch64 riscv64
 %define arches_xen              %{arches_x86} aarch64
 %if 0%{?fedora}
     %define arches_xen          x86_64 aarch64
@@ -29,12 +29,24 @@
 %define arches_zfs              %{arches_x86} %{power64} %{arm}
 %define arches_numactl          %{arches_x86} %{power64} aarch64 s390x
 %define arches_numad            %{arches_x86} %{power64} aarch64
+%define arches_ch               x86_64 aarch64
 
 # The hypervisor drivers that run in libvirtd
-%define with_qemu          0%{!?_without_qemu:1}
 %define with_lxc           0%{!?_without_lxc:1}
 %define with_libxl         0%{!?_without_libxl:1}
 %define with_vbox          0%{!?_without_vbox:1}
+%define with_ch            0%{!?_without_ch:1}
+
+%ifarch %{arches_64bit}
+    %define with_qemu      0%{!?_without_qemu:1}
+%else
+    # QEMU drops 32-bit in Fedora 44
+    %if 0%{?fedora} > 43
+        %define with_qemu  0
+    %else
+        %define with_qemu  0%{!?_without_qemu:1}
+    %endif
+%endif
 
 %ifarch %{arches_qemu_kvm}
     %define with_qemu_kvm      %{with_qemu}
@@ -42,6 +54,12 @@
     %define with_qemu_kvm      0
 %endif
 
+%if 0%{?fedora} >= 42
+    %define with_account_add 0
+%else
+    %define with_account_add 1
+%endif
+
 %define with_qemu_tcg      %{with_qemu}
 
 # RHEL disables TCG on all architectures
@@ -64,18 +82,13 @@
 
 %define with_storage_gluster 0%{!?_without_storage_gluster:1}
 %if 0%{?rhel}
-    # Glusterfs has been dropped in RHEL-9, and before that
-    # was only enabled on arches where KVM exists
-    %if 0%{?rhel} > 8
-        %define with_storage_gluster 0
-    %else
-        %ifnarch %{arches_qemu_kvm}
-            %define with_storage_gluster 0
-        %endif
-    %endif
+    # Glusterfs has been dropped in RHEL-9.
+    %define with_storage_gluster 0
 %endif
 
-# Fedora has zfs-fuse
+# On Fedora 43, the 'zfs-fuse' package was removed, but is obtainable via
+# other means. Build the backend, but it's no longer considered to be part
+# of 'daemon-driver-storage'.
 %if 0%{?fedora}
     %define with_storage_zfs      0%{!?_without_storage_zfs:1}
 %else
@@ -84,13 +97,12 @@
 
 %define with_storage_iscsi_direct 0%{!?_without_storage_iscsi_direct:1}
 # libiscsi has been dropped in RHEL-9
-%if 0%{?rhel} > 8
+%if 0%{?rhel}
     %define with_storage_iscsi_direct 0
 %endif
 
 # Other optional features
 %define with_numactl          0%{!?_without_numactl:1}
-%define with_userfaultfd_sysctl 0%{!?_without_userfaultfd_sysctl:1}
 
 # A few optional bits off by default, we enable later
 %define with_fuse             0
@@ -123,6 +135,9 @@
 %ifnarch %{arches_ceph}
     %define with_storage_rbd 0
 %endif
+%ifnarch %{arches_ch}
+    %define with_ch 0
+%endif
 
 # RHEL doesn't ship many hypervisor drivers
 %if 0%{?rhel}
@@ -132,14 +147,11 @@
     %define with_libxl 0
     %define with_hyperv 0
     %define with_lxc 0
+    %define with_ch 0
 %endif
 
 %define with_firewalld_zone 0%{!?_without_firewalld_zone:1}
 
-%if 0%{?rhel} && 0%{?rhel} < 9
-    %define with_netcf 0%{!?_without_netcf:1}
-%endif
-
 # fuse is used to provide virtualized /proc for LXC
 %if %{with_lxc}
     %define with_fuse      0%{!?_without_fuse:1}
@@ -181,8 +193,7 @@
 # Right now that's not the case anywhere, but things should be fine by the time
 # Fedora 40 is released.
 %if %{with_qemu}
-    # rhel-8 lacks pidfd_open
-    %if 0%{?fedora} || 0%{?rhel} >= 9
+    %if 0%{?fedora} || 0%{?rhel}
         %define with_nbdkit 0%{!?_without_nbdkit:1}
 
         # setting 'with_nbdkit_config_default' must be done only when compiling
@@ -190,7 +201,7 @@
         #
         # TODO: add RHEL 9 once a minor release that contains the necessary SELinux
         #       bits exists (we only support the most recent minor release)
-        %if 0%{?fedora} >= 40
+        %if 0%{?fedora}
             %define with_nbdkit_config_default 0%{!?_without_nbdkit_config_default:1}
         %endif
     %endif
@@ -201,13 +212,13 @@
 %endif
 
 %define with_modular_daemons 0
-%if 0%{?fedora} || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?rhel}
     %define with_modular_daemons 1
 %endif
 
 # Prefer nftables for future OS releases but keep using iptables
 # for existing ones
-%if 0%{?rhel} >= 10 || 0%{?fedora} >= 41
+%if 0%{?rhel} >= 10 || 0%{?fedora}
     %define prefer_nftables 1
     %define firewall_backend_priority nftables,iptables
 %else
@@ -252,19 +263,14 @@
 
 # RHEL releases provide stable tool chains and so it is safe to turn
 # compiler warning into errors without being worried about frequent
-# changes in reported warnings
-%if 0%{?rhel}
+# changes in reported warnings. ELN is a rebuild of Rawhide so should
+# be treated as unstable for this flag
+%if 0%{?rhel} && !0%{?eln}
     %define enable_werror -Dwerror=true
 %else
     %define enable_werror -Dwerror=false -Dgit_werror=disabled
 %endif
 
-# Fedora and RHEL-9 are new enough to support /dev/userfaultfd, which
-# does not require enabling vm.unprivileged_userfaultfd sysctl.
-%if 0%{?fedora} || 0%{?rhel} >= 9
-    %define with_userfaultfd_sysctl 0
-%endif
-
 %define tls_priority "@LIBVIRT,SYSTEM"
 
 # libvirt 8.1.0 stops distributing any sysconfig files.
@@ -288,8 +294,8 @@
 
 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 10.6.0
-Release: 7%{?dist}
+Version: 12.0.0
+Release: 3%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
 URL: https://libvirt.org/
 
@@ -298,24 +304,9 @@ URL: https://libvirt.org/
 %endif
 Source: https://download.libvirt.org/%{?mainturl}libvirt-%{version}.tar.xz
 
-# Fix `virsh domifaddr --source=arp` on kernel 6.10 (bz #2302245)
-Patch0001: 0001-virarptable-Properly-calculate-rtattr-length.patch
-Patch0002: 0002-virarptable-Fix-check-for-message-length.patch
-Patch0003: 0003-virarptable-End-parsing-earlier-in-case-of-NLMSG_DON.patch
-
-# Fix DHCP response checksum when using nftables firewall
-Patch0004: 0004-util-use-a-single-flags-arg-for-virNetDevBandwidthSe.patch
-Patch0005: 0005-util-make-it-optional-to-clear-existing-tc-qdiscs-fi.patch
-Patch0006: 0006-util-put-the-command-that-adds-a-tx-filter-qdisc-int.patch
-Patch0007: 0007-util-don-t-re-add-the-qdisc-used-for-tx-filters-if-i.patch
-Patch0008: 0008-util-add-new-tc-layer-for-virFirewallCmd-objects.patch
-Patch0009: 0009-network-add-tc-filter-rule-to-nftables-backend-to-fi.patch
-
-# Permit forward mode=open when network has no IP (bz 2255266)
-Patch: 0010-network-permit-forward-mode-open-when-a-network-has-.patch
-
-# Fix potential dataloss on snapshot deletion
-Patch11: 0011-qemu-snapshot-delete-disk-image-only-if-parent-snaps.patch
+# Fix IPv6 connections to ESXi
+# Upstream in > 12.0.0
+Patch: 0001-esx-Allow-connecting-to-IPv6-server.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -336,6 +327,9 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0
 %if %{with_vbox}
 Requires: libvirt-daemon-driver-vbox = %{version}-%{release}
 %endif
+%if %{with_ch}
+Requires: libvirt-daemon-driver-ch = %{version}-%{release}
+%endif
 Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
 Requires: libvirt-daemon-driver-interface = %{version}-%{release}
 Requires: libvirt-daemon-driver-secret = %{version}-%{release}
@@ -350,7 +344,7 @@ Requires: libvirt-libs = %{version}-%{release}
 BuildRequires: python3-docutils
 BuildRequires: meson >= 0.56.0
 BuildRequires: ninja-build
-BuildRequires: git
+BuildRequires: git-core
 BuildRequires: perl-interpreter
 BuildRequires: python3
 BuildRequires: python3-pytest
@@ -367,7 +361,7 @@ BuildRequires: gcc
     %if %{with_libxl}
 BuildRequires: xen-devel
     %endif
-BuildRequires: glib2-devel >= 2.58
+BuildRequires: glib2-devel >= 2.66
 BuildRequires: libxml2-devel
 BuildRequires: readline-devel
 BuildRequires: pkgconfig(bash-completion) >= 2.0
@@ -380,19 +374,14 @@ BuildRequires: libblkid-devel >= 2.17
 BuildRequires: augeas
 BuildRequires: systemd-devel >= 185
 BuildRequires: libpciaccess-devel >= 0.10.9
-BuildRequires: yajl-devel
+BuildRequires: json-c-devel
     %if %{with_sanlock}
 BuildRequires: sanlock-devel >= 2.4
     %endif
 BuildRequires: libpcap-devel >= 1.5.0
 BuildRequires: libnl3-devel
 BuildRequires: libselinux-devel
-# For modprobe
-BuildRequires: kmod
 BuildRequires: cyrus-sasl-devel
-BuildRequires: polkit >= 0.112
-# For mount/umount in FS driver
-BuildRequires: util-linux
     %if %{with_qemu}
 # For managing ACLs
 BuildRequires: libacl-devel
@@ -403,10 +392,6 @@ BuildRequires: /usr/bin/qemu-img
     %if %{with_nbdkit}
 BuildRequires: libnbd-devel
     %endif
-# For LVM drivers
-BuildRequires: lvm2
-# For pool type=iscsi
-BuildRequires: iscsi-initiator-utils
     %if %{with_storage_iscsi_direct}
 # For pool type=iscsi-direct
 BuildRequires: libiscsi-devel
@@ -429,7 +414,7 @@ BuildRequires: numactl-devel
     %endif
 BuildRequires: libcap-ng-devel >= 0.5.0
     %if %{with_fuse}
-BuildRequires: fuse-devel >= 2.8.6
+BuildRequires: fuse3-devel
     %endif
     %if %{with_libssh2}
 BuildRequires: libssh2-devel >= 1.3.0
@@ -446,13 +431,6 @@ BuildRequires: libwsman-devel >= 2.6.3
 BuildRequires: audit-libs-devel
 BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
-# For mount/umount in FS driver
-BuildRequires: util-linux
-# For showmount in FS driver (netfs discovery)
-BuildRequires: nfs-utils
-    %if %{with_numad}
-BuildRequires: numad
-    %endif
     %if %{with_wireshark}
 BuildRequires: wireshark-devel
     %endif
@@ -533,6 +511,8 @@ Requires: libvirt-libs = %{version}-%{release}
 # Recommends here will install libvirt-client by default (if available), but
 # RPM won't complain if the package is unavailable, masked, or removed later.
 Recommends: libvirt-client = %{version}-%{release}
+# For modprobe and rmmod
+Requires: kmod
 # for /sbin/ip
 Requires: iproute
 # for /sbin/tc
@@ -547,8 +527,10 @@ Requires(posttrans): /usr/bin/systemctl
 Requires(preun): /usr/bin/systemctl
 # libvirtd depends on 'messagebus' service
 Requires: dbus
+    %if %{with_account_add}
 # For uid creation during pre
 Requires(pre): shadow-utils
+    %endif
 # Needed by /usr/libexec/libvirt-guests.sh script.
     %if 0%{?fedora}
 Requires: gettext-runtime
@@ -575,6 +557,7 @@ resources
 %package daemon-plugin-lockd
 Summary: lockd client plugin for virtlockd
 Requires: libvirt-libs = %{version}-%{release}
+Requires: libvirt-daemon-common = %{version}-%{release}
 Requires: libvirt-daemon-lock = %{version}-%{release}
 
 %description daemon-plugin-lockd
@@ -688,8 +671,8 @@ an implementation of the secret key APIs.
 Summary: Storage driver plugin including base backends for the libvirtd daemon
 Requires: libvirt-daemon-common = %{version}-%{release}
 Requires: libvirt-libs = %{version}-%{release}
-Requires: nfs-utils
-# For mkfs
+Recommends: nfs-utils
+# For mkfs and mount/umount
 Requires: util-linux
 # For storage wiping with different algorithms
 Requires: scrub
@@ -801,9 +784,13 @@ volumes using the ceph protocol.
 Summary: Storage driver plugin for ZFS
 Requires: libvirt-daemon-driver-storage-core = %{version}-%{release}
 Requires: libvirt-libs = %{version}-%{release}
-# Support any conforming implementation of zfs
+# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable
+# externally. The package builds fine without these. Users will have to provide
+# their own implementation.
+        %if 0%{?fedora} && 0%{?fedora} < 43
 Requires: /sbin/zfs
 Requires: /sbin/zpool
+        %endif
 
 %description daemon-driver-storage-zfs
 The storage driver backend adding implementation of the storage APIs for
@@ -827,7 +814,10 @@ Requires: libvirt-daemon-driver-storage-gluster = %{version}-%{release}
     %if %{with_storage_rbd}
 Requires: libvirt-daemon-driver-storage-rbd = %{version}-%{release}
     %endif
-    %if %{with_storage_zfs}
+# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable
+# externally. We do not want to install this as part of 'daemon-driver-storage'
+# any more.
+    %if %{with_storage_zfs} && 0%{?fedora} && 0%{?fedora} < 43
 Requires: libvirt-daemon-driver-storage-zfs = %{version}-%{release}
     %endif
 
@@ -854,7 +844,7 @@ Requires: swtpm-tools
         %if %{with_numad}
 Requires: numad
         %endif
-        %if 0%{?fedora} || 0%{?rhel} >= 9
+        %if 0%{?fedora} || 0%{?rhel}
 Recommends: passt
 Recommends: passt-selinux
         %endif
@@ -1014,7 +1004,6 @@ Requires: libvirt-daemon-driver-libxl = %{version}-%{release}
 Requires: libvirt-daemon-driver-interface = %{version}-%{release}
 Requires: libvirt-daemon-driver-network = %{version}-%{release}
 Requires: libvirt-daemon-driver-nodedev = %{version}-%{release}
-Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
 Requires: libvirt-daemon-driver-secret = %{version}-%{release}
 Requires: libvirt-daemon-driver-storage = %{version}-%{release}
 Requires: xen
@@ -1048,6 +1037,20 @@ Server side daemon and driver required to manage the virtualization
 capabilities of VirtualBox
     %endif
 
+    %if %{with_ch}
+%package daemon-driver-ch
+Summary: Cloud-Hypervisor driver plugin for libvirtd daemon
+Requires: libvirt-daemon-common = %{version}-%{release}
+Requires: libvirt-daemon-log = %{version}-%{release}
+Requires: libvirt-libs = %{version}-%{release}
+
+%description daemon-driver-ch
+The ch driver plugin for the libvirtd daemon, providing
+an implementation of the hypervisor driver APIs by
+Cloud-Hypervisor
+    %endif
+
+
 %package client
 Summary: Client side utilities of the libvirt library
 Requires: libvirt-libs = %{version}-%{release}
@@ -1093,6 +1096,10 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic.
 %package login-shell
 Summary: Login shell for connecting users to an LXC container
 Requires: libvirt-libs = %{version}-%{release}
+        %if %{with_account_add}
+# For uid creation during pre
+Requires(pre): shadow-utils
+        %endif
 
 %description login-shell
 Provides the set-uid virt-login-shell binary that is used to
@@ -1115,6 +1122,7 @@ Requires: sanlock >= 2.4
 #for virt-sanlock-cleanup require augeas
 Requires: augeas
 Requires: libvirt-libs = %{version}-%{release}
+Requires: libvirt-daemon-common = %{version}-%{release}
 Obsoletes: libvirt-lock-sanlock < 9.1.0
 Provides: libvirt-lock-sanlock = %{version}-%{release}
 
@@ -1210,9 +1218,15 @@ exit 1
 %endif
 
 %if %{with_esx}
-    %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled
+    %define arg_esx -Ddriver_esx=enabled
 %else
-    %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled
+    %define arg_esx -Ddriver_esx=disabled
+%endif
+
+%if %{with_esx} || %{with_ch}
+    %define arg_curl -Dcurl=enabled
+%else
+    %define arg_curl -Dcurl=disabled
 %endif
 
 %if %{with_hyperv}
@@ -1227,6 +1241,12 @@ exit 1
     %define arg_vmware -Ddriver_vmware=disabled
 %endif
 
+%if %{with_ch}
+    %define arg_ch -Ddriver_ch=enabled
+%else
+    %define arg_ch -Ddriver_ch=disabled
+%endif
+
 %if %{with_storage_rbd}
     %define arg_storage_rbd -Dstorage_rbd=enabled
 %else
@@ -1323,12 +1343,6 @@ exit 1
     %define arg_remote_mode -Dremote_default_mode=legacy
 %endif
 
-%if %{with_userfaultfd_sysctl}
-    %define arg_userfaultfd_sysctl -Duserfaultfd_sysctl=enabled
-%else
-    %define arg_userfaultfd_sysctl -Duserfaultfd_sysctl=disabled
-%endif
-
 %define when  %(date +"%%F-%%T")
 %define where %(hostname)
 %define who   %{?packager}%{!?packager:Unknown}
@@ -1357,11 +1371,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
            -Ddriver_remote=enabled \
            -Ddriver_test=enabled \
            %{?arg_esx} \
+           %{?arg_curl} \
            %{?arg_hyperv} \
            %{?arg_vmware} \
+           %{?arg_ch} \
            -Ddriver_vz=disabled \
            -Ddriver_bhyve=disabled \
-           -Ddriver_ch=disabled \
            %{?arg_remote_mode} \
            -Ddriver_interface=enabled \
            -Ddriver_network=enabled \
@@ -1388,7 +1403,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
            -Dapparmor_profiles=disabled \
            -Dsecdriver_apparmor=disabled \
            -Dudev=enabled \
-           -Dyajl=enabled \
+           -Djson_c=enabled \
            %{?arg_sanlock} \
            -Dlibpcap=enabled \
            %{?arg_nbdkit} \
@@ -1411,7 +1426,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
            -Dqemu_datadir=%{qemu_datadir} \
            -Dtls_priority=%{tls_priority} \
            -Dsysctl_config=enabled \
-           %{?arg_userfaultfd_sysctl} \
            -Dssh_proxy=enabled \
            %{?enable_werror} \
            -Dexpensive_tests=enabled \
@@ -1441,6 +1455,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
   -Dblkid=disabled \
   -Dcapng=disabled \
   -Ddriver_bhyve=disabled \
+  -Ddriver_ch=disabled \
   -Ddriver_hyperv=disabled \
   -Ddriver_interface=disabled \
   -Ddriver_libvirtd=disabled \
@@ -1460,6 +1475,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
   -Dfuse=disabled \
   -Dglusterfs=disabled \
   -Dhost_validate=disabled \
+  -Djson_c=disabled \
   -Dlibiscsi=disabled \
   -Dnbdkit=disabled \
   -Dnbdkit_config_default=disabled \
@@ -1497,12 +1513,10 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
   -Dstorage_vstorage=disabled \
   -Dstorage_zfs=disabled \
   -Dsysctl_config=disabled \
-  -Duserfaultfd_sysctl=disabled \
   -Dssh_proxy=disabled \
   -Dtests=disabled \
   -Dudev=disabled \
   -Dwireshark_dissector=disabled \
-  -Dyajl=disabled \
   %{?enable_werror}
 %mingw_ninja
 %endif
@@ -1563,6 +1577,10 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
     %endif
+    %if ! %{with_ch}
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
+    %endif
 
 # Copied into libvirt-docs subpackage eventually
 mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
@@ -1773,10 +1791,12 @@ export VIR_TEST_DEBUG=1
 %pre daemon-common
 %libvirt_sysconfig_pre libvirt-guests
 %libvirt_systemd_oneshot_pre libvirt-guests
+    %if %{with_account_add}
 # 'libvirt' group is just to allow password-less polkit access to libvirt
 # daemons. The uid number is irrelevant, so we use dynamic allocation.
 getent group libvirt >/dev/null || groupadd -r libvirt
 exit 0
+    %endif
 
 %posttrans daemon-common
 %libvirt_sysconfig_posttrans libvirt-guests
@@ -1899,6 +1919,7 @@ exit 0
 %libvirt_sysconfig_pre virtqemud
 %libvirt_systemd_unix_pre virtqemud
 
+        %if %{with_account_add}
 # We want soft static allocation of well-known ids, as disk images
 # are commonly shared across NFS mounts by id rather than name.
 # See https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/
@@ -1914,6 +1935,7 @@ if ! getent passwd 'qemu' >/dev/null; then
   fi
 fi
 exit 0
+        %endif
 
 %posttrans daemon-driver-qemu
 %libvirt_sysconfig_posttrans virtqemud
@@ -1962,6 +1984,19 @@ exit 0
 %libvirt_systemd_unix_preun virtxend
     %endif
 
+    %if %{with_ch}
+%pre daemon-driver-ch
+%libvirt_sysconfig_pre virtchd
+%libvirt_systemd_unix_pre virtchd
+
+%posttrans daemon-driver-ch
+%libvirt_sysconfig_posttrans virtchd
+%libvirt_systemd_unix_posttrans virtchd
+
+%preun daemon-driver-ch
+%libvirt_systemd_unix_preun virtchd
+    %endif
+
 %pre daemon-config-network
 %libvirt_systemd_config_pre libvirtd
 %libvirt_systemd_config_pre virtnetworkd
@@ -2027,8 +2062,10 @@ done
 
     %if %{with_lxc}
 %pre login-shell
+        %if %{with_account_add}
 getent group virtlogin >/dev/null || groupadd -r virtlogin
 exit 0
+        %endif
     %endif
 %endif
 
@@ -2049,7 +2086,9 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf
 %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd
+%dir %{_datadir}/augeas/lenses
 %{_datadir}/augeas/lenses/libvirtd.aug
+%dir %{_datadir}/augeas/lenses/tests
 %{_datadir}/augeas/lenses/tests/test_libvirtd.aug
 %attr(0755, root, root) %{_sbindir}/libvirtd
 %{_mandir}/man8/libvirtd.8*
@@ -2060,7 +2099,7 @@ exit 0
 %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf
 %dir %{_datadir}/libvirt/
 %ghost %dir %{_rundir}/libvirt/
-%ghost %dir %{_rundir}/libvirt/common/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/common/
 %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/
@@ -2070,9 +2109,11 @@ exit 0
 %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-backend/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-file/
+%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %{_datadir}/polkit-1/actions/org.libvirt.unix.policy
 %{_datadir}/polkit-1/actions/org.libvirt.api.policy
 %{_datadir}/polkit-1/rules.d/50-libvirt.rules
+%{_sysusersdir}/libvirt.conf
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/
 %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper
 %attr(0755, root, root) %{_bindir}/virt-ssh-helper
@@ -2100,7 +2141,6 @@ exit 0
 %{_mandir}/man8/virtlockd.8*
 
 %files daemon-plugin-lockd
-%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so
 
 %files daemon-log
@@ -2146,7 +2186,7 @@ exit 0
 %{_unitdir}/virtinterfaced-ro.socket
 %{_unitdir}/virtinterfaced-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtinterfaced
-%ghost %dir %{_rundir}/libvirt/interface/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/interface/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_interface.so
 %{_mandir}/man8/virtinterfaced.8*
 
@@ -2188,7 +2228,7 @@ exit 0
 %{_unitdir}/virtnodedevd-ro.socket
 %{_unitdir}/virtnodedevd-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtnodedevd
-%ghost %dir %{_rundir}/libvirt/nodedev/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nodedev/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_nodedev.so
 %{_mandir}/man8/virtnodedevd.8*
 
@@ -2203,8 +2243,8 @@ exit 0
 %attr(0755, root, root) %{_sbindir}/virtnwfilterd
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/nwfilter/
 %ghost %dir %{_rundir}/libvirt/network/
-%ghost %dir %{_rundir}/libvirt/nwfilter-binding/
-%ghost %dir %{_rundir}/libvirt/nwfilter/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nwfilter-binding/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nwfilter/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_nwfilter.so
 %{_mandir}/man8/virtnwfilterd.8*
 
@@ -2218,7 +2258,7 @@ exit 0
 %{_unitdir}/virtsecretd-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtsecretd
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/
-%ghost %dir %{_rundir}/libvirt/secrets/
+%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/secrets/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so
 %{_mandir}/man8/virtsecretd.8*
 
@@ -2239,7 +2279,6 @@ exit 0
 %ghost %dir %{_rundir}/libvirt/storage/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so
 %{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so
-%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so
 %{_mandir}/man8/virtstoraged.8*
 
 %files daemon-driver-storage-disk
@@ -2281,9 +2320,6 @@ exit 0
     %if %{with_qemu}
 %files daemon-driver-qemu
 %config(noreplace) %{_sysconfdir}/libvirt/virtqemud.conf
-        %if %{with_userfaultfd_sysctl}
-%config(noreplace) %{_prefix}/lib/sysctl.d/60-qemu-postcopy-migration.conf
-        %endif
 %{_datadir}/augeas/lenses/virtqemud.aug
 %{_datadir}/augeas/lenses/tests/test_virtqemud.aug
 %{_unitdir}/virtqemud.service
@@ -2297,11 +2333,11 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
 %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
-%ghost %dir %{_rundir}/libvirt/qemu/
-%ghost %dir %{_rundir}/libvirt/qemu/dbus/
-%ghost %dir %{_rundir}/libvirt/qemu/passt/
-%ghost %dir %{_rundir}/libvirt/qemu/slirp/
-%ghost %dir %{_rundir}/libvirt/qemu/swtpm/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/
+%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/dbus/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/passt/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/slirp/
+%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/swtpm/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/checkpoint/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/dump/
@@ -2415,7 +2451,6 @@ exit 0
         %if %{with_libxl}
 %config(noreplace) %{_sysconfdir}/libvirt/libxl-sanlock.conf
         %endif
-%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
 %{_datadir}/augeas/lenses/libvirt_sanlock.aug
 %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
@@ -2425,6 +2460,22 @@ exit 0
 %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
     %endif
 
+    %if %{with_ch}
+%files daemon-driver-ch
+%attr(0755, root, root) %{_sbindir}/virtchd
+%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf
+%{_datadir}/augeas/lenses/virtchd.aug
+%{_datadir}/augeas/lenses/tests/test_virtchd.aug
+%{_unitdir}/virtchd-admin.socket
+%{_unitdir}/virtchd-ro.socket
+%{_unitdir}/virtchd.service
+%{_unitdir}/virtchd.socket
+%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so
+%config(noreplace) %{_sysconfdir}/libvirt/ch.conf
+%{_datadir}/augeas/lenses/libvirtd_ch.aug
+%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
+    %endif
+
 %files client
 %{_mandir}/man1/virsh.1*
 %{_mandir}/man1/virt-xml-validate.1*
@@ -2455,15 +2506,17 @@ exit 0
 %{_libdir}/libvirt-lxc.so.*
 %{_libdir}/libvirt-admin.so.*
 %dir %{_datadir}/libvirt/
+%{_datadir}/libvirt/test-screenshot.png
 %dir %{_datadir}/libvirt/schemas/
+%{_datadir}/libvirt/schemas/*.rng
+%dir %{_datadir}/systemtap/tapset/
 %{_datadir}/systemtap/tapset/libvirt_probes*.stp
 %{_datadir}/systemtap/tapset/libvirt_functions.stp
     %if %{with_qemu}
 %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp
     %endif
-%{_datadir}/libvirt/schemas/*.rng
+%dir %{_datadir}/libvirt/cpu_map
 %{_datadir}/libvirt/cpu_map/*.xml
-%{_datadir}/libvirt/test-screenshot.png
 
     %if %{with_wireshark}
 %files wireshark
@@ -2483,6 +2536,7 @@ exit 0
 %attr(4750, root, virtlogin) %{_bindir}/virt-login-shell
 %{_libexecdir}/virt-login-shell-helper
 %config(noreplace) %{_sysconfdir}/libvirt/virt-login-shell.conf
+%{_sysusersdir}/libvirt-login-shell.conf
 %{_mandir}/man1/virt-login-shell.1*
     %endif
 
@@ -2641,21 +2695,107 @@ exit 0
 
 
 %changelog
-* Wed Mar 05 2025 Cole Robinson <crobinso@redhat.com> - 10.6.0-7
-- Fix potential dataloss on snapshot deletion
+* Mon Jan 26 2026 Richard W.M. Jones <rjones@redhat.com> - 12.0.0-3
+- Backport fix for IPv6 connections to ESXi
 
-* Sat Dec 14 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-6
-- Fix DHCP response checksum when using nftables firewall
-- Permit forward mode=open when network has no IP (bz 2255266)
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 12.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 
-* Tue Sep 24 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-5
-- Rebuild for new wireshark
+* Thu Jan 15 2026 Daniel P. Berrangé <berrange@redhat.com> - 12.0.0-1
+- Update to 12.0.0
 
-* Wed Sep 18 2024 David Abdurachmanov <davidlt@rivosinc.com> - 10.6.0-4
-- Add riscv64 to arches_qemu_kvm
+* Mon Jan 12 2026 Daniel P. Berrangé <berrange@redhat.com> - 11.10.0-3
+- Disable -Werror on ELN
 
-* Thu Sep 12 2024 Dennis Gilmore <dennis@ausil.us> - 10.6.0-3
-- rebuild for updated wireshark
+* Thu Jan 08 2026 Richard W.M. Jones <rjones@redhat.com> - 11.10.0-2
+- Rebuild for xen 4.21.0
+
+* Mon Dec 01 2025 Cole Robinson <crobinso@redhat.com> - 11.10.0-1
+- Update to version 11.10.0
+
+* Mon Nov 17 2025 Richard W.M. Jones <rjones@redhat.com> - 11.9.0-3
+- Add upstream patches to fix parallel libguestfs
+
+* Tue Nov  4 2025 Tom Callaway <spot@fedoraproject.org> - 11.9.0-2
+- rebuild against new fuse3
+
+* Mon Nov  3 2025 Daniel P. Berrangé <berrange@redhat.com> - 11.9.0-1
+- Update to 11.9.0 release
+
+* Wed Oct 29 2025 Peter Robinson <pbrobinson@fedoraproject.org> - 11.8.0-3
+- Build against fuse3, supported since 8.2
+
+* Tue Oct 14 2025 Cole Robinson <crobinso@redhat.com> - 11.8.0-2
+- Fix build with latest wireshark
+
+* Wed Oct 01 2025 Cole Robinson <crobinso@redhat.com> - 11.8.0-1
+- Update to version 11.8.0
+
+* Thu Sep 04 2025 Adam Williamson <awilliam@redhat.com> - 11.7.0-3
+- Rebuild on a side tag
+
+* Thu Sep 04 2025 Adam Williamson <awilliam@redhat.com> - 11.7.0-2
+- Rebuild for libiscsi.so.11
+
+* Tue Sep 02 2025 Cole Robinson <crobinso@redhat.com> - 11.7.0-1
+- Update to version 11.7.0
+
+* Tue Aug 05 2025 Cole Robinson <crobinso@redhat.com> - 11.6.0-1
+- Update to version 11.6.0
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 11.5.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jul 16 2025 Richard W.M. Jones <rjones@redhat.com> - 11.5.0-2
+- Rebuild for updated Xen
+
+* Wed Jul 09 2025 Cole Robinson <crobinso@redhat.com> - 11.5.0-1
+- Update to version 11.5.0
+
+* Fri Jun 20 2025 Cole Robinson <crobinso@redhat.com> - 11.4.0-2
+- Fix dumpxml failures after migration (bz 2369243)
+
+* Mon Jun 02 2025 Cole Robinson <crobinso@redhat.com> - 11.4.0-1
+- Update to version 11.4.0
+
+* Thu May 08 2025 Adam Williamson <awilliam@redhat.com> - 11.3.0-3
+- Properly obsolete libvirt-daemon-driver-storage-zfs
+
+* Thu May 08 2025 Cole Robinson <crobinso@redhat.com> - 11.3.0-2
+- zfs-fuse is gone from rawhide, drop libvirt-daemon-storage-zfs
+
+* Wed May 07 2025 Cole Robinson <crobinso@redhat.com> - 11.3.0-1
+- Update to version 11.3.0
+
+* Tue Apr 29 2025 Daniel P. Berrangé <berrange@redhat.com> - 11.2.0-2
+- Fix install of Ampere 1 ARM CPU model (rhbz #2361196)
+- Fix location of mount, umount (rhbz #2359196)
+- Fix location of numad (rhbz #2359736)
+- Fix tests on rebuild with latest GCC 15
+
+* Tue Apr 01 2025 Cole Robinson <crobinso@redhat.com> - 11.2.0-1
+- Update to version 11.2.0
+
+* Mon Mar 03 2025 Cole Robinson <crobinso@redhat.com> - 11.1.0-1
+- Update to version 11.1.0
+
+* Fri Jan 17 2025 Cole Robinson <crobinso@redhat.com> - 11.0.0-1
+- Update to version 11.0.0
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.10.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Dec 02 2024 Cole Robinson <crobinso@redhat.com> - 10.10.0-1
+- Update to version 10.10.0
+
+* Fri Nov  1 2024 Daniel P. Berrangé <berrange@redhat.com> - 10.9.0-1
+- Update to version 10.9.0
+
+* Tue Oct 01 2024 Cole Robinson <crobinso@redhat.com> - 10.8.0-1
+- Update to version 10.8.0
+
+* Mon Sep 02 2024 Cole Robinson <crobinso@redhat.com> - 10.7.0-1
+- Update to version 10.7.0
 
 * Tue Aug 27 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-2
 - Fix `virsh domifaddr --source=arp` on kernel 6.10 (bz #2302245)

sources

@@ -1 +1 @@
-SHA512 (libvirt-10.6.0.tar.xz) = edec79e89669d5e9a46be35e0d6334a6ed3bbf32426679549bd998bde24cba52b0378843f41a3abb5d781ad53e2a6a54619a0bad3f168c11fb41736cc6af6568
+SHA512 (libvirt-12.0.0.tar.xz) = 5613e4e59865f688fe4cca2734c6de1cf68d0540c6e3013c9c21e583accd4f4fc21ec98e9c794036c5d6d0c8dd05ad1d22dab61f8c7d2934c8cb507b5bee76ad