Fix potential dataloss on snapshot deletion

Signed-off-by: Cole Robinson <crobinso@redhat.com>
libvirt-10.6.0-6.fc41
2025-03-05 11:27:07 -05:00 · 2024-12-14 13:48:38 -05:00 · 2024-12-11 15:58:43 -05:00 · 2024-09-24 05:18:59 -04:00 · 2024-09-18 15:07:58 +02:00 · 2024-09-12 08:59:02 -05:00
14 changed files with 1914 additions and 308 deletions
@@ -1,41 +0,0 @@
-From 845210011a9ffd9d17e30c51cbc81ba67c5d3166 Mon Sep 17 00:00:00 2001
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Tue, 20 Jan 2026 10:08:29 +0100
-Subject: [PATCH] esx: Allow connecting to IPv6 server
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When connecting to a VMWare server, the hostname from URI is
-resolved using esxUtil_ResolveHostname() which in turn calls
-getaddrinfo(). But in the hints argument, we restrict the return
-address to be IPv4 (AF_INET) which obviously fails if the address
-to resolve is an IPv6 address. Set the hint to AF_UNSPEC which
-allows both IPv4 and IPv6. While at it, also allow IPv4 addresses
-mapped in IPv6 by setting AI_V4MAPPED flag.
-
-Resolves: https://issues.redhat.com/browse/RHEL-138300
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
- src/esx/esx_util.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c
-index 88b3dc893f..a6275babd5 100644
--- a/src/esx/esx_util.c
-+++ b/src/esx/esx_util.c
-@@ -275,8 +275,8 @@ esxUtil_ResolveHostname(const char *hostname, char **ipAddress)
-     int errcode;
-     g_autofree char *address = NULL;
- 
-    hints.ai_flags = AI_ADDRCONFIG;
-    hints.ai_family = AF_INET;
-+    hints.ai_flags = AI_ADDRCONFIG | AI_V4MAPPED;
-+    hints.ai_family = AF_UNSPEC;
-     hints.ai_socktype = SOCK_STREAM;
-     hints.ai_protocol = 0;
- 
-- 
-2.52.0
-
@@ -0,0 +1,29 @@
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 16 Aug 2024 13:56:51 +0200
+Subject: [PATCH] virarptable: Properly calculate rtattr length
+Content-type: text/plain
+
+Use convenience macro which does almost the same thing we were doing,
+but also pads out the payload length to a multiple of NLMSG_ALIGNTO (4)
+bytes.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+Reviewed-by: Laine Stump <laine@redhat.com>
+---
+ src/util/virarptable.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/util/virarptable.c b/src/util/virarptable.c
+index 299dddd664..d8e41c5a86 100644
+--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
+@@ -102,8 +102,7 @@ virArpTableGet(void)
+             return table;
+ 
+         VIR_WARNINGS_NO_CAST_ALIGN
+-        parse_rtattr(tb, NDA_MAX, NDA_RTA(r),
+-                     nh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
+        parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
+         VIR_WARNINGS_RESET
+ 
+         if (tb[NDA_DST] == NULL || tb[NDA_LLADDR] == NULL)
@@ -0,0 +1,34 @@
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 16 Aug 2024 13:59:15 +0200
+Subject: [PATCH] virarptable: Fix check for message length
+Content-type: text/plain
+
+The previous check was all wrong since it calculated the how long would
+the netlink message be if the netlink header was the payload and then
+subtracted that from the whole message length, a variable that was not
+used later in the code.  This check can fail if there are no additional
+payloads, struct rtattr in particular, which we are parsing later,
+however the RTA_OK macro would've caught that anyway.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+Reviewed-by: Laine Stump <laine@redhat.com>
+---
+ src/util/virarptable.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/util/virarptable.c b/src/util/virarptable.c
+index d8e41c5a86..45ee76766f 100644
+--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
+@@ -81,10 +81,9 @@ virArpTableGet(void)
+     for (; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen)) {
+         VIR_WARNINGS_RESET
+         struct ndmsg *r = NLMSG_DATA(nh);
+-        int len = nh->nlmsg_len;
+         void *addr;
+ 
+-        if ((len -= NLMSG_LENGTH(sizeof(*nh))) < 0) {
+        if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
+             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("wrong nlmsg len"));
+             goto cleanup;
@@ -0,0 +1,46 @@
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 16 Aug 2024 14:02:48 +0200
+Subject: [PATCH] virarptable: End parsing earlier in case of NLMSG_DONE
+Content-type: text/plain
+
+Check for the last multipart message right as the first thing.  The
+presumption probably was that the last message might still contain a
+payload we want to parse.  However that cannot be true since that would
+have to be a type RTM_NEWNEIGH.  This was not caught because older
+kernels were note sending NLMSG_DONE and probably relied on the fact
+that the parsing just stops after all the messages are walked through,
+which the NLMSG_OK macro successfully did.
+
+Resolves: https://issues.redhat.com/browse/RHEL-52449
+Resolves: https://bugzilla.redhat.com/2302245
+Fixes: a176d67cdfaf5b8237a7e3a80d8be0e6bdf2d8fd
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+Reviewed-by: Laine Stump <laine@redhat.com>
+---
+ src/util/virarptable.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/util/virarptable.c b/src/util/virarptable.c
+index 45ee76766f..20d11f97b0 100644
+--- a/src/util/virarptable.c
+++ b/src/util/virarptable.c
+@@ -83,6 +83,9 @@ virArpTableGet(void)
+         struct ndmsg *r = NLMSG_DATA(nh);
+         void *addr;
+ 
+        if (nh->nlmsg_type == NLMSG_DONE)
+            break;
+
+         if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
+             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("wrong nlmsg len"));
+@@ -97,9 +100,6 @@ virArpTableGet(void)
+             (!(r->ndm_state == NUD_STALE || r->ndm_state == NUD_REACHABLE)))
+             continue;
+ 
+-        if (nh->nlmsg_type == NLMSG_DONE)
+-            return table;
+-
+         VIR_WARNINGS_NO_CAST_ALIGN
+         parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
+         VIR_WARNINGS_RESET
@@ -0,0 +1,315 @@
+From 807e2670f2704c41f0a1dca81a5d2f2f9336137c Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:44 -0500
+Subject: [PATCH 4/9] util: use a single flags arg for virNetDevBandwidthSet(),
+ not multiple bools
+
+Having two bools in the arg list is on the borderline of being
+confusing to anyone trying to read the code, but we're about to add a
+3rd. This patch replaces the two bools with a single flags argument
+which will instead have one or more bits from virNetDevBandwidthFlags
+set.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/lxc/lxc_driver.c           |  8 ++++++--
+ src/lxc/lxc_process.c          |  8 ++++++--
+ src/network/bridge_driver.c    | 10 ++++++++--
+ src/qemu/qemu_command.c        | 11 ++++++++---
+ src/qemu/qemu_driver.c         | 29 ++++++++++++++-------------
+ src/qemu/qemu_hotplug.c        | 22 +++++++++++++++------
+ src/util/virnetdevbandwidth.c  | 36 ++++++++++++++++++++--------------
+ src/util/virnetdevbandwidth.h  |  9 +++++++--
+ tests/virnetdevbandwidthtest.c |  8 +++++++-
+ 9 files changed, 94 insertions(+), 47 deletions(-)
+
+diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
+index 534e257f30..b693980dbb 100644
+--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
+@@ -3570,8 +3570,12 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
+     actualBandwidth = virDomainNetGetActualBandwidth(net);
+     if (actualBandwidth) {
+         if (virNetDevSupportsBandwidth(actualType)) {
+-            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
+-                                      !virDomainNetTypeSharesHostView(net)) < 0)
+            unsigned int flags = 0;
+
+            if (!virDomainNetTypeSharesHostView(net))
+                flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
+                 goto cleanup;
+         } else {
+             VIR_WARN("setting bandwidth on interfaces of "
+diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
+index f5eb5383ec..0e689fbb70 100644
+--- a/src/lxc/lxc_process.c
+++ b/src/lxc/lxc_process.c
+@@ -605,8 +605,12 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
+         actualBandwidth = virDomainNetGetActualBandwidth(net);
+         if (actualBandwidth) {
+             if (virNetDevSupportsBandwidth(type)) {
+-                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
+-                                          !virDomainNetTypeSharesHostView(net)) < 0)
+                unsigned int flags = 0;
+
+                if (!virDomainNetTypeSharesHostView(net))
+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
+                     goto cleanup;
+             } else {
+                 VIR_WARN("setting bandwidth on interfaces of "
+diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
+index 32572c755f..1c53636450 100644
+--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
+@@ -2058,8 +2058,11 @@ networkStartNetworkVirtual(virNetworkDriverState *driver,
+         }
+     }
+ 
+-    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
+         goto error;
+    }
+ 
+     return 0;
+ 
+@@ -2141,8 +2144,11 @@ networkStartNetworkBridge(virNetworkObj *obj)
+      * type BRIDGE, is started. On failure, undo anything you've done,
+      * and return -1. On success return 0.
+      */
+-    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
+         goto error;
+    }
+ 
+     if (networkStartHandleMACTableManagerMode(obj) < 0)
+         goto error;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index f15e6bda1e..b4815e5e71 100644
+--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
+@@ -8840,9 +8840,14 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
+                                                         def->uuid,
+                                                         !virDomainNetTypeSharesHostView(net)) < 0)
+                     goto cleanup;
+-            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
+-                                             !virDomainNetTypeSharesHostView(net)) < 0) {
+-                goto cleanup;
+            } else {
+                unsigned int flags = 0;
+
+                if (!virDomainNetTypeSharesHostView(net))
+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
+                    goto cleanup;
+             }
+         } else {
+             VIR_WARN("setting bandwidth on interfaces of "
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index 736602333e..14929616e5 100644
+--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
+@@ -9941,21 +9941,22 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
+                 virErrorRestore(&orig_err);
+                 goto endjob;
+             }
+-        } else if (virNetDevBandwidthSet(net->ifname, newBandwidth, false,
+-                                         !virDomainNetTypeSharesHostView(net)) < 0) {
+-            virErrorPtr orig_err;
+-
+-            virErrorPreserveLast(&orig_err);
+-            ignore_value(virNetDevBandwidthSet(net->ifname,
+-                                               net->bandwidth,
+-                                               false,
+-                                               !virDomainNetTypeSharesHostView(net)));
+-            if (net->bandwidth) {
+-                ignore_value(virDomainNetBandwidthUpdate(net,
+-                                                         net->bandwidth));
+        } else {
+            unsigned int bwflags = 0;
+
+            if (!virDomainNetTypeSharesHostView(net))
+                bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+            if (virNetDevBandwidthSet(net->ifname, newBandwidth, bwflags) < 0) {
+                virErrorPtr orig_err;
+
+                virErrorPreserveLast(&orig_err);
+                ignore_value(virNetDevBandwidthSet(net->ifname, net->bandwidth, bwflags));
+                if (net->bandwidth)
+                    ignore_value(virDomainNetBandwidthUpdate(net, net->bandwidth));
+                virErrorRestore(&orig_err);
+                goto endjob;
+             }
+-            virErrorRestore(&orig_err);
+-            goto endjob;
+         }
+ 
+         /* If the old bandwidth was cleared out, restore qdisc. */
+diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
+index 7cb1800504..d5e7e99359 100644
+--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
+@@ -1279,9 +1279,14 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
+                                                         vm->def->uuid,
+                                                         !virDomainNetTypeSharesHostView(net)) < 0)
+                     goto cleanup;
+-            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
+-                                             !virDomainNetTypeSharesHostView(net)) < 0) {
+-                goto cleanup;
+            } else {
+                int flags = 0;
+
+                if (!virDomainNetTypeSharesHostView(net))
+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
+                    goto cleanup;
+             }
+         } else {
+             VIR_WARN("setting bandwidth on interfaces of "
+@@ -4082,9 +4087,14 @@ qemuDomainChangeNet(virQEMUDriver *driver,
+                                                         vm->def->uuid,
+                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
+                     goto cleanup;
+-            } else if (virNetDevBandwidthSet(newdev->ifname, newb, false,
+-                                             !virDomainNetTypeSharesHostView(newdev)) < 0) {
+-                goto cleanup;
+            } else {
+                int flags = 0;
+
+                if (!virDomainNetTypeSharesHostView(newdev))
+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+                if (virNetDevBandwidthSet(newdev->ifname, newb, flags) < 0)
+                    goto cleanup;
+             }
+         } else {
+             if (virDomainInterfaceClearQoS(vm->def, olddev) < 0)
+diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
+index 2b58c58d3e..1baad849c6 100644
+--- a/src/util/virnetdevbandwidth.c
+++ b/src/util/virnetdevbandwidth.c
+@@ -173,30 +173,35 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
+  * virNetDevBandwidthSet:
+  * @ifname: on which interface
+  * @bandwidth: rates to set (may be NULL)
+- * @hierarchical_class: whether to create hierarchical class
+- * @swapped: true if IN/OUT should be set contrariwise
+ * @flags: bits indicating certain optional actions
+  *
+
+  * This function enables QoS on specified interface
+  * and set given traffic limits for both, incoming
+- * and outgoing traffic. Any previous setting get
+- * overwritten. If @hierarchical_class is TRUE, create
+- * hierarchical class. It is used to guarantee minimal
+- * throughput ('floor' attribute in NIC).
+ * and outgoing traffic.
+ *
+ * @flags bits and their meanings:
+ *
+ *   VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
+ *     whether to create a hierarchical class
+ *     A hiearchical class structure is used to implement a minimal
+ *     throughput guarantee ('floor' attribute in NIC).
+  *
+- * If @swapped is set, the IN part of @bandwidth is set on
+- * @ifname's TX, and vice versa. If it is not set, IN is set on
+- * RX and OUT on TX. This is because for some types of interfaces
+- * domain and the host live on the same side of the interface (so
+- * domain's RX/TX is host's RX/TX), and for some it's swapped
+- * (domain's RX/TX is hosts's TX/RX).
+ *   VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED
+ *     set if IN/OUT should be set backwards from what's indicated in
+ *     the bandwidth, i.e. the IN part of @bandwidth is set on
+ *     @ifname's TX, and the OUT part of @bandwidth is set on
+ *     @ifname's RX.  This is needed because for some types of
+ *     interfaces the domain and the host live on the same side of the
+ *     interface (so domain's RX/TX is host's RX/TX), and for some
+ *     it's swapped (domain's RX/TX is hosts's TX/RX).
+  *
+  * Return 0 on success, -1 otherwise.
+  */
+ int
+ virNetDevBandwidthSet(const char *ifname,
+                       const virNetDevBandwidth *bandwidth,
+-                      bool hierarchical_class,
+-                      bool swapped)
+                      unsigned int flags)
+ {
+     int ret = -1;
+     virNetDevBandwidthRate *rx = NULL; /* From domain POV */
+@@ -205,6 +210,7 @@ virNetDevBandwidthSet(const char *ifname,
+     char *average = NULL;
+     char *peak = NULL;
+     char *burst = NULL;
+    bool hierarchical_class = flags & VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
+ 
+     if (!bandwidth) {
+         /* nothing to be enabled */
+@@ -224,7 +230,7 @@ virNetDevBandwidthSet(const char *ifname,
+         return -1;
+     }
+ 
+-    if (swapped) {
+    if (flags & VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) {
+         rx = bandwidth->out;
+         tx = bandwidth->in;
+     } else {
+diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
+index 6d268fb119..80dc654486 100644
+--- a/src/util/virnetdevbandwidth.h
+++ b/src/util/virnetdevbandwidth.h
+@@ -39,11 +39,16 @@ void virNetDevBandwidthFree(virNetDevBandwidth *def);
+ 
+ G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
+ 
+typedef enum {
+    VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
+    VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
+} virNetDevBandwidthSetFlags;
+
+ int virNetDevBandwidthSet(const char *ifname,
+                           const virNetDevBandwidth *bandwidth,
+-                          bool hierarchical_class,
+-                          bool swapped)
+                          unsigned int flags)
+     G_GNUC_WARN_UNUSED_RESULT;
+
+ int virNetDevBandwidthClear(const char *ifname);
+ int virNetDevBandwidthCopy(virNetDevBandwidth **dest,
+                            const virNetDevBandwidth *src)
+diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
+index f7c38faa2e..6529ff4026 100644
+--- a/tests/virnetdevbandwidthtest.c
+++ b/tests/virnetdevbandwidthtest.c
+@@ -82,8 +82,14 @@ testVirNetDevBandwidthSet(const void *data)
+         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
+             return -1;
+     } else {
+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+
+        if (info->hierarchical_class)
+            flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
+
+         exp_cmd = info->exp_cmd_tc;
+-        if (virNetDevBandwidthSet(iface, band, info->hierarchical_class, true) < 0)
+
+        if (virNetDevBandwidthSet(iface, band, flags) < 0)
+             return -1;
+     }
+ 
+-- 
+2.47.1
+
@@ -0,0 +1,185 @@
+From 490f58382dca2a415a5f16b6133f298d853bb379 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:45 -0500
+Subject: [PATCH 5/9] util: make it optional to clear existing tc
+ qdiscs/filters in virNetDevBandwidthSet()
+
+virNetDevBandwidthSet() always clears all existing qdiscs and their
+subordinate filters before adding all the new qdiscs/filters. This is
+normally exactly what we want, but there is one case (the network
+driver) where the Qdisc added by virNetDevBandwidthSet() may already
+be in use by the nftables backend (which will add a rule to fix the
+checksum of dhcp packets); in that case, we *don't* want
+virNetDevBandwidthSet() to clear out the qdisc that was already added
+for nftables, and none of the bandwidth filters have been added yet,
+so there already aren't any "old" filters that need to be removed
+either - it is safe to just skip virNetDevBandwidthClear() in this
+case.
+
+To allow the network driver to set bandwidth without first clearing
+it, this patch adds the flag VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL to the
+virNetDevBandwidthSetFlags enum, and recognizes it in
+virNetDevBandwidthSet() - if the flag is set, then
+virNetDevBandwidth() will call virNetDevBandwidthClear() just as it
+always has. But if the flag isn't set it *won't* call
+virNetDevBandwidthClear().
+
+As suggested above, VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set for all
+calls to virNetdevBandwidthSet() except for two places in the network
+driver.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/lxc/lxc_driver.c           |  2 +-
+ src/lxc/lxc_process.c          |  2 +-
+ src/qemu/qemu_command.c        |  2 +-
+ src/qemu/qemu_driver.c         |  2 +-
+ src/qemu/qemu_hotplug.c        |  4 ++--
+ src/util/virnetdevbandwidth.c  | 21 ++++++++++++++++++++-
+ src/util/virnetdevbandwidth.h  |  1 +
+ tests/virnetdevbandwidthtest.c |  3 ++-
+ 8 files changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
+index b693980dbb..81581c74df 100644
+--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
+@@ -3570,7 +3570,7 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
+     actualBandwidth = virDomainNetGetActualBandwidth(net);
+     if (actualBandwidth) {
+         if (virNetDevSupportsBandwidth(actualType)) {
+-            unsigned int flags = 0;
+            unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+             if (!virDomainNetTypeSharesHostView(net))
+                 flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
+index 0e689fbb70..081ce03a57 100644
+--- a/src/lxc/lxc_process.c
+++ b/src/lxc/lxc_process.c
+@@ -605,7 +605,7 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
+         actualBandwidth = virDomainNetGetActualBandwidth(net);
+         if (actualBandwidth) {
+             if (virNetDevSupportsBandwidth(type)) {
+-                unsigned int flags = 0;
+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+                 if (!virDomainNetTypeSharesHostView(net))
+                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index b4815e5e71..ed54fd4c5b 100644
+--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
+@@ -8841,7 +8841,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
+                                                         !virDomainNetTypeSharesHostView(net)) < 0)
+                     goto cleanup;
+             } else {
+-                unsigned int flags = 0;
+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+                 if (!virDomainNetTypeSharesHostView(net))
+                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index 14929616e5..9549065b1f 100644
+--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
+@@ -9942,7 +9942,7 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
+                 goto endjob;
+             }
+         } else {
+-            unsigned int bwflags = 0;
+            unsigned int bwflags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+             if (!virDomainNetTypeSharesHostView(net))
+                 bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
+index d5e7e99359..ceda4119cd 100644
+--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
+@@ -1280,7 +1280,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
+                                                         !virDomainNetTypeSharesHostView(net)) < 0)
+                     goto cleanup;
+             } else {
+-                int flags = 0;
+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+                 if (!virDomainNetTypeSharesHostView(net))
+                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+@@ -4088,7 +4088,7 @@ qemuDomainChangeNet(virQEMUDriver *driver,
+                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
+                     goto cleanup;
+             } else {
+-                int flags = 0;
+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+                 if (!virDomainNetTypeSharesHostView(newdev))
+                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
+index 1baad849c6..9c48844c5d 100644
+--- a/src/util/virnetdevbandwidth.c
+++ b/src/util/virnetdevbandwidth.c
+@@ -196,6 +196,21 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
+  *     interface (so domain's RX/TX is host's RX/TX), and for some
+  *     it's swapped (domain's RX/TX is hosts's TX/RX).
+  *
+ *   VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL
+ *     If VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set, then the root
+ *     qdisc is deleted before adding any new qdisc/class/filter,
+ *     which causes any pre-existing filters to also be deleted. If
+ *     not set, then it's assumed that there are no existing rules (or
+ *     that those already there need to be kept). The caller should
+ *     set this flag for an existing interface that is having its
+ *     bandwidth settings modified, but can leave it unset if the
+ *     interface was newly created and this is the first time
+ *     bandwidth has been set, but someone else might have already
+ *     added the qdisc (e.g. this is the case when the network driver
+ *     is setting bandwidth for a virtual network bridge device - the
+ *     nftables backend may have already added qdisc handle 1:0 and a
+ *     filter, and we don't want to delete them)
+ *
+  * Return 0 on success, -1 otherwise.
+  */
+ int
+@@ -238,7 +253,11 @@ virNetDevBandwidthSet(const char *ifname,
+         tx = bandwidth->out;
+     }
+ 
+-    virNetDevBandwidthClear(ifname);
+    /* Only if the caller requests, clear everything including root
+     * qdisc and all filters before adding everything.
+     */
+    if (flags & VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL)
+        virNetDevBandwidthClear(ifname);
+ 
+     if (tx && tx->average) {
+         average = g_strdup_printf("%llukbps", tx->average);
+diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
+index 80dc654486..744aa4c826 100644
+--- a/src/util/virnetdevbandwidth.h
+++ b/src/util/virnetdevbandwidth.h
+@@ -42,6 +42,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
+ typedef enum {
+     VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
+     VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
+    VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL = (1 << 2),
+ } virNetDevBandwidthSetFlags;
+ 
+ int virNetDevBandwidthSet(const char *ifname,
+diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
+index 6529ff4026..6d5c847ad7 100644
+--- a/tests/virnetdevbandwidthtest.c
+++ b/tests/virnetdevbandwidthtest.c
+@@ -82,7 +82,8 @@ testVirNetDevBandwidthSet(const void *data)
+         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
+             return -1;
+     } else {
+-        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED |
+                             VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
+ 
+         if (info->hierarchical_class)
+             flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
+-- 
+2.47.1
+
@@ -0,0 +1,98 @@
+From faebbbbfa3b1bd4120852b3f416c8073ab82d5c5 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:46 -0500
+Subject: [PATCH 6/9] util: put the command that adds a tx filter qdisc into a
+ separate function
+
+virNetDevBandwidthSet() adds a queue discipline (qdisc) for each
+interface that it will need to add tc transmit filters to, and the
+filters are then attached to the qdisc.
+
+There are other circumstances where some other function will need to
+add tc transmit filters to an interface (in particular an upcoming
+patch to the network driver nftables backend that will use a tc tx
+filter to fix the checksum of dhcp packets), so that function will
+also need a qdisc for the tx filter. To assure both always use exactly
+the same qdisc, this patch puts the command that adds the tx filter
+qdisc into a separate helper function that can (and will) be called
+from either place
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/libvirt_private.syms      |  1 +
+ src/util/virnetdevbandwidth.c | 30 +++++++++++++++++++++++++-----
+ src/util/virnetdevbandwidth.h |  3 +++
+ 3 files changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index d15d6a6a9d..0211cee967 100644
+--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
+@@ -2859,6 +2859,7 @@ virNetDevVFInterfaceStats;
+ 
+ 
+ # util/virnetdevbandwidth.h
+virNetDevBandWidthAddTxFilterParentQdisc;
+ virNetDevBandwidthClear;
+ virNetDevBandwidthCopy;
+ virNetDevBandwidthEqual;
+diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
+index 9c48844c5d..90eebe6576 100644
+--- a/src/util/virnetdevbandwidth.c
+++ b/src/util/virnetdevbandwidth.c
+@@ -266,11 +266,7 @@ virNetDevBandwidthSet(const char *ifname,
+         if (tx->burst)
+             burst = g_strdup_printf("%llukb", tx->burst);
+ 
+-        cmd = virCommandNew(TC);
+-        virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
+-                             "handle", "1:", "htb", "default",
+-                             hierarchical_class ? "2" : "1", NULL);
+-        if (virCommandRun(cmd, NULL) < 0)
+        if (virNetDevBandWidthAddTxFilterParentQdisc(ifname, hierarchical_class) < 0)
+             goto cleanup;
+ 
+         /* If we are creating a hierarchical class, all non guaranteed traffic
+@@ -794,3 +790,27 @@ virNetDevBandwidthSetRootQDisc(const char *ifname,
+ 
+     return 0;
+ }
+
+/**
+ * virNetDevBandwidthAddTxFilterParentQdisc:
+ * @ifname: name of interface that needs a qdisc to attach tx filters to
+ * @hierarchical_class: true if hierarchical classes will be used on this interface
+ *
+ * Add a root Qdisc (Queueing Discipline) for attaching Tx filters to
+ * @ifname.
+ *
+ * returns 0 on success, -1 on failure
+ */
+int
+virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
+                                         bool hierarchical_class)
+{
+    g_autoptr(virCommand) cmd = NULL;
+
+    cmd = virCommandNew(TC);
+    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
+                         "handle", "1:", "htb", "default",
+                         hierarchical_class ? "2" : "1", NULL);
+
+    return virCommandRun(cmd, NULL);
+}
+diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
+index 744aa4c826..65c1500637 100644
+--- a/src/util/virnetdevbandwidth.h
+++ b/src/util/virnetdevbandwidth.h
+@@ -84,3 +84,6 @@ int virNetDevBandwidthUpdateFilter(const char *ifname,
+ int virNetDevBandwidthSetRootQDisc(const char *ifname,
+                                    const char *qdisc)
+     G_NO_INLINE;
+
+int virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
+                                             bool hierarchical_class);
+-- 
+2.47.1
+
@@ -0,0 +1,107 @@
+From 73c0fb19ce5b816ee81ede691252855c75391c9a Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:47 -0500
+Subject: [PATCH 7/9] util: don't re-add the qdisc used for tx filters if it
+ already exists
+
+There will soon be two separate users of tc on virtual networks, and
+both will use the "qdisc root handle 1: htb" to add tx filters. One or the
+other could get the first chance to add the qdisc, and then if at a
+later time the other decides to use it, we need to prevent the 2nd
+user from attempting to re-add the qdisc (because that just generates
+an error).
+
+We do this by running "tc qdisc show dev $bridge handle 1:" then
+checking if the output of that command contains both "qdisc" and " 1:
+".[*] If it does then the qdisc has already been added. If not then we
+need to add it now.
+
+[*]As of this writing, the output more exactly starts with "qdisc
+htb 1: root", but our comparison is made purposefully generous to
+increase the chances that it will continue to work properly if tc
+modifies the format of its output.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/util/virnetdevbandwidth.c  | 35 ++++++++++++++++++++++++++++------
+ tests/virnetdevbandwidthtest.c |  3 +++
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
+index 90eebe6576..5c6a65528c 100644
+--- a/src/util/virnetdevbandwidth.c
+++ b/src/util/virnetdevbandwidth.c
+@@ -805,12 +805,35 @@ int
+ virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
+                                          bool hierarchical_class)
+ {
+-    g_autoptr(virCommand) cmd = NULL;
+    g_autoptr(virCommand) testCmd = NULL;
+    g_autofree char *testResult = NULL;
+ 
+-    cmd = virCommandNew(TC);
+-    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
+-                         "handle", "1:", "htb", "default",
+-                         hierarchical_class ? "2" : "1", NULL);
+    /* first check it the qdisc with handle 1: was already added for
+     * this interface by someone else
+     */
+    testCmd = virCommandNew(TC);
+    virCommandAddArgList(testCmd, "qdisc", "show", "dev", ifname,
+                         "handle", "1:", NULL);
+    virCommandSetOutputBuffer(testCmd, &testResult);
+ 
+-    return virCommandRun(cmd, NULL);
+    if (virCommandRun(testCmd, NULL) < 0)
+        return -1;
+
+    /* output will be something like: "qdisc htb 1: root refcnt ..."
+     * if the qdisc was already added. We just search for "qdisc" and
+     * " 1: " anywhere in the output to allow for tc changing its
+     * output format.
+     */
+    if (!(testResult && strstr(testResult, "qdisc") && strstr(testResult, " 1: "))) {
+        /* didn't find qdisc in output, so we need to add one */
+        g_autoptr(virCommand) addCmd = virCommandNew(TC);
+
+        virCommandAddArgList(addCmd, "qdisc", "add", "dev", ifname, "root",
+                             "handle", "1:", "htb", "default",
+                             hierarchical_class ? "2" : "1", NULL);
+
+        return virCommandRun(addCmd, NULL);
+    }
+
+    return 0;
+ }
+diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
+index 6d5c847ad7..31aa7f469d 100644
+--- a/tests/virnetdevbandwidthtest.c
+++ b/tests/virnetdevbandwidthtest.c
+@@ -147,6 +147,7 @@ mymain(void)
+                 "</bandwidth>",
+                 TC " qdisc del dev eth0 root\n"
+                 TC " qdisc del dev eth0 ingress\n"
+                TC " qdisc show dev eth0 handle 1:\n"
+                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
+                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1024kbps quantum 87\n"
+                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
+@@ -177,6 +178,7 @@ mymain(void)
+                 "</bandwidth>",
+                 TC " qdisc del dev eth0 root\n"
+                 TC " qdisc del dev eth0 ingress\n"
+                TC " qdisc show dev eth0 handle 1:\n"
+                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
+                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1kbps ceil 2kbps burst 4kb quantum 1\n"
+                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
+@@ -199,6 +201,7 @@ mymain(void)
+                 "</bandwidth>",
+                 TC " qdisc del dev eth0 root\n"
+                 TC " qdisc del dev eth0 ingress\n"
+                TC " qdisc show dev eth0 handle 1:\n"
+                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
+                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 4294967295kbps quantum 366503875\n"
+                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
+-- 
+2.47.1
+
@@ -0,0 +1,171 @@
+From dac9cb9030ac03d18f59884864a0a253e3c9f8f1 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:48 -0500
+Subject: [PATCH 8/9] util: add new "tc" layer for virFirewallCmd objects
+
+If the layer of a virFirewallCmd is "tc", then the "tc" utility will
+be executed using the arguments that had been added to the
+virFirewallCmd
+
+tc layer doesn't support auto-rollback command creation (any rollback
+needs to be added manually with virFirewallAddRollbackCmd()), and also
+tc layer isn't supported by the iptables backend (it would have been
+straightforward to add, but the iptables backend doesn't need it, and
+I didn't want to take the chance of causing a regression in that
+code for no good reason).
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/network/network_nftables.c |  1 +
+ src/util/virfirewall.c         | 66 +++++++++++++++++++++-------------
+ src/util/virfirewall.h         |  1 +
+ src/util/virfirewalld.c        |  1 +
+ 4 files changed, 44 insertions(+), 25 deletions(-)
+
+diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
+index 268d1f12ca..cc184105c3 100644
+--- a/src/network/network_nftables.c
+++ b/src/network/network_nftables.c
+@@ -73,6 +73,7 @@ VIR_ENUM_IMPL(nftablesLayer,
+               "",
+               "ip",
+               "ip6",
+              "",
+ );
+ 
+ 
+diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
+index 811b787ecc..9389bcf541 100644
+--- a/src/util/virfirewall.c
+++ b/src/util/virfirewall.c
+@@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virFirewallLayer,
+               "ethernet",
+               "ipv4",
+               "ipv6",
+              "tc",
+ );
+ 
+ typedef struct _virFirewallGroup virFirewallGroup;
+@@ -57,6 +58,7 @@ VIR_ENUM_IMPL(virFirewallLayerCommand,
+               EBTABLES,
+               IPTABLES,
+               IP6TABLES,
+              TC,
+ );
+ 
+ struct _virFirewallCmd {
+@@ -591,6 +593,7 @@ virFirewallCmdIptablesApply(virFirewall *firewall,
+     case VIR_FIREWALL_LAYER_IPV6:
+         virCommandAddArg(cmd, "-w");
+         break;
+    case VIR_FIREWALL_LAYER_TC:
+     case VIR_FIREWALL_LAYER_LAST:
+         break;
+     }
+@@ -672,39 +675,52 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED,
+     size_t i;
+     int status;
+ 
+-    cmd = virCommandNew(NFT);
+    if (fwCmd->layer == VIR_FIREWALL_LAYER_TC) {
+ 
+-    if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
+-        fwCmd->argsLen > 1) {
+-        /* skip any leading options to get to command verb */
+-        for (i = 0; i < fwCmd->argsLen - 1; i++) {
+-            if (fwCmd->args[i][0] != '-')
+-                break;
+-        }
+        /* for VIR_FIREWALL_LAYER_TC, we run the 'tc' (traffic control) command with
+         * the supplied args.
+         */
+        cmd = virCommandNew(TC);
+ 
+-        if (i + 1 < fwCmd->argsLen &&
+-            VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
+        /* NB: RAW commands don't support auto-rollback command creation */
+ 
+-            cmdIdx = i;
+-            objectType = fwCmd->args[i + 1];
+    } else {
+ 
+-            /* we currently only handle auto-rollback for rules,
+-             * chains, and tables, and those all can be "rolled
+-             * back" by a delete command using the handle that is
+-             * returned when "-ae" is added to the add/insert
+-             * command.
+-             */
+-            if (STREQ_NULLABLE(objectType, "rule") ||
+-                STREQ_NULLABLE(objectType, "chain") ||
+-                STREQ_NULLABLE(objectType, "table")) {
+        cmd = virCommandNew(NFT);
+ 
+-                needRollback = true;
+-                /* this option to nft instructs it to add the
+-                 * "handle" of the created object to stdout
+        if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
+            fwCmd->argsLen > 1) {
+            /* skip any leading options to get to command verb */
+            for (i = 0; i < fwCmd->argsLen - 1; i++) {
+                if (fwCmd->args[i][0] != '-')
+                    break;
+            }
+
+            if (i + 1 < fwCmd->argsLen &&
+                VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
+
+                cmdIdx = i;
+                objectType = fwCmd->args[i + 1];
+
+                /* we currently only handle auto-rollback for rules,
+                 * chains, and tables, and those all can be "rolled
+                 * back" by a delete command using the handle that is
+                 * returned when "-ae" is added to the add/insert
+                 * command.
+                  */
+-                virCommandAddArg(cmd, "-ae");
+                if (STREQ_NULLABLE(objectType, "rule") ||
+                    STREQ_NULLABLE(objectType, "chain") ||
+                    STREQ_NULLABLE(objectType, "table")) {
+
+                    needRollback = true;
+                    /* this option to nft instructs it to add the
+                     * "handle" of the created object to stdout
+                     */
+                    virCommandAddArg(cmd, "-ae");
+                }
+             }
+         }
+
+     }
+ 
+     for (i = 0; i < fwCmd->argsLen; i++)
+diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
+index bce51259d2..d42e60884b 100644
+--- a/src/util/virfirewall.h
+++ b/src/util/virfirewall.h
+@@ -39,6 +39,7 @@ typedef enum {
+     VIR_FIREWALL_LAYER_ETHERNET,
+     VIR_FIREWALL_LAYER_IPV4,
+     VIR_FIREWALL_LAYER_IPV6,
+    VIR_FIREWALL_LAYER_TC,
+ 
+     VIR_FIREWALL_LAYER_LAST,
+ } virFirewallLayer;
+diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c
+index 827e201dbb..124523c420 100644
+--- a/src/util/virfirewalld.c
+++ b/src/util/virfirewalld.c
+@@ -43,6 +43,7 @@ VIR_LOG_INIT("util.firewalld");
+ VIR_ENUM_DECL(virFirewallLayerFirewallD);
+ VIR_ENUM_IMPL(virFirewallLayerFirewallD,
+               VIR_FIREWALL_LAYER_LAST,
+              "",
+               "eb",
+               "ipv4",
+               "ipv6",
+-- 
+2.47.1
+
@@ -0,0 +1,687 @@
+From b1e2318a0d609fcdff04fcf88953ea87cdd02b95 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 25 Nov 2024 22:24:49 -0500
+Subject: [PATCH 9/9] network: add tc filter rule to nftables backend to fix
+ checksum of DHCP responses
+
+Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the
+history and explanation of the problem that this patch is fixing.
+
+A shorter explanation is that when a guest is connected to a libvirt
+virtual network using a virtio-net adapter with in-kernel "vhost-net"
+packet processing enabled, it will fail to acquire an IP address from
+a DHCP seever running on the host.
+
+In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing
+out* the checksums of these packets with an nftables rule (nftables
+can't recompute the checksum, but it can set it to 0) . This
+*appeared* to work initially, but it turned out that zeroing the
+checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest
+interfaces. That attempt was reverted in commit v10.9.0-rc2.
+
+Fortunately, there is an existing way to recompute the checksum of a
+packet as it leaves an interface - the "tc" (traffic control) utility
+that libvirt already uses for bandwidth management. This patch uses a
+tc filter rule to match dhcp response packets on the bridge and
+recompute their checksum.
+
+The filter rule must be attached to a tc qdisc, which may also have a
+filter attached for bandwidth management (in the <bandwidth> element
+of the network config). Not only must we add the qdisc only once
+(which was already handled by the patch two prior to this one), but
+also the filter rule for checksum fixing and the filter rule for
+bandwidth management must be different priorities so they don't clash;
+this is solved by adding the checksum-fix filter with "priority 2",
+while the bandwidth management filter remains "priority 1" (both will
+always be evaluated anyway, it's just a matter of which is evaluated
+first).
+
+So far this method has worked with every different guest we could
+throw at it, including several that failed with the previous method.
+
+Fixes: b89c4991daa0ee9371f10937fab3b03c5ffdabc6
+Reported-by: Rich Jones <rjones@redhat.com>
+Reported-by: Andrea Bolognani <abologna@redhat.com>
+Fix-Suggested-by: Eric Garver <egarver@redhat.com>
+Fix-Suggested-by: Phil Sutter <psutter@redhat.com>
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/network/network_nftables.c                | 68 +++++++++++++++++++
+ .../forward-dev-linux.nftables                | 40 +++++++++++
+ .../isolated-linux.nftables                   | 40 +++++++++++
+ .../nat-default-linux.nftables                | 40 +++++++++++
+ .../nat-ipv6-linux.nftables                   | 40 +++++++++++
+ .../nat-ipv6-masquerade-linux.nftables        | 40 +++++++++++
+ .../nat-many-ips-linux.nftables               | 40 +++++++++++
+ .../nat-no-dhcp-linux.nftables                | 40 +++++++++++
+ .../nat-port-range-ipv6-linux.nftables        | 40 +++++++++++
+ .../nat-port-range-linux.nftables             | 40 +++++++++++
+ .../nat-tftp-linux.nftables                   | 40 +++++++++++
+ .../route-default-linux.nftables              | 40 +++++++++++
+ 12 files changed, 508 insertions(+)
+
+diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
+index cc184105c3..748edb0273 100644
+--- a/src/network/network_nftables.c
+++ b/src/network/network_nftables.c
+@@ -29,6 +29,7 @@
+ 
+ #include "internal.h"
+ #include "virfirewalld.h"
+#include "vircommand.h"
+ #include "virerror.h"
+ #include "virlog.h"
+ #include "virhash.h"
+@@ -924,6 +925,67 @@ nftablesAddIPSpecificFirewallRules(virFirewall *fw,
+ }
+ 
+ 
+/**
+ * nftablesAddUdpChecksumFixWithTC:
+ *
+ * Add a tc filter rule to @ifname (the bridge device of this network)
+ * that will recompute the checksum of udp packets output from @iface with
+ * destination port @port.
+ *
+ * Normally the checksum should be filled by some part of the basic
+ * network stack, but there are cases (e.g. DHCP response packets sent
+ * from virtualization host to a QEMU guest when the guest NIC uses
+ * vhost-net packet processing) when the host (sender) thinks that
+ * packet checksums will be computed elsewhere (and so leaves a
+ * partially computed checksum in the packet header) while the guest
+ * (receiver) thinks that the checksum has already been fully
+ * computed; in the meantime none of the code in between has actually
+ * finished computing the checksum.
+ *
+ * An example of this is DHCP response packets from host to guest. If
+ * the checksum of each of these packets isn't properly computed, then
+ * many guests (e.g. FreeBSD) will drop them with reason BAD CHECKSUM;
+ * this tc filter rule will fix the ip and udp checksums, and the
+ * FreeBSD dhcp client will happily accept the packet.
+ *
+ * (NB: if you're wondering how the tc qdisc and filter are removed
+ * when the network is destroyed, the answer is that the kernel
+ * automatically (and properly) removes them for us, so we don't need
+ * to worry about keeping track/deleting as we do with nftables rules)
+ */
+static int
+nftablesAddUdpChecksumFixWithTC(virFirewall *fw,
+                                const char *iface,
+                                int port)
+{
+    g_autofree char *portstr = g_strdup_printf("%d", port);
+
+    /* this will add the qdisc (that the filter below is attached to)
+     * unless it already exists
+     */
+    if (virNetDevBandWidthAddTxFilterParentQdisc(iface, true) < 0)
+        return -1;
+
+    /* add a filter to catch all udp packets with dst "port" and
+     * recompute their checksum
+     */
+    virFirewallAddCmd(fw, VIR_FIREWALL_LAYER_TC,
+                      "filter", "add", "dev", iface,
+                      "prio", "2", "protocol", "ip", "parent", "1:",
+                      "u32", "match", "ip", "dport", portstr, "ffff",
+                      "action", "csum", "ip", "and", "udp",
+                      NULL);
+
+    virFirewallAddRollbackCmd(fw, VIR_FIREWALL_LAYER_TC,
+                              "filter", "del", "dev", iface,
+                              "prio", "2", "protocol", "ip", "parent", "1:",
+                              "u32", "match", "ip", "dport", portstr, "ffff",
+                              "action", "csum", "ip", "and", "udp",
+                              NULL);
+    return 0;
+}
+
+
+ /* nftablesAddFirewallrules:
+  *
+  * @def - the network that needs an nftables firewall added
+@@ -944,6 +1006,12 @@ nftablesAddFirewallRules(virNetworkDef *def, virFirewall **fwRemoval)
+ 
+     virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK);
+ 
+    /* add the tc filter rule needed to fixup the checksum of dhcp
+     * response packets going from host to guest.
+     */
+    if (nftablesAddUdpChecksumFixWithTC(fw, def->bridge, 68) < 0)
+        return -1;
+
+     nftablesAddGeneralFirewallRules(fw, def);
+ 
+     for (i = 0;
+diff --git a/tests/networkxml2firewalldata/forward-dev-linux.nftables b/tests/networkxml2firewalldata/forward-dev-linux.nftables
+index 8badb74beb..6772383b37 100644
+--- a/tests/networkxml2firewalldata/forward-dev-linux.nftables
+++ b/tests/networkxml2firewalldata/forward-dev-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/isolated-linux.nftables b/tests/networkxml2firewalldata/isolated-linux.nftables
+index d1b4dac178..546a18b75a 100644
+--- a/tests/networkxml2firewalldata/isolated-linux.nftables
+++ b/tests/networkxml2firewalldata/isolated-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-default-linux.nftables b/tests/networkxml2firewalldata/nat-default-linux.nftables
+index 28508292f9..08623c1381 100644
+--- a/tests/networkxml2firewalldata/nat-default-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-default-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
+index d8a9ba706d..3fd6b94eef 100644
+--- a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
+index a7f09cda59..2811e098d1 100644
+--- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
+index b826fe6134..5409d5b552 100644
+--- a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
+index d8a9ba706d..3fd6b94eef 100644
+--- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
+index ceaed6fa40..d74417cdb3 100644
+--- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
+index 1dc37a26ec..b55bb287a9 100644
+--- a/tests/networkxml2firewalldata/nat-port-range-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.nftables b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
+index 28508292f9..08623c1381 100644
+--- a/tests/networkxml2firewalldata/nat-tftp-linux.nftables
+++ b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+diff --git a/tests/networkxml2firewalldata/route-default-linux.nftables b/tests/networkxml2firewalldata/route-default-linux.nftables
+index 282c9542a5..76d6902517 100644
+--- a/tests/networkxml2firewalldata/route-default-linux.nftables
+++ b/tests/networkxml2firewalldata/route-default-linux.nftables
+@@ -1,3 +1,43 @@
+tc \
+qdisc \
+show \
+dev \
+virbr0 \
+handle \
+1:
+tc \
+qdisc \
+add \
+dev \
+virbr0 \
+root \
+handle \
+1: \
+htb \
+default \
+2
+tc \
+filter \
+add \
+dev \
+virbr0 \
+prio \
+2 \
+protocol \
+ip \
+parent \
+1: \
+u32 \
+match \
+ip \
+dport \
+68 \
+ffff \
+action \
+csum \
+ip \
+and \
+udp
+ nft \
+ -ae insert \
+ rule \
+-- 
+2.47.1
+
@@ -0,0 +1,51 @@
+From 114c0ec656e879ab4d67919914bb24cf5993106d Mon Sep 17 00:00:00 2001
+Message-ID: <114c0ec656e879ab4d67919914bb24cf5993106d.1734201785.git.crobinso@redhat.com>
+From: Laine Stump <laine@redhat.com>
+Date: Mon, 2 Sep 2024 16:13:08 -0400
+Subject: [PATCH] network: permit <forward mode='open'/> when a network has no
+ IP address
+Content-type: text/plain
+
+The whole point of <forward mode='open'/> is to supress libvirt from
+adding any firewall rules for a network, and someone might want to
+create a network with no IP address (i.e. they don't want the guests
+to have connectivity to the host via this interface) and no firewall
+rules (they don't want any, or they want to add their own). So there's
+no reason to fail when a network has <forward mode='open'/> and also
+has no IP address.
+
+Kind-of-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/588
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ src/conf/network_conf.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
+index 5cf419acf1..320e1b089a 100644
+--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
+@@ -1789,7 +1789,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
+ 
+     case VIR_NETWORK_FORWARD_ROUTE:
+     case VIR_NETWORK_FORWARD_NAT:
+-    case VIR_NETWORK_FORWARD_OPEN:
+         /* It's pointless to specify L3 forwarding without specifying
+          * the network we're on.
+          */
+@@ -1806,8 +1805,10 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
+                            def->name);
+             return NULL;
+         }
+        break;
+ 
+-        if (def->forward.type == VIR_NETWORK_FORWARD_OPEN && def->forward.nifs) {
+    case VIR_NETWORK_FORWARD_OPEN:
+        if (def->forward.nifs) {
+             /* an open network by definition can't place any restrictions
+              * on what traffic is allowed or where it goes, so specifying
+              * a forwarding device is nonsensical.
+-- 
+2.47.1
+
@@ -0,0 +1,64 @@
+From d51179fa82448f4720f1645f0b7100df80508cc4 Mon Sep 17 00:00:00 2001
+From: Pavel Hrdina <phrdina@redhat.com>
+Date: Thu, 9 Jan 2025 16:23:44 +0100
+Subject: [PATCH] qemu: snapshot: delete disk image only if parent snapshot is
+ external
+Content-type: text/plain
+
+When we are deleting external snapshot that is not active we only need
+to delete overlay disk image of the parent snapshot. This works
+correctly even if parent snapshot is external and active as it will have
+another overlay created when user reverted to that snapshot.
+
+In case the parent snapshot is internal there are no overlay disk images
+created as everything is stored internally within the disk image. In
+this case we would delete the actual disk image storing internal
+snapshots and most likely the original disk image as well resulting in
+data loss once the VM is shutoff.
+
+Fixes: https://gitlab.com/libvirt/libvirt/-/issues/734
+Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+---
+ src/qemu/qemu_snapshot.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
+index 18b2e478f6..80cd54bf33 100644
+--- a/src/qemu/qemu_snapshot.c
+++ b/src/qemu/qemu_snapshot.c
+@@ -3144,6 +3144,8 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
+             return -1;
+         }
+ 
+        data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
+
+         if (data->merge) {
+             virStorageSource *snapDiskSrc = NULL;
+ 
+@@ -3185,8 +3187,6 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
+                 qemuSnapshotGetDisksWithBackingStore(vm, snap, data);
+             }
+ 
+-            data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
+-
+             if (data->parentSnap && !virDomainSnapshotIsExternal(data->parentSnap)) {
+                 virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
+                                _("deleting external snapshot that has internal snapshot as parent not supported"));
+@@ -3642,10 +3642,12 @@ qemuSnapshotDiscardExternal(virDomainObj *vm,
+             if (!data->job)
+                 goto error;
+         } else {
+-            if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
+-                virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
+-                VIR_WARN("Failed to remove snapshot image '%s'",
+-                         data->snapDisk->name);
+            if (data->parentSnap && virDomainSnapshotIsExternal(data->parentSnap)) {
+                if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
+                    virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
+                    VIR_WARN("Failed to remove snapshot image '%s'",
+                             data->snapDisk->name);
+                }
+             }
+         }
+     }
@@ -3,15 +3,15 @@
 # This spec file assumes you are building on a Fedora or RHEL version
 # that's still supported by the vendor. It may work on other distros
 # or versions, but no effort will be made to ensure that going forward.
-%define min_rhel 9
-%define min_fedora 41
+%define min_rhel 8
+%define min_fedora 37

-%define arches_qemu_kvm         %{ix86} x86_64 %{power64} aarch64 s390x riscv64
+%define arches_qemu_kvm         %{ix86} x86_64 %{power64} %{arm} aarch64 s390x riscv64
 %if 0%{?rhel}
-    %if 0%{?rhel} >= 10
-        %define arches_qemu_kvm     x86_64 aarch64 s390x riscv64
-    %else
+    %if 0%{?rhel} > 8
        %define arches_qemu_kvm     x86_64 aarch64 s390x
+    %else
+        %define arches_qemu_kvm     x86_64 %{power64} aarch64 s390x
    %endif
 %endif

@@ -19,7 +19,7 @@
 %define arches_x86              %{ix86} x86_64

 %define arches_systemtap_64bit  %{arches_64bit}
-%define arches_dmidecode        %{arches_x86} aarch64 riscv64
+%define arches_dmidecode        %{arches_x86}
 %define arches_xen              %{arches_x86} aarch64
 %if 0%{?fedora}
    %define arches_xen          x86_64 aarch64
@@ -29,24 +29,12 @@
 %define arches_zfs              %{arches_x86} %{power64} %{arm}
 %define arches_numactl          %{arches_x86} %{power64} aarch64 s390x
 %define arches_numad            %{arches_x86} %{power64} aarch64
-%define arches_ch               x86_64 aarch64

 # The hypervisor drivers that run in libvirtd
+%define with_qemu          0%{!?_without_qemu:1}
 %define with_lxc           0%{!?_without_lxc:1}
 %define with_libxl         0%{!?_without_libxl:1}
 %define with_vbox          0%{!?_without_vbox:1}
-%define with_ch            0%{!?_without_ch:1}
-
-%ifarch %{arches_64bit}
-    %define with_qemu      0%{!?_without_qemu:1}
-%else
-    # QEMU drops 32-bit in Fedora 44
-    %if 0%{?fedora} > 43
-        %define with_qemu  0
-    %else
-        %define with_qemu  0%{!?_without_qemu:1}
-    %endif
-%endif

 %ifarch %{arches_qemu_kvm}
    %define with_qemu_kvm      %{with_qemu}
@@ -54,12 +42,6 @@
    %define with_qemu_kvm      0
 %endif

-%if 0%{?fedora} >= 42
-    %define with_account_add 0
-%else
-    %define with_account_add 1
-%endif
-
 %define with_qemu_tcg      %{with_qemu}

 # RHEL disables TCG on all architectures
@@ -82,13 +64,18 @@

 %define with_storage_gluster 0%{!?_without_storage_gluster:1}
 %if 0%{?rhel}
-    # Glusterfs has been dropped in RHEL-9.
-    %define with_storage_gluster 0
+    # Glusterfs has been dropped in RHEL-9, and before that
+    # was only enabled on arches where KVM exists
+    %if 0%{?rhel} > 8
+        %define with_storage_gluster 0
+    %else
+        %ifnarch %{arches_qemu_kvm}
+            %define with_storage_gluster 0
+        %endif
+    %endif
 %endif

-# On Fedora 43, the 'zfs-fuse' package was removed, but is obtainable via
-# other means. Build the backend, but it's no longer considered to be part
-# of 'daemon-driver-storage'.
+# Fedora has zfs-fuse
 %if 0%{?fedora}
    %define with_storage_zfs      0%{!?_without_storage_zfs:1}
 %else
@@ -97,12 +84,13 @@

 %define with_storage_iscsi_direct 0%{!?_without_storage_iscsi_direct:1}
 # libiscsi has been dropped in RHEL-9
-%if 0%{?rhel}
+%if 0%{?rhel} > 8
    %define with_storage_iscsi_direct 0
 %endif

 # Other optional features
 %define with_numactl          0%{!?_without_numactl:1}
+%define with_userfaultfd_sysctl 0%{!?_without_userfaultfd_sysctl:1}

 # A few optional bits off by default, we enable later
 %define with_fuse             0
@@ -135,9 +123,6 @@
 %ifnarch %{arches_ceph}
    %define with_storage_rbd 0
 %endif
-%ifnarch %{arches_ch}
-    %define with_ch 0
-%endif

 # RHEL doesn't ship many hypervisor drivers
 %if 0%{?rhel}
@@ -147,11 +132,14 @@
    %define with_libxl 0
    %define with_hyperv 0
    %define with_lxc 0
-    %define with_ch 0
 %endif

 %define with_firewalld_zone 0%{!?_without_firewalld_zone:1}

+%if 0%{?rhel} && 0%{?rhel} < 9
+    %define with_netcf 0%{!?_without_netcf:1}
+%endif
+
 # fuse is used to provide virtualized /proc for LXC
 %if %{with_lxc}
    %define with_fuse      0%{!?_without_fuse:1}
@@ -193,7 +181,8 @@
 # Right now that's not the case anywhere, but things should be fine by the time
 # Fedora 40 is released.
 %if %{with_qemu}
-    %if 0%{?fedora} || 0%{?rhel}
+    # rhel-8 lacks pidfd_open
+    %if 0%{?fedora} || 0%{?rhel} >= 9
        %define with_nbdkit 0%{!?_without_nbdkit:1}

        # setting 'with_nbdkit_config_default' must be done only when compiling
@@ -201,7 +190,7 @@
        #
        # TODO: add RHEL 9 once a minor release that contains the necessary SELinux
        #       bits exists (we only support the most recent minor release)
-        %if 0%{?fedora}
+        %if 0%{?fedora} >= 40
            %define with_nbdkit_config_default 0%{!?_without_nbdkit_config_default:1}
        %endif
    %endif
@@ -212,13 +201,13 @@
 %endif

 %define with_modular_daemons 0
-%if 0%{?fedora} || 0%{?rhel}
+%if 0%{?fedora} || 0%{?rhel} >= 9
    %define with_modular_daemons 1
 %endif

 # Prefer nftables for future OS releases but keep using iptables
 # for existing ones
-%if 0%{?rhel} >= 10 || 0%{?fedora}
+%if 0%{?rhel} >= 10 || 0%{?fedora} >= 41
    %define prefer_nftables 1
    %define firewall_backend_priority nftables,iptables
 %else
@@ -263,14 +252,19 @@

 # RHEL releases provide stable tool chains and so it is safe to turn
 # compiler warning into errors without being worried about frequent
-# changes in reported warnings. ELN is a rebuild of Rawhide so should
-# be treated as unstable for this flag
-%if 0%{?rhel} && !0%{?eln}
+# changes in reported warnings
+%if 0%{?rhel}
    %define enable_werror -Dwerror=true
 %else
    %define enable_werror -Dwerror=false -Dgit_werror=disabled
 %endif

+# Fedora and RHEL-9 are new enough to support /dev/userfaultfd, which
+# does not require enabling vm.unprivileged_userfaultfd sysctl.
+%if 0%{?fedora} || 0%{?rhel} >= 9
+    %define with_userfaultfd_sysctl 0
+%endif
+
 %define tls_priority "@LIBVIRT,SYSTEM"

 # libvirt 8.1.0 stops distributing any sysconfig files.
@@ -294,8 +288,8 @@

 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 12.0.0
-Release: 3%{?dist}
+Version: 10.6.0
+Release: 7%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
 URL: https://libvirt.org/

@@ -304,9 +298,24 @@ URL: https://libvirt.org/
 %endif
 Source: https://download.libvirt.org/%{?mainturl}libvirt-%{version}.tar.xz

-# Fix IPv6 connections to ESXi
-# Upstream in > 12.0.0
-Patch: 0001-esx-Allow-connecting-to-IPv6-server.patch
+# Fix `virsh domifaddr --source=arp` on kernel 6.10 (bz #2302245)
+Patch0001: 0001-virarptable-Properly-calculate-rtattr-length.patch
+Patch0002: 0002-virarptable-Fix-check-for-message-length.patch
+Patch0003: 0003-virarptable-End-parsing-earlier-in-case-of-NLMSG_DON.patch
+
+# Fix DHCP response checksum when using nftables firewall
+Patch0004: 0004-util-use-a-single-flags-arg-for-virNetDevBandwidthSe.patch
+Patch0005: 0005-util-make-it-optional-to-clear-existing-tc-qdiscs-fi.patch
+Patch0006: 0006-util-put-the-command-that-adds-a-tx-filter-qdisc-int.patch
+Patch0007: 0007-util-don-t-re-add-the-qdisc-used-for-tx-filters-if-i.patch
+Patch0008: 0008-util-add-new-tc-layer-for-virFirewallCmd-objects.patch
+Patch0009: 0009-network-add-tc-filter-rule-to-nftables-backend-to-fi.patch
+
+# Permit forward mode=open when network has no IP (bz 2255266)
+Patch: 0010-network-permit-forward-mode-open-when-a-network-has-.patch
+
+# Fix potential dataloss on snapshot deletion
+Patch11: 0011-qemu-snapshot-delete-disk-image-only-if-parent-snaps.patch

 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -327,9 +336,6 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0
 %if %{with_vbox}
 Requires: libvirt-daemon-driver-vbox = %{version}-%{release}
 %endif
-%if %{with_ch}
-Requires: libvirt-daemon-driver-ch = %{version}-%{release}
-%endif
 Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
 Requires: libvirt-daemon-driver-interface = %{version}-%{release}
 Requires: libvirt-daemon-driver-secret = %{version}-%{release}
@@ -344,7 +350,7 @@ Requires: libvirt-libs = %{version}-%{release}
 BuildRequires: python3-docutils
 BuildRequires: meson >= 0.56.0
 BuildRequires: ninja-build
-BuildRequires: git-core
+BuildRequires: git
 BuildRequires: perl-interpreter
 BuildRequires: python3
 BuildRequires: python3-pytest
@@ -361,7 +367,7 @@ BuildRequires: gcc
    %if %{with_libxl}
 BuildRequires: xen-devel
    %endif
-BuildRequires: glib2-devel >= 2.66
+BuildRequires: glib2-devel >= 2.58
 BuildRequires: libxml2-devel
 BuildRequires: readline-devel
 BuildRequires: pkgconfig(bash-completion) >= 2.0
@@ -374,14 +380,19 @@ BuildRequires: libblkid-devel >= 2.17
 BuildRequires: augeas
 BuildRequires: systemd-devel >= 185
 BuildRequires: libpciaccess-devel >= 0.10.9
-BuildRequires: json-c-devel
+BuildRequires: yajl-devel
    %if %{with_sanlock}
 BuildRequires: sanlock-devel >= 2.4
    %endif
 BuildRequires: libpcap-devel >= 1.5.0
 BuildRequires: libnl3-devel
 BuildRequires: libselinux-devel
+# For modprobe
+BuildRequires: kmod
 BuildRequires: cyrus-sasl-devel
+BuildRequires: polkit >= 0.112
+# For mount/umount in FS driver
+BuildRequires: util-linux
    %if %{with_qemu}
 # For managing ACLs
 BuildRequires: libacl-devel
@@ -392,6 +403,10 @@ BuildRequires: /usr/bin/qemu-img
    %if %{with_nbdkit}
 BuildRequires: libnbd-devel
    %endif
+# For LVM drivers
+BuildRequires: lvm2
+# For pool type=iscsi
+BuildRequires: iscsi-initiator-utils
    %if %{with_storage_iscsi_direct}
 # For pool type=iscsi-direct
 BuildRequires: libiscsi-devel
@@ -414,7 +429,7 @@ BuildRequires: numactl-devel
    %endif
 BuildRequires: libcap-ng-devel >= 0.5.0
    %if %{with_fuse}
-BuildRequires: fuse3-devel
+BuildRequires: fuse-devel >= 2.8.6
    %endif
    %if %{with_libssh2}
 BuildRequires: libssh2-devel >= 1.3.0
@@ -431,6 +446,13 @@ BuildRequires: libwsman-devel >= 2.6.3
 BuildRequires: audit-libs-devel
 BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
+# For mount/umount in FS driver
+BuildRequires: util-linux
+# For showmount in FS driver (netfs discovery)
+BuildRequires: nfs-utils
+    %if %{with_numad}
+BuildRequires: numad
+    %endif
    %if %{with_wireshark}
 BuildRequires: wireshark-devel
    %endif
@@ -511,8 +533,6 @@ Requires: libvirt-libs = %{version}-%{release}
 # Recommends here will install libvirt-client by default (if available), but
 # RPM won't complain if the package is unavailable, masked, or removed later.
 Recommends: libvirt-client = %{version}-%{release}
-# For modprobe and rmmod
-Requires: kmod
 # for /sbin/ip
 Requires: iproute
 # for /sbin/tc
@@ -527,10 +547,8 @@ Requires(posttrans): /usr/bin/systemctl
 Requires(preun): /usr/bin/systemctl
 # libvirtd depends on 'messagebus' service
 Requires: dbus
-    %if %{with_account_add}
 # For uid creation during pre
 Requires(pre): shadow-utils
-    %endif
 # Needed by /usr/libexec/libvirt-guests.sh script.
    %if 0%{?fedora}
 Requires: gettext-runtime
@@ -557,7 +575,6 @@ resources
 %package daemon-plugin-lockd
 Summary: lockd client plugin for virtlockd
 Requires: libvirt-libs = %{version}-%{release}
-Requires: libvirt-daemon-common = %{version}-%{release}
 Requires: libvirt-daemon-lock = %{version}-%{release}

 %description daemon-plugin-lockd
@@ -671,8 +688,8 @@ an implementation of the secret key APIs.
 Summary: Storage driver plugin including base backends for the libvirtd daemon
 Requires: libvirt-daemon-common = %{version}-%{release}
 Requires: libvirt-libs = %{version}-%{release}
-Recommends: nfs-utils
-# For mkfs and mount/umount
+Requires: nfs-utils
+# For mkfs
 Requires: util-linux
 # For storage wiping with different algorithms
 Requires: scrub
@@ -784,13 +801,9 @@ volumes using the ceph protocol.
 Summary: Storage driver plugin for ZFS
 Requires: libvirt-daemon-driver-storage-core = %{version}-%{release}
 Requires: libvirt-libs = %{version}-%{release}
-# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable
-# externally. The package builds fine without these. Users will have to provide
-# their own implementation.
-        %if 0%{?fedora} && 0%{?fedora} < 43
+# Support any conforming implementation of zfs
 Requires: /sbin/zfs
 Requires: /sbin/zpool
-        %endif

 %description daemon-driver-storage-zfs
 The storage driver backend adding implementation of the storage APIs for
@@ -814,10 +827,7 @@ Requires: libvirt-daemon-driver-storage-gluster = %{version}-%{release}
    %if %{with_storage_rbd}
 Requires: libvirt-daemon-driver-storage-rbd = %{version}-%{release}
    %endif
-# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable
-# externally. We do not want to install this as part of 'daemon-driver-storage'
-# any more.
-    %if %{with_storage_zfs} && 0%{?fedora} && 0%{?fedora} < 43
+    %if %{with_storage_zfs}
 Requires: libvirt-daemon-driver-storage-zfs = %{version}-%{release}
    %endif

@@ -844,7 +854,7 @@ Requires: swtpm-tools
        %if %{with_numad}
 Requires: numad
        %endif
-        %if 0%{?fedora} || 0%{?rhel}
+        %if 0%{?fedora} || 0%{?rhel} >= 9
 Recommends: passt
 Recommends: passt-selinux
        %endif
@@ -1004,6 +1014,7 @@ Requires: libvirt-daemon-driver-libxl = %{version}-%{release}
 Requires: libvirt-daemon-driver-interface = %{version}-%{release}
 Requires: libvirt-daemon-driver-network = %{version}-%{release}
 Requires: libvirt-daemon-driver-nodedev = %{version}-%{release}
+Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
 Requires: libvirt-daemon-driver-secret = %{version}-%{release}
 Requires: libvirt-daemon-driver-storage = %{version}-%{release}
 Requires: xen
@@ -1037,20 +1048,6 @@ Server side daemon and driver required to manage the virtualization
 capabilities of VirtualBox
    %endif

-    %if %{with_ch}
-%package daemon-driver-ch
-Summary: Cloud-Hypervisor driver plugin for libvirtd daemon
-Requires: libvirt-daemon-common = %{version}-%{release}
-Requires: libvirt-daemon-log = %{version}-%{release}
-Requires: libvirt-libs = %{version}-%{release}
-
-%description daemon-driver-ch
-The ch driver plugin for the libvirtd daemon, providing
-an implementation of the hypervisor driver APIs by
-Cloud-Hypervisor
-    %endif
-
-
 %package client
 Summary: Client side utilities of the libvirt library
 Requires: libvirt-libs = %{version}-%{release}
@@ -1096,10 +1093,6 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic.
 %package login-shell
 Summary: Login shell for connecting users to an LXC container
 Requires: libvirt-libs = %{version}-%{release}
-        %if %{with_account_add}
-# For uid creation during pre
-Requires(pre): shadow-utils
-        %endif

 %description login-shell
 Provides the set-uid virt-login-shell binary that is used to
@@ -1122,7 +1115,6 @@ Requires: sanlock >= 2.4
 #for virt-sanlock-cleanup require augeas
 Requires: augeas
 Requires: libvirt-libs = %{version}-%{release}
-Requires: libvirt-daemon-common = %{version}-%{release}
 Obsoletes: libvirt-lock-sanlock < 9.1.0
 Provides: libvirt-lock-sanlock = %{version}-%{release}

@@ -1218,15 +1210,9 @@ exit 1
 %endif

 %if %{with_esx}
-    %define arg_esx -Ddriver_esx=enabled
+    %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled
 %else
-    %define arg_esx -Ddriver_esx=disabled
-%endif
-
-%if %{with_esx} || %{with_ch}
-    %define arg_curl -Dcurl=enabled
-%else
-    %define arg_curl -Dcurl=disabled
+    %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled
 %endif

 %if %{with_hyperv}
@@ -1241,12 +1227,6 @@ exit 1
    %define arg_vmware -Ddriver_vmware=disabled
 %endif

-%if %{with_ch}
-    %define arg_ch -Ddriver_ch=enabled
-%else
-    %define arg_ch -Ddriver_ch=disabled
-%endif
-
 %if %{with_storage_rbd}
    %define arg_storage_rbd -Dstorage_rbd=enabled
 %else
@@ -1343,6 +1323,12 @@ exit 1
    %define arg_remote_mode -Dremote_default_mode=legacy
 %endif

+%if %{with_userfaultfd_sysctl}
+    %define arg_userfaultfd_sysctl -Duserfaultfd_sysctl=enabled
+%else
+    %define arg_userfaultfd_sysctl -Duserfaultfd_sysctl=disabled
+%endif
+
 %define when  %(date +"%%F-%%T")
 %define where %(hostname)
 %define who   %{?packager}%{!?packager:Unknown}
@@ -1371,12 +1357,11 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
           -Ddriver_remote=enabled \
           -Ddriver_test=enabled \
           %{?arg_esx} \
-           %{?arg_curl} \
           %{?arg_hyperv} \
           %{?arg_vmware} \
-           %{?arg_ch} \
           -Ddriver_vz=disabled \
           -Ddriver_bhyve=disabled \
+           -Ddriver_ch=disabled \
           %{?arg_remote_mode} \
           -Ddriver_interface=enabled \
           -Ddriver_network=enabled \
@@ -1403,7 +1388,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
           -Dapparmor_profiles=disabled \
           -Dsecdriver_apparmor=disabled \
           -Dudev=enabled \
-           -Djson_c=enabled \
+           -Dyajl=enabled \
           %{?arg_sanlock} \
           -Dlibpcap=enabled \
           %{?arg_nbdkit} \
@@ -1426,6 +1411,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
           -Dqemu_datadir=%{qemu_datadir} \
           -Dtls_priority=%{tls_priority} \
           -Dsysctl_config=enabled \
+           %{?arg_userfaultfd_sysctl} \
           -Dssh_proxy=enabled \
           %{?enable_werror} \
           -Dexpensive_tests=enabled \
@@ -1455,7 +1441,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
  -Dblkid=disabled \
  -Dcapng=disabled \
  -Ddriver_bhyve=disabled \
-  -Ddriver_ch=disabled \
  -Ddriver_hyperv=disabled \
  -Ddriver_interface=disabled \
  -Ddriver_libvirtd=disabled \
@@ -1475,7 +1460,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
  -Dfuse=disabled \
  -Dglusterfs=disabled \
  -Dhost_validate=disabled \
-  -Djson_c=disabled \
  -Dlibiscsi=disabled \
  -Dnbdkit=disabled \
  -Dnbdkit_config_default=disabled \
@@ -1513,10 +1497,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
  -Dstorage_vstorage=disabled \
  -Dstorage_zfs=disabled \
  -Dsysctl_config=disabled \
+  -Duserfaultfd_sysctl=disabled \
  -Dssh_proxy=disabled \
  -Dtests=disabled \
  -Dudev=disabled \
  -Dwireshark_dissector=disabled \
+  -Dyajl=disabled \
  %{?enable_werror}
 %mingw_ninja
 %endif
@@ -1577,10 +1563,6 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
    %endif
-    %if ! %{with_ch}
-rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug
-rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
-    %endif

 # Copied into libvirt-docs subpackage eventually
 mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
@@ -1791,12 +1773,10 @@ export VIR_TEST_DEBUG=1
 %pre daemon-common
 %libvirt_sysconfig_pre libvirt-guests
 %libvirt_systemd_oneshot_pre libvirt-guests
-    %if %{with_account_add}
 # 'libvirt' group is just to allow password-less polkit access to libvirt
 # daemons. The uid number is irrelevant, so we use dynamic allocation.
 getent group libvirt >/dev/null || groupadd -r libvirt
 exit 0
-    %endif

 %posttrans daemon-common
 %libvirt_sysconfig_posttrans libvirt-guests
@@ -1919,7 +1899,6 @@ exit 0
 %libvirt_sysconfig_pre virtqemud
 %libvirt_systemd_unix_pre virtqemud

-        %if %{with_account_add}
 # We want soft static allocation of well-known ids, as disk images
 # are commonly shared across NFS mounts by id rather than name.
 # See https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/
@@ -1935,7 +1914,6 @@ if ! getent passwd 'qemu' >/dev/null; then
  fi
 fi
 exit 0
-        %endif

 %posttrans daemon-driver-qemu
 %libvirt_sysconfig_posttrans virtqemud
@@ -1984,19 +1962,6 @@ exit 0
 %libvirt_systemd_unix_preun virtxend
    %endif

-    %if %{with_ch}
-%pre daemon-driver-ch
-%libvirt_sysconfig_pre virtchd
-%libvirt_systemd_unix_pre virtchd
-
-%posttrans daemon-driver-ch
-%libvirt_sysconfig_posttrans virtchd
-%libvirt_systemd_unix_posttrans virtchd
-
-%preun daemon-driver-ch
-%libvirt_systemd_unix_preun virtchd
-    %endif
-
 %pre daemon-config-network
 %libvirt_systemd_config_pre libvirtd
 %libvirt_systemd_config_pre virtnetworkd
@@ -2062,10 +2027,8 @@ done

    %if %{with_lxc}
 %pre login-shell
-        %if %{with_account_add}
 getent group virtlogin >/dev/null || groupadd -r virtlogin
 exit 0
-        %endif
    %endif
 %endif

@@ -2086,9 +2049,7 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf
 %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd
-%dir %{_datadir}/augeas/lenses
 %{_datadir}/augeas/lenses/libvirtd.aug
-%dir %{_datadir}/augeas/lenses/tests
 %{_datadir}/augeas/lenses/tests/test_libvirtd.aug
 %attr(0755, root, root) %{_sbindir}/libvirtd
 %{_mandir}/man8/libvirtd.8*
@@ -2099,7 +2060,7 @@ exit 0
 %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf
 %dir %{_datadir}/libvirt/
 %ghost %dir %{_rundir}/libvirt/
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/common/
+%ghost %dir %{_rundir}/libvirt/common/
 %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/
@@ -2109,11 +2070,9 @@ exit 0
 %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-backend/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-file/
-%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %{_datadir}/polkit-1/actions/org.libvirt.unix.policy
 %{_datadir}/polkit-1/actions/org.libvirt.api.policy
 %{_datadir}/polkit-1/rules.d/50-libvirt.rules
-%{_sysusersdir}/libvirt.conf
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/
 %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper
 %attr(0755, root, root) %{_bindir}/virt-ssh-helper
@@ -2141,6 +2100,7 @@ exit 0
 %{_mandir}/man8/virtlockd.8*

 %files daemon-plugin-lockd
+%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so

 %files daemon-log
@@ -2186,7 +2146,7 @@ exit 0
 %{_unitdir}/virtinterfaced-ro.socket
 %{_unitdir}/virtinterfaced-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtinterfaced
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/interface/
+%ghost %dir %{_rundir}/libvirt/interface/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_interface.so
 %{_mandir}/man8/virtinterfaced.8*

@@ -2228,7 +2188,7 @@ exit 0
 %{_unitdir}/virtnodedevd-ro.socket
 %{_unitdir}/virtnodedevd-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtnodedevd
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nodedev/
+%ghost %dir %{_rundir}/libvirt/nodedev/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_nodedev.so
 %{_mandir}/man8/virtnodedevd.8*

@@ -2243,8 +2203,8 @@ exit 0
 %attr(0755, root, root) %{_sbindir}/virtnwfilterd
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/nwfilter/
 %ghost %dir %{_rundir}/libvirt/network/
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nwfilter-binding/
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/nwfilter/
+%ghost %dir %{_rundir}/libvirt/nwfilter-binding/
+%ghost %dir %{_rundir}/libvirt/nwfilter/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_nwfilter.so
 %{_mandir}/man8/virtnwfilterd.8*

@@ -2258,7 +2218,7 @@ exit 0
 %{_unitdir}/virtsecretd-admin.socket
 %attr(0755, root, root) %{_sbindir}/virtsecretd
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/
-%ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/secrets/
+%ghost %dir %{_rundir}/libvirt/secrets/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so
 %{_mandir}/man8/virtsecretd.8*

@@ -2279,6 +2239,7 @@ exit 0
 %ghost %dir %{_rundir}/libvirt/storage/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so
 %{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so
+%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so
 %{_mandir}/man8/virtstoraged.8*

 %files daemon-driver-storage-disk
@@ -2320,6 +2281,9 @@ exit 0
    %if %{with_qemu}
 %files daemon-driver-qemu
 %config(noreplace) %{_sysconfdir}/libvirt/virtqemud.conf
+        %if %{with_userfaultfd_sysctl}
+%config(noreplace) %{_prefix}/lib/sysctl.d/60-qemu-postcopy-migration.conf
+        %endif
 %{_datadir}/augeas/lenses/virtqemud.aug
 %{_datadir}/augeas/lenses/tests/test_virtqemud.aug
 %{_unitdir}/virtqemud.service
@@ -2333,11 +2297,11 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
 %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
-%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/
-%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/dbus/
-%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/passt/
-%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/slirp/
-%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/swtpm/
+%ghost %dir %{_rundir}/libvirt/qemu/
+%ghost %dir %{_rundir}/libvirt/qemu/dbus/
+%ghost %dir %{_rundir}/libvirt/qemu/passt/
+%ghost %dir %{_rundir}/libvirt/qemu/slirp/
+%ghost %dir %{_rundir}/libvirt/qemu/swtpm/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/checkpoint/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/dump/
@@ -2451,6 +2415,7 @@ exit 0
        %if %{with_libxl}
 %config(noreplace) %{_sysconfdir}/libvirt/libxl-sanlock.conf
        %endif
+%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
 %{_datadir}/augeas/lenses/libvirt_sanlock.aug
 %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
@@ -2460,22 +2425,6 @@ exit 0
 %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
    %endif

-    %if %{with_ch}
-%files daemon-driver-ch
-%attr(0755, root, root) %{_sbindir}/virtchd
-%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf
-%{_datadir}/augeas/lenses/virtchd.aug
-%{_datadir}/augeas/lenses/tests/test_virtchd.aug
-%{_unitdir}/virtchd-admin.socket
-%{_unitdir}/virtchd-ro.socket
-%{_unitdir}/virtchd.service
-%{_unitdir}/virtchd.socket
-%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so
-%config(noreplace) %{_sysconfdir}/libvirt/ch.conf
-%{_datadir}/augeas/lenses/libvirtd_ch.aug
-%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
-    %endif
-
 %files client
 %{_mandir}/man1/virsh.1*
 %{_mandir}/man1/virt-xml-validate.1*
@@ -2506,17 +2455,15 @@ exit 0
 %{_libdir}/libvirt-lxc.so.*
 %{_libdir}/libvirt-admin.so.*
 %dir %{_datadir}/libvirt/
-%{_datadir}/libvirt/test-screenshot.png
 %dir %{_datadir}/libvirt/schemas/
-%{_datadir}/libvirt/schemas/*.rng
-%dir %{_datadir}/systemtap/tapset/
 %{_datadir}/systemtap/tapset/libvirt_probes*.stp
 %{_datadir}/systemtap/tapset/libvirt_functions.stp
    %if %{with_qemu}
 %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp
    %endif
-%dir %{_datadir}/libvirt/cpu_map
+%{_datadir}/libvirt/schemas/*.rng
 %{_datadir}/libvirt/cpu_map/*.xml
+%{_datadir}/libvirt/test-screenshot.png

    %if %{with_wireshark}
 %files wireshark
@@ -2536,7 +2483,6 @@ exit 0
 %attr(4750, root, virtlogin) %{_bindir}/virt-login-shell
 %{_libexecdir}/virt-login-shell-helper
 %config(noreplace) %{_sysconfdir}/libvirt/virt-login-shell.conf
-%{_sysusersdir}/libvirt-login-shell.conf
 %{_mandir}/man1/virt-login-shell.1*
    %endif

@@ -2695,107 +2641,21 @@ exit 0


 %changelog
-* Mon Jan 26 2026 Richard W.M. Jones <rjones@redhat.com> - 12.0.0-3
- Backport fix for IPv6 connections to ESXi
+* Wed Mar 05 2025 Cole Robinson <crobinso@redhat.com> - 10.6.0-7
+- Fix potential dataloss on snapshot deletion

-* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 12.0.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+* Sat Dec 14 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-6
+- Fix DHCP response checksum when using nftables firewall
+- Permit forward mode=open when network has no IP (bz 2255266)

-* Thu Jan 15 2026 Daniel P. Berrangé <berrange@redhat.com> - 12.0.0-1
- Update to 12.0.0
+* Tue Sep 24 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-5
+- Rebuild for new wireshark

-* Mon Jan 12 2026 Daniel P. Berrangé <berrange@redhat.com> - 11.10.0-3
- Disable -Werror on ELN
+* Wed Sep 18 2024 David Abdurachmanov <davidlt@rivosinc.com> - 10.6.0-4
+- Add riscv64 to arches_qemu_kvm

-* Thu Jan 08 2026 Richard W.M. Jones <rjones@redhat.com> - 11.10.0-2
- Rebuild for xen 4.21.0
-
-* Mon Dec 01 2025 Cole Robinson <crobinso@redhat.com> - 11.10.0-1
- Update to version 11.10.0
-
-* Mon Nov 17 2025 Richard W.M. Jones <rjones@redhat.com> - 11.9.0-3
- Add upstream patches to fix parallel libguestfs
-
-* Tue Nov  4 2025 Tom Callaway <spot@fedoraproject.org> - 11.9.0-2
- rebuild against new fuse3
-
-* Mon Nov  3 2025 Daniel P. Berrangé <berrange@redhat.com> - 11.9.0-1
- Update to 11.9.0 release
-
-* Wed Oct 29 2025 Peter Robinson <pbrobinson@fedoraproject.org> - 11.8.0-3
- Build against fuse3, supported since 8.2
-
-* Tue Oct 14 2025 Cole Robinson <crobinso@redhat.com> - 11.8.0-2
- Fix build with latest wireshark
-
-* Wed Oct 01 2025 Cole Robinson <crobinso@redhat.com> - 11.8.0-1
- Update to version 11.8.0
-
-* Thu Sep 04 2025 Adam Williamson <awilliam@redhat.com> - 11.7.0-3
- Rebuild on a side tag
-
-* Thu Sep 04 2025 Adam Williamson <awilliam@redhat.com> - 11.7.0-2
- Rebuild for libiscsi.so.11
-
-* Tue Sep 02 2025 Cole Robinson <crobinso@redhat.com> - 11.7.0-1
- Update to version 11.7.0
-
-* Tue Aug 05 2025 Cole Robinson <crobinso@redhat.com> - 11.6.0-1
- Update to version 11.6.0
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 11.5.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Wed Jul 16 2025 Richard W.M. Jones <rjones@redhat.com> - 11.5.0-2
- Rebuild for updated Xen
-
-* Wed Jul 09 2025 Cole Robinson <crobinso@redhat.com> - 11.5.0-1
- Update to version 11.5.0
-
-* Fri Jun 20 2025 Cole Robinson <crobinso@redhat.com> - 11.4.0-2
- Fix dumpxml failures after migration (bz 2369243)
-
-* Mon Jun 02 2025 Cole Robinson <crobinso@redhat.com> - 11.4.0-1
- Update to version 11.4.0
-
-* Thu May 08 2025 Adam Williamson <awilliam@redhat.com> - 11.3.0-3
- Properly obsolete libvirt-daemon-driver-storage-zfs
-
-* Thu May 08 2025 Cole Robinson <crobinso@redhat.com> - 11.3.0-2
- zfs-fuse is gone from rawhide, drop libvirt-daemon-storage-zfs
-
-* Wed May 07 2025 Cole Robinson <crobinso@redhat.com> - 11.3.0-1
- Update to version 11.3.0
-
-* Tue Apr 29 2025 Daniel P. Berrangé <berrange@redhat.com> - 11.2.0-2
- Fix install of Ampere 1 ARM CPU model (rhbz #2361196)
- Fix location of mount, umount (rhbz #2359196)
- Fix location of numad (rhbz #2359736)
- Fix tests on rebuild with latest GCC 15
-
-* Tue Apr 01 2025 Cole Robinson <crobinso@redhat.com> - 11.2.0-1
- Update to version 11.2.0
-
-* Mon Mar 03 2025 Cole Robinson <crobinso@redhat.com> - 11.1.0-1
- Update to version 11.1.0
-
-* Fri Jan 17 2025 Cole Robinson <crobinso@redhat.com> - 11.0.0-1
- Update to version 11.0.0
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.10.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Mon Dec 02 2024 Cole Robinson <crobinso@redhat.com> - 10.10.0-1
- Update to version 10.10.0
-
-* Fri Nov  1 2024 Daniel P. Berrangé <berrange@redhat.com> - 10.9.0-1
- Update to version 10.9.0
-
-* Tue Oct 01 2024 Cole Robinson <crobinso@redhat.com> - 10.8.0-1
- Update to version 10.8.0
-
-* Mon Sep 02 2024 Cole Robinson <crobinso@redhat.com> - 10.7.0-1
- Update to version 10.7.0
+* Thu Sep 12 2024 Dennis Gilmore <dennis@ausil.us> - 10.6.0-3
+- rebuild for updated wireshark

 * Tue Aug 27 2024 Cole Robinson <crobinso@redhat.com> - 10.6.0-2
 - Fix `virsh domifaddr --source=arp` on kernel 6.10 (bz #2302245)
@@ -1 +1 @@
-SHA512 (libvirt-12.0.0.tar.xz) = 5613e4e59865f688fe4cca2734c6de1cf68d0540c6e3013c9c21e583accd4f4fc21ec98e9c794036c5d6d0c8dd05ad1d22dab61f8c7d2934c8cb507b5bee76ad
+SHA512 (libvirt-10.6.0.tar.xz) = edec79e89669d5e9a46be35e0d6334a6ed3bbf32426679549bd998bde24cba52b0378843f41a3abb5d781ad53e2a6a54619a0bad3f168c11fb41736cc6af6568
Author	SHA1	Message	Date
Cole Robinson	5a42f1fcdc	Fix potential dataloss on snapshot deletion Signed-off-by: Cole Robinson <crobinso@redhat.com>	2025-03-05 11:27:07 -05:00
Cole Robinson	b14bf469da	libvirt-10.6.0-6.fc41 Fix DHCP response checksum when using nftables firewall Permit forward mode=open when network has no IP (bz 2255266) Signed-off-by: Cole Robinson <crobinso@redhat.com>	2024-12-14 13:48:38 -05:00
Laine Stump	f2e51513a0	Fix DHCP response checksum when using nftables firewall backend for virtual networks	2024-12-11 15:58:43 -05:00
Cole Robinson	4f3b8e6a17	libvirt-10.6.0-5 Rebuild for new wireshark	2024-09-24 05:18:59 -04:00
David Abdurachmanov	985e71cf0c	Add riscv64 to arches_qemu_kvm Signed-off-by: David Abdurachmanov <davidlt@rivosinc.com>	2024-09-18 15:07:58 +02:00
Dennis Gilmore	c1a7e5f39b	rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark rebuild for updated wireshark Signed-off-by: Dennis Gilmore <dennis@ausil.us>	2024-09-12 08:59:02 -05:00