From patchwork Sat Oct 24 20:22:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10477 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jBrtN2Rpkz3wqs for ; Sat, 24 Oct 2026 20:23:08 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jBrtN0M33z6bV for ; Sat, 24 Oct 2026 20:23:08 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jBrtL078Fz378L for ; Sat, 24 Oct 2026 20:23:06 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jBrtH1p14z36Wf for ; Sat, 24 Oct 2026 20:23:03 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jBrtG3YKjz5QN; Sat, 24 Oct 2026 20:23:02 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1792873382; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9CTC2zzzKHPjqsbP7QtKpK2XttAySbq0VujYqVwOiLc=; b=bfC12gQEw7BeQDx7wL2DWwc7oFxKAm8o4+vul+XOE0MSV5oD4PqlGh4m8Ly+271LOqahN9 sVuwu+5Cn5lxzCCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1792873382; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9CTC2zzzKHPjqsbP7QtKpK2XttAySbq0VujYqVwOiLc=; b=A5wyqzGuBj53Wn2DSRt4RuKMOSnkeMoF+brI8nHiEP32XTPoUDBjwseVIP27bg335UCuIY WJkNoZsVnoBHXzM242gKxlmCiyGfSVvhlSfOVeBfrt8McU46lHrozqEjPGNll0Yxyai738 8fqF3MKFF8ZX1IUwtonVozxCejh7qBcPdb+CzXP3FinGa7WvNIO2EBXPhGTkS4/Idwwn5d KMTidqYeuvYXAIYo6srD4yRfxj37CsnY96Ttgns6NWU1Xg2wOO/6WwGhAaez5pfA8MWML5 aNW8fEt+e5xwNrRYSKdZ3df2/pRx4N3zAV/JvxJZxc/alqMesdJWeoagKhgJAQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] libvirt: Update to version 12.8.0 Date: Sat, 24 Oct 2026 22:22:39 +0200 Message-ID: <20261024202246.2358763-4-adolf.belka@ipfire.org> In-Reply-To: <20261024202246.2358763-1-adolf.belka@ipfire.org> References: <20261024202246.2358763-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 12.3.0 to 12.8.0 - Update of rootfile - Addition of patch to solve build issue - 3 CVE fixes in 12.7.0 - Changelog 12.8.0 New features** * resctrl: Support whole-process allocations and monitoring ``cachetune``, ``memorytune`` and ``energytune`` can now apply to the entire QEMU process. Monitors without a ``vcpus`` attribute inherit the enclosing scope. This enables whole-VM resctrl allocations and monitoring. * qemu: Add ``auto_dump_max_size`` to cap the size of auto-triggered dumps A guest that keeps crashing fills ``auto_dump_path`` one dump at a time. The new ``auto_dump_max_size`` setting in qemu.conf bounds the total size those dumps may occupy, pruning the oldest after each new one. It takes a byte count or a size such as ``"10GiB"``; 0, the default, keeps them all. * FreeBSD: support VLAN configuration on bridges libvirt on FreeBSD now supports VLAN configurations such as:: It also supports ``macTableManager='libvirt'`` bridge configuration for networks (requires FreeBSD 15.0 or newer). * bhyve: implement ``virDomainSetLifecycleAction()`` API The bhyve driver now implements the ``virDomainSetLifecycleAction()`` API (accessible via ``virsh set-lifecycle-action``). Improvements** * qemu: Select the win-dmp format for Windows guest crash dumps Dumps triggered by ```` and by watchdog handling used QEMU's elf default, which WinDbg cannot load. Where QEMU reports the format as available only to a guest that can use it, such dumps are now written in win-dmp format instead. * logging: ``max_size`` in virtlogd.conf accepts a unit suffix The setting now takes a size such as ``"2MiB"`` as well as a plain byte count. Bug fixes** * qemu: Fix resctrl monitor statistics reporting Statistics now use the correct monitor group names and omit nonexistent cache monitor data. * bhyve: fixes for transient/persistent domain handling and leftover TAP devices A few issues related to transient and persistent domain handling were fixed. Additionally, error handling bugs in the network interfaces management code were fixed so it does not leave dangling TAP interfaces on errors. 12.7.0 Security** * CVE-2026-18917: Integer overflow in RPC handler for ``virNodeGetFreePages`` The RPC handler for ``virNodeGetFreePages`` didn't properly check for overflows in multiplication of integers when calculating the amount of returned data for validation and allocation of the return buffer. Specific values could thus pass validation and cause an undersized buffer to be allocated. The hypervisor driver would then fill the undersized buffer based on the values prior to multiplication and thus cause a write beyond the end of the allocated buffer. This bug can be triggered via a read-only connection. * CVE-2026-77158: Double free of disks array in ``qemuAgentGetDisks`` The qemu hypervisor driver would double-free the array of parsed disks, on error code paths leading to crash of the daemon. The error code path could be reached when the qemu guest agent provided malformed data as response to the ``guest-get-disks`` command. * CVE-2026-77159: ``chown()`` of swtpm log file follows symlinks When starting up a VM with a ``swtpm`` device configured, libvirt ``chown()``-s the log file of swtpm to the (unprivileged) user/group running the swtpm process. The problem is that the directory containing the log files is also owned by the same user/group, thus users with access to that directory could install a symlink to a privileged file that the libvirt daemon would follow and chown the file pointed to. New features** * bhyve: implement ``virDomainGetGuestInfo()`` and ``virDomainAgentSetResponseTimeout()`` APIs The bhyve driver now implements ``virDomainGetGuestInfo()`` which returns information about the guest, and ``virDomainAgentSetResponseTimeout()`` which sets the guest agent response timeout. * bhyve: allow setting disk serial numbers The bhyve driver now allows specifying ```` for SATA disks and NVMe controllers:: BHYVE-SER01-0001 BHYVE-NVME0-01234 It also supports specifying ```` for NVMe disks:: 01000000efbeadde * qemu: Add poll-weight support for iothreads The qemu driver now supports the iothread poll-weight property, which controls the weight of the most recent event interval in the adaptive polling duration calculation. * Add guest device info to ``virDomainGetGuestInfo()`` QEMU guest agent has 'guest-get-devices` command, which returns information on guest devices (driver name, version, release date, and so on). This is now exposed via ``virDomainGetGuestInfo()`` API (accessible via ``guestinfo --devices`` virsh command). Bug fixes** * bhyve: fix domain API calls hanging after domain shutdown * remote: Fix stale virStream status In a few cases it might happen that daemon held incorrect state of a virStream leading to an infinite loop. This is now fixed. * esx: Don't crash when parsing unmounted datastore When libvirt constructs domain XML for an ESX domain it traverses through all datastores to find which one stores disks for the domain. But if a datastore wasn't mounted, then a crash would occur. This is now fixed. * virsh: Don't crash when certain error messages are printed A bug in the error printing function could cause ``virsh`` to crash when certain errors (e.g. disk not found in ``virsh detach-disk``) were being reported. 12.6.0 New features** * bhyve: implement ``virDomainRename()`` The bhyve driver now implements the ``virDomainRename()`` API for renaming of a domain (``virsh domrename``). * build: Add option to control building libvirtd Meson option ``libvirtd`` has been added to control building the monolithic libvirtd, independent from the stateful, daemon-based drivers. * sanlock: Add option to check ownership of disk leases The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` setting in sanlock.conf. When enabled, the sanlock plugin will check that leases are owned by the domain attempting to acquire them. Improvements** * qemu: Add ``preserve-running`` action for ```` Allow qemu VMs to be kept running after they notify that they've crashed. This is useful for guests that can take their own crash dump and reboot. 12.5.0 New features** * bhyve: Extend the guest agent support The bhyve driver now supports several APIs on top of the guest agent: * Getting and setting guest OS SSH keys * Setting guest OS user's password * Getting and setting guest OS time Additionally, domain rebooting and shutting down using the agent is now supported. * bhyve: Support ``on_reboot`` and ``on_poweroff`` actions The bhyve driver now respects the domain's ``on_reboot`` and ``on_poweroff`` actions. * bhyve: Support populating SMBIOS fields Add support for populating the SMBIOS fields as defined by the ```` section of the domain's XML. * qemu: Add support for standalone VNC server Starting with this release, libvirt might spawn a standalone qemu-vnc process instead of QEMU's built-in VNC server, for enhanced security. Improvements** * Enable hyperv driver on RHEL The spec file now enables the Hyper-V driver when building on Red Hat Enterprise Linux. * remote: allow passing argv to the ext transport The ext transport not only allows spawning a process (via the ``command`` attribute), but as of this release also specifying additional arguments to it, via ``argv`` attribute. * Introduce ``VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES`` flag Some CPU features may be enabled explicitly, but should not automatically become part of a host-model CPU and thus are not normally visible in domain capabilities. Users can now request such features to be shown in the host-model CPU in domain capabilities using the new flag. It is exposed as ``--supported-cpu-features`` option for ``virsh domcapabilities``. Bug fixes** * Ensure proper shutdown ordering of ``virtlogd`` and ``virtlockd`` The logging and locking helper daemons now shutdown after the daemon running the ``qemu`` hypervisor driver since their services may be needed to shutdown the VMs run by the qemu driver. * qemu: Record selected ``virtio`` video device model into the XML The ``qemu`` driver may depending on platform and installed QEMU modules pick one of two distinct virtio video device types for the primary device. The choice was not recorded in the XML and since the devices are incompatible it can cause failures on migration when the destination picks the wrong device. This version thus records the picked device both for running VMs on upgrade and for new devices to prevent this problem in the future. * bhyve: Guest agent related fixes A few bugs related to the guest agent communication are fixed, from not properly initializing an agent to crashing when the agent socket cannot be opened. * Fix domain capabilities on AMD CPUs QEMU 10.1 and newer does not automatically enable features from arch-capabilities MSR on AMD CPUs as they are specific for Intel CPUs and KVM is just emulating them on AMD. But advertising them on AMD CPUs can cause Windows guest OS to crash so they are hidden by default now. But the features are still supported and can be enabled explicitly, for example, when migrating existing domains. Libvirt now detects this scenario and properly shows the affected features as enabled in domain capabilities when requested by ``VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES`` flag. * vmx: Properly show all 64 disks on a SCSI controller Due to an off-by-one error a last, 64th disk was not shown in a domain XML, which is now fixed. 12.4.0 Removed features** * qemu: Bump minimum version to QEMU-7.2 The minimal required version of QEMU was bumped to 7.2.0. New features** * resctrl: Add energy monitoring via resctrl's PERF_PKG_MON Add support for Linux kernel 7.0 feature - energy monitoring via resctrl. This allows to monitor per-VM energy consumption on supported platforms. Implemented via ``energytune`` element in ``cputune`` . * Add channel lifecycle domain event Add support for a new domain event which can be used to track the state of any virtio channel. It is similar to guest agent lifecycle event. * bhyve: Add memory tuning support The bhyve driver now allows setting a domain's memory hard limit using the following syntax:: 1 It also implements the ``virDomainGetMemoryParameters()`` and ``virDomainSetMemoryParameters()`` APIs for controlling the memory hard limit of a running domain. * bhyve: Add virtio-console device support Domain XML can now use ``virtio-console`` devices. Among other things, these devices can be used to configure a QEMU Guest Agent::
Additionally, the ``virDomainQemuAgentCommand()`` API which allows running arbitrary guest agent commands is now supported. The ``virDomainGetHostname()`` API, used to query the hostname of a guest, now supports using the guest agent as a source of information. Improvements** * vircgroupv2: Implement freezer controller The CGroupV2 code now supports freezer controller which allows suspending and resuming of LXC domains. * virnetdevbandwidth: Only clear qdisc for defined directions Setting a QoS on a vNIC no longer leads to clearing (preconfigured) root queuing discipline ('qdisc`) in both directions (egress, ingress), only the affected one. Bug fixes** * storage: ZFS: Fix incorrect volsize and refreservation on zvol creation When creating a zvol, the ZFS driver listed all volumes in the pool and updated the new volume's size with data from the last volume in the list rather than the matching one. Now it correctly returns on valid one. * esx/vmware: VMs are tracked under different UUIDs by default The VMWare-related drivers were using allegedly unique IDs for domains, but it turned out they were not completely unique, even for the same host. That caused an issue where a different domain could have been acted upon then requested. Unfortunately, to make this work, the UUIDs of all VMWare-related domains will change from this release. In order to use the pre-v12.4.0 behaviour there is a new URI query parameter ``legacy_uuid`` which, if set to ``1``, will revert to the older way of working. * virsh: Provide no auth callbacks for bash completer The bash completer script calls virsh to provide completions. In some cases the underlying virsh might get stuck waiting on input (e.g. password for SSH session). Not anymore. * virauth: Verify virConnectAuth::cb is set in virAuthGetPasswordPath() A check was missing in ``virAuthGetPasswordPath()`` which might lead to crash of the client library when NULL callback was provided. This is now fixed. Signed-off-by: Adolf Belka --- config/rootfiles/packages/libvirt | 24 +++- lfs/libvirt | 9 +- ...riority-regardless-of-driver_network.patch | 103 ++++++++++++++++++ 3 files changed, 126 insertions(+), 10 deletions(-) create mode 100644 src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch diff --git a/config/rootfiles/packages/libvirt b/config/rootfiles/packages/libvirt index 18bbbb4cc..77382d468 100644 --- a/config/rootfiles/packages/libvirt +++ b/config/rootfiles/packages/libvirt @@ -4,6 +4,7 @@ etc/libvirt/libvirt-admin.conf etc/libvirt/libvirt.conf etc/libvirt/libvirtd.conf #etc/libvirt/nwfilter +#etc/libvirt/nwfilter.conf #etc/libvirt/nwfilter/allow-arp.xml #etc/libvirt/nwfilter/allow-dhcp-server.xml #etc/libvirt/nwfilter/allow-dhcp.xml @@ -89,16 +90,16 @@ usr/bin/virt-xml-validate #usr/lib/libvirt #usr/lib/libvirt-admin.so usr/lib/libvirt-admin.so.0 -usr/lib/libvirt-admin.so.0.12003.0 +usr/lib/libvirt-admin.so.0.12008.0 #usr/lib/libvirt-lxc.so usr/lib/libvirt-lxc.so.0 -usr/lib/libvirt-lxc.so.0.12003.0 +usr/lib/libvirt-lxc.so.0.12008.0 #usr/lib/libvirt-qemu.so usr/lib/libvirt-qemu.so.0 -usr/lib/libvirt-qemu.so.0.12003.0 +usr/lib/libvirt-qemu.so.0.12008.0 #usr/lib/libvirt.so usr/lib/libvirt.so.0 -usr/lib/libvirt.so.0.12003.0 +usr/lib/libvirt.so.0.12008.0 #usr/lib/libvirt/connection-driver usr/lib/libvirt/connection-driver/libvirt_driver_ch.so usr/lib/libvirt/connection-driver/libvirt_driver_interface.so @@ -120,8 +121,6 @@ usr/lib/libvirt/storage-backend/libvirt_storage_backend_vstorage.so #usr/lib/pkgconfig/libvirt.pc #usr/lib/sysctl.d usr/lib/sysctl.d/60-libvirtd.conf -#usr/lib/systemd/system/libvirtd.service.d -#usr/lib/systemd/system/libvirtd.service.d/10-secret.conf #usr/lib/sysusers.d usr/lib/sysusers.d/libvirt-login-shell.conf usr/lib/sysusers.d/libvirt-qemu.conf @@ -146,12 +145,14 @@ usr/sbin/virtstoraged #usr/share/augeas/lenses/libvirt_secrets.aug #usr/share/augeas/lenses/libvirtd.aug #usr/share/augeas/lenses/libvirtd_ch.aug +#usr/share/augeas/lenses/libvirtd_nwfilter.aug #usr/share/augeas/lenses/libvirtd_qemu.aug #usr/share/augeas/lenses/tests #usr/share/augeas/lenses/tests/test_libvirt_lockd.aug #usr/share/augeas/lenses/tests/test_libvirt_secrets.aug #usr/share/augeas/lenses/tests/test_libvirtd.aug #usr/share/augeas/lenses/tests/test_libvirtd_ch.aug +#usr/share/augeas/lenses/tests/test_libvirtd_nwfilter.aug #usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug #usr/share/augeas/lenses/tests/test_virtchd.aug #usr/share/augeas/lenses/tests/test_virtinterfaced.aug @@ -236,6 +237,7 @@ usr/share/libvirt/cpu_map/arm_Kunpeng-920.xml usr/share/libvirt/cpu_map/arm_Neoverse-N1.xml usr/share/libvirt/cpu_map/arm_Neoverse-N2.xml usr/share/libvirt/cpu_map/arm_Neoverse-V1.xml +usr/share/libvirt/cpu_map/arm_Neoverse-V2.xml usr/share/libvirt/cpu_map/arm_Tengyun-S2500.xml usr/share/libvirt/cpu_map/arm_ThunderX299xx.xml usr/share/libvirt/cpu_map/arm_a64fx.xml @@ -272,6 +274,8 @@ usr/share/libvirt/cpu_map/x86_Cascadelake-Server-v4.xml usr/share/libvirt/cpu_map/x86_Cascadelake-Server-v5.xml usr/share/libvirt/cpu_map/x86_Cascadelake-Server.xml usr/share/libvirt/cpu_map/x86_ClearwaterForest-v1.xml +usr/share/libvirt/cpu_map/x86_ClearwaterForest-v2.xml +usr/share/libvirt/cpu_map/x86_ClearwaterForest-v3.xml usr/share/libvirt/cpu_map/x86_ClearwaterForest.xml usr/share/libvirt/cpu_map/x86_Conroe-v1.xml usr/share/libvirt/cpu_map/x86_Conroe.xml @@ -285,6 +289,8 @@ usr/share/libvirt/cpu_map/x86_Denverton.xml usr/share/libvirt/cpu_map/x86_Dhyana-v1.xml usr/share/libvirt/cpu_map/x86_Dhyana-v2.xml usr/share/libvirt/cpu_map/x86_Dhyana.xml +usr/share/libvirt/cpu_map/x86_DiamondRapids-v1.xml +usr/share/libvirt/cpu_map/x86_DiamondRapids.xml usr/share/libvirt/cpu_map/x86_EPYC-Genoa-v1.xml usr/share/libvirt/cpu_map/x86_EPYC-Genoa-v2.xml usr/share/libvirt/cpu_map/x86_EPYC-Genoa.xml @@ -310,6 +316,8 @@ usr/share/libvirt/cpu_map/x86_EPYC.xml usr/share/libvirt/cpu_map/x86_GraniteRapids-v1.xml usr/share/libvirt/cpu_map/x86_GraniteRapids-v2.xml usr/share/libvirt/cpu_map/x86_GraniteRapids-v3.xml +usr/share/libvirt/cpu_map/x86_GraniteRapids-v4.xml +usr/share/libvirt/cpu_map/x86_GraniteRapids-v5.xml usr/share/libvirt/cpu_map/x86_GraniteRapids.xml usr/share/libvirt/cpu_map/x86_Haswell-IBRS.xml usr/share/libvirt/cpu_map/x86_Haswell-noTSX-IBRS.xml @@ -360,10 +368,14 @@ usr/share/libvirt/cpu_map/x86_SapphireRapids-v1.xml usr/share/libvirt/cpu_map/x86_SapphireRapids-v2.xml usr/share/libvirt/cpu_map/x86_SapphireRapids-v3.xml usr/share/libvirt/cpu_map/x86_SapphireRapids-v4.xml +usr/share/libvirt/cpu_map/x86_SapphireRapids-v5.xml +usr/share/libvirt/cpu_map/x86_SapphireRapids-v6.xml usr/share/libvirt/cpu_map/x86_SapphireRapids.xml usr/share/libvirt/cpu_map/x86_SierraForest-v1.xml usr/share/libvirt/cpu_map/x86_SierraForest-v2.xml usr/share/libvirt/cpu_map/x86_SierraForest-v3.xml +usr/share/libvirt/cpu_map/x86_SierraForest-v4.xml +usr/share/libvirt/cpu_map/x86_SierraForest-v5.xml usr/share/libvirt/cpu_map/x86_SierraForest.xml usr/share/libvirt/cpu_map/x86_Skylake-Client-IBRS.xml usr/share/libvirt/cpu_map/x86_Skylake-Client-noTSX-IBRS.xml diff --git a/lfs/libvirt b/lfs/libvirt index 7a879924d..891286f94 100644 --- a/lfs/libvirt +++ b/lfs/libvirt @@ -26,7 +26,7 @@ include Config SUMMARY = Server side daemon and supporting files for libvirt -VER = 12.3.0 +VER = 12.8.0 THISAPP = libvirt-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) SUP_ARCH = x86_64 aarch64 PROG = libvirt -PAK_VER = 47 +PAK_VER = 48 DEPS = ebtables libpciaccess ovmf swtpm qemu @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a6b2cd5de3f9cd81b8dadc8193c6bd12a018d8c4a6b175168a81988224a66f8e3ab28a2dccc441f8867b896271f6c3fa640cd456af07c64784b4adda5cea8e35 +$(DL_FILE)_BLAKE2 = 3bcef7dc68ff3bd36bd9fff8a537fe3ad0b1e8e53dc43e88541cff1296ed32ec83688cee1123d6d43ba6fdcc0c34bae24afbca50f46c9914e97662e11d7bcb23 install : $(TARGET) check : $(patsubst %,$(DIR_CHK)/%,$(objects)) @@ -82,7 +82,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/0001-Change-default-behavior-of-libvirt-guests.sh-for-IPF.patch - cd $(DIR_APP) && meson \ + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch + cd $(DIR_APP) && meson setup \ --prefix=/usr \ --localstatedir=/var \ --sysconfdir=/etc \ diff --git a/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch b/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch new file mode 100644 index 000000000..54500d6e3 --- /dev/null +++ b/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch @@ -0,0 +1,103 @@ +From 135e47348266fa6529db7d135abc9204615137ed Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= + +Date: Fri, 16 Oct 2026 14:40:44 +0200 +Subject: [PATCH] build: set firewall_backend_priority regardless of + driver_network +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Set firewall_backend_priority whenever WITH_NWFILTER or WITH_NETWORK is +set. And similarly, print firewall backends on the same condition. + +Otherwise a build with -Ddriver_network=disabled fails with: + + src/nwfilter/meson.build:51:43: ERROR: Unknown variable "firewall_backend_priority". + +Reviewed-by: Daniel P. Berrangé +Signed-off-by: Marek Marczykowski-Górecki +--- + meson.build | 54 +++++++++++++++++++++++++++-------------------------- + 1 file changed, 28 insertions(+), 26 deletions(-) + +diff --git a/meson.build b/meson.build +index 91547a1cc47..6d5ae23e3eb 100644 +--- a/meson.build ++++ b/meson.build +@@ -1650,31 +1650,6 @@ endif + + if not get_option('driver_network').disabled() and conf.has('WITH_LIBVIRTD') + conf.set('WITH_NETWORK', 1) +- +- firewall_backend_priority = get_option('firewall_backend_priority') +- if firewall_backend_priority.length() == 0 +- if host_machine.system() == 'linux' +- firewall_backend_priority = ['nftables', 'iptables'] +- elif host_machine.system() == 'freebsd' +- firewall_backend_priority = ['pf'] +- else +- # No firewall impl on non-Linux so far, so force 'none' +- # as placeholder +- firewall_backend_priority = ['none'] +- endif +- else +- if host_machine.system() != 'linux' +- error('firewall backend priority only supported on linux hosts') +- endif +- endif +- +- backends = [] +- foreach backend: firewall_backend_priority +- backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper() +- backends += backend +- endforeach +- +- conf.set('FIREWALL_BACKENDS', ', '.join(backends)) + elif get_option('driver_network').enabled() + error('libvirtd must be enabled to build the network driver') + endif +@@ -2035,6 +2010,33 @@ if conf.has('WITH_LIBVIRTD') and host_machine.system() == 'linux' + conf.set('WITH_NWFILTER', 1) + endif + ++if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK') ++ firewall_backend_priority = get_option('firewall_backend_priority') ++ if firewall_backend_priority.length() == 0 ++ if host_machine.system() == 'linux' ++ firewall_backend_priority = ['nftables', 'iptables'] ++ elif host_machine.system() == 'freebsd' ++ firewall_backend_priority = ['pf'] ++ else ++ # No firewall impl on non-Linux so far, so force 'none' ++ # as placeholder ++ firewall_backend_priority = ['none'] ++ endif ++ else ++ if host_machine.system() != 'linux' ++ error('firewall backend priority only supported on linux hosts') ++ endif ++ endif ++ ++ backends = [] ++ foreach backend: firewall_backend_priority ++ backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper() ++ backends += backend ++ endforeach ++ ++ conf.set('FIREWALL_BACKENDS', ', '.join(backends)) ++endif ++ + if not get_option('pm_utils').disabled() + use_pm_utils = true + if init_script == 'systemd' +@@ -2373,7 +2375,7 @@ misc_summary = { + 'virt-login-shell': conf.has('WITH_LOGIN_SHELL'), + 'Warning Flags': supported_cc_flags, + } +-if conf.has('WITH_NETWORK') ++if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK') + misc_summary += { + 'firewall backends': firewall_backend_priority, + } +