From patchwork Tue Nov 3 16:16:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10643 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jJtx56T5Wz3x5B for ; Tue, 03 Nov 2026 16:16:25 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jJtwx5nSDz8lM for ; Tue, 03 Nov 2026 16:16:17 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jJtwx4kJJz34bR for ; Tue, 03 Nov 2026 16:16:17 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jJtwv02gYz334m for ; Tue, 03 Nov 2026 16:16:14 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jJtwt22qKz70L; Tue, 03 Nov 2026 16:16:14 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793722574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=a1gaNmMY81Rtt0hriDSp6UGFaSjMzSb6EHRYTeMKABs=; b=3tvKg7F2Zd3oKvilL4S2SZqZoTREVSd8EvoEi9NcdJPhlTgfLaKaGxICcjj46HkGRQBQDr Ne2qJgePwu2f8WBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793722574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=a1gaNmMY81Rtt0hriDSp6UGFaSjMzSb6EHRYTeMKABs=; b=Z67sWyo/a4HrSJvc8vNw/Drrb5dCk5uxYf+/kJG+dNDyUK6GzwsyIK0mxzVeFuuOY9fmW1 Vjh3u5XudKkU2XHEPIzNoSDOe0dSpTDuw3tS05TumcY+XxOJe8bSWEf60k4ajrxR6cq/ba SE3jD4DzySyB8A+AnZ9t31QmlY8MwERb0wbPZRPgf8EllXrFBPzkvRpmOmNvSufJSZdUwY ygbLTADRiYFi+FmB33frGcClSi1Td9SW28i81JZcccSzIH7yuoT2K4rTBQqVzeWsBlhycI H6vbU5/Xu4tQflFcvvuqMwp7A3Y5y9S19wsanrAg7XaabekSd592smbV+ynz8g== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] libvirt: Update to version 12.9.0 Date: Tue, 3 Nov 2026 17:16:08 +0100 Message-ID: <20261103161610.2282465-2-adolf.belka@ipfire.org> In-Reply-To: <20261103161610.2282465-1-adolf.belka@ipfire.org> References: <20261103161610.2282465-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 12.8.0 to 12.9.0 - Update of rootfile - Patch used for version 12.8.0 has now been merged in to tarball. - Changelog 12.9.0 New features * bhyve: support session mode The bhyve driver now supports the session mode: ``bhyve:///session``. It requires bhyve monitor mode support, so at the time of writing it is available to -CURRENT users only. * bhyve: support boot order configuration for disks The bhyve driver now supports boot order configuration for the SATA and VirtIO disks with ````. Now it also uses the QEMU-compatible ``fwcfg`` interface. * bhyve: TPM support The bhyve driver now supports TPM with an external emulator. * bhyve: implement ``virDomainReset()`` The bhyve driver now implements the ``virDomainReset()`` API (accessible via ``virsh reset``). * FreeBSD: support isolated bridge ports libvirt on FreeBSD now supports isolated bridge ports such as:: Improvements * qemu: Emit UNDEFINED event when undefining source after migration After successfully migrating a domain with the ``VIR_MIGRATE_UNDEFINE_SOURCE`` flag, the QEMU driver now emits a ``VIR_DOMAIN_EVENT_UNDEFINED`` lifecycle event on the source host. The event includes the newly added VIR_DOMAIN_EVENT_UNDEFINED_MIGRATED detail. * qemu: report guest reboot as shutdown detail for on_reboot=destroy Libvirt now reports the reason of shutdown event properly. * qemu: Consider vhost net for MSHV accelerator This release enables vhost networking for both KVM and MSHV accelerators. Bug fixes * bhyve: fix shutdown handling on arm64 Signal-based shutdown now correctly handles bhyve terminating directly on arm64, preventing stopped domains from remaining reported as running. * virpci: fix handling newline in PCI device class This releases fixes a regression introduced in ``v12.2.0`` release which kept libvirt unable to parse PCI related files from a sysfs mount, if they contained a newline character. * security: Check if R/O or shared disk is not directory Starting a domain with a read only disk (e.g. cdrom), or attaching one to an already running domain might have resulted in mangled permissions, if a directory was given as the disk source. * esx: Avoid integer overflow in esxDomainGetInfo() The ESX driver implementation for ``virDomainGetInfo()`` API fetches domain memory size and domain max memory size in MiB and then multiplies both values by factor of 1024, since the API reports those sizes in KiB. But these multiplications can overflow and thus report invalid values. An error is reported instead. * conf: Deny negative vcpu count If a negative value was specified for the number of vCPUs in domain XML, libvirt would try to allocate absurdly large amounts of memory which would trigger OOM killer and kill the daemon. Non-positive values are forbidden now. Signed-off-by: Adolf Belka --- config/rootfiles/packages/libvirt | 18 ++- lfs/libvirt | 7 +- ...riority-regardless-of-driver_network.patch | 103 ------------------ 3 files changed, 17 insertions(+), 111 deletions(-) delete mode 100644 src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch diff --git a/config/rootfiles/packages/libvirt b/config/rootfiles/packages/libvirt index 77382d468..5b3cd573f 100644 --- a/config/rootfiles/packages/libvirt +++ b/config/rootfiles/packages/libvirt @@ -52,6 +52,16 @@ etc/logrotate.d/libvirtd etc/logrotate.d/libvirtd.libxl #etc/logrotate.d/libvirtd.lxc etc/logrotate.d/libvirtd.qemu +etc/logrotate.d/virtchd +etc/logrotate.d/virtinterfaced +etc/logrotate.d/virtlockd +etc/logrotate.d/virtlogd +etc/logrotate.d/virtnodedevd +etc/logrotate.d/virtnwfilterd +etc/logrotate.d/virtproxyd +etc/logrotate.d/virtqemud +etc/logrotate.d/virtsecretd +etc/logrotate.d/virtstoraged etc/rc.d/init.d/libvirt-guests etc/rc.d/init.d/libvirtd etc/rc.d/init.d/virtlogd @@ -90,16 +100,16 @@ usr/bin/virt-xml-validate #usr/lib/libvirt #usr/lib/libvirt-admin.so usr/lib/libvirt-admin.so.0 -usr/lib/libvirt-admin.so.0.12008.0 +usr/lib/libvirt-admin.so.0.12009.0 #usr/lib/libvirt-lxc.so usr/lib/libvirt-lxc.so.0 -usr/lib/libvirt-lxc.so.0.12008.0 +usr/lib/libvirt-lxc.so.0.12009.0 #usr/lib/libvirt-qemu.so usr/lib/libvirt-qemu.so.0 -usr/lib/libvirt-qemu.so.0.12008.0 +usr/lib/libvirt-qemu.so.0.12009.0 #usr/lib/libvirt.so usr/lib/libvirt.so.0 -usr/lib/libvirt.so.0.12008.0 +usr/lib/libvirt.so.0.12009.0 #usr/lib/libvirt/connection-driver usr/lib/libvirt/connection-driver/libvirt_driver_ch.so usr/lib/libvirt/connection-driver/libvirt_driver_interface.so diff --git a/lfs/libvirt b/lfs/libvirt index 891286f94..c1a57b6b7 100644 --- a/lfs/libvirt +++ b/lfs/libvirt @@ -26,7 +26,7 @@ include Config SUMMARY = Server side daemon and supporting files for libvirt -VER = 12.8.0 +VER = 12.9.0 THISAPP = libvirt-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) SUP_ARCH = x86_64 aarch64 PROG = libvirt -PAK_VER = 48 +PAK_VER = 49 DEPS = ebtables libpciaccess ovmf swtpm qemu @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3bcef7dc68ff3bd36bd9fff8a537fe3ad0b1e8e53dc43e88541cff1296ed32ec83688cee1123d6d43ba6fdcc0c34bae24afbca50f46c9914e97662e11d7bcb23 +$(DL_FILE)_BLAKE2 = dd74564fe7d60fe52d0f6889f04ed75cb584fe4d18cdd11ae36271aec38a2e315b013d16c108ded9981ee4a80d082fe171330cbfe62755c5489eab2052f393d4 install : $(TARGET) check : $(patsubst %,$(DIR_CHK)/%,$(objects)) @@ -82,7 +82,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/0001-Change-default-behavior-of-libvirt-guests.sh-for-IPF.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch cd $(DIR_APP) && meson setup \ --prefix=/usr \ --localstatedir=/var \ diff --git a/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch b/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch deleted file mode 100644 index 54500d6e3..000000000 --- a/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 135e47348266fa6529db7d135abc9204615137ed Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= - -Date: Fri, 16 Oct 2026 14:40:44 +0200 -Subject: [PATCH] build: set firewall_backend_priority regardless of - driver_network -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Set firewall_backend_priority whenever WITH_NWFILTER or WITH_NETWORK is -set. And similarly, print firewall backends on the same condition. - -Otherwise a build with -Ddriver_network=disabled fails with: - - src/nwfilter/meson.build:51:43: ERROR: Unknown variable "firewall_backend_priority". - -Reviewed-by: Daniel P. Berrangé -Signed-off-by: Marek Marczykowski-Górecki ---- - meson.build | 54 +++++++++++++++++++++++++++-------------------------- - 1 file changed, 28 insertions(+), 26 deletions(-) - -diff --git a/meson.build b/meson.build -index 91547a1cc47..6d5ae23e3eb 100644 ---- a/meson.build -+++ b/meson.build -@@ -1650,31 +1650,6 @@ endif - - if not get_option('driver_network').disabled() and conf.has('WITH_LIBVIRTD') - conf.set('WITH_NETWORK', 1) -- -- firewall_backend_priority = get_option('firewall_backend_priority') -- if firewall_backend_priority.length() == 0 -- if host_machine.system() == 'linux' -- firewall_backend_priority = ['nftables', 'iptables'] -- elif host_machine.system() == 'freebsd' -- firewall_backend_priority = ['pf'] -- else -- # No firewall impl on non-Linux so far, so force 'none' -- # as placeholder -- firewall_backend_priority = ['none'] -- endif -- else -- if host_machine.system() != 'linux' -- error('firewall backend priority only supported on linux hosts') -- endif -- endif -- -- backends = [] -- foreach backend: firewall_backend_priority -- backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper() -- backends += backend -- endforeach -- -- conf.set('FIREWALL_BACKENDS', ', '.join(backends)) - elif get_option('driver_network').enabled() - error('libvirtd must be enabled to build the network driver') - endif -@@ -2035,6 +2010,33 @@ if conf.has('WITH_LIBVIRTD') and host_machine.system() == 'linux' - conf.set('WITH_NWFILTER', 1) - endif - -+if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK') -+ firewall_backend_priority = get_option('firewall_backend_priority') -+ if firewall_backend_priority.length() == 0 -+ if host_machine.system() == 'linux' -+ firewall_backend_priority = ['nftables', 'iptables'] -+ elif host_machine.system() == 'freebsd' -+ firewall_backend_priority = ['pf'] -+ else -+ # No firewall impl on non-Linux so far, so force 'none' -+ # as placeholder -+ firewall_backend_priority = ['none'] -+ endif -+ else -+ if host_machine.system() != 'linux' -+ error('firewall backend priority only supported on linux hosts') -+ endif -+ endif -+ -+ backends = [] -+ foreach backend: firewall_backend_priority -+ backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper() -+ backends += backend -+ endforeach -+ -+ conf.set('FIREWALL_BACKENDS', ', '.join(backends)) -+endif -+ - if not get_option('pm_utils').disabled() - use_pm_utils = true - if init_script == 'systemd' -@@ -2373,7 +2375,7 @@ misc_summary = { - 'virt-login-shell': conf.has('WITH_LOGIN_SHELL'), - 'Warning Flags': supported_cc_flags, - } --if conf.has('WITH_NETWORK') -+if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK') - misc_summary += { - 'firewall backends': firewall_backend_priority, - } -