[libvirt][PATCH v8 0/5] Support query and use SGX
by Haibin Huang
This patch series provides support for enabling Intel's Software Guard Extensions (SGX)
feature in guest VM.
Giving the SGX support in QEMU be accepted and will be merged in two days Intel
Software Guard Extensions (Intel SGX) is a set of instructions that increases the security
of application code and data, giving them more protection from disclosure or modification.
Developers can partition sensitive information into enclaves, which are areas of execution
in memory with more security protection.
The typical flow looks below at very high level:
1. Calls virConnectGetDomainCapabilities API to domain capabilities that
includes the following SGX information.
<feature>
...
<sgx supported='yes'>
<epc_size unit='KiB'>N</epc_size>
</sgx>
</feature>
2. User requests to start a guest calling virCreateXML() with SGX requirement.
It should contain
<devices>
...
<memory model='sgx-epc'>
<target>
<size unit='KiB'>N</size>
</target>
</memory>
...
</devices>
Haibin Huang (2):
Get SGX Capabilities from QEMU
Transfer Qemu SGX Capabilities to XML
Lin Yang (3):
conf: Introduce SGX EPC element into device memory xml
qemu: Add command-line to generate SGX EPC memory backend
Add unit tests for guest VM creation command with SGX EPC
docs/schemas/domaincaps.rng | 22 ++-
docs/schemas/domaincommon.rng | 1 +
src/conf/domain_capabilities.c | 29 ++++
src/conf/domain_capabilities.h | 13 ++
src/conf/domain_conf.c | 6 +
src/conf/domain_conf.h | 1 +
src/conf/domain_validate.c | 1 +
src/libvirt_private.syms | 1 +
src/qemu/qemu_alias.c | 6 +-
src/qemu/qemu_capabilities.c | 143 +++++++++++++++++-
src/qemu/qemu_capabilities.h | 4 +
src/qemu/qemu_command.c | 41 ++++-
src/qemu/qemu_domain.c | 12 +-
src/qemu/qemu_domain_address.c | 6 +
src/qemu/qemu_driver.c | 1 +
src/qemu/qemu_monitor.c | 10 ++
src/qemu/qemu_monitor.h | 3 +
src/qemu/qemu_monitor_json.c | 83 ++++++++++
src/qemu/qemu_monitor_json.h | 3 +
src/qemu/qemu_process.c | 2 +
src/qemu/qemu_validate.c | 8 +
src/security/security_apparmor.c | 1 +
src/security/security_dac.c | 2 +
src/security/security_selinux.c | 2 +
tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 +
tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 +
tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 +
tests/domaincapsdata/empty.xml | 1 +
tests/domaincapsdata/libxl-xenfv.xml | 1 +
tests/domaincapsdata/libxl-xenpv.xml | 1 +
.../domaincapsdata/qemu_2.11.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.11.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 1 +
.../qemu_2.12.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_2.12.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_2.12.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.4.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.4.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.5.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.5.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.6.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml | 1 +
.../qemu_2.6.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_2.6.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_2.6.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_2.6.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.7.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.7.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.7.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.8.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.8.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.8.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.9.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_2.9.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_2.9.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.9.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_3.0.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_3.0.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_3.0.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_3.1.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_3.1.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_3.1.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.0.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml | 1 +
.../qemu_4.0.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_4.0.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_4.0.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_4.0.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.1.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_4.1.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 +
.../qemu_4.2.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 +
.../qemu_5.0.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_5.1.0.sparc.xml | 1 +
tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 +
.../qemu_5.2.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 +
tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 +
.../qemu_6.0.0-virt.aarch64.xml | 1 +
tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 +
tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 +
.../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 +
tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 +
.../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 4 +
.../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 4 +
tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 4 +
.../caps_6.2.0.x86_64.replies | 22 ++-
.../caps_6.2.0.x86_64.xml | 5 +
.../sgx-epc.x86_64-6.2.0.args | 37 +++++
tests/qemuxml2argvdata/sgx-epc.xml | 36 +++++
tests/qemuxml2argvtest.c | 2 +
126 files changed, 597 insertions(+), 12 deletions(-)
create mode 100644 tests/qemuxml2argvdata/sgx-epc.x86_64-6.2.0.args
create mode 100644 tests/qemuxml2argvdata/sgx-epc.xml
--
2.17.1
2 years, 11 months
[libvirt PATCH 00/20] use g_auto for virCommand (Episode II: The Sequel)
by Ján Tomko
TBD: docs/ and src/util
Ján Tomko (20):
openvz: refactor openvzExtractVersionInfo
openvz: refactor openvzLoadDomains
openvz: refactor openvzGetVEID
openvz: refactor openvzDomainDefineCmd
openvz: refactor openvzSetInitialConfig
openvz: refactor openvzSetDiskQuota
openvz: refactor openvzDomainSetNetwork
openvz: refactor openvzConnectListDomains
openvz: refactor openvzConnectListDefinedDomains
openvz: refactor openvzDomainGetBarrierLimit
openvz: refactor openvzDomainSetBarrierLimit
openvz: refactor openvzGetVEStatus
openvz: use g_auto in openvzDomainMigratePerform3Params
openvz: refactor openvzVEGetStringParam
vz: utils: use g_auto for virCommand
vmware: refactor vmwareUpdateVMStatus
vmware: use g_auto in vmwareLoadDomains
vmware: refactor vmwareExtractVersion
tests: use g_auto in testCompareXMLToConfFiles
tests: storagevolxml2argvtest: do not reuse cmd
src/openvz/openvz_conf.c | 62 ++++-------
src/openvz/openvz_driver.c | 197 +++++++++++++--------------------
src/openvz/openvz_util.c | 23 ++--
src/vmware/vmware_conf.c | 33 ++----
src/vmware/vmware_driver.c | 19 +---
src/vz/vz_utils.c | 3 +-
tests/networkxml2conftest.c | 5 +-
tests/storagevolxml2argvtest.c | 4 +-
8 files changed, 125 insertions(+), 221 deletions(-)
--
2.31.1
2 years, 11 months
[PATCH] conf: Turn virDomainDef.kvm_features into a struct
by Michal Privoznik
In future commits we will need to store not just an array of
VIR_TRISTATE_SWITCH_* but also an additional integer. Follow the
example of TCG and introduce a structure where both the array an
integer can live.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/conf/domain_conf.c | 20 +++++++++++++-------
src/conf/domain_conf.h | 7 ++++++-
src/qemu/qemu_command.c | 8 ++++----
3 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index b6249aa76f..07cbfa24bc 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -3713,6 +3713,7 @@ void virDomainDefFree(virDomainDef *def)
g_free(def->emulator);
g_free(def->description);
g_free(def->title);
+ g_free(def->kvm_features);
g_free(def->hyperv_vendor_id);
g_free(def->tcg_features);
@@ -17532,7 +17533,9 @@ static int
virDomainFeaturesKVMDefParse(virDomainDef *def,
xmlNodePtr node)
{
- def->features[VIR_DOMAIN_FEATURE_KVM] = VIR_TRISTATE_SWITCH_ON;
+ g_autofree virDomainFeatureKVM *kvm = NULL;
+
+ kvm = g_new0(virDomainFeatureKVM, 1);
node = xmlFirstElementChild(node);
while (node) {
@@ -17551,11 +17554,14 @@ virDomainFeaturesKVMDefParse(virDomainDef *def,
&value) < 0)
return -1;
- def->kvm_features[feature] = value;
+ kvm->features[feature] = value;
node = xmlNextElementSibling(node);
}
+ def->features[VIR_DOMAIN_FEATURE_KVM] = VIR_TRISTATE_SWITCH_ON;
+ def->kvm_features = g_steal_pointer(&kvm);
+
return 0;
}
@@ -21803,13 +21809,13 @@ virDomainDefFeaturesCheckABIStability(virDomainDef *src,
case VIR_DOMAIN_KVM_DEDICATED:
case VIR_DOMAIN_KVM_POLLCONTROL:
case VIR_DOMAIN_KVM_PVIPI:
- if (src->kvm_features[i] != dst->kvm_features[i]) {
+ if (src->kvm_features->features[i] != dst->kvm_features->features[i]) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("State of KVM feature '%s' differs: "
"source: '%s', destination: '%s'"),
virDomainKVMTypeToString(i),
- virTristateSwitchTypeToString(src->kvm_features[i]),
- virTristateSwitchTypeToString(dst->kvm_features[i]));
+ virTristateSwitchTypeToString(src->kvm_features->features[i]),
+ virTristateSwitchTypeToString(dst->kvm_features->features[i]));
return false;
}
@@ -27873,11 +27879,11 @@ virDomainDefFormatFeatures(virBuffer *buf,
case VIR_DOMAIN_KVM_DEDICATED:
case VIR_DOMAIN_KVM_POLLCONTROL:
case VIR_DOMAIN_KVM_PVIPI:
- if (def->kvm_features[j])
+ if (def->kvm_features->features[j])
virBufferAsprintf(&childBuf, "<%s state='%s'/>\n",
virDomainKVMTypeToString(j),
virTristateSwitchTypeToString(
- def->kvm_features[j]));
+ def->kvm_features->features[j]));
break;
case VIR_DOMAIN_KVM_LAST:
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index b410922f68..5613d621bb 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -2263,6 +2263,11 @@ typedef enum {
VIR_ENUM_DECL(virDomainIBS);
+typedef struct _virDomainFeatureKVM virDomainFeatureKVM;
+struct _virDomainFeatureKVM {
+ int features[VIR_DOMAIN_KVM_LAST];
+};
+
typedef struct _virDomainFeatureTCG virDomainFeatureTCG;
struct _virDomainFeatureTCG {
unsigned long long tb_cache; /* Stored in KiB */
@@ -2819,7 +2824,7 @@ struct _virDomainDef {
int features[VIR_DOMAIN_FEATURE_LAST];
int caps_features[VIR_DOMAIN_PROCES_CAPS_FEATURE_LAST];
int hyperv_features[VIR_DOMAIN_HYPERV_LAST];
- int kvm_features[VIR_DOMAIN_KVM_LAST];
+ virDomainFeatureKVM *kvm_features;
int msrs_features[VIR_DOMAIN_MSRS_LAST];
int xen_features[VIR_DOMAIN_XEN_LAST];
virDomainXenPassthroughMode xen_passthrough_mode;
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index ce22372749..7cdec9f910 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -6765,22 +6765,22 @@ qemuBuildCpuCommandLine(virCommand *cmd,
for (i = 0; i < VIR_DOMAIN_KVM_LAST; i++) {
switch ((virDomainKVM) i) {
case VIR_DOMAIN_KVM_HIDDEN:
- if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON)
+ if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON)
virBufferAddLit(&buf, ",kvm=off");
break;
case VIR_DOMAIN_KVM_DEDICATED:
- if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON)
+ if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON)
virBufferAddLit(&buf, ",kvm-hint-dedicated=on");
break;
case VIR_DOMAIN_KVM_POLLCONTROL:
- if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON)
+ if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON)
virBufferAddLit(&buf, ",kvm-poll-control=on");
break;
case VIR_DOMAIN_KVM_PVIPI:
- if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_OFF)
+ if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_OFF)
virBufferAddLit(&buf, ",kvm-pv-ipi=off");
break;
--
2.32.0
2 years, 11 months
[libvirt PATCH] examples: hellolibvirt: fix argc check
by Ján Tomko
https://gitlab.com/libvirt/libvirt/-/issues/255
Reported-by: Jeremy Alcim
Signed-off-by: Ján Tomko <jtomko(a)redhat.com>
---
Pushed as trivial.
examples/c/misc/hellolibvirt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/examples/c/misc/hellolibvirt.c b/examples/c/misc/hellolibvirt.c
index a598e01be2..39cefe934c 100644
--- a/examples/c/misc/hellolibvirt.c
+++ b/examples/c/misc/hellolibvirt.c
@@ -107,11 +107,12 @@ main(int argc, char *argv[])
{
int ret = 0;
virConnectPtr conn;
- char *uri;
+ char *uri = NULL;
printf("Attempting to connect to hypervisor\n");
- uri = (argc > 0 ? argv[1] : NULL);
+ if (argc > 1)
+ uri = argv[1];
/* virConnectOpenAuth is called here with all default parameters,
* except, possibly, the URI of the hypervisor. */
--
2.31.1
2 years, 11 months
[PATCH v3 0/4] Introduce TCG domain features
by Michal Privoznik
v3 of:
https://listman.redhat.com/archives/libvir-list/2021-November/msg00194.html
Note, patches 1/4 and 2/4 from v2 were pushed already.
diff to v2:
- Split feature validation into a separate patch
- Validate that the size is a multiple of MiB, because that's QEMU's
granularity
- Remembered to write NEWS entry
- Worked in Peter's comments from v2 (mostly to make code more future
proof)
Michal Prívozník (4):
conf: Introduce TCG domain features
qemu: Validate TCG feature is enabled only for TCG domains
qemu: Generate command line for tb-cache feature
NEWS: Document TCG features
NEWS.rst | 5 ++
docs/formatdomain.rst | 11 ++++
docs/schemas/domaincommon.rng | 15 ++++-
src/conf/domain_conf.c | 58 ++++++++++++++++++-
src/conf/domain_conf.h | 7 +++
src/qemu/qemu_command.c | 5 ++
src/qemu/qemu_validate.c | 17 ++++++
...efault-cpu-tcg-features.x86_64-latest.args | 36 ++++++++++++
.../x86_64-default-cpu-tcg-features.xml | 56 ++++++++++++++++++
tests/qemuxml2argvtest.c | 1 +
...default-cpu-tcg-features.x86_64-latest.xml | 1 +
tests/qemuxml2xmltest.c | 1 +
12 files changed, 210 insertions(+), 3 deletions(-)
create mode 100644 tests/qemuxml2argvdata/x86_64-default-cpu-tcg-features.x86_64-latest.args
create mode 100644 tests/qemuxml2argvdata/x86_64-default-cpu-tcg-features.xml
create mode 120000 tests/qemuxml2xmloutdata/x86_64-default-cpu-tcg-features.x86_64-latest.xml
--
2.32.0
2 years, 11 months
[libvirt PATCH 00/14] use g_auto for virCommand (Episode I: The End)
by Ján Tomko
A partial cleanup. The rest is in progress (TM)
Ján Tomko (14):
bhyve: refactor virBhyveProbeGrubCaps
bhyve: refactor bhyveProbeCapsDeviceHelper
bhyve: refactor bhyveProbeCapsFromHelp
bhyve: refactor bhyveConnectDomainXMLToNative
bhyve: use g_auto in virBhyveProcessStartImpl
bhyve: use g_auto in virBhyveProcessStop
bhyve: refactor virBhyveProcessBuildBhyveCmd
lxc: use g_auto in lxcContainerChild
lxc: refactor virLXCProcessBuildControllerCmd
lxc: use g_auto for virCommand in virLXCProcessEnsureRootFS
storage: logical: use two cmd vars in GetPoolSources
storage: util: steal cmd in CreateQemuImgCmdFromVol
security: apparmor: use automatic cleanup in load_profile
qemu: use automatic cleanup for virCommand
src/bhyve/bhyve_capabilities.c | 57 ++++++++++-----------------
src/bhyve/bhyve_command.c | 36 ++++++++---------
src/bhyve/bhyve_driver.c | 28 ++++++-------
src/bhyve/bhyve_process.c | 25 ++++--------
src/lxc/lxc_container.c | 3 +-
src/lxc/lxc_process.c | 14 ++-----
src/qemu/qemu_driver.c | 3 +-
src/qemu/qemu_interface.c | 3 +-
src/qemu/qemu_tpm.c | 4 +-
src/security/security_apparmor.c | 15 ++-----
src/storage/storage_backend_logical.c | 18 ++++-----
src/storage/storage_util.c | 5 +--
12 files changed, 78 insertions(+), 133 deletions(-)
--
2.31.1
2 years, 11 months
[PATCH 0/3] split daemon: Support sparse streams
by Michal Privoznik
See 3/3 for explanation.
Michal Prívozník (3):
virStreamInData: Allow callback to not rewind the stream
rpc: Introduce virNetClientStreamInData()
remote_driver: Implement virStreamInData() callback
src/libvirt-stream.c | 9 ++++-
src/libvirt_remote.syms | 1 +
src/remote/remote_daemon_stream.c | 8 ++--
src/remote/remote_driver.c | 26 +++++++++++++
src/rpc/virnetclientstream.c | 61 +++++++++++++++++++++++++++++++
src/rpc/virnetclientstream.h | 4 ++
6 files changed, 105 insertions(+), 4 deletions(-)
--
2.32.0
2 years, 11 months
[libvirt PATCH 0/8] Use g_auto for virCaps and LXCDriverConfig (glib chronicles)
by Ján Tomko
Pipeline in progress: https://gitlab.com/janotomko/libvirt/-/pipelines/427100328
Ján Tomko (8):
lxc: fix error value of lxcNodeGetSecurityModel
Use g_auto for freeing virCaps
Use g_auto for stealing virCaps
lxc: define cleanup function for virLXCDriverConfig
lxc: use g_auto for virLXCDriverGetConfig
lxc: remove cleanup from lxcNodeGetSecurityModel
bhyve: bhyveConnectCompareCPU: remove cleanup label
Remove empty cleanup sections
src/bhyve/bhyve_driver.c | 46 ++++++----------
src/ch/ch_conf.c | 14 ++---
src/ch/ch_driver.c | 3 +-
src/hyperv/hyperv_driver.c | 10 ++--
src/libxl/libxl_capabilities.c | 14 ++---
src/libxl/libxl_conf.c | 11 ++--
src/libxl/xen_common.c | 8 +--
src/libxl/xen_xl.c | 32 ++++-------
src/lxc/lxc_conf.c | 18 +++----
src/lxc/lxc_conf.h | 2 +
src/lxc/lxc_container.c | 12 ++---
src/lxc/lxc_driver.c | 97 ++++++++++++----------------------
src/lxc/lxc_native.c | 41 +++++---------
src/lxc/lxc_process.c | 44 +++++----------
src/test/test_driver.c | 14 ++---
src/util/vircgroup.c | 12 ++---
src/util/virfirmware.c | 18 +++----
src/vmware/vmware_conf.c | 5 +-
src/vz/vz_driver.c | 20 +++----
tests/qemucaps2xmltest.c | 14 ++---
tests/testutilsxen.c | 5 +-
tests/vboxsnapshotxmltest.c | 8 +--
tests/virconftest.c | 24 ++++-----
tests/virfiletest.c | 14 ++---
tests/virstringtest.c | 16 +++---
25 files changed, 174 insertions(+), 328 deletions(-)
--
2.31.1
2 years, 11 months
[libvirt PATCH] qemu: qemuBuildChardevCommand: use chrSourcePriv unconditionally
by Ján Tomko
In the QEMU driver, we allocate private source data unconditionally
for every chardev and the rest of the function just assumes it's there.
Signed-off-by: Ján Tomko <jtomko(a)redhat.com>
---
Pointed out by Coverity.
src/qemu/qemu_command.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 613f7a5d2a..0017cf6ca7 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1493,7 +1493,7 @@ qemuBuildChardevCommand(virCommand *cmd,
* secinfo is added only to a TCP serial device during
* qemuDomainSecretChardevPrepare. Subsequently called
* functions can just check the config fields */
- if (chrSourcePriv && chrSourcePriv->secinfo) {
+ if (chrSourcePriv->secinfo) {
if (qemuBuildObjectSecretCommandLine(cmd,
chrSourcePriv->secinfo,
qemuCaps) < 0)
--
2.31.1
2 years, 11 months
[libvirt PATCH v2 00/12] Improve AMD SEV support
by Daniel P. Berrangé
This addresses a few issues in the AMD SEV support
- Neither host or domain level SEV metadata is
exposed in virsh commands
- The domain launch security parameters don't expose
enough info to validate the measurement
- Support verified direct kernel boot
- Report max SEV/SEV-ES guest counts
The second point was the initial purpose of my work. Per the
SEV API guide to calculate the measurement we need
measurement = HMAC(0x04 || API_MAJOR || API_MINOR || BUILD ||
GCTX.POLICY || GCTX.LD || MNONCE; GCTX.TIK)
The API_MINOR, API_MAJOR, BUILD values are things that are
available from 'query-sev' QMP command and libvirt does
not expose this info. This patch series adds them to
virDomainGetLaunchSecurityParams alongside the measurement
that we already report.
So now the client can fetch this info and calculate an expected
measurement to compare with the actual measurement they got.
They will thus know if the guest is safe to inject secrets into,
which is where Jim's recent patches come into play.
Daniel P. Berrangé (12):
include: add new launch security parameters
qemu: report error querying launch params for inactive guest
qemu: add monitor APIs for query-sev
qemu: report new launch security parameters
tools: add 'domlaunchsecinfo' virsh command
tools: add 'nodesevinfo' virsh command
conf: extend domain capabilities for max SEV guest count
include: define parameters for reporting SEV guest limits
qemu: report max number of SEV guests
conf: add support for setting SEV kernel hashes
qemu: probe for sev-guest.kernel-hashes property
qemu: format sev-guest.kernel-hashes property
docs/formatdomain.rst | 7 +-
docs/formatdomaincaps.html.in | 6 +
docs/manpages/virsh.rst | 31 +++++
docs/schemas/domaincaps.rng | 6 +
docs/schemas/domaincommon.rng | 5 +
include/libvirt/libvirt-domain.h | 32 +++++
include/libvirt/libvirt-host.h | 16 +++
src/conf/domain_capabilities.c | 4 +
src/conf/domain_capabilities.h | 2 +
src/conf/domain_conf.c | 8 ++
src/conf/domain_conf.h | 1 +
src/qemu/qemu_capabilities.c | 46 ++++++++
src/qemu/qemu_capabilities.h | 1 +
src/qemu/qemu_command.c | 7 ++
src/qemu/qemu_driver.c | 59 ++++++++--
src/qemu/qemu_monitor.c | 13 +++
src/qemu/qemu_monitor.h | 9 ++
src/qemu/qemu_monitor_json.c | 46 ++++++++
src/qemu/qemu_monitor_json.h | 9 ++
src/qemu/qemu_validate.c | 8 ++
.../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 2 +
.../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 2 +
tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 2 +
.../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 2 +
.../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 2 +
tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 2 +
.../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 7 +-
.../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 7 +-
tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 7 +-
.../caps_2.12.0.x86_64.replies | 97 ++++++++++++----
.../caps_3.0.0.x86_64.replies | 97 ++++++++++++----
.../caps_3.1.0.x86_64.replies | 97 ++++++++++++----
.../caps_4.0.0.x86_64.replies | 97 ++++++++++++----
.../caps_4.1.0.x86_64.replies | 89 ++++++++++----
.../caps_4.2.0.x86_64.replies | 89 ++++++++++----
.../caps_5.0.0.x86_64.replies | 89 ++++++++++----
.../caps_5.1.0.x86_64.replies | 89 ++++++++++----
.../caps_5.2.0.x86_64.replies | 89 ++++++++++----
.../caps_6.0.0.x86_64.replies | 89 ++++++++++----
.../caps_6.1.0.x86_64.replies | 89 ++++++++++----
.../caps_6.2.0.x86_64.replies | 109 ++++++++++++++----
.../caps_6.2.0.x86_64.xml | 8 ++
tests/qemumonitorjsontest.c | 43 +++++++
...unch-security-sev-direct.x86_64-6.2.0.args | 40 +++++++
.../launch-security-sev-direct.xml | 39 +++++++
tests/qemuxml2argvtest.c | 1 +
tools/virsh-domain.c | 53 +++++++++
tools/virsh-host.c | 45 ++++++++
48 files changed, 1427 insertions(+), 271 deletions(-)
create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.x86_64-6.2.0.args
create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.xml
--
2.33.1
2 years, 11 months