[PATCH] spec: Enable ch driver
by Praveen K Paladugu
Enabling building and packaging ch driver in the spec file.
Signed-off-by: Praveen K Paladugu <praveenkpaladugu(a)gmail.com>
---
libvirt.spec.in | 51 ++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 48 insertions(+), 3 deletions(-)
diff --git a/libvirt.spec.in b/libvirt.spec.in
index 3d5164b534..303d7cb34a 100644
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -35,6 +35,7 @@
%define with_lxc 0%{!?_without_lxc:1}
%define with_libxl 0%{!?_without_libxl:1}
%define with_vbox 0%{!?_without_vbox:1}
+%define with_ch 0%{!?_without_ch:1}
%ifarch %{arches_qemu_kvm}
%define with_qemu_kvm %{with_qemu}
@@ -1026,6 +1027,20 @@ Server side daemon and driver required to manage the virtualization
capabilities of VirtualBox
%endif
+ %if %{with_ch}
+%package daemon-driver-ch
+Summary: Cloud-Hypervisor driver plugin for libvirtd daemon
+Requires: libvirt-daemon-common = %{version}-%{release}
+Requires: libvirt-daemon-log = %{version}-%{release}
+Requires: libvirt-libs = %{version}-%{release}
+
+%description daemon-driver-ch
+The ch driver plugin for the libvirtd daemon, providing
+an implementation of the hypervisor driver APIs by
+Cloud-Hypervisor
+ %endif
+
+
%package client
Summary: Client side utilities of the libvirt library
Requires: libvirt-libs = %{version}-%{release}
@@ -1188,9 +1203,15 @@ exit 1
%endif
%if %{with_esx}
- %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled
+ %define arg_esx -Ddriver_esx=enabled
+%else
+ %define arg_esx -Ddriver_esx=disabled
+%endif
+
+%if %{with_esx} || %{with_ch}
+ %define arg_curl -Dcurl=enabled
%else
- %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled
+ %define arg_curl -Dcurl=disabled
%endif
%if %{with_hyperv}
@@ -1205,6 +1226,12 @@ exit 1
%define arg_vmware -Ddriver_vmware=disabled
%endif
+%if %{with_ch}
+ %define arg_ch -Ddriver_ch=enabled
+%else
+ %define arg_ch -Ddriver_ch=disabled
+%endif
+
%if %{with_storage_rbd}
%define arg_storage_rbd -Dstorage_rbd=enabled
%else
@@ -1335,11 +1362,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
-Ddriver_remote=enabled \
-Ddriver_test=enabled \
%{?arg_esx} \
+ %{?arg_curl} \
%{?arg_hyperv} \
%{?arg_vmware} \
+ %{?arg_ch} \
-Ddriver_vz=disabled \
-Ddriver_bhyve=disabled \
- -Ddriver_ch=disabled \
%{?arg_remote_mode} \
-Ddriver_interface=enabled \
-Ddriver_network=enabled \
@@ -1541,6 +1569,10 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl
rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug
rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
%endif
+ %if ! %{with_ch}
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
+ %endif
# Copied into libvirt-docs subpackage eventually
mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
@@ -2405,6 +2437,19 @@ exit 0
%attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
%endif
+ %if %{with_ch}
+%files daemon-driver-ch
+%attr(0755, root, root) %{_sbindir}/virtchd
+%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf
+%{_datadir}/augeas/lenses/virtchd.aug
+%{_datadir}/augeas/lenses/tests/test_virtchd.aug
+%{_unitdir}/virtchd-admin.socket
+%{_unitdir}/virtchd-ro.socket
+%{_unitdir}/virtchd.service
+%{_unitdir}/virtchd.socket
+%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so
+ %endif
+
%files client
%{_mandir}/man1/virsh.1*
%{_mandir}/man1/virt-xml-validate.1*
--
2.47.0
5 months
[PATCH] qemu: allow migration of guest with mdev vGPU to VF vGPU
by Laine Stump
GPU vendors are moving away from using mdev to create virtual GPUs
towards using SRIOV VFs that are vGPUs. In both cases, once created
the vGPUs are assigned to guests via <hostdev> (i.e. VFIO device
assignment), and inside the guest the devices look identical, but mdev
vGPUs are located by QEMU/VFIO using a uuid, while VF vGPUs are
located with a PCI address. So although we generally require the
device on the source host to exactly match the device on the
destination host, in the case of mdev-created vGPU vs. VF vGPU
migration *can* potentially work, except that libvirt has a hard-coded
check that prevents us from even trying.
This patch loosens up that check so that we will allow attempts to
migrate a guest from a source host that has mdev-created vGPUs to a
destination host that has VF vGPUs (and vice versa). The expectation
is that if this doesn't actually work then QEMU will fail and generate
an error that we can report.
Based-on-patch-by: Zhiyi Guo <zhguo(a)redhat.com>
Signed-off-by: Laine Stump <laine(a)redhat.com>
---
Zhiyi's original patch removed the check for subsys type completely,
and this worked. My modified patch keeps the check in place, but
allows it to pass if the src type is pci and dst is mdev, or vice
versa.
src/conf/domain_conf.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 4ad8289b89..9d5fda0469 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -20647,13 +20647,27 @@ virDomainHostdevDefCheckABIStability(virDomainHostdevDef *src,
return false;
}
- if (src->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
- src->source.subsys.type != dst->source.subsys.type) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("Target host device subsystem %1$s does not match source %2$s"),
- virDomainHostdevSubsysTypeToString(dst->source.subsys.type),
- virDomainHostdevSubsysTypeToString(src->source.subsys.type));
- return false;
+ if (src->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) {
+ virDomainHostdevSubsysType srcType = src->source.subsys.type;
+ virDomainHostdevSubsysType dstType = dst->source.subsys.type;
+
+ /* If the source and destination subsys types aren't the same,
+ * then migration can't be supported, *except* that it might
+ * be supported to migrate from subsys type 'pci' to 'mdev'
+ * and vice versa. (libvirt can't know for certain whether or
+ * not it will actually work, so we have to just allow it and
+ * count on QEMU to provide us with an error if it fails)
+ */
+
+ if (srcType != dstType
+ && ((srcType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI && srcType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV)
+ || (dstType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI && dstType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV))) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target host device subsystem type %1$s is not compatible with source subsystem type %2$s"),
+ virDomainHostdevSubsysTypeToString(dstType),
+ virDomainHostdevSubsysTypeToString(srcType));
+ return false;
+ }
}
if (!virDomainDeviceInfoCheckABIStability(src->info, dst->info))
--
2.47.1
5 months
[PATCH] qemu: Add audit entries for suspend and resume
by Jim Fehlig
We recently received a request from certification auditors to provide
audit entries for suspend and resume. This small patch uses the existing
virtDomainAudit{Start,Stop} functions with new reasons "suspended" and
"resumed".
Signed-off-by: Jim Fehlig <jfehlig(a)suse.com>
---
For suspend, I initially wrote the following
virDomainAuditStart(vm, virDomainPausedReasonTypeToString(reason), true);
but I'm not sure it makes sense in resume, where we have reasons such as
VIR_DOMAIN_CRASHED_PANICKED. For symmetry, it seemed best to go with
"suspended" and "resumed".
src/qemu/qemu_driver.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index f1a633fdd3..c670bb681e 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -1682,6 +1682,7 @@ static int qemuDomainSuspend(virDomainPtr dom)
goto endjob;
}
qemuDomainSaveStatus(vm);
+ virDomainAuditStart(vm, "suspended", true);
ret = 0;
endjob:
@@ -1738,6 +1739,7 @@ static int qemuDomainResume(virDomainPtr dom)
}
}
qemuDomainSaveStatus(vm);
+ virDomainAuditStop(vm, "resumed");
ret = 0;
endjob:
--
2.43.0
5 months, 1 week
[PATCH v2 0/4] fix AppArmor policy restore for runtime rules
by Georgia Garcia
Some rules are generated dynamically during boot and added to the
AppArmor policy. An example of that is macvtap devices that call the
AppArmorSetFDLabel hook to add a rule for the tap device path.
Since this information is dynamic, it is not available in the xml
config, therefore whenever a "Restore" hook is called, the entire
profile is regenerated by virt-aa-helper based only the information
from the VM definition, so the dynamic/runtime information is lost.
This patchset fixes that by storing these rules in a different file
called libvirt-uuid.runtime_files, which is included by
libvirt-uuid.files that already exists. It also includes other fixes
like memory leaks, adoption of the GLib API in the apparmor files and
a fix on the AppArmor policy that incorrectly applies apparmor policy
syntax.
Georgia Garcia (4):
security_apparmor: fix memleaks in AppArmorSetFDLabel
security: replace uses of label and VIR_FREE by g_autofree
apparmor: fix UUID specification
virt-aa-helper: store dynamically generated rules
.../usr.lib.libvirt.virt-aa-helper.in | 5 +-
src/security/apparmor/usr.sbin.libvirtd.in | 7 +-
src/security/security_apparmor.c | 83 +++++-----
src/security/virt-aa-helper.c | 145 +++++++++---------
4 files changed, 120 insertions(+), 120 deletions(-)
--
2.34.1
5 months, 1 week
[PATCH v2 1/3] Revert "qemu: explicit swtpm state locking"
by marcandre.lureau＠redhat.com
From: Marc-André Lureau <marcandre.lureau(a)redhat.com>
This reverts commit bb5e26749fe5b5856a3541be2cbe147701e6e121.
swtpm-setup doesn't have "tpmstate-lock", only swtpm.
Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com>
---
src/qemu/qemu_tpm.c | 11 ++---------
src/util/virtpm.c | 1 -
src/util/virtpm.h | 1 -
tests/testutilsqemu.c | 1 -
4 files changed, 2 insertions(+), 12 deletions(-)
diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
index f5e0184e54..476e3dd224 100644
--- a/src/qemu/qemu_tpm.c
+++ b/src/qemu/qemu_tpm.c
@@ -344,23 +344,16 @@ static char *
qemuTPMGetSwtpmSetupStateArg(const virDomainTPMSourceType source_type,
const char *source_path)
{
- const char *lock = ",lock";
-
- if (!virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK)) {
- VIR_WARN("This swtpm version doesn't support explicit locking");
- lock = "";
- }
-
switch (source_type) {
case VIR_DOMAIN_TPM_SOURCE_TYPE_FILE:
/* the file:// prefix is supported since swtpm_setup 0.7.0 */
/* assume the capability check for swtpm is redundant. */
- return g_strdup_printf("file://%s%s", source_path, lock);
+ return g_strdup_printf("file://%s", source_path);
case VIR_DOMAIN_TPM_SOURCE_TYPE_DIR:
case VIR_DOMAIN_TPM_SOURCE_TYPE_DEFAULT:
case VIR_DOMAIN_TPM_SOURCE_TYPE_LAST:
default:
- return g_strdup_printf("%s%s", source_path, lock);
+ return g_strdup_printf("%s", source_path);
}
}
diff --git a/src/util/virtpm.c b/src/util/virtpm.c
index 4016ad8fc4..f90839debe 100644
--- a/src/util/virtpm.c
+++ b/src/util/virtpm.c
@@ -53,7 +53,6 @@ VIR_ENUM_IMPL(virTPMSwtpmSetupFeature,
"cmdarg-reconfigure-pcr-banks",
"tpm-1.2",
"tpm-2.0",
- "tpmstate-opt-lock",
"cmdarg-profile",
);
diff --git a/src/util/virtpm.h b/src/util/virtpm.h
index 03fb92629a..4119a903e5 100644
--- a/src/util/virtpm.h
+++ b/src/util/virtpm.h
@@ -45,7 +45,6 @@ typedef enum {
VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS,
VIR_TPM_SWTPM_SETUP_FEATURE_TPM_1_2,
VIR_TPM_SWTPM_SETUP_FEATURE_TPM_2_0,
- VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK,
VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE,
VIR_TPM_SWTPM_SETUP_FEATURE_LAST
diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
index 5caccbc6b4..abc425b9b7 100644
--- a/tests/testutilsqemu.c
+++ b/tests/testutilsqemu.c
@@ -71,7 +71,6 @@ virTPMSwtpmSetupCapsGet(virTPMSwtpmSetupFeature cap)
case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES:
case VIR_TPM_SWTPM_SETUP_FEATURE_TPM12_NOT_NEED_ROOT:
case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS:
- case VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK:
case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE:
case VIR_TPM_SWTPM_SETUP_FEATURE_LAST:
break;
--
2.47.0
5 months, 1 week
[PATCH] apparmor: Allow running loongarch64 VMs on Debian 12
by Xianglai Li
Allows to load firmware in the qemu-efi-loongarch64 directory
Allows the binary qemu-system-loongarch64 to be run
This makes it impossible to run loongarch64 VMs when AppArmor is enabled
Signed-off-by: Xianglai Li <lixianglai(a)loongson.cn>
---
src/security/apparmor/libvirt-qemu.in | 1 +
src/security/virt-aa-helper.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in
index 694da26dea..c63077574e 100644
--- a/src/security/apparmor/libvirt-qemu.in
+++ b/src/security/apparmor/libvirt-qemu.in
@@ -144,6 +144,7 @@
/usr/bin/qemu-system-hppa rmix,
/usr/bin/qemu-system-i386 rmix,
/usr/bin/qemu-system-lm32 rmix,
+ /usr/bin/qemu-system-loongarch64 rmix,
/usr/bin/qemu-system-m68k rmix,
/usr/bin/qemu-system-microblaze rmix,
/usr/bin/qemu-system-microblazeel rmix,
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 1cf9d7ad3d..94a28bf331 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly)
"/usr/share/AAVMF/",
"/usr/share/qemu-efi/", /* for AAVMF images */
"/usr/share/qemu-efi-aarch64/",
+ "/usr/share/qemu-efi-loongarch64/",
"/usr/share/qemu-efi-riscv64/",
"/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */
"/usr/lib/u-boot/",
--
2.39.1
5 months, 1 week
[PATCH] hyperv: Introduce and export 'facility' variable.
by Michal Privoznik
In its upstream commit [1] openwsman dropped 'facility' variable
which is documented as:
* all processes that use the libu must define a "facility" variable somewhere
* to satisfy this external linkage reference.
*
* Such variable will be used as the syslog(3) facility argument.
Well, prior to that commit, openwsman itself declared the
variable (and set it to LOG_DAEMON). Now it's up to us.
Yeah, the variable naming is terrible and also I we are not using
libu directly, but apparently libwsman.so requires it anyway:
$ objdump -T /usr/lib64/libwsman.so | grep facility
0000000000000000 D *UND* 0000000000000000 Base facility
1: https://github.com/Openwsman/openwsman/commit/d72c51f21b9c85a773b7955ac58...
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/hyperv/hyperv_wmi.c | 3 +++
src/libvirt_hyperv.syms | 11 +++++++++++
src/meson.build | 6 ++++++
3 files changed, 20 insertions(+)
create mode 100644 src/libvirt_hyperv.syms
diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c
index 0b82f1f131..040bcfec11 100644
--- a/src/hyperv/hyperv_wmi.c
+++ b/src/hyperv/hyperv_wmi.c
@@ -28,6 +28,7 @@
#include <wsman-soap.h>
#include <wsman-xml.h>
#include <wsman-xml-binding.h>
+#include <u/syslog.h>
#include "internal.h"
#include "virerror.h"
@@ -47,6 +48,8 @@
VIR_LOG_INIT("hyperv.hyperv_wmi");
+int facility = LOG_DAEMON;
+
int
hypervGetWmiClassList(hypervPrivate *priv, hypervWmiClassInfo *wmiInfo,
virBuffer *query, hypervObject **wmiClass)
diff --git a/src/libvirt_hyperv.syms b/src/libvirt_hyperv.syms
new file mode 100644
index 0000000000..60e98db473
--- /dev/null
+++ b/src/libvirt_hyperv.syms
@@ -0,0 +1,11 @@
+#
+# HyperV-specific symbols
+#
+
+# hyperv/hyperv_wmi.c
+facility;
+
+# Let emacs know we want case-insensitive sorting
+# Local Variables:
+# sort-fold-case: t
+# End:
diff --git a/src/meson.build b/src/meson.build
index b53ea2a71f..cce89fac27 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -125,6 +125,12 @@ else
sym_files += 'libvirt_libssh2.syms'
endif
+if conf.has('WITH_HYPERV')
+ used_sym_files += 'libvirt_hyperv.syms'
+else
+ sym_files += 'libvirt_hyperv.syms'
+endif
+
# variables filled by subdirectories
libvirt_libs = []
--
2.45.2
5 months, 1 week
[PATCH 0/2] po: handle translatin of polkit policy file strings
by Daniel P. Berrangé
There was a proposal
https://gitlab.com/libvirt/libvirt/-/merge_requests/387
to add translations for the polkit files. In reviewing this we came
to the conclusion the approach was undesirable. After getting misled
by a Debian/Ubuntu specific downstream only patch to polkit which
auto-translated polkit files at runtime, this implements the manual
approach of merging translations into the polkit files at build time.
Daniel P. Berrangé (2):
po: add its rules for translating polkit file strings
remote: apply translations to polkit files
meson.build | 5 +++++
po/POTFILES | 2 ++
po/its/polkit.its | 8 ++++++++
po/its/polkit.loc | 6 ++++++
po/meson.build | 3 +--
src/access/meson.build | 18 ++++++++++++++----
.../{libvirtd.policy => libvirtd.policy.in} | 0
src/remote/meson.build | 13 ++++++++-----
8 files changed, 44 insertions(+), 11 deletions(-)
create mode 100644 po/its/polkit.its
create mode 100644 po/its/polkit.loc
rename src/remote/{libvirtd.policy => libvirtd.policy.in} (100%)
--
2.46.0
5 months, 1 week
[PATCH 00/19] hw/microblaze: Allow running cross-endian vCPUs
by Philippe Mathieu-Daudé
Make machines endianness-agnostic, allowing to run a big-endian vCPU
on the little-endian 'qemu-system-microblazeel' binary, and a little
endian one on the big-endian 'qemu-system-microblaze' binary.
Tests added, following combinations covered:
- little-endian vCPU using little-endian binary (in-tree)
- little-endian vCPU using big-endian binary (new)
- big-endian vCPU using little-endian binary (new)
- big-endian vCPU using big-endian binary (in-tree)
Deprecate untested big-endian machines, likely build on the big
endian binary by mistake:
- petalogix-ml605
- xlnx-zynqmp-pmu
To make a target endian-agnostic we need to remove the MO_TE uses.
In order to do that, we propagate the MemOp from earlier in the
call stack, or we extract it from the vCPU env (on MicroBlaze the
CPU endianness is exposed by the 'ENDI' bit).
Note, since vCPU can run in any endianness, the
MemoryRegionOps::endianness should not be DEVICE_NATIVE_ENDIAN
anymore, because this definition expand to the binary endianness,
swapping data regardless how the vcpu access it.
See adjust_endianness() -> devend_memop(). Something to keep in
mind, possibly requiring further work and optimizations (avoid
double-swap).
Next step: Look at unifying binaries.
Please review,
Phil.
Philippe Mathieu-Daudé (19):
target/microblaze: Rename CPU endianness property as 'little-endian'
hw/microblaze: Deprecate big-endian petalogix-ml605 & xlnx-zynqmp-pmu
hw/microblaze/s3adsp1800: Explicit CPU endianness
hw/microblaze/s3adsp1800: Rename unimplemented MMIO region as xps_gpio
hw/microblaze/s3adsp1800: Declare machine type using DEFINE_TYPES
macro
hw/microblaze: Fix MemoryRegionOps coding style
hw/microblaze: Restrict MemoryRegionOps are implemented as 32-bit
hw/microblaze: Propagate CPU endianness to microblaze_load_kernel()
hw/intc/xilinx_intc: Only expect big-endian accesses
hw/timer/xilinx_timer: Only expect big-endian accesses
hw/timer/xilinx_timer: Allow down to 8-bit memory access
hw/net/xilinx_ethlite: Only expect big-endian accesses
target/microblaze: Explode MO_TExx -> MO_TE | MO_xx
target/microblaze: Set MO_TE once in do_load() / do_store()
target/microblaze: Introduce mo_endian() helper
target/microblaze: Consider endianness while translating code
hw/microblaze: Support various endianness for s3adsp1800 machines
tests/functional: Explicit endianness of microblaze assets
tests/functional: Add microblaze cross-endianness tests
docs/about/deprecated.rst | 6 ++
.../devices/microblaze-softmmu/default.mak | 2 -
.../devices/microblazeel-softmmu/default.mak | 5 +-
hw/microblaze/boot.h | 4 +-
target/microblaze/cpu.h | 7 ++
hw/char/xilinx_uartlite.c | 8 ++-
hw/intc/xilinx_intc.c | 23 +++++--
hw/microblaze/boot.c | 8 +--
hw/microblaze/petalogix_ml605_mmu.c | 11 ++-
hw/microblaze/petalogix_s3adsp1800_mmu.c | 67 +++++++++++++++++--
hw/microblaze/xlnx-zynqmp-pmu.c | 12 ++--
hw/net/xilinx_ethlite.c | 28 ++++++--
hw/timer/xilinx_timer.c | 15 +++--
target/microblaze/cpu.c | 2 +-
target/microblaze/translate.c | 49 ++++++++------
.../functional/test_microblaze_s3adsp1800.py | 27 +++++++-
.../test_microblazeel_s3adsp1800.py | 25 ++++++-
17 files changed, 236 insertions(+), 63 deletions(-)
--
2.45.2
5 months, 1 week
[PATCH] docs: Clarify what source and name attributes of TPM profile describe
by Stefan Berger
Clarify what source and name attributes of TPM profile describe and
update the version placeholder to the libvirt version when profiles
were first supported, v10.10. Also mention that profiles with prefix
'custom:' in their name can be modified.
Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com>
---
docs/formatdomain.rst | 29 +++++++++++++++++------------
1 file changed, 17 insertions(+), 12 deletions(-)
diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index 60bee8bd4f..0a56a96ea4 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -8303,27 +8303,32 @@ Example: usage of external TPM emulator :since:`Since 9.0.0`
``profile``
The ``profile`` node is used to set a profile for a TPM 2.0 given in the
- source attribute. This profile will be set when the TPM is initially
- created and after that cannot be changed anymore. Once a profile has been
- set the name attribute will be updated with the name of the profile that
- is running. If no profile is provided, then swtpm will use the latest
- built-in 'default' profile or the default profile set in swtpm_setup.conf.
- Otherwise swtpm_setup will search for a profile with the given name with
- appended .json suffix in a configurable local and then in a distro
- directory. If none could be found in either, it will fall back trying to
- use a built-in one.
+ ``source`` attribute. This attribute describes the name of the file under
+ which the profile is stored, e.g. 'local:restricted' describes a locally
+ created profile with name 'restricted.json' that is found in the directory
+ pointed to by swtpm_setup.conf's local_profiles_dir. This profile will be set
+ when the TPM is initially created and after that the profile cannot be
+ changed anymore. Once a profile has been set, the ``name`` attribute will be
+ updated with the profile's name from its JSON description, for example
+ 'custom:restricted'. If no profile is provided, then swtpm will use the
+ latest built-in 'default' profile or the default profile set in
+ swtpm_setup.conf. Otherwise swtpm_setup will search for a profile with the
+ given name with appended .json suffix in a configurable local and then in a
+ distro directory. If none could be found in either, it will fall back trying
+ to use a built-in one.
The built-in 'null' profile provides backwards compatibility with
libtpms v0.9 but also restricts the user to use only TPM features that were
- available at the time of libtpms v0.9. The built-in 'custom' profile is the
- only profile that a user can modify and where the ``removeDisabled``
+ available at the time of libtpms v0.9. The built-in 'custom' profile, or
+ those with the prefix 'custom:' in the name, are the
+ only profiles that a user can modify and where the ``removeDisabled``
attribute has any effect. This attribute is particularly useful when a host
is running in FIPS mode and therefore some crypto algorithms (camellia,
tdes, unpadded RSA encryption, 1024-bit RSA keys, and others) are
disabled. When it is set to ``check`` (recommended) then only those
algorithms that are currently disabled will automatically be removed from
the 'custom' profile, while when it is set to ``fips-host`` then all
- potentially disabled algorithms will be removed. :since:`Since 10.??.0`
+ potentially disabled algorithms will be removed. :since:`Since 10.10.0`
TPM profiles provided by a distro can be referenced with the 'distro:'
prefix. Locally created TPM profiles can be referenced with the
--
2.47.1
5 months, 2 weeks