February 2025 - Devel - libvirt List Archives

[PATCH 0/1] nwfilter: Fix deadlock between nwfilter-list and VM startup/migration
by Dion Bosschieter 07 Mar '25

07 Mar '25

A deadlock occurs when `nwfilterBindingCreateXML` and `nwfilterConnectListAllNWFilters` acquire locks in an inconsistent order. This affects both incoming migrations and VM startups (`virsh start`), where `nwfilterBindingCreateXML` needs `updateLock`, while `nwfilter-list` first acquires `driverMutex` and then locks individual filters. This patch resolves the deadlock by ensuring `nwfilterBindingCreateXML` acquires `driverMutex` before `updateLock`, following the locking pattern used by other functions like `undefine` `nwfilterStateReload`. Added the use of `driverMutex` in `nwfilterBindingDelete` to maintain consistent locking order, as suggested. Fixes: https://gitlab.com/libvirt/libvirt/-/issues/680 Dion Bosschieter (1): nwfilter: Fix deadlock between nwfilter-list and VM startup/migration src/nwfilter/nwfilter_driver.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) -- 2.39.3 (Apple Git-146)

3 3

[libvirt] [PATCH] Fix python error reporting for some storage operations
by Cole Robinson 07 Mar '25

07 Mar '25

In the python bindings, all vir* classes expect to be passed a virConnect object when instantiated. Before the storage stuff, these classes were only instantiated in virConnect methods, so the generator is hardcoded to pass 'self' as the connection instance to these classes. Problem is there are some methods that return pool or vol instances which aren't called from virConnect: you can lookup a storage volume's associated pool, and can lookup volumes from a pool. In these cases passing 'self' doesn't give the vir* instance a connection, so when it comes time to raise an exception crap hits the fan. Rather than rework the generator to accomodate this edge case, I just fixed the init functions for virStorage* to pull the associated connection out of the passed value if it's not a virConnect instance. Thanks, Cole diff --git a/python/generator.py b/python/generator.py index 01a17da..c706b19 100755 --- a/python/generator.py +++ b/python/generator.py @@ -962,8 +962,12 @@ def buildWrappers(): list = reference_keepers[classname] for ref in list: classes.write(" self.%s = None\n" % ref[1]) - if classname in [ "virDomain", "virNetwork", "virStoragePool", "virStorageVol" ]: + if classname in [ "virDomain", "virNetwork" ]: classes.write(" self._conn = conn\n") + elif classname in [ "virStorageVol", "virStoragePool" ]: + classes.write(" self._conn = conn\n" + \ + " if not isinstance(conn, virConnect):\n" + \ + " self._conn = conn._conn\n") classes.write(" if _obj != None:self._o = _obj;return\n") classes.write(" self._o = None\n\n"); destruct=None

4 3

[PATCH RFC] util: pick a better runtime directory when XDG_RUNTIME_DIR isn't set
by Laine Stump 06 Mar '25

06 Mar '25

====== I'm sending this as an RFC just because what it's doing feels kind of dirty - directly examining XDG_RUNTIME_DIR seems like an "end run" around the Glib API. If anyone has a better idea of what to do, please give details :-) ====== When running unprivileged (i.e. not as root, but as a regular user), libvirt calls g_get_user_runtime_dir() (from Glib) to get the name of a directory where status files can be saved. This is a directory that is 1) writeable by the current user, and 2) will remain there until the host reboots, but then 3) be erased after the reboot. This is used for pidfiles, sockets created to communicate between processes, status XML of active domains, etc. Normally g_get_user_runtime_dir() returns the setting of XDG_RUNTIME_DIR in the user's environment; usually this is set to /run/user/${UID} (e.g. /run/user/1000) - that directory is created when a user first logs in and is owned by the user, but is cleared out when the system reboots (more specifically, this directory usually resides in a tmpfs, and so disappears when that tmpfs is unmounted). But sometimes XDG_RUNTIME_DIR isn't set in the user's environment. In that case, g_get_user_runtime_dir() returns ${HOME}/.config (e.g. /home/laine/.config). This directory fulfills the first 2 criteria above, but fails the 3rd. This isn't just some pedantic complaint - libvirt actually depends on the directory being cleared out during a reboot - otherwise it might think that stale status files are indicating active guests when in fact the guests were shutdown during the reboot). In my opinion this behavior is a bug in Glib - see the requirements for XDG_RUNTIME in the FreeDesktop documentation here: https://specifications.freedesktop.org/basedir-spec/latest/#variables but they've documented the behavior as proper in the Glib docs for g_get_user_runtime_dir(), and so likely will consider it not a bug. Beyond that, aside from failing the "must be cleared out during a reboot" requirement, use of $HOME/.cache in this way also disturbs SELinux, which gives an AVC denial when libvirt (or passt) tries to create a file or socket in that directory (the SELinux policy permits use of /run/user/$UID, but not of $HOME/.config). We *could* add that to the SELinux policy, but since the glib behavior doesn't All of the above is a very long leadup to the functionality in this patch: rather than blindly accepting the path returned from g_get_user_runtime_dir(), we first check if XDG_RUNTIME_DIR is set; if it isn't set then we look to see if /run/user/$UID exists and is writable by this user, if so we use *that* as the directory for our status files. Otherwise (both when XDG_RUNTIME_DIR is set, and when /run/user/$UID isn't usable) we fallback to just using the path returned by g_get_user_runtime_dir() - that isn't perfect, but it's what we were doing before, so at least it's not any worse. Resolves: https://issues.redhat.com/browse/RHEL-70222 Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/util/virutil.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/util/virutil.c b/src/util/virutil.c index 2abcb282fe..4c7f4b62bc 100644 --- a/src/util/virutil.c +++ b/src/util/virutil.c @@ -538,6 +538,28 @@ char *virGetUserRuntimeDirectory(void) #ifdef WIN32 return g_strdup(g_get_user_runtime_dir()); #else + /* tl;dr - if XDG_RUNTIME_DIR is set, use g_get_user_runtime_dir(). + * if not set, then see if /run/user/$UID works + * if so, use that, else fallback to g_get_user_runtime_dir() + * + * this is done because the directory returned by + * g_get_user_runtime_dir() when XDG_RUNTIME_DIR isn't set is + * "suboptimal" (it's a location that is owned by the user, but + * isn't erased when the user completely logs out) + */ + + if (!getenv("XDG_RUNTIME_DIR")) { + g_autofree char *runtime_dir = NULL; + struct stat sb; + + runtime_dir = g_strdup_printf("/run/user/%d", getuid()); + if (virFileIsDir(runtime_dir) && + (stat(runtime_dir, &sb) == 0) && (sb.st_mode & S_IWUSR)) { + return g_build_filename(runtime_dir, "libvirt", NULL); + } + } + + /* either XDG_RUNTIME_DIR was set, or /run/usr/$UID wasn't writable */ return g_build_filename(g_get_user_runtime_dir(), "libvirt", NULL); #endif } -- 2.47.1

4 12

[PATCH] qemu: snapshot: Remove dead code in qemuSnapshotDeleteBlockJobFinishing()
by Alexander Kuznetsov 06 Mar '25

06 Mar '25

qemuSnapshotDeleteBlockJobFinishing() returns only 0 and 1. Convert it to bool and remove the dead code handling -1 return in the caller. Found by Linux Verification Center (linuxtesting.org) with Svace. Reported-by: Reported-by: Andrey Slepykh <a.slepykh(a)fobos-nt.ru> Signed-off-by: Alexander Kuznetsov <kuznetsovam(a)altlinux.org> --- src/qemu/qemu_snapshot.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 80cd54bf33..d277f76b4b 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -3465,7 +3465,7 @@ qemuSnapshotDeleteBlockJobIsRunning(qemuBlockjobState state) /* When finishing or aborting qemu blockjob we only need to know if the * job is still active or not. */ -static int +static bool qemuSnapshotDeleteBlockJobIsActive(qemuBlockjobState state) { switch (state) { @@ -3475,7 +3475,7 @@ qemuSnapshotDeleteBlockJobIsActive(qemuBlockjobState state) case QEMU_BLOCKJOB_STATE_ABORTING: case QEMU_BLOCKJOB_STATE_PENDING: case QEMU_BLOCKJOB_STATE_PIVOTING: - return 1; + return true; case QEMU_BLOCKJOB_STATE_COMPLETED: case QEMU_BLOCKJOB_STATE_FAILED: @@ -3485,7 +3485,7 @@ qemuSnapshotDeleteBlockJobIsActive(qemuBlockjobState state) break; } - return 0; + return false; } @@ -3513,18 +3513,14 @@ static int qemuSnapshotDeleteBlockJobFinishing(virDomainObj *vm, qemuBlockJobData *job) { - int rc; qemuBlockJobUpdate(vm, job, VIR_ASYNC_JOB_SNAPSHOT); - while ((rc = qemuSnapshotDeleteBlockJobIsActive(job->state)) > 0) { + while (qemuSnapshotDeleteBlockJobIsActive(job->state)) { if (qemuDomainObjWait(vm) < 0) return -1; qemuBlockJobUpdate(vm, job, VIR_ASYNC_JOB_SNAPSHOT); } - if (rc < 0) - return -1; - return 0; } -- 2.42.4

2 2

[PATCH v2 0/7] Add support for more ACPI table types
by Daniel P. Berrangé 06 Mar '25

06 Mar '25

This was triggered by a request by KubeVirt in https://gitlab.com/libvirt/libvirt/-/issues/748 I've not functionally tested this, since I lack any suitable guest windows environment this is looking for MSDM tables, nor does my machine have MSDM ACPI tables to pass to a guest. I'm blindly assuming that the QEMU CLI code is identical except for s/SLIC/MSDM/. In this 2nd version I've addressed two further issues * the xen driver was incorrectly mapping its 'acpi_firmware' option to type=slic. Xen's setting accepts a concatenation of tables of any type. This is different from type=slic which represents a single table, whose type will be forced to 'SLIC' if not already set. To address this we introduce a new 'rawset' type * The QEMU driver does not require a type to be set in the first place; if set it merely overrides what is in the data file. Supporting this would let us handle any ACPI table type without further XML changes. To address this we introduce a new 'raw' type, which can occur many times. Daniel P. Berrangé (7): conf: introduce support for multiple ACPI tables src: validate permitted ACPI table types in libxl/qemu drivers src: introduce 'raw' and 'rawset' ACPI table types qemu: support 'raw' ACPI table type libxl: support 'rawset' ACPI table type conf: support MSDM ACPI table type qemu: support MSDM ACPI table type docs/formatdomain.rst | 23 ++++- src/conf/domain_conf.c | 94 ++++++++++++++----- src/conf/domain_conf.h | 24 ++++- src/conf/schemas/domaincommon.rng | 7 +- src/libvirt_private.syms | 2 + src/libxl/libxl_conf.c | 5 +- src/libxl/libxl_domain.c | 28 ++++++ src/libxl/xen_xl.c | 15 ++- src/qemu/qemu_command.c | 18 +++- src/qemu/qemu_validate.c | 23 +++++ src/security/security_dac.c | 18 ++-- src/security/security_selinux.c | 16 ++-- src/security/virt-aa-helper.c | 5 +- .../acpi-table-many.x86_64-latest.args | 37 ++++++++ .../acpi-table-many.x86_64-latest.xml | 42 +++++++++ tests/qemuxmlconfdata/acpi-table-many.xml | 34 +++++++ tests/qemuxmlconftest.c | 1 + .../xlconfigdata/test-fullvirt-acpi-slic.xml | 2 +- 18 files changed, 337 insertions(+), 57 deletions(-) create mode 100644 tests/qemuxmlconfdata/acpi-table-many.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-table-many.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-table-many.xml -- 2.47.1

2 9

[PATCH] qemuPrepareNVRAMFile: Fix NVRAM image conversion check
by Peter Krempa 03 Mar '25

03 Mar '25

In case when user provides custom paths (those not covered by the JSON firmware descriptor files or the default locations) for the loader and nvram template no auto-detection will be performed and user's config will be taken at face value. Historically when 'templateFormat' didn't exist we assumed that the 'format' field covers both. Thus if 'templateFormat' is VIR_STORAGE_FILE_NONE we need to skip the check forbidding image format conversion for 'file' backed to avoid breaking legacy configs with manual/non-detected format assuming that user picked the correct format. Add a comment to the declaration of 'nvramTemplateFormat' noting the above for future reference. Resolves: https://issues.redhat.com/browse/RHEL-81731 Fixes: 2aa644a2fc8 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/conf/domain_conf.h | 7 +++++++ src/qemu/qemu_process.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index d4fa79cb84..1fcc3fdb98 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2362,6 +2362,13 @@ struct _virDomainLoaderDef { virStorageSource *nvram; bool newStyleNVRAM; char *nvramTemplate; /* user override of path to master nvram */ + /* Historically it was assumed that the format of the template and the + * actual nvram image are identical, which is no longer true. + * + * Note: if 'nvramTemplate' comes from the user and is not overriden by + * auto-detection nvramTemplateFormat may be VIR_STORAGE_FILE_NONE. Code + * shall assume that the template format matches if it isn't provided. + */ virStorageFileFormat nvramTemplateFormat; }; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 0d9b8bcb93..7b7b5c17e3 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4709,7 +4709,10 @@ qemuPrepareNVRAMFile(virQEMUDriver *driver, return -1; } - if (loader->nvram->format != loader->nvramTemplateFormat) { + /* If 'nvramTemplateFormat' is empty it means that it's a user-provided + * template which we couldn't verify. Assume the user knows what they're doing */ + if (loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE && + loader->nvram->format != loader->nvramTemplateFormat) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("conversion of the nvram template to another target format is not supported")); return -1; -- 2.48.1

2 1

[PATCH 0/6] Add support for configuring PCI high memory MMIO size
by Matthew R. Ochs 01 Mar '25

01 Mar '25

This patch series adds support for configuring the PCI high memory MMIO window size for aarch64 virt machine types. This feature has been merged into the QEMU upstream staging branch [1] and will be available in QEMU 10.0. It allows users to configure the size of the high memory MMIO window above 4GB, which is particularly useful for systems with large amounts of PCI memory requirements. The feature is exposed through the domain XML as a new PCI feature: <features> <pci> <highmem-mmio-size unit='G'>512</highmem-mmio-size> </pci> </features> When enabled, this configures the size of the PCI high memory MMIO window via QEMU's highmem-mmio-size machine property. The feature is only available for aarch64 virt machine types and requires QEMU support. This series depends on [2] and should be applied on top of those patches. For your convenience, this series is also available on Github [3]. [1] https://lore.kernel.org/qemu-devel/20250221145419.1281890-1-mochs@nvidia.co… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/Z4NQ… [3] git fetch https://github.com/nvmochs/libvirt.git pci_highmem_mmio_size Signed-off-by: Matthew R. Ochs <mochs(a)nvidia.com> Matthew R. Ochs (6): domain: Add PCI configuration feature infrastructure schema: Add PCI configuration feature schema conf: Add PCI configuration XML parsing and formatting qemu: Add capability for PCI high memory MMIO size qemu: Add command line support for PCI high memory MMIO size tests: Add tests for machine PCI features src/conf/domain_conf.c | 103 ++++++++++++++++++ src/conf/domain_conf.h | 6 + src/conf/schemas/domaincommon.rng | 9 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 6 + src/qemu/qemu_validate.c | 15 +++ .../caps_10.0.0_aarch64.replies | 10 ++ .../caps_10.0.0_aarch64.xml | 1 + ...rch64-virt-machine-pci.aarch64-latest.args | 31 ++++++ ...arch64-virt-machine-pci.aarch64-latest.xml | 30 +++++ .../aarch64-virt-machine-pci.xml | 20 ++++ tests/qemuxmlconftest.c | 2 + 13 files changed, 236 insertions(+) create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.xml -- 2.46.0

1 6

[PATCH] virDomainHostdevDefNew: update users not to check return value
by Roman Bogorodskiy 28 Feb '25

28 Feb '25

virDomainHostdevDefNew() has been using g_new0() for a while now. As it calls abort() on OOM, it's not necessary to check whether the return value is NULL. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/conf/domain_conf.c | 3 +-- src/libxl/xen_common.c | 4 +--- src/libxl/xen_xl.c | 4 +--- src/lxc/lxc_native.c | 4 ---- src/vbox/vbox_common.c | 12 +----------- 5 files changed, 4 insertions(+), 23 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 5630a469be..d4ce85b3a1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13316,8 +13316,7 @@ virDomainHostdevDefParseXML(virDomainXMLOption *xmlopt, ctxt->node = node; - if (!(def = virDomainHostdevDefNew())) - goto error; + def = virDomainHostdevDefNew(); if (virXMLPropEnumDefault(node, "mode", virDomainHostdevModeTypeFromString, VIR_XML_PROP_NONE, diff --git a/src/libxl/xen_common.c b/src/libxl/xen_common.c index b7ec552631..cbcdbf5a00 100644 --- a/src/libxl/xen_common.c +++ b/src/libxl/xen_common.c @@ -445,9 +445,7 @@ xenParsePCI(char *entry) } } - if (!(hostdev = virDomainHostdevDefNew())) - return NULL; - + hostdev = virDomainHostdevDefNew(); hostdev->managed = false; hostdev->writeFiltering = filtered; hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI; diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index 53f6871efc..482b151666 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -924,9 +924,7 @@ xenParseXLUSB(virConf *conf, virDomainDef *def) key = nextkey; } - if (!(hostdev = virDomainHostdevDefNew())) - return -1; - + hostdev = virDomainHostdevDefNew(); hostdev->managed = false; hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB; hostdev->source.subsys.u.usb.bus = busNum; diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c index c0011e0600..7700804429 100644 --- a/src/lxc/lxc_native.c +++ b/src/lxc/lxc_native.c @@ -377,10 +377,6 @@ static virDomainHostdevDef * lxcCreateHostdevDef(const char *data) { virDomainHostdevDef *hostdev = virDomainHostdevDefNew(); - - if (!hostdev) - return NULL; - hostdev->mode = VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES; hostdev->source.caps.type = VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET; hostdev->source.caps.u.net.ifname = g_strdup(data); diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c index de3c9989a5..2121d7e2d1 100644 --- a/src/vbox/vbox_common.c +++ b/src/vbox/vbox_common.c @@ -3087,11 +3087,8 @@ vboxHostDeviceGetXMLDesc(struct _vboxDriver *data, virDomainDef *def, IMachine * /* Alloc mem needed for the filters now */ def->hostdevs = g_new0(virDomainHostdevDef *, def->nhostdevs); - for (i = 0; i < def->nhostdevs; i++) { + for (i = 0; i < def->nhostdevs; i++) def->hostdevs[i] = virDomainHostdevDefNew(); - if (!def->hostdevs[i]) - goto release_hostdevs; - } for (i = 0; i < deviceFilters.count; i++) { PRBool active = PR_FALSE; @@ -3138,13 +3135,6 @@ vboxHostDeviceGetXMLDesc(struct _vboxDriver *data, virDomainDef *def, IMachine * gVBoxAPI.UArray.vboxArrayRelease(&deviceFilters); VBOX_RELEASE(USBCommon); return; - - release_hostdevs: - for (i = 0; i < def->nhostdevs; i++) - virDomainHostdevDefFree(def->hostdevs[i]); - VIR_FREE(def->hostdevs); - - goto release_filters; } -- 2.47.1

2 1

[RFC PATCH v2 6/6] qemuxmlconftest: Adds Arm CCA support
by Akio Kakuno 28 Feb '25

28 Feb '25

- This test was added to check the xml used to launch the VM for Arm CCA support. This test was created using the method described in the documentation. Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> --- .../launch-security-cca.aarch64-latest.args | 30 +++++++++++++++++++ .../launch-security-cca.aarch64-latest.xml | 24 +++++++++++++++ tests/qemuxmlconfdata/launch-security-cca.xml | 16 ++++++++++ tests/qemuxmlconftest.c | 2 ++ 4 files changed, 72 insertions(+) create mode 100644 tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/launch-security-cca.xml diff --git a/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args new file mode 100644 index 0000000000..ea8c46735b --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args @@ -0,0 +1,30 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-cca_test \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.config \ +/usr/bin/qemu-system-aarch64 \ +-name guest=cca_test,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-cca_test/master-key.aes"}' \ +-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,confidential-guest-support=rme0,acpi=off \ +-accel kvm \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 00010203-0405-4607-8809-0a0b0c0d0e0f \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-object '{"qom-type":"rme-guest","id":"rme0","measurement-algorithm":"sha256"}' \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml new file mode 100644 index 0000000000..382313472b --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml @@ -0,0 +1,24 @@ +<domain type='kvm'> + <name>cca_test</name> + <uuid>00010203-0405-4607-8809-0a0b0c0d0e0f</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='aarch64' machine='virt'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <gic version='3'/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + <controller type='pci' index='0' model='pcie-root'/> + <audio id='1' type='none'/> + </devices> + <launchSecurity type='cca'/> +</domain> diff --git a/tests/qemuxmlconfdata/launch-security-cca.xml b/tests/qemuxmlconfdata/launch-security-cca.xml new file mode 100644 index 0000000000..dccd67f8a5 --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.xml @@ -0,0 +1,16 @@ +<domain type='kvm'> + <name>cca_test</name> + <uuid>00010203-0405-4607-8809-0a0b0c0d0e0f</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='aarch64' machine='virt'>hvm</type> + </os> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + </devices> + <launchSecurity type='cca'> + <measurement-algo>sha256</measurement-algo> + </launchSecurity> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 6a46bfc7a3..babe658359 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2877,6 +2877,8 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("launch-security-cca", "aarch64"); + DO_TEST_CAPS_LATEST("vhost-user-fs-fd-memory"); DO_TEST_CAPS_LATEST("vhost-user-fs-fd-openfiles"); DO_TEST_CAPS_LATEST("vhost-user-fs-hugepages"); -- 2.34.1

1 0

[RFC PATCH v2 5/6] domaincapstest: Adds Arm CCA support
by Akio Kakuno 28 Feb '25

28 Feb '25

- This test was added to check domain capabilities for Arm CCA support. This test was created using the method described in the documentation. Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> --- .../qemu_9.1.0-virt.aarch64.xml | 243 ++++++++++++++++++ tests/domaincapsdata/qemu_9.1.0.aarch64.xml | 243 ++++++++++++++++++ 2 files changed, 486 insertions(+) create mode 100644 tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_9.1.0.aarch64.xml diff --git a/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml b/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml new file mode 100644 index 0000000000..6c1ec1734a --- /dev/null +++ b/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml @@ -0,0 +1,243 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-aarch64</path> + <domain>kvm</domain> + <machine>virt-9.2</machine> + <arch>aarch64</arch> + <vcpu max='512'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'> + <value>efi</value> + </enum> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='yes'> + <model usable='unknown' vendor='unknown'>a64fx</model> + <model usable='unknown' vendor='unknown'>arm1026</model> + <model usable='unknown' vendor='unknown'>arm1136</model> + <model usable='unknown' vendor='unknown'>arm1136-r2</model> + <model usable='unknown' vendor='unknown'>arm1176</model> + <model usable='unknown' vendor='unknown'>arm11mpcore</model> + <model usable='unknown' vendor='unknown'>arm926</model> + <model usable='unknown' vendor='unknown'>arm946</model> + <model usable='unknown' vendor='unknown'>cortex-a15</model> + <model usable='unknown' vendor='unknown'>cortex-a35</model> + <model usable='unknown' vendor='unknown'>cortex-a53</model> + <model usable='unknown' vendor='unknown'>cortex-a55</model> + <model usable='unknown' vendor='unknown'>cortex-a57</model> + <model usable='unknown' vendor='unknown'>cortex-a7</model> + <model usable='unknown' vendor='unknown'>cortex-a710</model> + <model usable='unknown' vendor='unknown'>cortex-a72</model> + <model usable='unknown' vendor='unknown'>cortex-a76</model> + <model usable='unknown' vendor='unknown'>cortex-a8</model> + <model usable='unknown' vendor='unknown'>cortex-a9</model> + <model usable='unknown' vendor='unknown'>cortex-m0</model> + <model usable='unknown' vendor='unknown'>cortex-m3</model> + <model usable='unknown' vendor='unknown'>cortex-m33</model> + <model usable='unknown' vendor='unknown'>cortex-m4</model> + <model usable='unknown' vendor='unknown'>cortex-m55</model> + <model usable='unknown' vendor='unknown'>cortex-m7</model> + <model usable='unknown' vendor='unknown'>cortex-r5</model> + <model usable='unknown' vendor='unknown'>cortex-r52</model> + <model usable='unknown' vendor='unknown'>cortex-r5f</model> + <model usable='unknown' vendor='unknown'>max</model> + <model usable='unknown' vendor='unknown'>neoverse-n1</model> + <model usable='unknown' vendor='unknown'>neoverse-n2</model> + <model usable='unknown' vendor='unknown'>neoverse-v1</model> + <model usable='unknown' vendor='unknown'>pxa250</model> + <model usable='unknown' vendor='unknown'>pxa255</model> + <model usable='unknown' vendor='unknown'>pxa260</model> + <model usable='unknown' vendor='unknown'>pxa261</model> + <model usable='unknown' vendor='unknown'>pxa262</model> + <model usable='unknown' vendor='unknown'>pxa270</model> + <model usable='unknown' vendor='unknown'>pxa270-a0</model> + <model usable='unknown' vendor='unknown'>pxa270-a1</model> + <model usable='unknown' vendor='unknown'>pxa270-b0</model> + <model usable='unknown' vendor='unknown'>pxa270-b1</model> + <model usable='unknown' vendor='unknown'>pxa270-c0</model> + <model usable='unknown' vendor='unknown'>pxa270-c5</model> + <model usable='unknown' vendor='unknown'>sa1100</model> + <model usable='unknown' vendor='unknown'>sa1110</model> + <model usable='unknown' vendor='unknown'>ti925t</model> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>floppy</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>fdc</value> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>sata</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>vga</value> + <value>cirrus</value> + <value>virtio</value> + <value>none</value> + <value>bochs</value> + <value>ramfb</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-tis</value> + </enum> + <enum name='backendModel'> + <value>passthrough</value> + <value>emulator</value> + <value>external</value> + </enum> + <enum name='backendVersion'> + <value>2.0</value> + </enum> + </tpm> + <redirdev supported='no'/> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>pvpanic</value> + </enum> + </panic> + </devices> + <features> + <gic supported='yes'> + <enum name='version'> + <value>3</value> + </enum> + </gic> + <vmcoreinfo supported='yes'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <ps2 supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <cca supported='yes'> + <enum name='measurement-algo'> + <value>sha256</value> + <value>sha512</value> + </enum> + </cca> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>cca</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> diff --git a/tests/domaincapsdata/qemu_9.1.0.aarch64.xml b/tests/domaincapsdata/qemu_9.1.0.aarch64.xml new file mode 100644 index 0000000000..6c1ec1734a --- /dev/null +++ b/tests/domaincapsdata/qemu_9.1.0.aarch64.xml @@ -0,0 +1,243 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-aarch64</path> + <domain>kvm</domain> + <machine>virt-9.2</machine> + <arch>aarch64</arch> + <vcpu max='512'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'> + <value>efi</value> + </enum> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='yes'> + <model usable='unknown' vendor='unknown'>a64fx</model> + <model usable='unknown' vendor='unknown'>arm1026</model> + <model usable='unknown' vendor='unknown'>arm1136</model> + <model usable='unknown' vendor='unknown'>arm1136-r2</model> + <model usable='unknown' vendor='unknown'>arm1176</model> + <model usable='unknown' vendor='unknown'>arm11mpcore</model> + <model usable='unknown' vendor='unknown'>arm926</model> + <model usable='unknown' vendor='unknown'>arm946</model> + <model usable='unknown' vendor='unknown'>cortex-a15</model> + <model usable='unknown' vendor='unknown'>cortex-a35</model> + <model usable='unknown' vendor='unknown'>cortex-a53</model> + <model usable='unknown' vendor='unknown'>cortex-a55</model> + <model usable='unknown' vendor='unknown'>cortex-a57</model> + <model usable='unknown' vendor='unknown'>cortex-a7</model> + <model usable='unknown' vendor='unknown'>cortex-a710</model> + <model usable='unknown' vendor='unknown'>cortex-a72</model> + <model usable='unknown' vendor='unknown'>cortex-a76</model> + <model usable='unknown' vendor='unknown'>cortex-a8</model> + <model usable='unknown' vendor='unknown'>cortex-a9</model> + <model usable='unknown' vendor='unknown'>cortex-m0</model> + <model usable='unknown' vendor='unknown'>cortex-m3</model> + <model usable='unknown' vendor='unknown'>cortex-m33</model> + <model usable='unknown' vendor='unknown'>cortex-m4</model> + <model usable='unknown' vendor='unknown'>cortex-m55</model> + <model usable='unknown' vendor='unknown'>cortex-m7</model> + <model usable='unknown' vendor='unknown'>cortex-r5</model> + <model usable='unknown' vendor='unknown'>cortex-r52</model> + <model usable='unknown' vendor='unknown'>cortex-r5f</model> + <model usable='unknown' vendor='unknown'>max</model> + <model usable='unknown' vendor='unknown'>neoverse-n1</model> + <model usable='unknown' vendor='unknown'>neoverse-n2</model> + <model usable='unknown' vendor='unknown'>neoverse-v1</model> + <model usable='unknown' vendor='unknown'>pxa250</model> + <model usable='unknown' vendor='unknown'>pxa255</model> + <model usable='unknown' vendor='unknown'>pxa260</model> + <model usable='unknown' vendor='unknown'>pxa261</model> + <model usable='unknown' vendor='unknown'>pxa262</model> + <model usable='unknown' vendor='unknown'>pxa270</model> + <model usable='unknown' vendor='unknown'>pxa270-a0</model> + <model usable='unknown' vendor='unknown'>pxa270-a1</model> + <model usable='unknown' vendor='unknown'>pxa270-b0</model> + <model usable='unknown' vendor='unknown'>pxa270-b1</model> + <model usable='unknown' vendor='unknown'>pxa270-c0</model> + <model usable='unknown' vendor='unknown'>pxa270-c5</model> + <model usable='unknown' vendor='unknown'>sa1100</model> + <model usable='unknown' vendor='unknown'>sa1110</model> + <model usable='unknown' vendor='unknown'>ti925t</model> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>floppy</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>fdc</value> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>sata</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>vga</value> + <value>cirrus</value> + <value>virtio</value> + <value>none</value> + <value>bochs</value> + <value>ramfb</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-tis</value> + </enum> + <enum name='backendModel'> + <value>passthrough</value> + <value>emulator</value> + <value>external</value> + </enum> + <enum name='backendVersion'> + <value>2.0</value> + </enum> + </tpm> + <redirdev supported='no'/> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>pvpanic</value> + </enum> + </panic> + </devices> + <features> + <gic supported='yes'> + <enum name='version'> + <value>3</value> + </enum> + </gic> + <vmcoreinfo supported='yes'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <ps2 supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <cca supported='yes'> + <enum name='measurement-algo'> + <value>sha256</value> + <value>sha512</value> + </enum> + </cca> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>cca</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> -- 2.34.1

1 0