[PATCH v2 0/5] apparmor: assume at least version 3
by Daniel P. Berrangé
In v2:
- Do upfront check for apparmor >= 3.0.0
- Add further revert commit
Daniel P. Berrangé (5):
meson: mandate apparmor >= 3.0.0
apparmor: assume at least apparmor >= 3
Revert "apparmor: Allow version-specific bits in abstractions too"
Revert "apparmor: Allow version-specific bits in profiles"
meson: drop remaining checks for apparmor version
meson.build | 7 +-
.../apparmor/{libvirt-lxc.in => libvirt-lxc} | 2 -
.../{libvirt-qemu.in => libvirt-qemu} | 4 --
src/security/apparmor/meson.build | 64 ++-----------------
.../usr.lib.libvirt.virt-aa-helper.in | 5 --
src/security/apparmor/usr.sbin.libvirtd.in | 2 -
src/security/apparmor/usr.sbin.virtqemud.in | 2 -
src/security/apparmor/usr.sbin.virtxend.in | 2 -
src/security/virt-aa-helper.c | 9 +--
9 files changed, 10 insertions(+), 87 deletions(-)
rename src/security/apparmor/{libvirt-lxc.in => libvirt-lxc} (99%)
rename src/security/apparmor/{libvirt-qemu.in => libvirt-qemu} (99%)
--
2.48.1
30 minutes
[PATCH] virt-aa-helper: delete dynamic files
by Alessandro
We attempted multiple ways to clean up dynamic files; however, we must
preserve user overrides, which requires keeping the file
/etc/apparmor.d/libvirt/libvirt-uuid
This commit proposes to move user overrides into
/etc/apparmor.d/libvirt/libvirt-uuid.local and include it, if present,
unconditionally. When we stop the domain, we remove libvirt.uuid and
libvirt-uuid.files, whereas we preserve libvirt-uuid.local if present.
Applying the patch, it produces the following:
root@virt-hv-lab002:/etc/apparmor.d/libvirt# ls -1 libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033*
libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033
libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033.files
root@virt-hv-lab002:/etc/apparmor.d/libvirt# cat libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033
profile libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033 flags=(attach_disconnected) {
#include <abstractions/libvirt-qemu>
#include if exists <libvirt/libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033.files>
#include if exists <libvirt/libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033.local>
}
root@virt-hv-lab002:/etc/apparmor.d/libvirt# cat libvirt-e7424556-ffc1-4f6e-bafa-84e66c4dc033.files
"/var/log/libvirt/**/testing-9a4be628.log" w,
"/var/lib/libvirt/qemu/domain-testing-9a4be628/monitor.sock" rw,
"/var/lib/libvirt/qemu/domain-4-testing-9a4be628/*" rw,
"/var/run/libvirt/**/testing-9a4be628.pid" rwk,
"/var/run/libvirt/**/*.tunnelmigrate.dest.testing-9a4be628" rw,
"/var/lib/libvirt/images/testing-9a4be628.qcow2" rwk,
"/var/lib/libvirt/images/noble-server-cloudimg-amd64.img" rk,
# don't audit writes to readonly files
deny "/var/lib/libvirt/images/noble-server-cloudimg-amd64.img" w,
"/var/lib/libvirt/images/testing-9a4be628-ds.qcow2" rwk,
"/usr/share/OVMF/OVMF_CODE_4M.fd" rk,
# don't audit writes to readonly files
deny "/usr/share/OVMF/OVMF_CODE_4M.fd" w,
"/var/lib/libvirt/qemu/nvram/testing-9a4be628_VARS.fd" rwk,
"/dev/vhost-net" rw,
"/var/lib/libvirt/qemu/domain-4-testing-9a4be628/{,**}" rwk,
"/run/libvirt/qemu/channel/4-testing-9a4be628/{,**}" rwk,
"/var/lib/libvirt/qemu/domain-4-testing-9a4be628/master-key.aes" rwk,
"/dev/net/tun" rwk,
"/dev/userfaultfd" rwk,
Fixes: https://gitlab.com/libvirt/libvirt/-/issues/451
Signed-off-by: Alessandro <alessandro(a)0x65c.net>
---
src/security/virt-aa-helper.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 034c042..8f044a1 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1495,8 +1495,10 @@ main(int argc, char **argv)
rc = parserLoad(ctl->uuid);
} else if (ctl->cmd == 'R' || ctl->cmd == 'D') {
rc = parserRemove(ctl->uuid);
- if (ctl->cmd == 'D')
+ if (ctl->cmd == 'D'){
unlink(include_file);
+ unlink(profile);
+ }
} else if (ctl->cmd == 'c' || ctl->cmd == 'r') {
g_autofree char *included_files = NULL;
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
@@ -1561,12 +1563,15 @@ main(int argc, char **argv)
/* create the profile from TEMPLATE */
if (ctl->cmd == 'c' || purged) {
g_autofree char *tmp = NULL;
+ g_autofree char *tmp_local = NULL:
#if defined(WITH_APPARMOR_3)
const char *ifexists = "if exists ";
#else
const char *ifexists = "";
#endif
tmp = g_strdup_printf(" #include %s<libvirt/%s.files>\n", ifexists, ctl->uuid);
+ tmp_local = g_strdup_printf(" #include %s<libvirt/%s.local>\n", ifexists, ctl->uuid);
+ tmp = g_strconcat(tmp,tmp_local, NULL);
if (ctl->dryrun) {
vah_info(profile);
--
2.49.0
34 minutes
[PATCH 0/3] apparmor: assume at least version 3
by Daniel P. Berrangé
Daniel P. Berrangé (3):
apparmor: assume at least apparmor >= 3
Revert "apparmor: Allow version-specific bits in profiles"
meson: drop remaining checks for apparmor version
meson.build | 3 --
src/security/apparmor/libvirt-lxc.in | 2 -
src/security/apparmor/libvirt-qemu.in | 4 --
src/security/apparmor/meson.build | 45 +------------------
.../usr.lib.libvirt.virt-aa-helper.in | 5 ---
src/security/apparmor/usr.sbin.libvirtd.in | 2 -
src/security/apparmor/usr.sbin.virtqemud.in | 2 -
src/security/apparmor/usr.sbin.virtxend.in | 2 -
src/security/virt-aa-helper.c | 9 +---
9 files changed, 3 insertions(+), 71 deletions(-)
--
2.48.1
2 hours, 14 minutes
[PATCH 0/4] Allow xml-configured coredump format on VM crash
by Nikolai Barybin
When libvirt processes VM crash event it always dumps core in raw
format.
This series makes it possible to configure dump format via domain xml.
This would be especcialy helpful for Windows guests, because it requires
a lot effort to convert raw dump into wingdb.
Nikolai Barybin (4):
conf: schemas: add coredump_format element to events section
src: conf: add parsing/formatting for 'coredump_format' value
qemu: use configurable dump format in doCoreDumpToAutoDumpPath()
docs: formatdomain: document 'coredump_format' element
docs/formatdomain.rst | 9 +++++
src/conf/domain_conf.c | 64 +++++++++++++++++++++++++++++++
src/conf/domain_conf.h | 2 +
src/conf/schemas/domaincommon.rng | 19 +++++++++
src/libvirt_private.syms | 2 +
src/qemu/qemu_driver.c | 2 +-
6 files changed, 97 insertions(+), 1 deletion(-)
--
2.43.5
2 days, 20 hours
[PATCH] virDomainDiskDefValidateSourceChainOne: Fix validation of 'data-file' nesting
by Peter Krempa
From: Peter Krempa <pkrempa(a)redhat.com>
As the 'dataStore' is internally represented as a virStorageSource
object it has provisions for nesting which is not supported.
When I've reviewed and modified the commit adding data file parsing
support I've added code that was supposed to reject any 'backingStore'
and 'dataStore' structures nested in a source of a 'dataStore'.
Unfortunately the check was broken as one of the terms checked the
presence of parent's 'backingStore' instead of the nesting.
Fix it and add tests.
Fixes: b3171cf8da3
Resolves: https://issues.redhat.com/browse/RHEL-85320
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/conf/domain_validate.c | 2 +-
...sk-qcow2-datafile-store.x86_64-latest.args | 43 +++++++++++--------
...isk-qcow2-datafile-store.x86_64-latest.xml | 22 +++++++++-
.../disk-qcow2-datafile-store.xml | 19 ++++++++
4 files changed, 66 insertions(+), 20 deletions(-)
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 396d1e400a..d0d4bc0bf4 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -562,7 +562,7 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src)
return -1;
}
- if (src->dataFileStore->dataFileStore || src->backingStore) {
+ if (src->dataFileStore->dataFileStore || src->dataFileStore->backingStore) {
virReportError(VIR_ERR_XML_ERROR, "%s",
_("The <source> of <dataStore> can't have another nested <dataStore> or <backingStore> element"));
return -1;
diff --git a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.args b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.args
index 5a64246af6..74f2d1a090 100644
--- a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.args
@@ -27,25 +27,32 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-no-shutdown \
-boot strict=on \
-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
--blockdev '{"driver":"file","filename":"/tmp/data-file-store","node-name":"libvirt-9-storage","read-only":false}' \
--blockdev '{"driver":"nbd","server":{"type":"unix","path":"/path/to/sock"},"export":"Volume2/Image","node-name":"libvirt-8-storage","auto-read-only":true,"discard":"unmap"}' \
+-blockdev '{"driver":"file","filename":"/tmp/data-file-store","node-name":"libvirt-13-storage","read-only":false}' \
+-blockdev '{"driver":"nbd","server":{"type":"unix","path":"/path/to/sock"},"export":"Volume2/Image","node-name":"libvirt-12-storage","auto-read-only":true,"discard":"unmap"}' \
+-blockdev '{"node-name":"libvirt-12-format","read-only":false,"driver":"qcow2","data-file":"libvirt-13-storage","file":"libvirt-12-storage"}' \
+-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-12-format","id":"virtio-disk0","bootindex":1}' \
+-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-11-storage","read-only":false}' \
+-blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-10-storage","auto-read-only":true,"discard":"unmap"}' \
+-blockdev '{"node-name":"libvirt-10-format","read-only":false,"driver":"qcow2","data-file":"libvirt-11-storage","file":"libvirt-10-storage"}' \
+-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-10-format","id":"virtio-disk1"}' \
+-blockdev '{"driver":"nbd","server":{"type":"unix","path":"/path/to/sock/datafile"},"export":"Volume2/ImageDataFile","node-name":"libvirt-9-storage","read-only":false}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071879","node-name":"libvirt-8-storage","auto-read-only":true,"discard":"unmap"}' \
-blockdev '{"node-name":"libvirt-8-format","read-only":false,"driver":"qcow2","data-file":"libvirt-9-storage","file":"libvirt-8-storage"}' \
--device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-8-format","id":"virtio-disk0","bootindex":1}' \
--blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-7-storage","read-only":false}' \
--blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-6-storage","auto-read-only":true,"discard":"unmap"}' \
--blockdev '{"node-name":"libvirt-6-format","read-only":false,"driver":"qcow2","data-file":"libvirt-7-storage","file":"libvirt-6-storage"}' \
--device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-6-format","id":"virtio-disk1"}' \
--blockdev '{"driver":"nbd","server":{"type":"unix","path":"/path/to/sock/datafile"},"export":"Volume2/ImageDataFile","node-name":"libvirt-5-storage","read-only":false}' \
--blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071879","node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \
--blockdev '{"node-name":"libvirt-4-format","read-only":false,"driver":"qcow2","data-file":"libvirt-5-storage","file":"libvirt-4-storage"}' \
--device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-4-format","id":"virtio-disk2"}' \
--blockdev '{"driver":"file","filename":"/tmp/data-file-store-2","node-name":"libvirt-3-storage","read-only":true}' \
--blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071877","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}' \
--blockdev '{"node-name":"libvirt-2-format","read-only":true,"driver":"qcow2","data-file":"libvirt-3-storage","file":"libvirt-2-storage"}' \
--blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071880","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
--blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"qcow2","file":"libvirt-1-storage","backing":"libvirt-2-format"}' \
--device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-1-format","id":"virtio-disk3"}' \
+-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-8-format","id":"virtio-disk2"}' \
+-blockdev '{"driver":"file","filename":"/tmp/data-file-store-2","node-name":"libvirt-7-storage","read-only":true}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071877","node-name":"libvirt-6-storage","auto-read-only":true,"discard":"unmap"}' \
+-blockdev '{"node-name":"libvirt-6-format","read-only":true,"driver":"qcow2","data-file":"libvirt-7-storage","file":"libvirt-6-storage"}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/rhel7.1484071880","node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \
+-blockdev '{"node-name":"libvirt-5-format","read-only":false,"driver":"qcow2","file":"libvirt-5-storage","backing":"libvirt-6-format"}' \
+-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-5-format","id":"virtio-disk3"}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/datastore_1","aio":"native","node-name":"libvirt-4-storage","read-only":true,"discard":"unmap","cache":{"direct":true,"no-flush":false}}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/base-with-data-file.qcow","aio":"native","node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap","cache":{"direct":true,"no-flush":false}}' \
+-blockdev '{"node-name":"libvirt-3-format","read-only":true,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","data-file":"libvirt-4-storage","file":"libvirt-3-storage"}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/datastore_2","aio":"native","node-name":"libvirt-2-storage","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false}}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/images/datastore.qcow2","aio":"native","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap","cache":{"direct":true,"no-flush":false}}' \
+-blockdev '{"node-name":"libvirt-1-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","data-file":"libvirt-2-storage","file":"libvirt-1-storage","backing":"libvirt-3-format"}' \
+-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x6","drive":"libvirt-1-format","id":"virtio-disk4","write-cache":"on"}' \
-audiodev '{"id":"audio1","driver":"none"}' \
--device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x7"}' \
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
-msg timestamp=on
diff --git a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.xml b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.xml
index a026749faf..a4bfcb29e0 100644
--- a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.xml
+++ b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.xml
@@ -69,6 +69,26 @@
<target dev='vdd' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</disk>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='none' io='native' discard='unmap'/>
+ <source file='/var/lib/libvirt/images/datastore.qcow2'>
+ <dataStore type='file'>
+ <format type='raw'/>
+ <source file='/var/lib/libvirt/images/datastore_2'/>
+ </dataStore>
+ </source>
+ <backingStore type='file'>
+ <format type='qcow2'/>
+ <source file='/var/lib/libvirt/images/base-with-data-file.qcow'>
+ <dataStore type='file'>
+ <format type='raw'/>
+ <source file='/var/lib/libvirt/images/datastore_1'/>
+ </dataStore>
+ </source>
+ </backingStore>
+ <target dev='vde' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </disk>
<controller type='usb' index='0' model='piix3-uhci'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
@@ -77,7 +97,7 @@
<input type='keyboard' bus='ps2'/>
<audio id='1' type='none'/>
<memballoon model='virtio'>
- <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
</memballoon>
</devices>
</domain>
diff --git a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.xml b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.xml
index dff5f15158..9f2671a3e7 100644
--- a/tests/qemuxmlconfdata/disk-qcow2-datafile-store.xml
+++ b/tests/qemuxmlconfdata/disk-qcow2-datafile-store.xml
@@ -62,6 +62,25 @@
</backingStore>
<target dev='vdd' bus='virtio'/>
</disk>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='none' io='native' discard='unmap'/>
+ <source file='/var/lib/libvirt/images/datastore.qcow2'>
+ <dataStore type='file'>
+ <format type='raw'/>
+ <source file='/var/lib/libvirt/images/datastore_2'/>
+ </dataStore>
+ </source>
+ <backingStore type='file'>
+ <format type='qcow2'/>
+ <source file='/var/lib/libvirt/images/base-with-data-file.qcow'>
+ <dataStore type='file'>
+ <format type='raw'/>
+ <source file='/var/lib/libvirt/images/datastore_1'/>
+ </dataStore>
+ </source>
+ </backingStore>
+ <target dev='vde' bus='virtio'/>
+ </disk>
<controller type='usb' index='0'/>
<controller type='pci' index='0' model='pci-root'/>
<memballoon model='virtio'/>
--
2.49.0
3 days
[PATCH 0/8] Support FD passing for the NBD server socket used for backup
by Peter Krempa
See 6/8 for justification.
Peter Krempa (8):
virDomainStorageNetworkParseHost: Remove unpopulated 'transport'
variable
virDomainStorageNetworkParseHost: Refactor cleanup
conf: Introduce VIR_STORAGE_NET_HOST_TRANS_FD
virStorageNetHostDefClear: Move into virStorageNetHostDefFree
qemu: monitor: Support FD passing of sockets to
'qemuMonitorJSONNBDServerStart'
backup: Add support for passing server socket file descriptor to
backup NBD server
tests: domainbackupxml2xml: Add test case for pull-mode backup with
NBD transport='fd'
qemu: monitor: Improve field annotations in QEMU_CHECK_MONITOR
docs/formatbackup.rst | 21 +++++
src/conf/backup_conf.c | 3 +-
src/conf/domain_conf.c | 93 ++++++++++++-------
src/conf/domain_conf.h | 3 +-
src/conf/schemas/domainbackup.rng | 6 ++
src/conf/storage_source_conf.c | 20 ++--
src/conf/storage_source_conf.h | 7 +-
src/libvirt_private.syms | 1 -
src/qemu/qemu_backup.c | 28 ++++++
src/qemu/qemu_block.c | 1 +
src/qemu/qemu_monitor.c | 2 +-
src/qemu/qemu_monitor_json.c | 21 +++++
.../storage_file_backend_gluster.c | 1 +
.../domainbackupxml2xmlin/backup-pull-fd.xml | 22 +++++
.../domainbackupxml2xmlout/backup-pull-fd.xml | 23 +++++
tests/genericxml2xmltest.c | 1 +
16 files changed, 198 insertions(+), 55 deletions(-)
create mode 100644 tests/domainbackupxml2xmlin/backup-pull-fd.xml
create mode 100644 tests/domainbackupxml2xmlout/backup-pull-fd.xml
--
2.49.0
3 days
Plans for 11.2.0 release (freeze on Tuesday 25 Mar)
by Jiri Denemark
We are getting close to 11.2.0 release of libvirt. To aim for the
release on Tuesday 01 Apr I suggest entering the freeze on Tuesday
25 Mar and tagging RC2 on Friday 28 Mar.
I hope this works for everyone.
Jirka
3 days, 1 hour
[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik
From: Michal Privoznik <mprivozn(a)redhat.com>
There are some features/improvements/bug fixes I've either
contributed or reviewed/merged. Document them for upcoming
release.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
NEWS.rst | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/NEWS.rst b/NEWS.rst
index 18d45656b8..cd5ec4eab2 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -75,6 +75,18 @@ v11.2.0 (unreleased)
system are printed. A user may specify ``--all`` to also print models which
are not supported on the host.
+ * qemu: Introduce os/shim element
+
+ For secure boot environments where ``<loader/>`` is signed, it may be
+ unfeasible to keep the binary up to date (esp. when revoking certificates
+ contained within). To address that, new ``<shim/>`` element is introduced
+ which allows hypervisor to side load another UEFI binary, which can then
+ contain new certification authorities and/or list of revocations.
+
+ * ch: Enable SEV SNP support
+
+ Cloud Hypervisor guests can be now started with SEV SNP enabled.
+
* **Improvements**
* qemu: Improved guest agent corner case error reporting
@@ -87,6 +99,14 @@ v11.2.0 (unreleased)
The new error codes are ``VIR_ERR_AGENT_COMMAND_TIMEOUT`` and
``VIR_ERR_AGENT_COMMAND_FAILED``.
+ * qemu: Reflect MAC address change in live domain XML
+
+ When a guest changes MAC address on one of its vNICs the new MAC address is
+ now visible in the live XML under ``currentAddress`` attribute of
+ ``<mac/>`` element. At the same time,
+ ``VIR_DOMAIN_EVENT_ID_NIC_MAC_CHANGE`` event is emitted so that management
+ applications can update their internal state.
+
* **Bug fixes**
* qemu: attach virtio-mem with CCW address
@@ -95,6 +115,11 @@ v11.2.0 (unreleased)
default type CCW address assigned. A specified CCW address is now used for
the virtio-mem device instead of getting overwritten by a PCI address.
+ * ch: Various memory leak fixes
+
+ There were some memory leaks identified in the Cloud Hypervisor driver.
+ They are fixed now.
+
v11.1.0 (2025-03-03)
====================
--
2.48.1
3 days, 4 hours
[PATCH rfcv4 00/13] LIBVIRT: X86: TDX support
by Zhenzhong Duan
Hi,
This series brings libvirt the x86 TDX support.
* What's TDX?
TDX stands for Trust Domain Extensions which isolates VMs from
the virtual-machine manager (VMM)/hypervisor and any other software on
the platform.
To support TDX, multiple software components, not only KVM but also QEMU,
guest Linux and virtual bios, need to be updated. For more details, please
check link[1].
This patchset is another software component to extend libvirt to support TDX,
with which one can start a TDX guest from high level rather than running qemu
directly.
* Misc
As QEMU use a software emulated way to reset guest which isn't supported by TDX
guest for security reason. We simulate reboot for TDX guest by kill and create a
new one in FakeReboot framework.
Complete code can be found at [2], matching qemu code can be found at [3].
There is a 'debug' property for tdx-guest object which isn't in matching qemu[3]
yet. I keep them intentionally as they will be implemented in qemu as extention
series of [3].
* Test
start/stop/reboot with virsh
stop/reboot trigger in guest
stop with on_poweroff=destroy/restart
reboot with on_reboot=destroy/restart
* Patch organization
- patch 1-4: Support query of TDX capabilities.
- patch 5-8: Add TDX type to launchsecurity framework.
- patch 9-11: Add reboot support to TDX guest
- patch 12-13: Add test and docs
TODO:
- update QEMU capabilities data in tests, depending on qemu TDX merged beforehand
- add reconnect logic in virsh command
[1] https://lore.kernel.org/kvm/cover.1708933498.git.isaku.yamahata@intel.com
[2] https://github.com/intel/libvirt-tdx/commits/tdx_for_upstream_rfcv4
[3] https://github.com/intel/qemu-tdx/tree/tdx-qemu-upstream-v5
Thanks
Zhenzhong
Changelog:
rfcv4:
- add a check to tools/virt-host-validate-qemu.c (Daniel)
- remove check of q35 (Daniel)
- model 'SocktetAddress' QAPI in xml schema (Daniel)
- s/Quote-Generation-Service/quoteGenerationService/ (Daniel)
- define bits in tdx->policy and add validating logic (Daniel)
- presume QEMU choose split kernel irqchip for TDX guest by default (Daniel)
- utilize existing FakeReboot framework to do reboot for TDX guest (Daniel)
- drop patch11 'conf: Add support to keep same domid for hard reboot' (Daniel)
- add test in tests/ to validate parsing and formatting logic (Daniel)
- add doc in docs/formatdomain.rst (Daniel)
- add R-B
rfcv3:
- Change to generate qemu cmdline with -bios
- drop firmware auto match as -bios is used
- add a hard reboot method to reboot TDX guest
rfcv3: https://www.mail-archive.com/devel@lists.libvirt.org/msg00385.html
rfcv2:
- give up using qmp cmd and check TDX directly on host for TDX capabilities.
- use launchsecurity framework to support TDX
- use <os>.<loader> for general loader
- add auto firmware match feature for TDX
A example TDVF fimware description file 70-edk2-x86_64-tdx.json:
{
"description": "UEFI firmware for x86_64, supporting Intel TDX",
"interface-types": [
"uefi"
],
"mapping": {
"device": "generic",
"filename": "/usr/share/OVMF/OVMF_CODE-tdx.fd"
},
"targets": [
{
"architecture": "x86_64",
"machines": [
"pc-q35-*"
]
}
],
"features": [
"intel-tdx",
"verbose-dynamic"
],
"tags": [
]
}
rfcv2: https://www.mail-archive.com/libvir-list@redhat.com/msg219378.html
Zhenzhong Duan (13):
tools: Secure guest check for Intel in virt-host-validate
qemu: Check if INTEL Trust Domain Extention support is enabled
qemu: Add TDX capability
conf: expose TDX feature in domain capabilities
conf: add tdx as launch security type
qemu: Add command line and validation for TDX type
qemu: force special parameters enabled for TDX guest
Add Intel TDX Quote Generation Service(QGS) support
qemu: add FakeReboot support for TDX guest
qemu: Support reboot command in guest
qemu: Avoid duplicate FakeReboot for secure guest
Add test cases for Intel TDX
docs: domain: Add documentation for Intel TDX guest
docs/formatdomain.rst | 68 ++++
docs/formatdomaincaps.rst | 1 +
src/conf/domain_capabilities.c | 1 +
src/conf/domain_capabilities.h | 1 +
src/conf/domain_conf.c | 312 ++++++++++++++++++
src/conf/domain_conf.h | 75 +++++
src/conf/schemas/domaincaps.rng | 9 +
src/conf/schemas/domaincommon.rng | 135 ++++++++
src/conf/virconftypes.h | 2 +
src/qemu/qemu_capabilities.c | 36 +-
src/qemu/qemu_capabilities.h | 1 +
src/qemu/qemu_command.c | 139 ++++++++
src/qemu/qemu_firmware.c | 1 +
src/qemu/qemu_monitor.c | 28 +-
src/qemu/qemu_monitor.h | 2 +-
src/qemu/qemu_monitor_json.c | 6 +-
src/qemu/qemu_namespace.c | 1 +
src/qemu/qemu_process.c | 75 +++++
src/qemu/qemu_validate.c | 44 +++
...unch-security-tdx-qgs-fd.x86_64-latest.xml | 77 +++++
.../launch-security-tdx-qgs-fd.xml | 30 ++
...ch-security-tdx-qgs-inet.x86_64-latest.xml | 77 +++++
.../launch-security-tdx-qgs-inet.xml | 30 ++
...ch-security-tdx-qgs-unix.x86_64-latest.xml | 77 +++++
.../launch-security-tdx-qgs-unix.xml | 30 ++
...h-security-tdx-qgs-vsock.x86_64-latest.xml | 77 +++++
.../launch-security-tdx-qgs-vsock.xml | 30 ++
tests/qemuxmlconftest.c | 24 ++
tools/virt-host-validate-common.c | 22 +-
tools/virt-host-validate-common.h | 1 +
30 files changed, 1407 insertions(+), 5 deletions(-)
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-fd.x86_64-latest.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-fd.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-inet.x86_64-latest.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-inet.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-unix.x86_64-latest.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-unix.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-vsock.x86_64-latest.xml
create mode 100644 tests/qemuxmlconfdata/launch-security-tdx-qgs-vsock.xml
--
2.34.1
4 days, 7 hours
