- Devel - libvirt List Archives

[libvirt][PATCH v6 0/6] Support query and use SGX
by Haibin Huang 23 Aug '21

23 Aug '21

This patch series provides support for enabling Intel's Software Guard Extensions (SGX) feature in guest VM. Giving the SGX support in QEMU is still pending for reviewing, this patch series is not submmited for code review, but only describe the SGX enabling solution design that contains changes to virConnectGetDomainCapabilities API response and domain definition. All comments/suggestions would be highly appreciated. Intel Software Guard Extensions (Intel® SGX) is a set of instructions that increases the security of application code and data, giving them more protection from disclosure or modification. Developers can partition sensitive information into enclaves, which are areas of execution in memory with more security protection. The typical flow looks below at very high level: 1. Calls virConnectGetDomainCapabilities API to domain capabilities that includes the following SGX information. <feature> ... <sgx supported='yes'> <epc_size unit=’KiB’>N</epc_size> </sgx> </feature> 2. User requests to start a guest calling virCreateXML() with SGX requirement. It should contain <devices> ... <memory model='sgx-epc'> <target> <size unit='KiB'>N</size> </target> </memory> ... </devices> Haibin Huang (3): Support to query SGX capability Add dommaincaps unit test add qemu capabilities version 5.2.0 Lin Yang (3): conf: Introduce SGX EPC element into device memory xml qemu: Add command-line to generate SGX EPC memory backend Add unit tests for guest VM creation command with SGX EPC docs/schemas/domaincaps.rng | 17 + docs/schemas/domaincommon.rng | 1 + src/conf/domain_capabilities.c | 29 + src/conf/domain_capabilities.h | 13 + src/conf/domain_conf.c | 4 + src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 2 +- src/qemu/qemu_alias.c | 8 +- src/qemu/qemu_capabilities.c | 146 + src/qemu/qemu_capabilities.h | 6 + src/qemu/qemu_command.c | 42 +- src/qemu/qemu_domain.c | 10 +- src/qemu/qemu_monitor.c | 10 + src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 91 + src/qemu/qemu_monitor_json.h | 3 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 2 + src/security/security_selinux.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + tests/domaincapsdata/empty.xml | 1 + tests/domaincapsdata/libxl-xenfv.xml | 1 + tests/domaincapsdata/libxl-xenpv.xml | 1 + .../domaincapsdata/qemu_1.5.3-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.5.3-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.5.3.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.1.1.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-tcg.x86_64.xml | 1 + .../qemu_2.10.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.10.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.11.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.4.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.5.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.7.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.8.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.8.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.9.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_3.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml | 1 + .../qemu_4.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 207 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 201 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 207 + .../caps_5.2.0.x86_64.replies | 29649 ++++++++++++++++ .../caps_5.2.0.x86_64.xml | 3189 ++ .../sgx-epc.x86_64-5.1.0.args | 41 + tests/qemuxml2argvdata/sgx-epc.xml | 40 + tests/qemuxml2argvtest.c | 1 + 123 files changed, 34013 insertions(+), 9 deletions(-) create mode 100644 tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_5.2.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml create mode 100644 tests/qemuxml2argvdata/sgx-epc.x86_64-5.1.0.args create mode 100644 tests/qemuxml2argvdata/sgx-epc.xml -- 2.17.1

3 11

Questions about the ownership of /var/cache/libvirt/qemu
by Peng Liang 23 Aug '21

23 Aug '21

Hi all, When we change the user for QEMU process (change "user" and "group" in /etc/libvirt/qemu.conf) to a normal user, we found that libvirtd will also change the ownership of /var/cache/libvirt/qemu but will keep the ownership of /var/cache/libvirt/qemu/capabilities as root. Is it secure to put files/directories owned by root in a directory owned by a normal user? Could the normal user replace the root's file with a new one? Does it need to set sticky bit on /var/cache/libvirt/qemu or keep the ownership of /var/cache/libvirt/qemu as root?

2 2

[PATCH 0/2] docs/about: some documentation clean-up
by Yanan Wang 23 Aug '21

23 Aug '21

These two patches (one of which has been reviewed) originally come from [1]. Here resend them separately as a short doc clean-up series. [1] https://lore.kernel.org/qemu-devel/20210819031027.41104-1-wangyanan55@huawe… Yanan Wang (2): docs/about: Remove the duplicated doc docs/about: Unify the subject format docs/about/deprecated.rst | 56 ++++++++++++++++----------------- docs/about/removed-features.rst | 41 +++++++++--------------- 2 files changed, 42 insertions(+), 55 deletions(-) -- 2.19.1

3 4

[libvirt PATCH 0/9] tests: cputest: use g_auto more (glib chronicles)
by Ján Tomko 20 Aug '21

20 Aug '21

Also improve the compilation times (unoptimized optimization routines take too long when there are too many branches in a function, which is the case of cputest's main) and switch qemuxml2* to use the same approach. Ján Tomko (9): qemu: monitor: define cleanup function for qemuMonitorCPUModelInfo tests: use g_auto in cpuTestMakeQEMUCaps tests: cputest: use g_auto for virQEMUCaps tests: cputest: use g_auto for virCPUData tests: cputest: use g_auto for virCPUDef tests: cputest: use g_autofree tests: cputest: remove unnecessary labels tests: cputests: introduce and use virTestRunLog tests: qemuxml2*test: switch to virRunTestLog src/qemu/qemu_monitor.h | 1 + tests/cputest.c | 239 +++++++++++----------------------- tests/qemustatusxml2xmltest.c | 3 +- tests/qemuxml2argvtest.c | 10 +- tests/qemuxml2xmltest.c | 9 +- tests/testutils.c | 30 +++++ tests/testutils.h | 4 + tests/testutilsqemu.h | 1 - 8 files changed, 114 insertions(+), 183 deletions(-) -- 2.31.1

2 10

[libvirt PATCH 0/5] virnetdevopenvswitch: fix overindented label (glib chronicles)
by Ján Tomko 20 Aug '21

20 Aug '21

By removing it, of course. Patch 1/5 also has the potential to fix the build on FreeBSD, but it failed with an internal server error for me. Ján Tomko (5): build: only build virnetdevopenvswitchtest on Linux tests: virnetdevopenvswitch: use g_auto tests: virnetdevbandwidthtest: use g_auto tests: introduce testVirNetDevBandwidthParse tests: virnetdev*: remove unnecessary labels tests/meson.build | 6 ++- tests/virnetdevbandwidthtest.c | 56 ++++++++++++------------- tests/virnetdevopenvswitchtest.c | 70 ++++++++++++++------------------ 3 files changed, 61 insertions(+), 71 deletions(-) -- 2.31.1

2 6

[PATCH 0/6] nwfilter define: add support for validation against schema
by Kristina Hanicova 20 Aug '21

20 Aug '21

Kristina Hanicova (6): api: add public virNWFilterDefineXMLFlags() and remote protocol nwfilter: add nwfilterDefineXMLFlags() api: add virNWFilterDefineFlags nwfilter_conf: add validation against schema in define nwfilter_driver: allow VIR_NWFILTER_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define nwfilter docs/manpages/virsh.rst | 5 +++- include/libvirt/libvirt-nwfilter.h | 7 +++++ src/conf/nwfilter_conf.c | 13 +++++---- src/conf/nwfilter_conf.h | 3 ++- src/driver-nwfilter.h | 6 +++++ src/libvirt-nwfilter.c | 43 ++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 ++++ src/nwfilter/nwfilter_driver.c | 21 ++++++++++++--- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 18 ++++++++++++- src/remote_protocol-structs | 8 ++++++ tools/virsh-nwfilter.c | 13 ++++++++- 12 files changed, 130 insertions(+), 13 deletions(-) -- 2.31.1

2 10

[PATCH 0/4] interface define: add support for validation against schema
by Kristina Hanicova 20 Aug '21

20 Aug '21

Kristina Hanicova (4): api: add virInterfaceDefineFlags conf: add validation and propagate flags into virInterfaceDefParse() src: allow validation flag in interface define virsh: add support for '--validate' option in define interface docs/manpages/virsh.rst | 5 +++-- include/libvirt/libvirt-interface.h | 4 ++++ src/conf/interface_conf.c | 14 ++++++++------ src/conf/interface_conf.h | 3 ++- src/conf/virinterfaceobj.c | 2 +- src/interface/interface_backend_netcf.c | 6 +++--- src/libvirt-interface.c | 2 +- src/test/test_driver.c | 4 ++-- tests/interfacexml2xmltest.c | 2 +- tools/virsh-interface.c | 10 +++++++++- 10 files changed, 34 insertions(+), 18 deletions(-) -- 2.31.1

2 6

[PATCH 0/4] secret define: add support for validation against schema
by Kristina Hanicova 20 Aug '21

20 Aug '21

Kristina Hanicova (4): api: add virSecretDefineFlags secret_conf: add validation against schema in define secret_driver: allow VIR_SECRET_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define secret docs/manpages/virsh.rst | 4 +++- include/libvirt/libvirt-secret.h | 5 +++++ src/conf/secret_conf.c | 13 ++++++++----- src/conf/secret_conf.h | 2 +- src/libvirt-secret.c | 2 +- src/secret/secret_driver.c | 4 ++-- tools/virsh-secret.c | 10 +++++++++- 7 files changed, 29 insertions(+), 11 deletions(-) -- 2.31.1

2 5

[PATCH v2 00/12] Implement detach device related APIs for test driver
by Luke Yue 20 Aug '21

20 Aug '21

v2: - Extract DetachXXXDeviceConfig functions from drivers and use them - Add a trial implementation of detach memballoon and TPM, if they are fine, more device support will be added to test driver in the future - Add expectError to testCompareOutputLit for some "fail on purpose" tests - Refine tests Luke Yue (12): conf: Introduce virDomainInputDefRemove and fix memory leak domain_driver: extract DetachXXXDeviceConfig related functions and use them test_driver: Implement virDomainDetachDeviceFlags test_driver: Implement virDomainDetachDeviceAlias test_driver: Implement virDomainDetachDevice conf: Add tpm helpers for future use test_driver: add TPM support for testDomainDetachDeviceLiveAndConfig conf: Add a memballoon helper for future use test_driver: add memballoon support for testDomainDetachDeviceLiveAndConfig examples: xml: test: add xml for testing devices related APIs virshtest: add expectError parameter to testCompareOutputLit tests: Test detach-device and detach-device-alias for test driver examples/xml/test/testdevcontroller.xml | 1 + examples/xml/test/testdevdiskcdrom.xml | 5 + examples/xml/test/testdevfs.xml | 6 + examples/xml/test/testdevhostdev.xml | 5 + examples/xml/test/testdevif.xml | 6 + examples/xml/test/testdevinput.xml | 1 + examples/xml/test/testdevlease.xml | 5 + examples/xml/test/testdevmem.xml | 6 + examples/xml/test/testdevmemballoon.xml | 3 + examples/xml/test/testdevrng.xml | 4 + examples/xml/test/testdevshmem.xml | 4 + examples/xml/test/testdevsound.xml | 3 + examples/xml/test/testdevtpm.xml | 5 + examples/xml/test/testdevvsock.xml | 3 + examples/xml/test/testdevwatchdog.xml | 1 + examples/xml/test/testdomfc5.xml | 54 +++++ examples/xml/test/testnodeinline.xml | 54 +++++ src/conf/domain_conf.c | 103 ++++++++ src/conf/domain_conf.h | 12 + src/hypervisor/domain_driver.c | 303 ++++++++++++++++++++++++ src/hypervisor/domain_driver.h | 47 ++++ src/libvirt_private.syms | 20 ++ src/libxl/libxl_driver.c | 41 +--- src/lxc/lxc_driver.c | 37 +-- src/qemu/qemu_driver.c | 124 ++-------- src/test/test_driver.c | 239 +++++++++++++++++++ tests/virshtest.c | 131 ++++++++-- 27 files changed, 1033 insertions(+), 190 deletions(-) create mode 100644 examples/xml/test/testdevcontroller.xml create mode 100644 examples/xml/test/testdevdiskcdrom.xml create mode 100644 examples/xml/test/testdevfs.xml create mode 100644 examples/xml/test/testdevhostdev.xml create mode 100644 examples/xml/test/testdevif.xml create mode 100644 examples/xml/test/testdevinput.xml create mode 100644 examples/xml/test/testdevlease.xml create mode 100644 examples/xml/test/testdevmem.xml create mode 100644 examples/xml/test/testdevmemballoon.xml create mode 100644 examples/xml/test/testdevrng.xml create mode 100644 examples/xml/test/testdevshmem.xml create mode 100644 examples/xml/test/testdevsound.xml create mode 100644 examples/xml/test/testdevtpm.xml create mode 100644 examples/xml/test/testdevvsock.xml create mode 100644 examples/xml/test/testdevwatchdog.xml -- 2.33.0

1 12

[libvirt PATCH 0/2] tests: use g_auto more (glib chronicles)
by Ján Tomko 20 Aug '21

20 Aug '21

Convert two more functions to use automatic cleanup. Ján Tomko (2): tests: use g_auto in testQemuGetCaps tests: use g_auto in qemuTestParseCapabilitiesArch tests/qemucaps2xmltest.c | 16 ++++++---------- tests/testutilsqemu.c | 10 +++------- 2 files changed, 9 insertions(+), 17 deletions(-) -- 2.31.1

3 4