- Devel - libvirt List Archives

[PATCH 0/5] Introduce UEFI shim support
by Michal Privoznik 06 Mar '25

06 Mar '25

*** BLURB HERE *** Michal Prívozník (5): conf: Introduce os/shim element qemu_capabilities: Introduce QEMU_CAPS_MACHINE_SHIM qemu_validate: Check whether UEFI shim is supported qemu_command: Generate cmd line for UEFI shim security: Set seclabels on UEFI shim docs/formatdomain.rst | 5 +++++ src/conf/domain_conf.c | 12 ++++++++---- src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 6 ++++++ src/conf/schemas/domaincommon.rng | 5 +++++ src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 2 ++ src/qemu/qemu_validate.c | 7 +++++++ src/security/security_dac.c | 10 ++++++++++ src/security/security_selinux.c | 9 +++++++++ src/security/virt-aa-helper.c | 4 ++++ tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml | 1 + tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml | 1 + .../launch-security-sev-direct.x86_64-latest.args | 1 + .../launch-security-sev-direct.x86_64-latest.xml | 1 + tests/qemuxmlconfdata/launch-security-sev-direct.xml | 1 + 17 files changed, 65 insertions(+), 4 deletions(-) -- 2.45.3

2 6

[PATCH 0/8] qemu: Follow-up to "schemas: domaincaps: Add missing schema for '<cpu0Id>'"
by Peter Krempa 04 Mar '25

04 Mar '25

As promised in the original patch fixing the schema this is the test-case follow up. As not entirely expected it's a bit more involved and also contains fixes for other bugs. Peter Krempa (8): qemu: capabilities: Parse 'cpu0Id' from capability cache XML domaincapstest: Use proper input file based on 'variant' in 'fillQemuCaps' domaincapstest: Allow tests of all capability variants qemucapabilitiesdata: Document '+amdsev' variant qemucapabilitiestest: Add test data for 'qemu-9.2' on a SEV-enabled AMD host qemuxmlconftest: Propery discriminate output files for caps variants qemuxmlconftest: Add 'latest' version of 'launch-security-sev*' originally using 6.0.0 qemuxmlconftest: Add '+amdsev' versions of the rest of 'launch-security-sev*' cases src/qemu/qemu_capabilities.c | 1 + .../qemu_7.0.0-hvf.aarch64+hvf.xml | 43 +- .../qemu_7.2.0-hvf.x86_64+hvf.xml | 952 +- .../qemu_9.2.0-q35.x86_64+amdsev.xml | 852 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1821 + .../qemu_9.2.0.x86_64+amdsev.xml | 852 + tests/domaincapstest.c | 21 +- tests/qemucapabilitiesdata/README.rst | 4 + .../caps_9.2.0_x86_64+amdsev.replies | 43857 ++++++++++++++++ .../caps_9.2.0_x86_64+amdsev.xml | 3132 ++ .../caps.x86_64+amdsev.xml | 29 + ...h64-virt-headless.aarch64-latest+hvf.args} | 0 ...ch64-virt-headless.aarch64-latest+hvf.xml} | 0 ...86_64-q35-headless.x86_64-latest+hvf.args} | 0 ...x86_64-q35-headless.x86_64-latest+hvf.xml} | 0 ...urity-sev-direct.x86_64-latest+amdsev.args | 38 + ...curity-sev-direct.x86_64-latest+amdsev.xml | 48 + ...ng-platform-info.x86_64-latest+amdsev.args | 35 + ...ing-platform-info.x86_64-latest+amdsev.xml | 43 + ...security-sev-snp.x86_64-latest+amdsev.args | 42 + ...-security-sev-snp.x86_64-latest+amdsev.xml | 73 + ...nch-security-sev.x86_64-latest+amdsev.args | 35 + ...unch-security-sev.x86_64-latest+amdsev.xml | 45 + tests/qemuxmlconftest.c | 40 +- tests/testutilsqemu.c | 6 +- 25 files changed, 51941 insertions(+), 28 deletions(-) create mode 100644 tests/domaincapsdata/qemu_9.2.0-q35.x86_64+amdsev.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0-tcg.x86_64+amdsev.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0.x86_64+amdsev.xml create mode 100644 tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.replies create mode 100644 tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml create mode 100644 tests/qemucaps2xmloutdata/caps.x86_64+amdsev.xml rename tests/qemuxmlconfdata/{hvf-aarch64-virt-headless.aarch64-latest.args => hvf-aarch64-virt-headless.aarch64-latest+hvf.args} (100%) rename tests/qemuxmlconfdata/{hvf-aarch64-virt-headless.aarch64-latest.xml => hvf-aarch64-virt-headless.aarch64-latest+hvf.xml} (100%) rename tests/qemuxmlconfdata/{hvf-x86_64-q35-headless.x86_64-latest.args => hvf-x86_64-q35-headless.x86_64-latest+hvf.args} (100%) rename tests/qemuxmlconfdata/{hvf-x86_64-q35-headless.x86_64-latest.xml => hvf-x86_64-q35-headless.x86_64-latest+hvf.xml} (100%) create mode 100644 tests/qemuxmlconfdata/launch-security-sev-direct.x86_64-latest+amdsev.args create mode 100644 tests/qemuxmlconfdata/launch-security-sev-direct.x86_64-latest+amdsev.xml create mode 100644 tests/qemuxmlconfdata/launch-security-sev-missing-platform-info.x86_64-latest+amdsev.args create mode 100644 tests/qemuxmlconfdata/launch-security-sev-missing-platform-info.x86_64-latest+amdsev.xml create mode 100644 tests/qemuxmlconfdata/launch-security-sev-snp.x86_64-latest+amdsev.args create mode 100644 tests/qemuxmlconfdata/launch-security-sev-snp.x86_64-latest+amdsev.xml create mode 100644 tests/qemuxmlconfdata/launch-security-sev.x86_64-latest+amdsev.args create mode 100644 tests/qemuxmlconfdata/launch-security-sev.x86_64-latest+amdsev.xml -- 2.48.1

2 9

[PATCH] docs/api.rst: revert erroneously change of Once -> OnDevice
by Cleber Rosa 04 Mar '25

04 Mar '25

Commit af1b89d1d for some reason changed a perfectly fine statement to one that I could not understand. Let's revert it. Signed-off-by: Cleber Rosa <crosa(a)redhat.com> --- docs/api.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api.rst b/docs/api.rst index cdba642967..243303de68 100644 --- a/docs/api.rst +++ b/docs/api.rst @@ -26,7 +26,7 @@ name will default to a preselected hypervisor, but it's probably not a wise thing to do in most cases. See the `connection URI <uri.html>`__ page for a full descriptions of the values allowed. -OnDevice the application obtains a +Once the application obtains a `virConnectPtr <html/libvirt-libvirt-host.html#virConnectPtr>`__ connection to the hypervisor it can then use it to manage the hypervisor's available domains and related virtualization resources, -- 2.48.1

2 1

[PATCH] schemas: domaincaps: Add missing schema for '<cpu0Id>'
by Peter Krempa 03 Mar '25

03 Mar '25

Fixes: 0236e6154c46603bc443eda2f05c8ce511c55b08 Resolves: https://issues.redhat.com/browse/RHEL-81890 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- I'll also attempt to add tests for this once I'll be able to get to a capability dump from a sev-es enabled box. src/conf/schemas/domaincaps.rng | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng index 3559d2ae05..595dbcd634 100644 --- a/src/conf/schemas/domaincaps.rng +++ b/src/conf/schemas/domaincaps.rng @@ -438,6 +438,11 @@ <data type="unsignedInt"/> </element> </optional> + <optional> + <element name="cpu0Id"> + <data type="string"/> + </element> + </optional> </element> </define> -- 2.48.1

2 1

[PATCH] qemuPrepareNVRAMFile: Fix NVRAM image conversion check
by Peter Krempa 03 Mar '25

03 Mar '25

In case when user provides custom paths (those not covered by the JSON firmware descriptor files or the default locations) for the loader and nvram template no auto-detection will be performed and user's config will be taken at face value. Historically when 'templateFormat' didn't exist we assumed that the 'format' field covers both. Thus if 'templateFormat' is VIR_STORAGE_FILE_NONE we need to skip the check forbidding image format conversion for 'file' backed to avoid breaking legacy configs with manual/non-detected format assuming that user picked the correct format. Add a comment to the declaration of 'nvramTemplateFormat' noting the above for future reference. Resolves: https://issues.redhat.com/browse/RHEL-81731 Fixes: 2aa644a2fc8 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/conf/domain_conf.h | 7 +++++++ src/qemu/qemu_process.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index d4fa79cb84..1fcc3fdb98 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2362,6 +2362,13 @@ struct _virDomainLoaderDef { virStorageSource *nvram; bool newStyleNVRAM; char *nvramTemplate; /* user override of path to master nvram */ + /* Historically it was assumed that the format of the template and the + * actual nvram image are identical, which is no longer true. + * + * Note: if 'nvramTemplate' comes from the user and is not overriden by + * auto-detection nvramTemplateFormat may be VIR_STORAGE_FILE_NONE. Code + * shall assume that the template format matches if it isn't provided. + */ virStorageFileFormat nvramTemplateFormat; }; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 0d9b8bcb93..7b7b5c17e3 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4709,7 +4709,10 @@ qemuPrepareNVRAMFile(virQEMUDriver *driver, return -1; } - if (loader->nvram->format != loader->nvramTemplateFormat) { + /* If 'nvramTemplateFormat' is empty it means that it's a user-provided + * template which we couldn't verify. Assume the user knows what they're doing */ + if (loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE && + loader->nvram->format != loader->nvramTemplateFormat) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("conversion of the nvram template to another target format is not supported")); return -1; -- 2.48.1

2 1

Release of libvirt-11.1.0
by Jiri Denemark 03 Mar '25

03 Mar '25

The 11.1.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Packaging changes * De-modularize the 'fs' storage file backend The storage file backend for local files uses only code which we compile into the internal libraries anyways so there's no point in having it as a loadable module. The ``storage-file/libvirt_storage_file_fs.so`` module no longer exists and its functionality is embedded directly. * Removed features * vbox: removed support for version 6.1 APIs Libvirt no longer supports use of VirtualBox 6.1 since this version reached its end of life on 2024/01. * New features * nodedev: Support ccwgroup based qeth devices CCW group devices are devices that use multiple subchannels on the mainframe's channel subsystem. A qeth group device maps to subchannels and their corresponding device numbers and device bus-IDs. The ``ccwgroup`` device nodes are placed besides the subchannel nodes under computer and list the group members within a new ``ccwgroup`` capability. A new capability ``ccwgroup_member`` is added into capability ``ccw`` to represent a device membership to a ccwgroup. Filters are added to find ccwgroups as well as ccwgroup members. * ch: Support handling events from cloud-hypervisor The ch driver now supports handling events from the cloud-hypervisor. Events include VM lifecyle operations such as shutdown, pause, resume, etc. Libvirt will now read these events and take actions such as updating domain state, etc. * Introduce virtio-mem ``<memory/>`` model for s390 guests The virtio-mem model of ``<memory/>`` device can now be used with s390 guests. * Support using passt as the backend for interface type='vhostuser' The combination of vhostuser transport with passt as the backend provides high performance, fully featured networking without the need for libvirt or QEMU to have any elevated privileges or capabilities. Configuration and features are identical to the configuration for type='user' with the passt backend. * Improvements * qemu: I/O error messages can be queried via ``virDomainGetMessages()`` The qemu hypervisor driver now preserves the last I/O error message along with the timestamp when it was recorded and preserves it to be queried via ``virDomainGetMessages()``. * Bug fixes * tools: ssh-proxy: Check if domain is running before connecting to it If domain is not running but has a static CID configured for its VSOCK then the ssh-proxy parsed it anyways. This may have resulted in mistakenly connecting to a different domain. Domain status is checked before parsing its CID. * apparmor: Allow SGX if configured If domain has ``<memory model='sgx-epc'\>`` configured then libvirt now adds corresponding devices into a per-domain profile so that AppArmor does not deny QEMU access to them. * qemu: Fix crash when starting a domain on a host with unknown host CPU On hosts where we cannot detect a host CPU model (mostly aarch64 hosts) starting a domain with a custom CPU model caused a crash of virtqemud. The bug was introduced in libvirt-10.9.0 Enjoy. Jirka

1 0

[PATCH 0/6] Add support for configuring PCI high memory MMIO size
by Matthew R. Ochs 01 Mar '25

01 Mar '25

This patch series adds support for configuring the PCI high memory MMIO window size for aarch64 virt machine types. This feature has been merged into the QEMU upstream staging branch [1] and will be available in QEMU 10.0. It allows users to configure the size of the high memory MMIO window above 4GB, which is particularly useful for systems with large amounts of PCI memory requirements. The feature is exposed through the domain XML as a new PCI feature: <features> <pci> <highmem-mmio-size unit='G'>512</highmem-mmio-size> </pci> </features> When enabled, this configures the size of the PCI high memory MMIO window via QEMU's highmem-mmio-size machine property. The feature is only available for aarch64 virt machine types and requires QEMU support. This series depends on [2] and should be applied on top of those patches. For your convenience, this series is also available on Github [3]. [1] https://lore.kernel.org/qemu-devel/20250221145419.1281890-1-mochs@nvidia.co… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/Z4NQ… [3] git fetch https://github.com/nvmochs/libvirt.git pci_highmem_mmio_size Signed-off-by: Matthew R. Ochs <mochs(a)nvidia.com> Matthew R. Ochs (6): domain: Add PCI configuration feature infrastructure schema: Add PCI configuration feature schema conf: Add PCI configuration XML parsing and formatting qemu: Add capability for PCI high memory MMIO size qemu: Add command line support for PCI high memory MMIO size tests: Add tests for machine PCI features src/conf/domain_conf.c | 103 ++++++++++++++++++ src/conf/domain_conf.h | 6 + src/conf/schemas/domaincommon.rng | 9 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 6 + src/qemu/qemu_validate.c | 15 +++ .../caps_10.0.0_aarch64.replies | 10 ++ .../caps_10.0.0_aarch64.xml | 1 + ...rch64-virt-machine-pci.aarch64-latest.args | 31 ++++++ ...arch64-virt-machine-pci.aarch64-latest.xml | 30 +++++ .../aarch64-virt-machine-pci.xml | 20 ++++ tests/qemuxmlconftest.c | 2 + 13 files changed, 236 insertions(+) create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/aarch64-virt-machine-pci.xml -- 2.46.0

1 6

[PATCH] virDomainHostdevDefNew: update users not to check return value
by Roman Bogorodskiy 28 Feb '25

28 Feb '25

virDomainHostdevDefNew() has been using g_new0() for a while now. As it calls abort() on OOM, it's not necessary to check whether the return value is NULL. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/conf/domain_conf.c | 3 +-- src/libxl/xen_common.c | 4 +--- src/libxl/xen_xl.c | 4 +--- src/lxc/lxc_native.c | 4 ---- src/vbox/vbox_common.c | 12 +----------- 5 files changed, 4 insertions(+), 23 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 5630a469be..d4ce85b3a1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13316,8 +13316,7 @@ virDomainHostdevDefParseXML(virDomainXMLOption *xmlopt, ctxt->node = node; - if (!(def = virDomainHostdevDefNew())) - goto error; + def = virDomainHostdevDefNew(); if (virXMLPropEnumDefault(node, "mode", virDomainHostdevModeTypeFromString, VIR_XML_PROP_NONE, diff --git a/src/libxl/xen_common.c b/src/libxl/xen_common.c index b7ec552631..cbcdbf5a00 100644 --- a/src/libxl/xen_common.c +++ b/src/libxl/xen_common.c @@ -445,9 +445,7 @@ xenParsePCI(char *entry) } } - if (!(hostdev = virDomainHostdevDefNew())) - return NULL; - + hostdev = virDomainHostdevDefNew(); hostdev->managed = false; hostdev->writeFiltering = filtered; hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI; diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index 53f6871efc..482b151666 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -924,9 +924,7 @@ xenParseXLUSB(virConf *conf, virDomainDef *def) key = nextkey; } - if (!(hostdev = virDomainHostdevDefNew())) - return -1; - + hostdev = virDomainHostdevDefNew(); hostdev->managed = false; hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB; hostdev->source.subsys.u.usb.bus = busNum; diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c index c0011e0600..7700804429 100644 --- a/src/lxc/lxc_native.c +++ b/src/lxc/lxc_native.c @@ -377,10 +377,6 @@ static virDomainHostdevDef * lxcCreateHostdevDef(const char *data) { virDomainHostdevDef *hostdev = virDomainHostdevDefNew(); - - if (!hostdev) - return NULL; - hostdev->mode = VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES; hostdev->source.caps.type = VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET; hostdev->source.caps.u.net.ifname = g_strdup(data); diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c index de3c9989a5..2121d7e2d1 100644 --- a/src/vbox/vbox_common.c +++ b/src/vbox/vbox_common.c @@ -3087,11 +3087,8 @@ vboxHostDeviceGetXMLDesc(struct _vboxDriver *data, virDomainDef *def, IMachine * /* Alloc mem needed for the filters now */ def->hostdevs = g_new0(virDomainHostdevDef *, def->nhostdevs); - for (i = 0; i < def->nhostdevs; i++) { + for (i = 0; i < def->nhostdevs; i++) def->hostdevs[i] = virDomainHostdevDefNew(); - if (!def->hostdevs[i]) - goto release_hostdevs; - } for (i = 0; i < deviceFilters.count; i++) { PRBool active = PR_FALSE; @@ -3138,13 +3135,6 @@ vboxHostDeviceGetXMLDesc(struct _vboxDriver *data, virDomainDef *def, IMachine * gVBoxAPI.UArray.vboxArrayRelease(&deviceFilters); VBOX_RELEASE(USBCommon); return; - - release_hostdevs: - for (i = 0; i < def->nhostdevs; i++) - virDomainHostdevDefFree(def->hostdevs[i]); - VIR_FREE(def->hostdevs); - - goto release_filters; } -- 2.47.1

2 1

[RFC PATCH v2 6/6] qemuxmlconftest: Adds Arm CCA support
by Akio Kakuno 28 Feb '25

28 Feb '25

- This test was added to check the xml used to launch the VM for Arm CCA support. This test was created using the method described in the documentation. Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> --- .../launch-security-cca.aarch64-latest.args | 30 +++++++++++++++++++ .../launch-security-cca.aarch64-latest.xml | 24 +++++++++++++++ tests/qemuxmlconfdata/launch-security-cca.xml | 16 ++++++++++ tests/qemuxmlconftest.c | 2 ++ 4 files changed, 72 insertions(+) create mode 100644 tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/launch-security-cca.xml diff --git a/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args new file mode 100644 index 0000000000..ea8c46735b --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.args @@ -0,0 +1,30 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-cca_test \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-cca_test/.config \ +/usr/bin/qemu-system-aarch64 \ +-name guest=cca_test,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-cca_test/master-key.aes"}' \ +-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,confidential-guest-support=rme0,acpi=off \ +-accel kvm \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 00010203-0405-4607-8809-0a0b0c0d0e0f \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-object '{"qom-type":"rme-guest","id":"rme0","measurement-algorithm":"sha256"}' \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml new file mode 100644 index 0000000000..382313472b --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.aarch64-latest.xml @@ -0,0 +1,24 @@ +<domain type='kvm'> + <name>cca_test</name> + <uuid>00010203-0405-4607-8809-0a0b0c0d0e0f</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='aarch64' machine='virt'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <gic version='3'/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + <controller type='pci' index='0' model='pcie-root'/> + <audio id='1' type='none'/> + </devices> + <launchSecurity type='cca'/> +</domain> diff --git a/tests/qemuxmlconfdata/launch-security-cca.xml b/tests/qemuxmlconfdata/launch-security-cca.xml new file mode 100644 index 0000000000..dccd67f8a5 --- /dev/null +++ b/tests/qemuxmlconfdata/launch-security-cca.xml @@ -0,0 +1,16 @@ +<domain type='kvm'> + <name>cca_test</name> + <uuid>00010203-0405-4607-8809-0a0b0c0d0e0f</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='aarch64' machine='virt'>hvm</type> + </os> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + </devices> + <launchSecurity type='cca'> + <measurement-algo>sha256</measurement-algo> + </launchSecurity> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 6a46bfc7a3..babe658359 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2877,6 +2877,8 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("launch-security-cca", "aarch64"); + DO_TEST_CAPS_LATEST("vhost-user-fs-fd-memory"); DO_TEST_CAPS_LATEST("vhost-user-fs-fd-openfiles"); DO_TEST_CAPS_LATEST("vhost-user-fs-hugepages"); -- 2.34.1

1 0

[RFC PATCH v2 5/6] domaincapstest: Adds Arm CCA support
by Akio Kakuno 28 Feb '25

28 Feb '25

- This test was added to check domain capabilities for Arm CCA support. This test was created using the method described in the documentation. Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> --- .../qemu_9.1.0-virt.aarch64.xml | 243 ++++++++++++++++++ tests/domaincapsdata/qemu_9.1.0.aarch64.xml | 243 ++++++++++++++++++ 2 files changed, 486 insertions(+) create mode 100644 tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_9.1.0.aarch64.xml diff --git a/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml b/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml new file mode 100644 index 0000000000..6c1ec1734a --- /dev/null +++ b/tests/domaincapsdata/qemu_9.1.0-virt.aarch64.xml @@ -0,0 +1,243 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-aarch64</path> + <domain>kvm</domain> + <machine>virt-9.2</machine> + <arch>aarch64</arch> + <vcpu max='512'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'> + <value>efi</value> + </enum> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='yes'> + <model usable='unknown' vendor='unknown'>a64fx</model> + <model usable='unknown' vendor='unknown'>arm1026</model> + <model usable='unknown' vendor='unknown'>arm1136</model> + <model usable='unknown' vendor='unknown'>arm1136-r2</model> + <model usable='unknown' vendor='unknown'>arm1176</model> + <model usable='unknown' vendor='unknown'>arm11mpcore</model> + <model usable='unknown' vendor='unknown'>arm926</model> + <model usable='unknown' vendor='unknown'>arm946</model> + <model usable='unknown' vendor='unknown'>cortex-a15</model> + <model usable='unknown' vendor='unknown'>cortex-a35</model> + <model usable='unknown' vendor='unknown'>cortex-a53</model> + <model usable='unknown' vendor='unknown'>cortex-a55</model> + <model usable='unknown' vendor='unknown'>cortex-a57</model> + <model usable='unknown' vendor='unknown'>cortex-a7</model> + <model usable='unknown' vendor='unknown'>cortex-a710</model> + <model usable='unknown' vendor='unknown'>cortex-a72</model> + <model usable='unknown' vendor='unknown'>cortex-a76</model> + <model usable='unknown' vendor='unknown'>cortex-a8</model> + <model usable='unknown' vendor='unknown'>cortex-a9</model> + <model usable='unknown' vendor='unknown'>cortex-m0</model> + <model usable='unknown' vendor='unknown'>cortex-m3</model> + <model usable='unknown' vendor='unknown'>cortex-m33</model> + <model usable='unknown' vendor='unknown'>cortex-m4</model> + <model usable='unknown' vendor='unknown'>cortex-m55</model> + <model usable='unknown' vendor='unknown'>cortex-m7</model> + <model usable='unknown' vendor='unknown'>cortex-r5</model> + <model usable='unknown' vendor='unknown'>cortex-r52</model> + <model usable='unknown' vendor='unknown'>cortex-r5f</model> + <model usable='unknown' vendor='unknown'>max</model> + <model usable='unknown' vendor='unknown'>neoverse-n1</model> + <model usable='unknown' vendor='unknown'>neoverse-n2</model> + <model usable='unknown' vendor='unknown'>neoverse-v1</model> + <model usable='unknown' vendor='unknown'>pxa250</model> + <model usable='unknown' vendor='unknown'>pxa255</model> + <model usable='unknown' vendor='unknown'>pxa260</model> + <model usable='unknown' vendor='unknown'>pxa261</model> + <model usable='unknown' vendor='unknown'>pxa262</model> + <model usable='unknown' vendor='unknown'>pxa270</model> + <model usable='unknown' vendor='unknown'>pxa270-a0</model> + <model usable='unknown' vendor='unknown'>pxa270-a1</model> + <model usable='unknown' vendor='unknown'>pxa270-b0</model> + <model usable='unknown' vendor='unknown'>pxa270-b1</model> + <model usable='unknown' vendor='unknown'>pxa270-c0</model> + <model usable='unknown' vendor='unknown'>pxa270-c5</model> + <model usable='unknown' vendor='unknown'>sa1100</model> + <model usable='unknown' vendor='unknown'>sa1110</model> + <model usable='unknown' vendor='unknown'>ti925t</model> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>floppy</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>fdc</value> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>sata</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>vga</value> + <value>cirrus</value> + <value>virtio</value> + <value>none</value> + <value>bochs</value> + <value>ramfb</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-tis</value> + </enum> + <enum name='backendModel'> + <value>passthrough</value> + <value>emulator</value> + <value>external</value> + </enum> + <enum name='backendVersion'> + <value>2.0</value> + </enum> + </tpm> + <redirdev supported='no'/> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>pvpanic</value> + </enum> + </panic> + </devices> + <features> + <gic supported='yes'> + <enum name='version'> + <value>3</value> + </enum> + </gic> + <vmcoreinfo supported='yes'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <ps2 supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <cca supported='yes'> + <enum name='measurement-algo'> + <value>sha256</value> + <value>sha512</value> + </enum> + </cca> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>cca</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> diff --git a/tests/domaincapsdata/qemu_9.1.0.aarch64.xml b/tests/domaincapsdata/qemu_9.1.0.aarch64.xml new file mode 100644 index 0000000000..6c1ec1734a --- /dev/null +++ b/tests/domaincapsdata/qemu_9.1.0.aarch64.xml @@ -0,0 +1,243 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-aarch64</path> + <domain>kvm</domain> + <machine>virt-9.2</machine> + <arch>aarch64</arch> + <vcpu max='512'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'> + <value>efi</value> + </enum> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='yes'> + <model usable='unknown' vendor='unknown'>a64fx</model> + <model usable='unknown' vendor='unknown'>arm1026</model> + <model usable='unknown' vendor='unknown'>arm1136</model> + <model usable='unknown' vendor='unknown'>arm1136-r2</model> + <model usable='unknown' vendor='unknown'>arm1176</model> + <model usable='unknown' vendor='unknown'>arm11mpcore</model> + <model usable='unknown' vendor='unknown'>arm926</model> + <model usable='unknown' vendor='unknown'>arm946</model> + <model usable='unknown' vendor='unknown'>cortex-a15</model> + <model usable='unknown' vendor='unknown'>cortex-a35</model> + <model usable='unknown' vendor='unknown'>cortex-a53</model> + <model usable='unknown' vendor='unknown'>cortex-a55</model> + <model usable='unknown' vendor='unknown'>cortex-a57</model> + <model usable='unknown' vendor='unknown'>cortex-a7</model> + <model usable='unknown' vendor='unknown'>cortex-a710</model> + <model usable='unknown' vendor='unknown'>cortex-a72</model> + <model usable='unknown' vendor='unknown'>cortex-a76</model> + <model usable='unknown' vendor='unknown'>cortex-a8</model> + <model usable='unknown' vendor='unknown'>cortex-a9</model> + <model usable='unknown' vendor='unknown'>cortex-m0</model> + <model usable='unknown' vendor='unknown'>cortex-m3</model> + <model usable='unknown' vendor='unknown'>cortex-m33</model> + <model usable='unknown' vendor='unknown'>cortex-m4</model> + <model usable='unknown' vendor='unknown'>cortex-m55</model> + <model usable='unknown' vendor='unknown'>cortex-m7</model> + <model usable='unknown' vendor='unknown'>cortex-r5</model> + <model usable='unknown' vendor='unknown'>cortex-r52</model> + <model usable='unknown' vendor='unknown'>cortex-r5f</model> + <model usable='unknown' vendor='unknown'>max</model> + <model usable='unknown' vendor='unknown'>neoverse-n1</model> + <model usable='unknown' vendor='unknown'>neoverse-n2</model> + <model usable='unknown' vendor='unknown'>neoverse-v1</model> + <model usable='unknown' vendor='unknown'>pxa250</model> + <model usable='unknown' vendor='unknown'>pxa255</model> + <model usable='unknown' vendor='unknown'>pxa260</model> + <model usable='unknown' vendor='unknown'>pxa261</model> + <model usable='unknown' vendor='unknown'>pxa262</model> + <model usable='unknown' vendor='unknown'>pxa270</model> + <model usable='unknown' vendor='unknown'>pxa270-a0</model> + <model usable='unknown' vendor='unknown'>pxa270-a1</model> + <model usable='unknown' vendor='unknown'>pxa270-b0</model> + <model usable='unknown' vendor='unknown'>pxa270-b1</model> + <model usable='unknown' vendor='unknown'>pxa270-c0</model> + <model usable='unknown' vendor='unknown'>pxa270-c5</model> + <model usable='unknown' vendor='unknown'>sa1100</model> + <model usable='unknown' vendor='unknown'>sa1110</model> + <model usable='unknown' vendor='unknown'>ti925t</model> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>floppy</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>fdc</value> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>sata</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>vga</value> + <value>cirrus</value> + <value>virtio</value> + <value>none</value> + <value>bochs</value> + <value>ramfb</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-tis</value> + </enum> + <enum name='backendModel'> + <value>passthrough</value> + <value>emulator</value> + <value>external</value> + </enum> + <enum name='backendVersion'> + <value>2.0</value> + </enum> + </tpm> + <redirdev supported='no'/> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>pvpanic</value> + </enum> + </panic> + </devices> + <features> + <gic supported='yes'> + <enum name='version'> + <value>3</value> + </enum> + </gic> + <vmcoreinfo supported='yes'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <ps2 supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <cca supported='yes'> + <enum name='measurement-algo'> + <value>sha256</value> + <value>sha512</value> + </enum> + </cca> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>cca</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> -- 2.34.1

1 0