[libvirt] [PATCH 0/4] Enable support for s390 crypto key mgmt operations
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com> The IBM System z Central Processor Assist for Cryptographic Functions (CPACF) hardware provides a set of CPU instructions for use in clear-key encryption, pseudo random number generation, hash functions, and protected-key encryption. The CPACF protected key cryptographic functions operate with a protected key which is encrypted under a unique wrapping key that is stored in the Hardware System Area (HSA) of the machine and can only be accessed by firmware. The wrapping key cannot be accessed by the operating system or application programs. There are two wrapping keys: One for wrapping AES keys and one for wrapping DES/TDES keys. This patch set enables the support for encrypting clear keys under the AES and DES/TDES wrapping keys for guests started on hosts running on s390 hardware that supports key wrapping. Tony Krowiak (4): libvirt: docs: XML to enable/disable protected key mgmt ops libvirt: conf: parse XML for protected key management ops libvirt: qemu: enable/disable protected key management ops libvirt: tests: test protected key mgmt ops support
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Two new domain configuration XML elements have been added to enable/disable the protected key management operations for a guest: <domain> ... <keywrap> <cipher name='aes|dea' state='on|off'/> </keywrap> ... </domain> Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Viktor Mihajlovski <mihajlov@de.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- docs/formatdomain.html.in | 37 +++++++++++++++++++++++++++++++++++++ docs/schemas/domaincommon.rng | 24 ++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 0 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 0767a2a..0553a79 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -6211,6 +6211,43 @@ qemu-kvm -net nic,model=? /dev/null being on a file system that lacks security labeling. </p> + <h3><a name="keywrap" shape="rect" id="keywrap">Key Wrap</a></h3> + + <p>The content of the optional <code>keywrap</code> element specifies + whether the guest will be allowed to perform the S390 cryptographic key + management operations. A clear key can be protected by encrypting it + under a unique wrapping key that is generated for each guest VM running + on the host. Two variations of wrapping keys are generated: one version + for encrypting protected keys using the DEA/TDEA algorithm, and another + version for keys encrypted using the AES algorithm. If a + <code>keywrap</code> element is not included, the guest will be granted + access to both AES and DEA/TDEA key wrapping by default.</p> + + <pre xml:space="preserve"> +<domain> + ... + <keywrap> + <cipher name='aes' state='off'/> + <keywrap/> + ... +</domain> +</pre> + <p>At least one <code>cipher</code> element must be nested within the + <code>keywrap</code> element.</p> + <dl><dt><code>cipher</code></dt> + <dd>The <code>name</code> attribute identifies the algorithm + for encrypting a protected key. The values supported for this attribute + are <code>aes</code> for encryption under the AES wrapping key, or + <code>dea</code> for encryption under the DEA/TDEA wrapping key. The + <code>state</code> attribute indicates whether the cryptographic key + management operations should be turned on for the specified encryption + algorithm. The value can be set to <code>on</code> or <code>off</code>. + A default state of <code>on</code> will be assumed if a + <code>cipher</code> element is not included for the AES or DEA/TDEA + encryption algorithm. + </dd></dl> + + Note: DEA/TDEA is synonymous with DES/TDES. <h2><a name="examples">Example configs</a></h2> <p> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 7072954..71d9681 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -67,6 +67,9 @@ <optional> <ref name='qemucmdline'/> </optional> + <optional> + <ref name='keywrap'/> + </optional> </interleave> </element> </define> @@ -382,6 +385,27 @@ </element> </define> + <define name="keywrap"> + <element name="keywrap"> + <oneOrMore> + <element name="cipher"> + <attribute name="name"> + <choice> + <value>aes</value> + <value>dea</value> + </choice> + </attribute> + <attribute name="state"> + <choice> + <value>on</value> + <value>off</value> + </choice> + </attribute> + </element> + </oneOrMore> + </element> + </define> + <!-- The Identifiers can be: - an optional id attribute with a number on the domain element -- 1.7.1
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Parse the domain configuration XML elements that enable/disable access to the protected key management operations for a guest: <domain> ... <keywrap> <cipher name='aes|dea' state='on|off'/> </keywrap> ... </domain> Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/conf/domain_conf.c | 189 ++++++++++++++++++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 20 +++++ src/libvirt_private.syms | 2 + 3 files changed, 211 insertions(+), 0 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 0b18720..4c8d934 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -476,6 +476,11 @@ VIR_ENUM_IMPL(virDomainSoundModel, VIR_DOMAIN_SOUND_MODEL_LAST, "ich9", "usb") +VIR_ENUM_IMPL(virDomainKeyWrapCipherName, + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_LAST, + "aes", + "dea") + VIR_ENUM_IMPL(virDomainMemballoonModel, VIR_DOMAIN_MEMBALLOON_MODEL_LAST, "virtio", "xen", @@ -835,6 +840,124 @@ virDomainXMLOptionClassDispose(void *obj) /** + * virDomainKeyWrapCipherDefParseXML: + * + * @def Domain definition + * @node An XML cipher node + * @ctxt The XML context + * + * Parse the attributes from the cipher node and store the state attribute in + * @def + * + * A cipher node has the form of + * + * <cipher name='aes|dea' state='on|off'/> + * + * Returns 0 if the parse succeeded, otherwise; returns -1 + */ +static int +virDomainKeyWrapCipherDefParseXML(virDomainDefPtr def, xmlNodePtr node, + xmlXPathContextPtr ctxt) +{ + + char *name = NULL; + char *state = NULL; + int state_type; + int name_type; + int rc = -1; + xmlNodePtr oldnode = ctxt->node; + ctxt->node = node; + name = virXPathString("string(./@name)", ctxt); + + if (name == NULL) { + virReportError(VIR_ERR_CONF_SYNTAX, "%s", + _("missing name for cipher")); + goto error; + } + + if ((name_type = virDomainKeyWrapCipherNameTypeFromString(name)) < 0) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("%s is not a supported cipher name"), name); + goto error; + } + + state = virXPathString("string(./@state)", ctxt); + + if (state == NULL) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("missing state for cipher named %s"), name); + goto error; + } + + if ((state_type = virTristateSwitchTypeFromString(state)) < 0) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("%s is not a supported cipher state"), state); + goto error; + } + + switch (name_type) { + case VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_AES: + if (def->keywrap.aes != VIR_TRISTATE_SWITCH_ABSENT) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("A domain definition can have no more than " + "one cipher node with name %s"), + virDomainKeyWrapCipherNameTypeToString(name_type)); + + goto error; + } + def->keywrap.aes = state_type; + break; + case VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_DEA: + if (def->keywrap.dea != VIR_TRISTATE_SWITCH_ABSENT) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("A domain definition can have no more than " + "one cipher node with name %s"), + virDomainKeyWrapCipherNameTypeToString(name_type)); + + goto error; + } + def->keywrap.dea = state_type; + break; + default: + virReportError(VIR_ERR_CONF_SYNTAX, + _("%s is not a supported cipher name"), name); + goto error; + } + + ctxt->node = oldnode; + rc = 0; + + error: + VIR_FREE(name); + VIR_FREE(state); + return rc; +} + +static int +virDomainKeyWrapDefParseXML(virDomainDefPtr def, xmlXPathContextPtr ctxt) +{ + size_t i; + int rc = -1; + xmlNodePtr *nodes = NULL; + int n = virXPathNodeSet("./keywrap/cipher", ctxt, &nodes); + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; + + for (i = 0; i < n; i++) { + if (virDomainKeyWrapCipherDefParseXML(def, nodes[i], ctxt) < 0) + goto error; + } + + rc = 0; + + error: + VIR_FREE(nodes); + + return rc; +} + + +/** * virDomainXMLOptionNew: * * Allocate a new domain XML configuration @@ -15558,6 +15681,9 @@ virDomainDefParseXML(xmlDocPtr xml, VIR_FREE(tmp); } + if (virDomainKeyWrapDefParseXML(def, ctxt) < 0) + goto error; + /* Extract custom metadata */ if ((node = virXPathNode("./metadata[1]", ctxt)) != NULL) def->metadata = xmlCopyNode(node, 1); @@ -20598,6 +20724,66 @@ virDomainLoaderDefFormat(virBufferPtr buf, } } +static int +virDomainKeyGetWrapCipherValue(int cdef, char **cstate, const char *cname) +{ + const char *state; + + if (cdef != VIR_TRISTATE_SWITCH_ABSENT) { + state = virTristateSwitchTypeToString(cdef); + + if (state == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected %s key wrap state %d"), cname, cdef); + return -1; + } + + if (VIR_STRDUP(*cstate, state) < 0) + return -1; + } + + return 0; +} + +static int +virDomainKeyWrapDefFormat(virBufferPtr buf, virDomainDefPtr def) +{ + char *aes_state = NULL; + char *dea_state = NULL; + const char *aes_name = + virDomainKeyWrapCipherNameTypeToString( + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_AES); + const char *dea_name = + virDomainKeyWrapCipherNameTypeToString( + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_DEA); + + if ((virDomainKeyGetWrapCipherValue(def->keywrap.aes, &aes_state, + aes_name) < 0) || + (virDomainKeyGetWrapCipherValue(def->keywrap.dea, &dea_state, + dea_name) < 0)) + return -1; + + if (aes_state || dea_state) { + virBufferAddLit(buf, "<keywrap>\n"); + virBufferAdjustIndent(buf, 2); + + if (aes_state) + virBufferAsprintf(buf, "<cipher name='%s' state='%s'/>\n", + aes_name, aes_state); + + if (dea_state) + virBufferAsprintf(buf, "<cipher name='%s' state='%s'/>\n", + dea_name, dea_state); + + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</keywrap>\n"); + VIR_FREE(aes_state); + VIR_FREE(dea_state); + } + + return 0; +} + static bool virDomainDefHasCapabilitiesFeatures(virDomainDefPtr def) { @@ -21489,6 +21675,9 @@ virDomainDefFormatInternal(virDomainDefPtr def, goto error; } + if (virDomainKeyWrapDefFormat(buf, def) < 0) + goto error; + virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "</domain>\n"); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 0761eee..bc467f9 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2126,6 +2126,13 @@ struct _virDomainPowerManagement { int s4; }; +typedef struct _virDomainKeyWrapDef virDomainKeyWrapDef; +typedef virDomainKeyWrapDef *virDomainKeyWrapPtr; +struct _virDomainKeyWrapDef { + int aes; /* enum virTristateSwitch */ + int dea; +}; + /* * Guest VM main configuration * @@ -2263,12 +2270,24 @@ struct _virDomainDef { /* Application-specific custom metadata */ xmlNodePtr metadata; + + virDomainKeyWrapDef keywrap; }; unsigned long long virDomainDefGetMemoryInitial(virDomainDefPtr def); void virDomainDefSetMemoryInitial(virDomainDefPtr def, unsigned long long size); unsigned long long virDomainDefGetMemoryActual(virDomainDefPtr def); +# define VIR_DOMAIN_AES_KEY_WRAP_DEFAULT VIR_TRISTATE_SWITCH_ON +# define VIR_DOMAIN_DEA_KEY_WRAP_DEFAULT VIR_TRISTATE_SWITCH_ON + +enum { + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_AES, + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_DEA, + + VIR_DOMAIN_KEY_WRAP_CIPHER_NAME_LAST +} virDomainKeyWrapCipherName; + typedef enum { VIR_DOMAIN_TAINT_CUSTOM_ARGV, /* Custom ARGV passthrough from XML */ VIR_DOMAIN_TAINT_CUSTOM_MONITOR, /* Custom monitor commands issued */ @@ -2958,6 +2977,7 @@ VIR_ENUM_DECL(virDomainChrTcpProtocol) VIR_ENUM_DECL(virDomainChrSpicevmc) VIR_ENUM_DECL(virDomainSoundCodec) VIR_ENUM_DECL(virDomainSoundModel) +VIR_ENUM_DECL(virDomainKeyWrapCipherName) VIR_ENUM_DECL(virDomainMemballoonModel) VIR_ENUM_DECL(virDomainSmbiosMode) VIR_ENUM_DECL(virDomainWatchdogModel) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 3a99813..7aa178f 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -330,6 +330,8 @@ virDomainIOThreadIDDefFree; virDomainIOThreadIDDel; virDomainIOThreadIDFind; virDomainIOThreadSchedDelId; +virDomainKeyWrapCipherNameTypeFromString; +virDomainKeyWrapCipherNameTypeToString; virDomainLeaseDefFree; virDomainLeaseIndex; virDomainLeaseInsert; -- 1.7.1
On 27.04.2015 23:57, akrowiak@linux.vnet.ibm.com wrote:
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
Parse the domain configuration XML elements that enable/disable access to the protected key management operations for a guest:
<domain> ... <keywrap> <cipher name='aes|dea' state='on|off'/> </keywrap> ... </domain>
Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/conf/domain_conf.c | 189 ++++++++++++++++++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 20 +++++ src/libvirt_private.syms | 2 + 3 files changed, 211 insertions(+), 0 deletions(-)
Er. I'm just too lazy to point out all the bits. I'm gonna rework and post v2. Michal
On 05/15/2015 10:39 AM, Michal Privoznik wrote:
On 27.04.2015 23:57, akrowiak@linux.vnet.ibm.com wrote:
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
Parse the domain configuration XML elements that enable/disable access to the protected key management operations for a guest:
<domain> ... <keywrap> <cipher name='aes|dea' state='on|off'/> </keywrap> ... </domain>
Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/conf/domain_conf.c | 189 ++++++++++++++++++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 20 +++++ src/libvirt_private.syms | 2 + 3 files changed, 211 insertions(+), 0 deletions(-)
Er. I'm just too lazy to point out all the bits. I'm gonna rework and post v2. Does that mean you will be reworking the parsing code as well?
Michal
From: Tony Krowiak <aekrowia@us.ibm.com> Introduces two new -machine option parameters to the QEMU command to enable/disable the CPACF protected key management operations for a guest: aes-key-wrap='on|off' dea-key-wrap='on|off' The QEMU code maps the corresponding domain configuration elements to the QEMU -machine option parameters to create the QEMU command: <cipher name='aes' state='on'> --> aes-key-wrap=on <cipher name='aes' state='off'> --> aes-key-wrap=off <cipher name='dea' state='on'> --> dea-key-wrap=on <cipher name='dea' state='off'> --> dea-key-wrap=off Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Signed-off-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/qemu/qemu_capabilities.c | 5 +++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 72 ++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_domain.c | 39 ++++++++++++++++++++++- 4 files changed, 117 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index a458611..d1b9f6f 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -279,6 +279,9 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "qxl.vgamem_mb", "qxl-vga.vgamem_mb", "pc-dimm", + + "aes-key-wrap", /* 185 */ + "dea-key-wrap", ); @@ -2518,6 +2521,8 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = { { "msg", "timestamp", QEMU_CAPS_MSG_TIMESTAMP }, { "numa", NULL, QEMU_CAPS_NUMA }, { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX}, + { "machine", "aes-key-wrap", QEMU_CAPS_AES_KEY_WRAP }, + { "machine", "dea-key-wrap", QEMU_CAPS_DEA_KEY_WRAP }, }; static int diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index c7b1ac7..31e0494 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -224,6 +224,8 @@ typedef enum { QEMU_CAPS_QXL_VGAMEM = 182, /* -device qxl.vgamem_mb */ QEMU_CAPS_QXL_VGA_VGAMEM = 183, /* -device qxl-vga.vgamem_mb */ QEMU_CAPS_DEVICE_PC_DIMM = 184, /* pc-dimm device */ + QEMU_CAPS_AES_KEY_WRAP = 185, /* -machine aes_key_wrap */ + QEMU_CAPS_DEA_KEY_WRAP = 186, /* -machine dea_key_wrap */ QEMU_CAPS_LAST, /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 247954f..8ff1d88 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -38,6 +38,7 @@ #include "virnetdevbridge.h" #include "virstring.h" #include "virtime.h" +#include "virutil.h" #include "viruuid.h" #include "c-ctype.h" #include "domain_nwfilter.h" @@ -7295,6 +7296,39 @@ qemuBuildObsoleteAccelArg(virCommandPtr cmd, return 0; } +static bool +qemuAppendKeyWrapMachineParm(virBuffer *buf, virQEMUCapsPtr qemuCaps, + int flag, const char *pname, int pstate) +{ + if (pstate != VIR_TRISTATE_SWITCH_ABSENT) { + if (!virQEMUCapsGet(qemuCaps, flag)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("%s is not available with this QEMU binary"), pname); + return false; + } + + virBufferAsprintf(buf, ",%s=%s", pname, + virTristateSwitchTypeToString(pstate)); + } + + return true; +} + +static bool +qemuAppendKeyWrapMachineParms(virBuffer *buf, virQEMUCapsPtr qemuCaps, + const virDomainDef *def) +{ + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_AES_KEY_WRAP, + "aes-key-wrap", def->keywrap.aes)) + return false; + + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_DEA_KEY_WRAP, + "dea-key-wrap", def->keywrap.dea)) + return false; + + return true; +} + static int qemuBuildMachineArgStr(virCommandPtr cmd, const virDomainDef *def, @@ -7329,6 +7363,14 @@ qemuBuildMachineArgStr(virCommandPtr cmd, } obsoleteAccel = true; + + if ((def->keywrap.aes != VIR_TRISTATE_SWITCH_ABSENT) || + (def->keywrap.dea != VIR_TRISTATE_SWITCH_ABSENT)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("key wrap support is not available " + "with this QEMU binary")); + return -1; + } } else { virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -7373,6 +7415,11 @@ qemuBuildMachineArgStr(virCommandPtr cmd, } } + if (!qemuAppendKeyWrapMachineParms(&buf, qemuCaps, def)) { + virBufferFreeAndReset(&buf); + return -1; + } + virCommandAddArgBuffer(cmd, &buf); } @@ -12772,6 +12819,9 @@ qemuParseCommandLine(virCapsPtr qemuCaps, } /* handle all remaining "-machine" parameters */ + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; + while ((param = list[j++])) { if (STRPREFIX(param, "dump-guest-core=")) { param += strlen("dump-guest-core="); @@ -12783,6 +12833,28 @@ qemuParseCommandLine(virCapsPtr qemuCaps, } else if (STRPREFIX(param, "accel=kvm")) { def->virtType = VIR_DOMAIN_VIRT_KVM; def->features[VIR_DOMAIN_FEATURE_PAE] = VIR_TRISTATE_SWITCH_ON; + } else if (STRPREFIX(param, "aes-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("aes-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("aes-key-wrap="); + def->keywrap.aes = virTristateSwitchTypeFromString(param); + if (def->keywrap.aes < 0) + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + } else if (STRPREFIX(param, "dea-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("dea-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("dea-key-wrap="); + def->keywrap.dea = virTristateSwitchTypeFromString(param); + if (def->keywrap.dea < 0) + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; } } virStringFreeList(list); diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 2478ad7..7d2f977 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -899,11 +899,41 @@ virDomainXMLNamespace virQEMUDriverDomainXMLNamespace = { }; +static bool +qemuDomainKeyWrapCapsGet(virQEMUDriverPtr driver, virDomainDefPtr def, + virQEMUCapsFlags flag) +{ + virQEMUCapsPtr qemuCaps = NULL; + + if (driver->qemuCapsCache && def->emulator) + qemuCaps = virQEMUCapsCacheLookup(driver->qemuCapsCache, def->emulator); + + return virQEMUCapsGet(qemuCaps, flag); +} + +static int +qemuDomainKeyWrapSetDefaults(virQEMUDriverPtr driver, virDomainDefPtr def) +{ + if (def->keywrap.aes == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_AES_KEY_WRAP)) + def->keywrap.aes = VIR_DOMAIN_AES_KEY_WRAP_DEFAULT; + } + + if (def->keywrap.dea == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_DEA_KEY_WRAP)) + def->keywrap.dea = VIR_DOMAIN_DEA_KEY_WRAP_DEFAULT; + } + + return 0; +} + + static int qemuDomainDefPostParse(virDomainDefPtr def, virCapsPtr caps, - void *opaque ATTRIBUTE_UNUSED) + void *opaque) { + virQEMUDriverPtr driver = opaque; bool addDefaultUSB = true; bool addImplicitSATA = false; bool addPCIRoot = false; @@ -911,6 +941,7 @@ qemuDomainDefPostParse(virDomainDefPtr def, bool addDefaultMemballoon = true; bool addDefaultUSBKBD = false; bool addDefaultUSBMouse = false; + bool setDefaultKeyWrap = false; if (def->os.bootloader || def->os.bootloaderArgs) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", @@ -974,9 +1005,11 @@ qemuDomainDefPostParse(virDomainDefPtr def, break; case VIR_ARCH_S390: addDefaultUSB = false; + setDefaultKeyWrap = true; break; case VIR_ARCH_S390X: addDefaultUSB = false; + setDefaultKeyWrap = true; break; case VIR_ARCH_SPARC: @@ -1045,6 +1078,10 @@ qemuDomainDefPostParse(virDomainDefPtr def, VIR_DOMAIN_INPUT_BUS_USB) < 0) return -1; + if (setDefaultKeyWrap) + if (qemuDomainKeyWrapSetDefaults(driver, def) < 0) + return -1; + return 0; } -- 1.7.1
On 27.04.2015 23:57, akrowiak@linux.vnet.ibm.com wrote:
From: Tony Krowiak <aekrowia@us.ibm.com>
Introduces two new -machine option parameters to the QEMU command to enable/disable the CPACF protected key management operations for a guest:
aes-key-wrap='on|off' dea-key-wrap='on|off'
The QEMU code maps the corresponding domain configuration elements to the QEMU -machine option parameters to create the QEMU command:
<cipher name='aes' state='on'> --> aes-key-wrap=on <cipher name='aes' state='off'> --> aes-key-wrap=off <cipher name='dea' state='on'> --> dea-key-wrap=on <cipher name='dea' state='off'> --> dea-key-wrap=off
Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Signed-off-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/qemu/qemu_capabilities.c | 5 +++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 72 ++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_domain.c | 39 ++++++++++++++++++++++- 4 files changed, 117 insertions(+), 1 deletions(-)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index a458611..d1b9f6f 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -279,6 +279,9 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "qxl.vgamem_mb", "qxl-vga.vgamem_mb", "pc-dimm", + + "aes-key-wrap", /* 185 */ + "dea-key-wrap", );
@@ -2518,6 +2521,8 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = { { "msg", "timestamp", QEMU_CAPS_MSG_TIMESTAMP }, { "numa", NULL, QEMU_CAPS_NUMA }, { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX}, + { "machine", "aes-key-wrap", QEMU_CAPS_AES_KEY_WRAP }, + { "machine", "dea-key-wrap", QEMU_CAPS_DEA_KEY_WRAP }, };
static int diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index c7b1ac7..31e0494 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -224,6 +224,8 @@ typedef enum { QEMU_CAPS_QXL_VGAMEM = 182, /* -device qxl.vgamem_mb */ QEMU_CAPS_QXL_VGA_VGAMEM = 183, /* -device qxl-vga.vgamem_mb */ QEMU_CAPS_DEVICE_PC_DIMM = 184, /* pc-dimm device */ + QEMU_CAPS_AES_KEY_WRAP = 185, /* -machine aes_key_wrap */ + QEMU_CAPS_DEA_KEY_WRAP = 186, /* -machine dea_key_wrap */
QEMU_CAPS_LAST, /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 247954f..8ff1d88 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -38,6 +38,7 @@ #include "virnetdevbridge.h" #include "virstring.h" #include "virtime.h" +#include "virutil.h" #include "viruuid.h" #include "c-ctype.h" #include "domain_nwfilter.h" @@ -7295,6 +7296,39 @@ qemuBuildObsoleteAccelArg(virCommandPtr cmd, return 0; }
+static bool +qemuAppendKeyWrapMachineParm(virBuffer *buf, virQEMUCapsPtr qemuCaps, + int flag, const char *pname, int pstate) +{ + if (pstate != VIR_TRISTATE_SWITCH_ABSENT) { + if (!virQEMUCapsGet(qemuCaps, flag)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("%s is not available with this QEMU binary"), pname); + return false; + } + + virBufferAsprintf(buf, ",%s=%s", pname, + virTristateSwitchTypeToString(pstate)); + } + + return true; +} + +static bool +qemuAppendKeyWrapMachineParms(virBuffer *buf, virQEMUCapsPtr qemuCaps, + const virDomainDef *def) +{ + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_AES_KEY_WRAP, + "aes-key-wrap", def->keywrap.aes)) + return false; + + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_DEA_KEY_WRAP, + "dea-key-wrap", def->keywrap.dea)) + return false; + + return true; +} + static int qemuBuildMachineArgStr(virCommandPtr cmd, const virDomainDef *def, @@ -7329,6 +7363,14 @@ qemuBuildMachineArgStr(virCommandPtr cmd, }
obsoleteAccel = true; + + if ((def->keywrap.aes != VIR_TRISTATE_SWITCH_ABSENT) || + (def->keywrap.dea != VIR_TRISTATE_SWITCH_ABSENT)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("key wrap support is not available " + "with this QEMU binary")); + return -1; + } } else { virBuffer buf = VIR_BUFFER_INITIALIZER;
@@ -7373,6 +7415,11 @@ qemuBuildMachineArgStr(virCommandPtr cmd, } }
+ if (!qemuAppendKeyWrapMachineParms(&buf, qemuCaps, def)) { + virBufferFreeAndReset(&buf); + return -1; + } + virCommandAddArgBuffer(cmd, &buf); }
@@ -12772,6 +12819,9 @@ qemuParseCommandLine(virCapsPtr qemuCaps, }
/* handle all remaining "-machine" parameters */ + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; + while ((param = list[j++])) { if (STRPREFIX(param, "dump-guest-core=")) { param += strlen("dump-guest-core="); @@ -12783,6 +12833,28 @@ qemuParseCommandLine(virCapsPtr qemuCaps, } else if (STRPREFIX(param, "accel=kvm")) { def->virtType = VIR_DOMAIN_VIRT_KVM; def->features[VIR_DOMAIN_FEATURE_PAE] = VIR_TRISTATE_SWITCH_ON; + } else if (STRPREFIX(param, "aes-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("aes-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("aes-key-wrap="); + def->keywrap.aes = virTristateSwitchTypeFromString(param); + if (def->keywrap.aes < 0) + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + } else if (STRPREFIX(param, "dea-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("dea-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("dea-key-wrap="); + def->keywrap.dea = virTristateSwitchTypeFromString(param); + if (def->keywrap.dea < 0) + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; } } virStringFreeList(list); diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 2478ad7..7d2f977 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -899,11 +899,41 @@ virDomainXMLNamespace virQEMUDriverDomainXMLNamespace = { };
+static bool +qemuDomainKeyWrapCapsGet(virQEMUDriverPtr driver, virDomainDefPtr def, + virQEMUCapsFlags flag) +{ + virQEMUCapsPtr qemuCaps = NULL; + + if (driver->qemuCapsCache && def->emulator) + qemuCaps = virQEMUCapsCacheLookup(driver->qemuCapsCache, def->emulator); + + return virQEMUCapsGet(qemuCaps, flag); +} + +static int +qemuDomainKeyWrapSetDefaults(virQEMUDriverPtr driver, virDomainDefPtr def) +{ + if (def->keywrap.aes == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_AES_KEY_WRAP)) + def->keywrap.aes = VIR_DOMAIN_AES_KEY_WRAP_DEFAULT; + } + + if (def->keywrap.dea == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_DEA_KEY_WRAP)) + def->keywrap.dea = VIR_DOMAIN_DEA_KEY_WRAP_DEFAULT; + }
Why are we setting this ON by default? I guess we should leave it for users to decide. Even if it is a performance gain.
+ + return 0; +} + +
Michal
On 05/15/2015 10:39 AM, Michal Privoznik wrote:
On 27.04.2015 23:57, akrowiak@linux.vnet.ibm.com wrote:
From: Tony Krowiak <aekrowia@us.ibm.com>
Introduces two new -machine option parameters to the QEMU command to enable/disable the CPACF protected key management operations for a guest:
aes-key-wrap='on|off' dea-key-wrap='on|off'
The QEMU code maps the corresponding domain configuration elements to the QEMU -machine option parameters to create the QEMU command:
<cipher name='aes' state='on'> --> aes-key-wrap=on <cipher name='aes' state='off'> --> aes-key-wrap=off <cipher name='dea' state='on'> --> dea-key-wrap=on <cipher name='dea' state='off'> --> dea-key-wrap=off
Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com> Signed-off-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/qemu/qemu_capabilities.c | 5 +++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 72 ++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_domain.c | 39 ++++++++++++++++++++++- 4 files changed, 117 insertions(+), 1 deletions(-)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index a458611..d1b9f6f 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -279,6 +279,9 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "qxl.vgamem_mb", "qxl-vga.vgamem_mb", "pc-dimm", + + "aes-key-wrap", /* 185 */ + "dea-key-wrap", );
@@ -2518,6 +2521,8 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = { { "msg", "timestamp", QEMU_CAPS_MSG_TIMESTAMP }, { "numa", NULL, QEMU_CAPS_NUMA }, { "drive", "throttling.bps-total-max", QEMU_CAPS_DRIVE_IOTUNE_MAX}, + { "machine", "aes-key-wrap", QEMU_CAPS_AES_KEY_WRAP }, + { "machine", "dea-key-wrap", QEMU_CAPS_DEA_KEY_WRAP }, };
static int diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index c7b1ac7..31e0494 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -224,6 +224,8 @@ typedef enum { QEMU_CAPS_QXL_VGAMEM = 182, /* -device qxl.vgamem_mb */ QEMU_CAPS_QXL_VGA_VGAMEM = 183, /* -device qxl-vga.vgamem_mb */ QEMU_CAPS_DEVICE_PC_DIMM = 184, /* pc-dimm device */ + QEMU_CAPS_AES_KEY_WRAP = 185, /* -machine aes_key_wrap */ + QEMU_CAPS_DEA_KEY_WRAP = 186, /* -machine dea_key_wrap */
QEMU_CAPS_LAST, /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 247954f..8ff1d88 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -38,6 +38,7 @@ #include "virnetdevbridge.h" #include "virstring.h" #include "virtime.h" +#include "virutil.h" #include "viruuid.h" #include "c-ctype.h" #include "domain_nwfilter.h" @@ -7295,6 +7296,39 @@ qemuBuildObsoleteAccelArg(virCommandPtr cmd, return 0; }
+static bool +qemuAppendKeyWrapMachineParm(virBuffer *buf, virQEMUCapsPtr qemuCaps, + int flag, const char *pname, int pstate) +{ + if (pstate != VIR_TRISTATE_SWITCH_ABSENT) { + if (!virQEMUCapsGet(qemuCaps, flag)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("%s is not available with this QEMU binary"), pname); + return false; + } + + virBufferAsprintf(buf, ",%s=%s", pname, + virTristateSwitchTypeToString(pstate)); + } + + return true; +} + +static bool +qemuAppendKeyWrapMachineParms(virBuffer *buf, virQEMUCapsPtr qemuCaps, + const virDomainDef *def) +{ + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_AES_KEY_WRAP, + "aes-key-wrap", def->keywrap.aes)) + return false; + + if (!qemuAppendKeyWrapMachineParm(buf, qemuCaps, QEMU_CAPS_DEA_KEY_WRAP, + "dea-key-wrap", def->keywrap.dea)) + return false; + + return true; +} + static int qemuBuildMachineArgStr(virCommandPtr cmd, const virDomainDef *def, @@ -7329,6 +7363,14 @@ qemuBuildMachineArgStr(virCommandPtr cmd, }
obsoleteAccel = true; + + if ((def->keywrap.aes != VIR_TRISTATE_SWITCH_ABSENT) || + (def->keywrap.dea != VIR_TRISTATE_SWITCH_ABSENT)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("key wrap support is not available " + "with this QEMU binary")); + return -1; + } } else { virBuffer buf = VIR_BUFFER_INITIALIZER;
@@ -7373,6 +7415,11 @@ qemuBuildMachineArgStr(virCommandPtr cmd, } }
+ if (!qemuAppendKeyWrapMachineParms(&buf, qemuCaps, def)) { + virBufferFreeAndReset(&buf); + return -1; + } + virCommandAddArgBuffer(cmd, &buf); }
@@ -12772,6 +12819,9 @@ qemuParseCommandLine(virCapsPtr qemuCaps, }
/* handle all remaining "-machine" parameters */ + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; + while ((param = list[j++])) { if (STRPREFIX(param, "dump-guest-core=")) { param += strlen("dump-guest-core="); @@ -12783,6 +12833,28 @@ qemuParseCommandLine(virCapsPtr qemuCaps, } else if (STRPREFIX(param, "accel=kvm")) { def->virtType = VIR_DOMAIN_VIRT_KVM; def->features[VIR_DOMAIN_FEATURE_PAE] = VIR_TRISTATE_SWITCH_ON; + } else if (STRPREFIX(param, "aes-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("aes-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("aes-key-wrap="); + def->keywrap.aes = virTristateSwitchTypeFromString(param); + if (def->keywrap.aes < 0) + def->keywrap.aes = VIR_TRISTATE_SWITCH_ABSENT; + } else if (STRPREFIX(param, "dea-key-wrap=")) { + if (STREQ(arg, "-M")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("dea-key-wrap is not supported with " + "this QEMU binary")); + goto error; + } + param += strlen("dea-key-wrap="); + def->keywrap.dea = virTristateSwitchTypeFromString(param); + if (def->keywrap.dea < 0) + def->keywrap.dea = VIR_TRISTATE_SWITCH_ABSENT; } } virStringFreeList(list); diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 2478ad7..7d2f977 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -899,11 +899,41 @@ virDomainXMLNamespace virQEMUDriverDomainXMLNamespace = { };
+static bool +qemuDomainKeyWrapCapsGet(virQEMUDriverPtr driver, virDomainDefPtr def, + virQEMUCapsFlags flag) +{ + virQEMUCapsPtr qemuCaps = NULL; + + if (driver->qemuCapsCache && def->emulator) + qemuCaps = virQEMUCapsCacheLookup(driver->qemuCapsCache, def->emulator); + + return virQEMUCapsGet(qemuCaps, flag); +} + +static int +qemuDomainKeyWrapSetDefaults(virQEMUDriverPtr driver, virDomainDefPtr def) +{ + if (def->keywrap.aes == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_AES_KEY_WRAP)) + def->keywrap.aes = VIR_DOMAIN_AES_KEY_WRAP_DEFAULT; + } + + if (def->keywrap.dea == VIR_TRISTATE_SWITCH_ABSENT) { + if (qemuDomainKeyWrapCapsGet(driver, def, QEMU_CAPS_DEA_KEY_WRAP)) + def->keywrap.dea = VIR_DOMAIN_DEA_KEY_WRAP_DEFAULT; + } Why are we setting this ON by default? I guess we should leave it for users to decide. Even if it is a performance gain. This mimics the s390 hardware management console which enables key wrapping for an LPAR by default.
+ + return 0; +} + + Michal
From: Tony Krowiak <aekrowia@us.ibm.com> Test the support for enabling/disabling CPACF protected key management operations for a guest. Signed-off-by: Tony Krowiak <akrowiak@linux.vnet.ibm.com> Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com> --- src/qemu/qemu_capabilities.c | 9 ++ src/qemu/qemu_capabilities.h | 2 + tests/qemuargv2xmltest.c | 6 + .../qemuxml2argv-machine-aeskeywrap-off-argv.args | 6 + .../qemuxml2argv-machine-aeskeywrap-off-argv.xml | 27 ++++ .../qemuxml2argv-machine-aeskeywrap-off-cap.args | 7 + .../qemuxml2argv-machine-aeskeywrap-off-cap.xml | 28 +++++ .../qemuxml2argv-machine-aeskeywrap-off-caps.args | 7 + .../qemuxml2argv-machine-aeskeywrap-off-caps.xml | 28 +++++ .../qemuxml2argv-machine-aeskeywrap-on-argv.args | 6 + .../qemuxml2argv-machine-aeskeywrap-on-argv.xml | 27 ++++ .../qemuxml2argv-machine-aeskeywrap-on-cap.args | 7 + .../qemuxml2argv-machine-aeskeywrap-on-cap.xml | 28 +++++ .../qemuxml2argv-machine-aeskeywrap-on-caps.args | 7 + .../qemuxml2argv-machine-aeskeywrap-on-caps.xml | 27 ++++ .../qemuxml2argv-machine-deakeywrap-off-argv.args | 6 + .../qemuxml2argv-machine-deakeywrap-off-argv.xml | 27 ++++ .../qemuxml2argv-machine-deakeywrap-off-cap.args | 7 + .../qemuxml2argv-machine-deakeywrap-off-cap.xml | 28 +++++ .../qemuxml2argv-machine-deakeywrap-off-caps.args | 7 + .../qemuxml2argv-machine-deakeywrap-off-caps.xml | 28 +++++ .../qemuxml2argv-machine-deakeywrap-on-argv.args | 6 + .../qemuxml2argv-machine-deakeywrap-on-argv.xml | 27 ++++ .../qemuxml2argv-machine-deakeywrap-on-cap.args | 7 + .../qemuxml2argv-machine-deakeywrap-on-cap.xml | 28 +++++ .../qemuxml2argv-machine-deakeywrap-on-caps.args | 7 + .../qemuxml2argv-machine-deakeywrap-on-caps.xml | 28 +++++ .../qemuxml2argv-machine-keywrap-none-argv.args | 6 + .../qemuxml2argv-machine-keywrap-none-argv.xml | 24 ++++ .../qemuxml2argv-machine-keywrap-none-caps.args | 7 + .../qemuxml2argv-machine-keywrap-none-caps.xml | 25 ++++ .../qemuxml2argv-machine-keywrap-none.args | 7 + .../qemuxml2argv-machine-keywrap-none.xml | 25 ++++ tests/qemuxml2argvtest.c | 127 ++++++++++++++++++-- 34 files changed, 637 insertions(+), 12 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index d1b9f6f..e5fd7cc 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -3558,6 +3558,15 @@ virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps, } +int +virQEMUCacheCapsForBinary(virQEMUCapsCachePtr cache, const char *binary, + virQEMUCapsPtr qemuCaps) +{ + return virHashAddEntry(cache->binaries, binary, + virQEMUCapsNewCopy(qemuCaps)); +} + + virQEMUCapsCachePtr virQEMUCapsCacheNew(const char *libDir, const char *cacheDir, diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 31e0494..8c3042d 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -293,6 +293,8 @@ void virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps, virQEMUCapsCachePtr virQEMUCapsCacheNew(const char *libDir, const char *cacheDir, uid_t uid, gid_t gid); +int virQEMUCacheCapsForBinary(virQEMUCapsCachePtr cache, const char *binary, + virQEMUCapsPtr qemuCaps); virQEMUCapsPtr virQEMUCapsCacheLookup(virQEMUCapsCachePtr cache, const char *binary); virQEMUCapsPtr virQEMUCapsCacheLookupCopy(virQEMUCapsCachePtr cache, diff --git a/tests/qemuargv2xmltest.c b/tests/qemuargv2xmltest.c index d6df116..ea85913 100644 --- a/tests/qemuargv2xmltest.c +++ b/tests/qemuargv2xmltest.c @@ -292,6 +292,12 @@ mymain(void) DO_TEST_FULL("qemu-ns-no-env", FLAG_EXPECT_WARNING); + DO_TEST("machine-aeskeywrap-on-argv"); + DO_TEST("machine-aeskeywrap-off-argv"); + DO_TEST("machine-deakeywrap-on-argv"); + DO_TEST("machine-deakeywrap-off-argv"); + DO_TEST("machine-keywrap-none-argv"); + virObjectUnref(driver.config); virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args new file mode 100644 index 0000000..4ef9fc0 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml new file mode 100644 index 0000000..0975d4a --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args new file mode 100644 index 0000000..80caba7 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml new file mode 100644 index 0000000..a0c0037 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args new file mode 100644 index 0000000..a20e49a --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml new file mode 100644 index 0000000..a0c0037 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args new file mode 100644 index 0000000..2b238d5 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml new file mode 100644 index 0000000..8aa8f8e --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args new file mode 100644 index 0000000..6f6366b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml new file mode 100644 index 0000000..768eed1 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args new file mode 100644 index 0000000..ad8d7b4 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml new file mode 100644 index 0000000..1702e6e --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='aes' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args new file mode 100644 index 0000000..f38c914 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=off \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml new file mode 100644 index 0000000..90b6d9f --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args new file mode 100644 index 0000000..e379f15 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=off \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml new file mode 100644 index 0000000..dbc22fc --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args new file mode 100644 index 0000000..861b46b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on,dea-key-wrap=off \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml new file mode 100644 index 0000000..dbc22fc --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='off'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args new file mode 100644 index 0000000..f64e57f --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml new file mode 100644 index 0000000..76a6a51 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args new file mode 100644 index 0000000..9c4b513 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml new file mode 100644 index 0000000..c0a063b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args new file mode 100644 index 0000000..ad8d7b4 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml new file mode 100644 index 0000000..c0a063b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> + <keywrap> + <cipher name='dea' state='on'/> + </keywrap> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args new file mode 100644 index 0000000..9264ec4 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml new file mode 100644 index 0000000..0a963a1 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml @@ -0,0 +1,24 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + </disk> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args new file mode 100644 index 0000000..ad8d7b4 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on,dea-key-wrap=on \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml new file mode 100644 index 0000000..9727686 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml @@ -0,0 +1,25 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args new file mode 100644 index 0000000..f4bd156 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-s390x -S \ +-machine s390-ccw-virtio,accel=tcg \ +-m 214 -smp 1 -nographic -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ +-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \ +-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml new file mode 100644 index 0000000..9727686 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml @@ -0,0 +1,25 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='vda' bus='virtio'/> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </disk> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 0763068..5d72b92 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -520,7 +520,7 @@ mymain(void) if (VIR_STRDUP_QUIET(driver.config->spicePassword, "123456") < 0) return EXIT_FAILURE; -# define DO_TEST_FULL(name, migrateFrom, migrateFd, flags, ...) \ +# define DO_TEST_FULL(name, migrateFrom, migrateFd, binary, flags, ...) \ do { \ static struct testInfo info = { \ name, NULL, migrateFrom, migrateFd, (flags) \ @@ -530,6 +530,15 @@ mymain(void) if (testAddCPUModels(info.extraFlags, skipLegacyCPUs) < 0) \ return EXIT_FAILURE; \ virQEMUCapsSetList(info.extraFlags, __VA_ARGS__, QEMU_CAPS_LAST);\ + if (binary) { \ + driver.qemuCapsCache = virQEMUCapsCacheNew(driver.config->libDir, \ + driver.config->cacheDir,\ + driver.config->user, \ + driver.config->group); \ + if (virQEMUCacheCapsForBinary(driver.qemuCapsCache, \ + binary, info.extraFlags) < 0) \ + return EXIT_FAILURE; \ + } \ if (virtTestRun("QEMU XML-2-ARGV " name, \ testCompareXMLToArgvHelper, &info) < 0) \ ret = -1; \ @@ -537,16 +546,19 @@ mymain(void) } while (0) # define DO_TEST(name, ...) \ - DO_TEST_FULL(name, NULL, -1, 0, __VA_ARGS__) + DO_TEST_FULL(name, NULL, -1, NULL, 0, __VA_ARGS__) + +# define DO_TEST_CACHE_CAPS(name, binary, ...) \ + DO_TEST_FULL(name, NULL, -1, binary, 0, __VA_ARGS__) # define DO_TEST_ERROR(name, ...) \ - DO_TEST_FULL(name, NULL, -1, FLAG_EXPECT_ERROR, __VA_ARGS__) + DO_TEST_FULL(name, NULL, -1, NULL, FLAG_EXPECT_ERROR, __VA_ARGS__) # define DO_TEST_FAILURE(name, ...) \ - DO_TEST_FULL(name, NULL, -1, FLAG_EXPECT_FAILURE, __VA_ARGS__) + DO_TEST_FULL(name, NULL, -1, NULL, FLAG_EXPECT_FAILURE, __VA_ARGS__) # define DO_TEST_PARSE_ERROR(name, ...) \ - DO_TEST_FULL(name, NULL, -1, \ + DO_TEST_FULL(name, NULL, -1, NULL, \ FLAG_EXPECT_PARSE_ERROR | FLAG_EXPECT_ERROR, \ __VA_ARGS__) @@ -557,7 +569,7 @@ mymain(void) * predictable NUMA topology and so on). On non-Linux * platforms the macro just consume its argument. */ # define DO_TEST_LINUX(name, ...) \ - DO_TEST_FULL(name, NULL, -1, 0, __VA_ARGS__) + DO_TEST_FULL(name, NULL, -1, NULL, 0, __VA_ARGS__) # else /* __linux__ */ # define DO_TEST_LINUX(name, ...) \ do { \ @@ -1204,12 +1216,12 @@ mymain(void) QEMU_CAPS_PCIDEVICE, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_PCI_ROMBAR); - DO_TEST_FULL("restore-v1", "stdio", 7, 0, QEMU_CAPS_MIGRATE_KVM_STDIO); - DO_TEST_FULL("restore-v2", "stdio", 7, 0, QEMU_CAPS_MIGRATE_QEMU_EXEC); - DO_TEST_FULL("restore-v2", "exec:cat", 7, 0, QEMU_CAPS_MIGRATE_QEMU_EXEC); - DO_TEST_FULL("restore-v2-fd", "stdio", 7, 0, QEMU_CAPS_MIGRATE_QEMU_FD); - DO_TEST_FULL("restore-v2-fd", "fd:7", 7, 0, QEMU_CAPS_MIGRATE_QEMU_FD); - DO_TEST_FULL("migrate", "tcp:10.0.0.1:5000", -1, 0, + DO_TEST_FULL("restore-v1", "stdio", 7, NULL, 0, QEMU_CAPS_MIGRATE_KVM_STDIO); + DO_TEST_FULL("restore-v2", "stdio", 7, NULL, 0, QEMU_CAPS_MIGRATE_QEMU_EXEC); + DO_TEST_FULL("restore-v2", "exec:cat", 7, NULL, 0, QEMU_CAPS_MIGRATE_QEMU_EXEC); + DO_TEST_FULL("restore-v2-fd", "stdio", 7, NULL, 0, QEMU_CAPS_MIGRATE_QEMU_FD); + DO_TEST_FULL("restore-v2-fd", "fd:7", 7, NULL, 0, QEMU_CAPS_MIGRATE_QEMU_FD); + DO_TEST_FULL("migrate", "tcp:10.0.0.1:5000", -1, NULL, 0, QEMU_CAPS_MIGRATE_QEMU_TCP); DO_TEST("qemu-ns", NONE); @@ -1565,6 +1577,97 @@ mymain(void) DO_TEST("memory-hotplug-dimm-addr", QEMU_CAPS_DEVICE_PC_DIMM, QEMU_CAPS_NUMA, QEMU_CAPS_DEVICE, QEMU_CAPS_OBJECT_MEMORY_RAM); + DO_TEST_CACHE_CAPS("machine-aeskeywrap-on-caps", + "/usr/bin/qemu-system-s390x", + QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, + QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-on-caps", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-on-caps", NONE); + + DO_TEST_CACHE_CAPS("machine-aeskeywrap-on-cap", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-on-cap", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-on-cap", NONE); + + DO_TEST_CACHE_CAPS("machine-aeskeywrap-off-caps", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-off-caps", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-off-caps", NONE); + + DO_TEST_CACHE_CAPS("machine-aeskeywrap-off-cap", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-off-cap", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-aeskeywrap-off-cap", NONE); + + DO_TEST_CACHE_CAPS("machine-deakeywrap-on-caps", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-on-caps", QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-on-caps", NONE); + + DO_TEST_CACHE_CAPS("machine-deakeywrap-on-cap", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-on-cap", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-on-cap", NONE); + + DO_TEST_CACHE_CAPS("machine-deakeywrap-off-caps", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-off-caps", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-off-caps", NONE); + + DO_TEST_CACHE_CAPS("machine-deakeywrap-off-cap", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-off-cap", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_FAILURE("machine-deakeywrap-off-cap", NONE); + + DO_TEST_CACHE_CAPS("machine-keywrap-none-caps", + "/usr/bin/qemu-system-s390x", QEMU_CAPS_MACHINE_OPT, + QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP, + QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + DO_TEST_CACHE_CAPS("machine-keywrap-none", "/usr/bin/qemu-system-s390x", + QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DRIVE, + QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE, + QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390); + virObjectUnref(driver.config); virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); -- 1.7.1
On 04/27/2015 05:57 PM, akrowiak@linux.vnet.ibm.com wrote:
From: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
The IBM System z Central Processor Assist for Cryptographic Functions (CPACF) hardware provides a set of CPU instructions for use in clear-key encryption, pseudo random number generation, hash functions, and protected-key encryption. The CPACF protected key cryptographic functions operate with a protected key which is encrypted under a unique wrapping key that is stored in the Hardware System Area (HSA) of the machine and can only be accessed by firmware. The wrapping key cannot be accessed by the operating system or application programs. There are two wrapping keys: One for wrapping AES keys and one for wrapping DES/TDES keys. This patch set enables the support for encrypting clear keys under the AES and DES/TDES wrapping keys for guests started on hosts running on s390 hardware that supports key wrapping.
Tony Krowiak (4): libvirt: docs: XML to enable/disable protected key mgmt ops libvirt: conf: parse XML for protected key management ops libvirt: qemu: enable/disable protected key management ops libvirt: tests: test protected key mgmt ops support
-- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
Any comments?
participants (3)
-
akrowiak＠linux.vnet.ibm.com -
Michal Privoznik -
Tony Krowiak