11:48 a.m.
This is a promised follow up to:
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/7...
Michal Prívozník (8):
libvirt_private.syms: Export virDomainLaunchSecurity enum handlers
qemuxmlconftest; Explicitly enable QEMU_CAPS_SEV_SNP_GUEST for
"launch-security-sev-snp"
qemu_capabilities: Probe SEV capabilities even for
QEMU_CAPS_SEV_SNP_GUEST
domcaps: Report launchSecurity
qemu: Fill launchSecurity in domaincaps
qemu_validate: Use domaincaps to validate supported launchSecurity
type
virt-host-validate: Move AMD SEV into a separate func
virt-host-validate: Detect SEV-ES and SEV-SNP
docs/formatdomaincaps.rst | 10 +++
src/conf/domain_capabilities.c | 14 ++++
src/conf/domain_capabilities.h | 9 ++
src/conf/schemas/domaincaps.rng | 10 +++
src/libvirt_private.syms | 2 +
src/qemu/qemu_capabilities.c | 24 +++++-
src/qemu/qemu_capabilities.h | 3 +
src/qemu/qemu_validate.c | 29 +++----
.../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 3 +
.../qemu_4.2.0-virt.aarch64.xml | 3 +
tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_4.2.0.s390x.xml | 3 +
tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 3 +
.../qemu_5.0.0-tcg-virt.riscv64.xml | 3 +
.../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 3 +
.../qemu_5.0.0-virt.aarch64.xml | 3 +
.../qemu_5.0.0-virt.riscv64.xml | 3 +
tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_5.1.0.sparc.xml | 3 +
tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 3 +
.../qemu_5.2.0-tcg-virt.riscv64.xml | 3 +
.../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 3 +
.../qemu_5.2.0-virt.aarch64.xml | 3 +
.../qemu_5.2.0-virt.riscv64.xml | 3 +
tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_5.2.0.s390x.xml | 3 +
tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 5 ++
.../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 5 ++
.../qemu_6.0.0-virt.aarch64.xml | 3 +
tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_6.0.0.s390x.xml | 5 ++
tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 5 ++
.../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 3 +
.../qemu_6.2.0-virt.aarch64.xml | 3 +
tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 3 +
.../qemu_7.0.0-hvf.aarch64+hvf.xml | 3 +
.../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 3 +
.../qemu_7.0.0-virt.aarch64.xml | 3 +
tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 3 +
tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 3 +
.../qemu_7.2.0-hvf.x86_64+hvf.xml | 3 +
.../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 3 +
.../qemu_7.2.0-tcg.x86_64+hvf.xml | 3 +
.../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_7.2.0.ppc.xml | 3 +
tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 3 +
.../qemu_8.0.0-tcg-virt.riscv64.xml | 3 +
.../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 3 +
.../qemu_8.0.0-virt.riscv64.xml | 3 +
tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_8.1.0.s390x.xml | 5 ++
tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 3 +
.../qemu_8.2.0-tcg-virt.loongarch64.xml | 3 +
.../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 3 +
.../qemu_8.2.0-virt.aarch64.xml | 3 +
.../qemu_8.2.0-virt.loongarch64.xml | 3 +
tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 +
tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 3 +
tests/domaincapsdata/qemu_8.2.0.s390x.xml | 5 ++
tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 3 +
.../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 3 +
.../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 3 +
tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 3 +
.../caps_9.1.0_x86_64.xml | 1 -
tests/qemuxmlconftest.c | 6 +-
tools/virt-host-validate-common.c | 83 ++++++++++++++-----
95 files changed, 413 insertions(+), 42 deletions(-)
--
2.44.2
11:48 a.m.
New subject: [PATCH 1/8] libvirt_private.syms: Export virDomainLaunchSecurity enum handlers
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/libvirt_private.syms | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index bac4a8a366..f7a0a8bc36 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -497,6 +497,8 @@ virDomainIOThreadIDDel;
virDomainIOThreadIDFind;
virDomainKeyWrapCipherNameTypeFromString;
virDomainKeyWrapCipherNameTypeToString;
+virDomainLaunchSecurityTypeFromString;
+virDomainLaunchSecurityTypeToString;
virDomainLeaseDefFree;
virDomainLeaseIndex;
virDomainLeaseInsert;
--
2.44.2
11:48 a.m.
New subject: [PATCH 2/8] qemuxmlconftest; Explicitly enable QEMU_CAPS_SEV_SNP_GUEST for "launch-security-sev-snp"
Soon, QEMU_CAPS_SEV_SNP_GUEST is going to be dependant on more
than plain presence of "sev-snp-guest" object in QEMU. Explicitly
enable the capability for "launch-security-sev-snp" test so that
we can continue testing cmd line and xml2xml.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
tests/qemuxmlconftest.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index d27dc9fe94..8e0d47c6fd 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -2849,7 +2849,11 @@ mymain(void)
QEMU_CAPS_SEV_GUEST,
QEMU_CAPS_LAST);
- DO_TEST_CAPS_ARCH_LATEST("launch-security-sev-snp", "x86_64");
+ DO_TEST_CAPS_ARCH_LATEST_FULL("launch-security-sev-snp",
+ "x86_64",
+ ARG_QEMU_CAPS,
+ QEMU_CAPS_SEV_SNP_GUEST,
+ QEMU_CAPS_LAST);
DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x");
--
2.44.2
11:48 a.m.
New subject: [PATCH 3/8] qemu_capabilities: Probe SEV capabilities even for QEMU_CAPS_SEV_SNP_GUEST
While it's very unlikely to have QEMU that supports SEV-SNP but
doesn't support plain SEV, for completeness sake we ought to
query SEV capabilities if QEMU supports either. And similarly to
QEMU_CAPS_SEV_GUEST we need to clear the capability if talking to
QEMU proves SEV is not really supported.
This in turn removes the 'sev-snp'guest' capability from on of
our test cases as Peter's machine he uses to refresh capabilities
is not SEV capable. But that's okay. It's consistent with
'sev-guest' capability.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/qemu/qemu_capabilities.c | 4 +++-
tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml | 1 -
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index fe704d16dd..adaf5f9c26 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -3465,7 +3465,8 @@ virQEMUCapsProbeQMPSEVCapabilities(virQEMUCaps *qemuCaps,
int rc = -1;
virSEVCapability *caps = NULL;
- if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST))
+ if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST) &&
+ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST))
return 0;
if ((rc = qemuMonitorGetSEVCapabilities(mon, &caps)) < 0)
@@ -3474,6 +3475,7 @@ virQEMUCapsProbeQMPSEVCapabilities(virQEMUCaps *qemuCaps,
/* SEV isn't actually supported */
if (rc == 0) {
virQEMUCapsClear(qemuCaps, QEMU_CAPS_SEV_GUEST);
+ virQEMUCapsClear(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST);
return 0;
}
diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
b/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
index a9973a0913..e0332ce1e8 100644
--- a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml
@@ -203,7 +203,6 @@
<flag name='display-reload'/>
<flag name='usb-mtp'/>
<flag name='virtio-sound'/>
- <flag name='sev-snp-guest'/>
<version>9000050</version>
<microcodeVersion>43100246</microcodeVersion>
<package>v9.0.0-1388-g80e8f06021-dirty</package>
--
2.44.2
1:54 p.m.
New subject: [PATCH 3/8] qemu_capabilities: Probe SEV capabilities even for
QEMU_CAPS_SEV_SNP_GUEST
On Tue, Jun 25, 2024 at 11:48:48 +0200, Michal Privoznik wrote:
While it's very unlikely to have QEMU that supports SEV-SNP but
doesn't support plain SEV, for completeness sake we ought to
query SEV capabilities if QEMU supports either. And similarly to
QEMU_CAPS_SEV_GUEST we need to clear the capability if talking to
QEMU proves SEV is not really supported.
This in turn removes the 'sev-snp'guest' capability from on of
s/snp'/snp-/
s/ on / one /
our test cases as Peter's machine he uses to refresh
capabilities
is not SEV capable. But that's okay. It's consistent with
'sev-guest' capability.
Jirka
11:48 a.m.
New subject: [PATCH 4/8] domcaps: Report launchSecurity
In order to learn what types of <launchSecurity/> are supported
users can turn to domain capabilities and find <sev/> and
<s390-pv/> elements. While these may expose some additional info
on individual launchSecurity types, we are lacking clean
enumeration (like we do for say device models). And given that
SEV and SEV SNP share the same basis (info found under <sev/> is
applicable to SEV SNP too) we have no other way to report SEV SNP
support.
Therefore, report supported launchSecurity types in domain
capabilities.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
docs/formatdomaincaps.rst | 10 ++++++++++
src/conf/domain_capabilities.c | 14 ++++++++++++++
src/conf/domain_capabilities.h | 9 +++++++++
src/conf/schemas/domaincaps.rng | 10 ++++++++++
4 files changed, 43 insertions(+)
diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
index 609a767189..a2ad0acc3d 100644
--- a/docs/formatdomaincaps.rst
+++ b/docs/formatdomaincaps.rst
@@ -798,3 +798,13 @@ are supported. The ``features`` enum corresponds to the
``<hyperv/>`` element
Please note that depending on the QEMU version some capabilities might be
missing even though QEMU does support them. This is because prior to QEMU-6.1.0
not all features were reported by QEMU.
+
+Launch security
+^^^^^^^^^^^^^^^
+
+The ``launchSecurity`` element exposes supported aspects of encrypted guests.
+The ``sectype`` enum corresponds to ``type`` attribute of ``<launchSecurity/>``
+element as documented in `Launch Security
+<formatdomain.html#launch-security>`__. :since:`(Since 10.5.0)` For additional
+information on individual types, see sections above: `s390-pv capability`_ for
+S390 PV, `SEV capabilities`_ for AMD SEV and/or AMD SEV-SNP.
diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c
index 68eb3c9797..3f2d231d1c 100644
--- a/src/conf/domain_capabilities.c
+++ b/src/conf/domain_capabilities.c
@@ -707,6 +707,19 @@ virDomainCapsFeatureHypervFormat(virBuffer *buf,
FORMAT_EPILOGUE(hyperv);
}
+
+static void
+virDomainCapsLaunchSecurityFormat(virBuffer *buf,
+ const virDomainCapsLaunchSecurity *launchSecurity)
+{
+ FORMAT_PROLOGUE(launchSecurity);
+
+ ENUM_PROCESS(launchSecurity, sectype, virDomainLaunchSecurityTypeToString);
+
+ FORMAT_EPILOGUE(launchSecurity);
+}
+
+
static void
virDomainCapsFormatFeatures(const virDomainCaps *caps,
virBuffer *buf)
@@ -728,6 +741,7 @@ virDomainCapsFormatFeatures(const virDomainCaps *caps,
virDomainCapsFeatureSEVFormat(&childBuf, caps->sev);
virDomainCapsFeatureSGXFormat(&childBuf, caps->sgx);
virDomainCapsFeatureHypervFormat(&childBuf, caps->hyperv);
+ virDomainCapsLaunchSecurityFormat(&childBuf, &caps->launchSecurity);
virXMLFormatElement(buf, "features", NULL, &childBuf);
}
diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
index fadc30cdd7..986f3cb394 100644
--- a/src/conf/domain_capabilities.h
+++ b/src/conf/domain_capabilities.h
@@ -165,6 +165,14 @@ struct _virDomainCapsFeatureHyperv {
virDomainCapsEnum features; /* Info about supported virDomainHyperv features */
};
+STATIC_ASSERT_ENUM(VIR_DOMAIN_LAUNCH_SECURITY_LAST);
+typedef struct _virDomainCapsLaunchSecurity virDomainCapsLaunchSecurity;
+struct _virDomainCapsLaunchSecurity {
+ virTristateBool supported;
+ virDomainCapsEnum sectype; /* Info about supported virDomainLaunchSecurity */
+};
+
+
typedef enum {
VIR_DOMCAPS_CPU_USABLE_UNKNOWN,
VIR_DOMCAPS_CPU_USABLE_YES,
@@ -284,6 +292,7 @@ struct _virDomainCaps {
virSEVCapability *sev;
virSGXCapability *sgx;
virDomainCapsFeatureHyperv *hyperv;
+ virDomainCapsLaunchSecurity launchSecurity;
/* add new domain features here */
virTristateBool features[VIR_DOMAIN_CAPS_FEATURE_LAST];
diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng
index e7aa4a1066..b8115fe028 100644
--- a/src/conf/schemas/domaincaps.rng
+++ b/src/conf/schemas/domaincaps.rng
@@ -285,6 +285,13 @@
</element>
</define>
+ <define name="launchSecurity">
+ <element name="launchSecurity">
+ <ref name="supported"/>
+ <ref name="enum"/>
+ </element>
+ </define>
+
<define name="features">
<element name="features">
<optional>
@@ -317,6 +324,9 @@
<optional>
<ref name="hyperv"/>
</optional>
+ <optional>
+ <ref name='launchSecurity'/>
+ </optional>
</element>
</define>
--
2.44.2
11:48 a.m.
New subject: [PATCH 5/8] qemu: Fill launchSecurity in domaincaps
The inspiration for these rules comes from
qemuValidateDomainDef().
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/qemu/qemu_capabilities.c | 20 +++++++++++++++++++
src/qemu/qemu_capabilities.h | 3 +++
.../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 3 +++
.../qemu_4.2.0-virt.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_4.2.0.s390x.xml | 3 +++
tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 3 +++
.../qemu_5.0.0-tcg-virt.riscv64.xml | 3 +++
.../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 3 +++
.../qemu_5.0.0-virt.aarch64.xml | 3 +++
.../qemu_5.0.0-virt.riscv64.xml | 3 +++
tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_5.1.0.sparc.xml | 3 +++
tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 3 +++
.../qemu_5.2.0-tcg-virt.riscv64.xml | 3 +++
.../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 3 +++
.../qemu_5.2.0-virt.aarch64.xml | 3 +++
.../qemu_5.2.0-virt.riscv64.xml | 3 +++
tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_5.2.0.s390x.xml | 3 +++
tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 5 +++++
.../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 5 +++++
.../qemu_6.0.0-virt.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_6.0.0.s390x.xml | 5 +++++
tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 5 +++++
.../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 3 +++
.../qemu_6.2.0-virt.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 3 +++
.../qemu_7.0.0-hvf.aarch64+hvf.xml | 3 +++
.../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 3 +++
.../qemu_7.0.0-virt.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 3 +++
tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 3 +++
.../qemu_7.2.0-hvf.x86_64+hvf.xml | 3 +++
.../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 3 +++
.../qemu_7.2.0-tcg.x86_64+hvf.xml | 3 +++
.../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_7.2.0.ppc.xml | 3 +++
tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 3 +++
.../qemu_8.0.0-tcg-virt.riscv64.xml | 3 +++
.../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 3 +++
.../qemu_8.0.0-virt.riscv64.xml | 3 +++
tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_8.1.0.s390x.xml | 5 +++++
tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 3 +++
.../qemu_8.2.0-tcg-virt.loongarch64.xml | 3 +++
.../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 3 +++
.../qemu_8.2.0-virt.aarch64.xml | 3 +++
.../qemu_8.2.0-virt.loongarch64.xml | 3 +++
tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 3 +++
tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 3 +++
tests/domaincapsdata/qemu_8.2.0.s390x.xml | 5 +++++
tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 3 +++
.../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 3 +++
.../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 3 +++
tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 3 +++
86 files changed, 287 insertions(+)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index adaf5f9c26..4f9895ba9c 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -6514,6 +6514,24 @@ virQEMUCapsFillDomainDeviceCryptoCaps(virQEMUCaps *qemuCaps,
}
+void
+virQEMUCapsFillDomainLaunchSecurity(virQEMUCaps *qemuCaps,
+ virDomainCapsLaunchSecurity *launchSecurity)
+{
+ launchSecurity->supported = VIR_TRISTATE_BOOL_YES;
+ launchSecurity->sectype.report = true;
+
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_SEV);
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP);
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST) &&
+ virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_PV);
+}
+
+
+
/**
* virQEMUCapsSupportsGICVersion:
* @qemuCaps: QEMU capabilities
@@ -6678,6 +6696,7 @@ virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps,
virDomainCapsDeviceChannel *channel = &domCaps->channel;
virDomainCapsMemoryBacking *memoryBacking = &domCaps->memoryBacking;
virDomainCapsDeviceCrypto *crypto = &domCaps->crypto;
+ virDomainCapsLaunchSecurity *launchSecurity = &domCaps->launchSecurity;
virQEMUCapsFillDomainFeaturesFromQEMUCaps(qemuCaps, domCaps);
@@ -6717,6 +6736,7 @@ virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps,
virQEMUCapsFillDomainFeatureSGXCaps(qemuCaps, domCaps);
virQEMUCapsFillDomainFeatureHypervCaps(qemuCaps, domCaps);
virQEMUCapsFillDomainDeviceCryptoCaps(qemuCaps, crypto);
+ virQEMUCapsFillDomainLaunchSecurity(qemuCaps, launchSecurity);
return 0;
}
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index a98da8c2eb..ef71e8511e 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -867,6 +867,9 @@ void virQEMUCapsFillDomainDeviceChannelCaps(virQEMUCaps *qemuCaps,
void virQEMUCapsFillDomainDeviceCryptoCaps(virQEMUCaps *qemuCaps,
virDomainCapsDeviceCrypto *crypto);
+void virQEMUCapsFillDomainLaunchSecurity(virQEMUCaps *qemuCaps,
+ virDomainCapsLaunchSecurity *launchSecurity);
+
bool virQEMUCapsGuestIsNative(virArch host,
virArch guest);
diff --git a/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
index c42a20763f..f9aacbfbf9 100644
--- a/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
@@ -319,5 +319,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_4.2.0-tcg.x86_64.xml
index 5766bcc428..9a3f15f56b 100644
--- a/tests/domaincapsdata/qemu_4.2.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0-tcg.x86_64.xml
@@ -264,5 +264,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_4.2.0-virt.aarch64.xml
index ab68d3547b..c5337f602f 100644
--- a/tests/domaincapsdata/qemu_4.2.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0-virt.aarch64.xml
@@ -196,5 +196,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0.aarch64.xml
b/tests/domaincapsdata/qemu_4.2.0.aarch64.xml
index ab68d3547b..c5337f602f 100644
--- a/tests/domaincapsdata/qemu_4.2.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0.aarch64.xml
@@ -196,5 +196,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0.ppc64.xml
b/tests/domaincapsdata/qemu_4.2.0.ppc64.xml
index 66a9ba87e9..735d563e1b 100644
--- a/tests/domaincapsdata/qemu_4.2.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0.ppc64.xml
@@ -164,5 +164,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0.s390x.xml
b/tests/domaincapsdata/qemu_4.2.0.s390x.xml
index c0567ffdde..e275d71d5d 100644
--- a/tests/domaincapsdata/qemu_4.2.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_4.2.0.s390x.xml
@@ -270,5 +270,8 @@
<s390-pv supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_4.2.0.x86_64.xml
b/tests/domaincapsdata/qemu_4.2.0.x86_64.xml
index 27199ff0c5..68caf22e4a 100644
--- a/tests/domaincapsdata/qemu_4.2.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0.x86_64.xml
@@ -319,5 +319,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_5.0.0-q35.x86_64.xml
index a4db647efc..18ed6c5929 100644
--- a/tests/domaincapsdata/qemu_5.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0-q35.x86_64.xml
@@ -321,5 +321,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0-tcg-virt.riscv64.xml
b/tests/domaincapsdata/qemu_5.0.0-tcg-virt.riscv64.xml
index 1c7d7c97df..e2a4ac3c66 100644
--- a/tests/domaincapsdata/qemu_5.0.0-tcg-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0-tcg-virt.riscv64.xml
@@ -149,5 +149,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_5.0.0-tcg.x86_64.xml
index d2b82e5581..520cf1fa30 100644
--- a/tests/domaincapsdata/qemu_5.0.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0-tcg.x86_64.xml
@@ -266,5 +266,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_5.0.0-virt.aarch64.xml
index d3cd333c07..6899e58ff2 100644
--- a/tests/domaincapsdata/qemu_5.0.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0-virt.aarch64.xml
@@ -209,5 +209,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0-virt.riscv64.xml
b/tests/domaincapsdata/qemu_5.0.0-virt.riscv64.xml
index 3272241b8f..3780a0c765 100644
--- a/tests/domaincapsdata/qemu_5.0.0-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0-virt.riscv64.xml
@@ -152,5 +152,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0.aarch64.xml
b/tests/domaincapsdata/qemu_5.0.0.aarch64.xml
index d3cd333c07..6899e58ff2 100644
--- a/tests/domaincapsdata/qemu_5.0.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0.aarch64.xml
@@ -209,5 +209,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0.ppc64.xml
b/tests/domaincapsdata/qemu_5.0.0.ppc64.xml
index 5f29f5c4ae..9e640a7e63 100644
--- a/tests/domaincapsdata/qemu_5.0.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0.ppc64.xml
@@ -171,5 +171,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.0.0.x86_64.xml
b/tests/domaincapsdata/qemu_5.0.0.x86_64.xml
index 56b94b1ea0..c939476333 100644
--- a/tests/domaincapsdata/qemu_5.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.0.0.x86_64.xml
@@ -321,5 +321,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.1.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_5.1.0-q35.x86_64.xml
index 2a8a784813..31b312e26e 100644
--- a/tests/domaincapsdata/qemu_5.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.1.0-q35.x86_64.xml
@@ -253,5 +253,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.1.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_5.1.0-tcg.x86_64.xml
index 2743f91431..9c442ff803 100644
--- a/tests/domaincapsdata/qemu_5.1.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.1.0-tcg.x86_64.xml
@@ -266,5 +266,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.1.0.sparc.xml
b/tests/domaincapsdata/qemu_5.1.0.sparc.xml
index 7baee953ce..3752115e46 100644
--- a/tests/domaincapsdata/qemu_5.1.0.sparc.xml
+++ b/tests/domaincapsdata/qemu_5.1.0.sparc.xml
@@ -135,5 +135,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.1.0.x86_64.xml
b/tests/domaincapsdata/qemu_5.1.0.x86_64.xml
index 735cd42466..b634db1fd6 100644
--- a/tests/domaincapsdata/qemu_5.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.1.0.x86_64.xml
@@ -253,5 +253,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml
index 968cfe68e8..ed4112461f 100644
--- a/tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml
@@ -253,5 +253,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0-tcg-virt.riscv64.xml
b/tests/domaincapsdata/qemu_5.2.0-tcg-virt.riscv64.xml
index 1c7d7c97df..e2a4ac3c66 100644
--- a/tests/domaincapsdata/qemu_5.2.0-tcg-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0-tcg-virt.riscv64.xml
@@ -149,5 +149,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml
index 7e5f3c8c2b..bc28ada928 100644
--- a/tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml
@@ -266,5 +266,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_5.2.0-virt.aarch64.xml
index f32634548b..3ad9cf7a39 100644
--- a/tests/domaincapsdata/qemu_5.2.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0-virt.aarch64.xml
@@ -209,5 +209,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0-virt.riscv64.xml
b/tests/domaincapsdata/qemu_5.2.0-virt.riscv64.xml
index 3272241b8f..3780a0c765 100644
--- a/tests/domaincapsdata/qemu_5.2.0-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0-virt.riscv64.xml
@@ -152,5 +152,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0.aarch64.xml
b/tests/domaincapsdata/qemu_5.2.0.aarch64.xml
index f32634548b..3ad9cf7a39 100644
--- a/tests/domaincapsdata/qemu_5.2.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0.aarch64.xml
@@ -209,5 +209,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0.ppc64.xml
b/tests/domaincapsdata/qemu_5.2.0.ppc64.xml
index 96fd13e06e..791bf6e60e 100644
--- a/tests/domaincapsdata/qemu_5.2.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0.ppc64.xml
@@ -171,5 +171,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0.s390x.xml
b/tests/domaincapsdata/qemu_5.2.0.s390x.xml
index 2af88d081a..5189544d66 100644
--- a/tests/domaincapsdata/qemu_5.2.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_5.2.0.s390x.xml
@@ -272,5 +272,8 @@
<s390-pv supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_5.2.0.x86_64.xml
b/tests/domaincapsdata/qemu_5.2.0.x86_64.xml
index 9bbb22b0d8..99a565072b 100644
--- a/tests/domaincapsdata/qemu_5.2.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_5.2.0.x86_64.xml
@@ -253,5 +253,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_6.0.0-q35.x86_64.xml
index 66da296d8e..ed2511d138 100644
--- a/tests/domaincapsdata/qemu_6.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.0.0-q35.x86_64.xml
@@ -260,5 +260,10 @@
<maxESGuests>450</maxESGuests>
</sev>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>sev</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
index 169e777644..b4c9092996 100644
--- a/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
@@ -274,5 +274,10 @@
<maxESGuests>450</maxESGuests>
</sev>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>sev</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_6.0.0-virt.aarch64.xml
index 64e62aacf2..6a0a497b83 100644
--- a/tests/domaincapsdata/qemu_6.0.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_6.0.0-virt.aarch64.xml
@@ -211,5 +211,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0.aarch64.xml
b/tests/domaincapsdata/qemu_6.0.0.aarch64.xml
index 64e62aacf2..6a0a497b83 100644
--- a/tests/domaincapsdata/qemu_6.0.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_6.0.0.aarch64.xml
@@ -211,5 +211,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0.s390x.xml
b/tests/domaincapsdata/qemu_6.0.0.s390x.xml
index c8dd1e88c9..d4fdef3791 100644
--- a/tests/domaincapsdata/qemu_6.0.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_6.0.0.s390x.xml
@@ -273,5 +273,10 @@
<s390-pv supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>s390-pv</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.0.0.x86_64.xml
b/tests/domaincapsdata/qemu_6.0.0.x86_64.xml
index 0af8b9d064..557c22a67e 100644
--- a/tests/domaincapsdata/qemu_6.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.0.0.x86_64.xml
@@ -260,5 +260,10 @@
<maxESGuests>450</maxESGuests>
</sev>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>sev</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.1.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_6.1.0-q35.x86_64.xml
index cc2081955d..ae8f0bcda1 100644
--- a/tests/domaincapsdata/qemu_6.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.1.0-q35.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
index 35f31f4ae8..59ee5c3c67 100644
--- a/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
@@ -269,5 +269,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.1.0.x86_64.xml
b/tests/domaincapsdata/qemu_6.1.0.x86_64.xml
index 22f8c8a397..3c13c2712c 100644
--- a/tests/domaincapsdata/qemu_6.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.1.0.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml
index 782aa792a9..4df5b1b3ab 100644
--- a/tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
index fa1c32f138..9f3e6cb9de 100644
--- a/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
@@ -271,5 +271,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_6.2.0-virt.aarch64.xml
index 64bed8b367..682d796ba9 100644
--- a/tests/domaincapsdata/qemu_6.2.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0-virt.aarch64.xml
@@ -218,5 +218,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0.aarch64.xml
b/tests/domaincapsdata/qemu_6.2.0.aarch64.xml
index 64bed8b367..682d796ba9 100644
--- a/tests/domaincapsdata/qemu_6.2.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0.aarch64.xml
@@ -218,5 +218,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0.ppc64.xml
b/tests/domaincapsdata/qemu_6.2.0.ppc64.xml
index 69a6bcc8bc..b7336e995d 100644
--- a/tests/domaincapsdata/qemu_6.2.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0.ppc64.xml
@@ -170,5 +170,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_6.2.0.x86_64.xml
b/tests/domaincapsdata/qemu_6.2.0.x86_64.xml
index e6283ff153..dbc25bd48e 100644
--- a/tests/domaincapsdata/qemu_6.2.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_6.2.0.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0-hvf.aarch64+hvf.xml
b/tests/domaincapsdata/qemu_7.0.0-hvf.aarch64+hvf.xml
index 94a79e8743..5b4e05f91e 100644
--- a/tests/domaincapsdata/qemu_7.0.0-hvf.aarch64+hvf.xml
+++ b/tests/domaincapsdata/qemu_7.0.0-hvf.aarch64+hvf.xml
@@ -172,5 +172,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_7.0.0-q35.x86_64.xml
index 50b2ee2ffe..59953e6309 100644
--- a/tests/domaincapsdata/qemu_7.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0-q35.x86_64.xml
@@ -266,5 +266,8 @@
<section node='1' size='262144' unit='KiB'/>
</sections>
</sgx>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_7.0.0-tcg.x86_64.xml
index 8a98f7ed87..02e585816a 100644
--- a/tests/domaincapsdata/qemu_7.0.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0-tcg.x86_64.xml
@@ -281,5 +281,8 @@
<section node='1' size='262144' unit='KiB'/>
</sections>
</sgx>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_7.0.0-virt.aarch64.xml
index d5830c46a3..86ec857aaa 100644
--- a/tests/domaincapsdata/qemu_7.0.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0-virt.aarch64.xml
@@ -217,5 +217,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0.aarch64.xml
b/tests/domaincapsdata/qemu_7.0.0.aarch64.xml
index d5830c46a3..86ec857aaa 100644
--- a/tests/domaincapsdata/qemu_7.0.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0.aarch64.xml
@@ -217,5 +217,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0.ppc64.xml
b/tests/domaincapsdata/qemu_7.0.0.ppc64.xml
index c865dcf418..83ac4a9ba9 100644
--- a/tests/domaincapsdata/qemu_7.0.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0.ppc64.xml
@@ -175,5 +175,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.0.0.x86_64.xml
b/tests/domaincapsdata/qemu_7.0.0.x86_64.xml
index fa4b912168..b0dd57f4f7 100644
--- a/tests/domaincapsdata/qemu_7.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.0.0.x86_64.xml
@@ -266,5 +266,8 @@
<section node='1' size='262144' unit='KiB'/>
</sections>
</sgx>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.1.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_7.1.0-q35.x86_64.xml
index 2eec2e3162..d68ba222e2 100644
--- a/tests/domaincapsdata/qemu_7.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.1.0-q35.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.1.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_7.1.0-tcg.x86_64.xml
index 4741164370..a9c4b36f90 100644
--- a/tests/domaincapsdata/qemu_7.1.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.1.0-tcg.x86_64.xml
@@ -270,5 +270,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.1.0.ppc64.xml
b/tests/domaincapsdata/qemu_7.1.0.ppc64.xml
index aa3a0571b6..5aec717752 100644
--- a/tests/domaincapsdata/qemu_7.1.0.ppc64.xml
+++ b/tests/domaincapsdata/qemu_7.1.0.ppc64.xml
@@ -168,5 +168,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.1.0.x86_64.xml
b/tests/domaincapsdata/qemu_7.1.0.x86_64.xml
index 449e1b51d1..1e33d89b6e 100644
--- a/tests/domaincapsdata/qemu_7.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.1.0.x86_64.xml
@@ -256,5 +256,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0-hvf.x86_64+hvf.xml
b/tests/domaincapsdata/qemu_7.2.0-hvf.x86_64+hvf.xml
index dfd319431e..076a1daa99 100644
--- a/tests/domaincapsdata/qemu_7.2.0-hvf.x86_64+hvf.xml
+++ b/tests/domaincapsdata/qemu_7.2.0-hvf.x86_64+hvf.xml
@@ -179,5 +179,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_7.2.0-q35.x86_64.xml
index e48a07da28..7d855b68c5 100644
--- a/tests/domaincapsdata/qemu_7.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.2.0-q35.x86_64.xml
@@ -262,5 +262,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64+hvf.xml
b/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64+hvf.xml
index bba0e5069b..42b889b1d2 100644
--- a/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64+hvf.xml
+++ b/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64+hvf.xml
@@ -260,5 +260,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64.xml
index bba0e5069b..42b889b1d2 100644
--- a/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.2.0-tcg.x86_64.xml
@@ -260,5 +260,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0.ppc.xml
b/tests/domaincapsdata/qemu_7.2.0.ppc.xml
index 7fd4b1ce17..f76d41b7a3 100644
--- a/tests/domaincapsdata/qemu_7.2.0.ppc.xml
+++ b/tests/domaincapsdata/qemu_7.2.0.ppc.xml
@@ -154,5 +154,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_7.2.0.x86_64.xml
b/tests/domaincapsdata/qemu_7.2.0.x86_64.xml
index d116cf2e48..5ca0ad53c7 100644
--- a/tests/domaincapsdata/qemu_7.2.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_7.2.0.x86_64.xml
@@ -262,5 +262,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml
index 2815064abc..ac181ca366 100644
--- a/tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml
@@ -281,5 +281,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.0.0-tcg-virt.riscv64.xml
b/tests/domaincapsdata/qemu_8.0.0-tcg-virt.riscv64.xml
index 1911e34b07..cd462603d4 100644
--- a/tests/domaincapsdata/qemu_8.0.0-tcg-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_8.0.0-tcg-virt.riscv64.xml
@@ -155,5 +155,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml
index ce9035cb9b..5ad8f24d87 100644
--- a/tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml
@@ -283,5 +283,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.0.0-virt.riscv64.xml
b/tests/domaincapsdata/qemu_8.0.0-virt.riscv64.xml
index d331dc45e5..913f20afc3 100644
--- a/tests/domaincapsdata/qemu_8.0.0-virt.riscv64.xml
+++ b/tests/domaincapsdata/qemu_8.0.0-virt.riscv64.xml
@@ -158,5 +158,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.0.0.x86_64.xml
b/tests/domaincapsdata/qemu_8.0.0.x86_64.xml
index 07d1d06115..7fb44a17a3 100644
--- a/tests/domaincapsdata/qemu_8.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.0.0.x86_64.xml
@@ -281,5 +281,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.1.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_8.1.0-q35.x86_64.xml
index 4d438efdf7..0b5da8882e 100644
--- a/tests/domaincapsdata/qemu_8.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.1.0-q35.x86_64.xml
@@ -283,5 +283,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.1.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_8.1.0-tcg.x86_64.xml
index b8a566920f..759af05bd4 100644
--- a/tests/domaincapsdata/qemu_8.1.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.1.0-tcg.x86_64.xml
@@ -284,5 +284,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.1.0.s390x.xml
b/tests/domaincapsdata/qemu_8.1.0.s390x.xml
index 3f4299237e..e909ffd420 100644
--- a/tests/domaincapsdata/qemu_8.1.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_8.1.0.s390x.xml
@@ -268,5 +268,10 @@
<s390-pv supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>s390-pv</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.1.0.x86_64.xml
b/tests/domaincapsdata/qemu_8.1.0.x86_64.xml
index 919357e577..3e8a25452e 100644
--- a/tests/domaincapsdata/qemu_8.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.1.0.x86_64.xml
@@ -283,5 +283,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_8.2.0-q35.x86_64.xml
index f711a51044..83cc97b2fd 100644
--- a/tests/domaincapsdata/qemu_8.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0-q35.x86_64.xml
@@ -285,5 +285,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0-tcg-virt.loongarch64.xml
b/tests/domaincapsdata/qemu_8.2.0-tcg-virt.loongarch64.xml
index 0edce04323..0f59518360 100644
--- a/tests/domaincapsdata/qemu_8.2.0-tcg-virt.loongarch64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0-tcg-virt.loongarch64.xml
@@ -161,5 +161,8 @@
<async-teardown supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_8.2.0-tcg.x86_64.xml
index e215b5d946..0eb354e836 100644
--- a/tests/domaincapsdata/qemu_8.2.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0-tcg.x86_64.xml
@@ -284,5 +284,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0-virt.aarch64.xml
b/tests/domaincapsdata/qemu_8.2.0-virt.aarch64.xml
index e4519e4a1b..291493272b 100644
--- a/tests/domaincapsdata/qemu_8.2.0-virt.aarch64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0-virt.aarch64.xml
@@ -223,5 +223,8 @@
<async-teardown supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0-virt.loongarch64.xml
b/tests/domaincapsdata/qemu_8.2.0-virt.loongarch64.xml
index 2259a6ebca..32b2385af8 100644
--- a/tests/domaincapsdata/qemu_8.2.0-virt.loongarch64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0-virt.loongarch64.xml
@@ -165,5 +165,8 @@
<async-teardown supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0.aarch64.xml
b/tests/domaincapsdata/qemu_8.2.0.aarch64.xml
index e4519e4a1b..291493272b 100644
--- a/tests/domaincapsdata/qemu_8.2.0.aarch64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0.aarch64.xml
@@ -223,5 +223,8 @@
<async-teardown supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0.armv7l.xml
b/tests/domaincapsdata/qemu_8.2.0.armv7l.xml
index efc6010e44..059c4236c3 100644
--- a/tests/domaincapsdata/qemu_8.2.0.armv7l.xml
+++ b/tests/domaincapsdata/qemu_8.2.0.armv7l.xml
@@ -171,5 +171,8 @@
<async-teardown supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0.s390x.xml
b/tests/domaincapsdata/qemu_8.2.0.s390x.xml
index 9c00145370..6897395eef 100644
--- a/tests/domaincapsdata/qemu_8.2.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_8.2.0.s390x.xml
@@ -268,5 +268,10 @@
<s390-pv supported='yes'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'>
+ <value>s390-pv</value>
+ </enum>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_8.2.0.x86_64.xml
b/tests/domaincapsdata/qemu_8.2.0.x86_64.xml
index bc060e21b6..6e20c9be9b 100644
--- a/tests/domaincapsdata/qemu_8.2.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_8.2.0.x86_64.xml
@@ -285,5 +285,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.0.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_9.0.0-q35.x86_64.xml
index 015effd3b0..7b3f073e2e 100644
--- a/tests/domaincapsdata/qemu_9.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.0.0-q35.x86_64.xml
@@ -285,5 +285,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.0.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_9.0.0-tcg.x86_64.xml
index 91d3f68c26..3d16bbce6e 100644
--- a/tests/domaincapsdata/qemu_9.0.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.0.0-tcg.x86_64.xml
@@ -286,5 +286,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.0.0.x86_64.xml
b/tests/domaincapsdata/qemu_9.0.0.x86_64.xml
index a258cdc063..ce5f901e37 100644
--- a/tests/domaincapsdata/qemu_9.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.0.0.x86_64.xml
@@ -285,5 +285,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.1.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_9.1.0-q35.x86_64.xml
index 40e8533e16..0150f0ab93 100644
--- a/tests/domaincapsdata/qemu_9.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.1.0-q35.x86_64.xml
@@ -286,5 +286,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.1.0-tcg.x86_64.xml
b/tests/domaincapsdata/qemu_9.1.0-tcg.x86_64.xml
index 996d2e9390..0111abd4e6 100644
--- a/tests/domaincapsdata/qemu_9.1.0-tcg.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.1.0-tcg.x86_64.xml
@@ -285,5 +285,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
diff --git a/tests/domaincapsdata/qemu_9.1.0.x86_64.xml
b/tests/domaincapsdata/qemu_9.1.0.x86_64.xml
index 6381d05bf2..7275237a47 100644
--- a/tests/domaincapsdata/qemu_9.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_9.1.0.x86_64.xml
@@ -286,5 +286,8 @@
<value>avic</value>
</enum>
</hyperv>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
</features>
</domainCapabilities>
--
2.44.2
1:54 p.m.
New subject: [PATCH 5/8] qemu: Fill launchSecurity in domaincaps
On Tue, Jun 25, 2024 at 11:48:50 +0200, Michal Privoznik wrote:
The inspiration for these rules comes from
qemuValidateDomainDef().
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
...
diff --git a/src/qemu/qemu_capabilities.c
b/src/qemu/qemu_capabilities.c
index adaf5f9c26..4f9895ba9c 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -6514,6 +6514,24 @@ virQEMUCapsFillDomainDeviceCryptoCaps(virQEMUCaps *qemuCaps,
}
+void
+virQEMUCapsFillDomainLaunchSecurity(virQEMUCaps *qemuCaps,
+ virDomainCapsLaunchSecurity *launchSecurity)
+{
+ launchSecurity->supported = VIR_TRISTATE_BOOL_YES;
+ launchSecurity->sectype.report = true;
+
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_SEV);
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP);
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST) &&
+ virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT))
+ VIR_DOMAIN_CAPS_ENUM_SET(launchSecurity->sectype,
VIR_DOMAIN_LAUNCH_SECURITY_PV);
+}
+
+
+
Two empty lines would have been enough :-)
/**
* virQEMUCapsSupportsGICVersion:
* @qemuCaps: QEMU capabilities
@@ -6678,6 +6696,7 @@ virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps,
virDomainCapsDeviceChannel *channel = &domCaps->channel;
virDomainCapsMemoryBacking *memoryBacking = &domCaps->memoryBacking;
virDomainCapsDeviceCrypto *crypto = &domCaps->crypto;
+ virDomainCapsLaunchSecurity *launchSecurity = &domCaps->launchSecurity;
virQEMUCapsFillDomainFeaturesFromQEMUCaps(qemuCaps, domCaps);
@@ -6717,6 +6736,7 @@ virQEMUCapsFillDomainCaps(virQEMUCaps *qemuCaps,
virQEMUCapsFillDomainFeatureSGXCaps(qemuCaps, domCaps);
virQEMUCapsFillDomainFeatureHypervCaps(qemuCaps, domCaps);
virQEMUCapsFillDomainDeviceCryptoCaps(qemuCaps, crypto);
+ virQEMUCapsFillDomainLaunchSecurity(qemuCaps, launchSecurity);
return 0;
}
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index a98da8c2eb..ef71e8511e 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -867,6 +867,9 @@ void virQEMUCapsFillDomainDeviceChannelCaps(virQEMUCaps *qemuCaps,
void virQEMUCapsFillDomainDeviceCryptoCaps(virQEMUCaps *qemuCaps,
virDomainCapsDeviceCrypto *crypto);
+void virQEMUCapsFillDomainLaunchSecurity(virQEMUCaps *qemuCaps,
+ virDomainCapsLaunchSecurity *launchSecurity);
+
bool virQEMUCapsGuestIsNative(virArch host,
virArch guest);
diff --git a/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
b/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
index c42a20763f..f9aacbfbf9 100644
--- a/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_4.2.0-q35.x86_64.xml
@@ -319,5 +319,8 @@
<async-teardown supported='no'/>
<sev supported='no'/>
<sgx supported='no'/>
+ <launchSecurity supported='yes'>
+ <enum name='sectype'/>
+ </launchSecurity>
I think reporting launchSecurity as unsupported when no sectype is
available would make more sense.
</features>
</domainCapabilities>
Jirka
11:48 a.m.
New subject: [PATCH 6/8] qemu_validate: Use domaincaps to validate supported launchSecurity type
Now that the logic for detecting supported launchSecurity types
has been moved to domain capabilities generation, we can just use
it when validating launchSecurity type. Just like we do for
device models and so on.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/qemu/qemu_validate.c | 29 ++++++++++++-----------------
1 file changed, 12 insertions(+), 17 deletions(-)
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 3cfcceafc9..b392428f48 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -1310,14 +1310,20 @@ qemuValidateDomainDef(const virDomainDef *def,
return -1;
if (def->sec) {
+ virDomainCapsLaunchSecurity launchSecurity = { };
+
+ virQEMUCapsFillDomainLaunchSecurity(qemuCaps, &launchSecurity);
+
+ if (!VIR_DOMAIN_CAPS_ENUM_IS_SET(launchSecurity.sectype,
+ def->sec->sectype)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("'%1$s' launch security is not supported with
this QEMU binary"),
+
virDomainLaunchSecurityTypeToString(def->sec->sectype));
+ return -1;
+ }
+
switch (def->sec->sectype) {
case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
- if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("SEV launch security is not supported with this
QEMU binary"));
- return -1;
- }
-
if (def->sec->data.sev.common.kernel_hashes != VIR_TRISTATE_BOOL_ABSENT
&&
!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST_KERNEL_HASHES)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -1327,20 +1333,9 @@ qemuValidateDomainDef(const virDomainDef *def,
break;
case VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP:
- if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("SEV SNP launch security is not supported with this
QEMU binary"));
- return -1;
- }
break;
case VIR_DOMAIN_LAUNCH_SECURITY_PV:
- if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT)
||
- !virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("S390 PV launch security is not supported with this
QEMU binary"));
- return -1;
- }
if (!virQEMUCapsGetKVMSupportsSecureGuest(qemuCaps)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("S390 PV launch security is not supported by this
host or kernel"));
--
2.44.2
11:48 a.m.
New subject: [PATCH 7/8] virt-host-validate: Move AMD SEV into a separate func
The code that validates AMD SEV is going to be expanded soon.
Move it into its own function to avoid lengthening
virHostValidateSecureGuests() where the code lives now, even
more.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
tools/virt-host-validate-common.c | 54 ++++++++++++++++++-------------
1 file changed, 32 insertions(+), 22 deletions(-)
diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c
index ad06dfb245..7dca1d795b 100644
--- a/tools/virt-host-validate-common.c
+++ b/tools/virt-host-validate-common.c
@@ -379,6 +379,35 @@ bool virHostKernelModuleIsLoaded(const char *module)
}
+static int
+virHostValidateAMDSev(virValidateLevel level)
+{
+ g_autofree char *mod_value = NULL;
+
+ if (virFileReadValueString(&mod_value,
"/sys/module/kvm_amd/parameters/sev") < 0) {
+ virValidateFail(level, "AMD Secure Encrypted Virtualization not "
+ "supported by the currently used kernel");
+ return VIR_VALIDATE_FAILURE(level);
+ }
+
+ if (mod_value[0] != '1' && mod_value[0] != 'Y' &&
mod_value[0] != 'y') {
+ virValidateFail(level,
+ "AMD Secure Encrypted Virtualization appears to be "
+ "disabled in kernel. Add kvm_amd.sev=1 "
+ "to the kernel cmdline arguments");
+ return VIR_VALIDATE_FAILURE(level);
+ }
+
+ if (!virFileExists("/dev/sev")) {
+ virValidateFail(level,
+ "AMD Secure Encrypted Virtualization appears to be "
+ "disabled in firmware.");
+ return VIR_VALIDATE_FAILURE(level);
+ }
+
+ return 1;
+}
+
int virHostValidateSecureGuests(const char *hvname,
virValidateLevel level)
{
@@ -388,7 +417,6 @@ int virHostValidateSecureGuests(const char *hvname,
virArch arch = virArchFromHost();
g_autofree char *cmdline = NULL;
static const char *kIBMValues[] = {"y", "Y", "on",
"ON", "oN", "On", "1"};
- g_autofree char *mod_value = NULL;
flags = virHostValidateGetCPUFlags();
@@ -430,29 +458,11 @@ int virHostValidateSecureGuests(const char *hvname,
return VIR_VALIDATE_FAILURE(level);
}
} else if (hasAMDSev) {
- if (virFileReadValueString(&mod_value,
"/sys/module/kvm_amd/parameters/sev") < 0) {
- virValidateFail(level, "AMD Secure Encrypted Virtualization not "
- "supported by the currently used kernel");
- return VIR_VALIDATE_FAILURE(level);
- }
+ int rc = virHostValidateAMDSev(level);
- if (mod_value[0] != '1' && mod_value[0] != 'Y' &&
mod_value[0] != 'y') {
- virValidateFail(level,
- "AMD Secure Encrypted Virtualization appears to be
"
- "disabled in kernel. Add kvm_amd.sev=1 "
- "to the kernel cmdline arguments");
- return VIR_VALIDATE_FAILURE(level);
- }
-
- if (virFileExists("/dev/sev")) {
+ if (rc > 0)
virValidatePass();
- return 1;
- } else {
- virValidateFail(level,
- "AMD Secure Encrypted Virtualization appears to be
"
- "disabled in firmware.");
- return VIR_VALIDATE_FAILURE(level);
- }
+ return rc;
}
virValidateFail(level,
--
2.44.2
11:48 a.m.
New subject: [PATCH 8/8] virt-host-validate: Detect SEV-ES and SEV-SNP
With a simple cpuid (Section "E.4.17 Function
8000_001Fh—Encrypted Memory Capabilities" in "AMD64 Architecture
Programmer’s Manual Vol. 3") we can detect whether CPU is capable
of running SEV-ES and/or SEV-SNP guests. Report these in
virt-host-validate tool.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
tools/virt-host-validate-common.c | 33 +++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c
index 7dca1d795b..2985c0c826 100644
--- a/tools/virt-host-validate-common.c
+++ b/tools/virt-host-validate-common.c
@@ -34,6 +34,7 @@
#include "virstring.h"
#include "virarch.h"
#include "virutil.h"
+#include "virhostcpu.h"
#define VIR_FROM_THIS VIR_FROM_NONE
@@ -380,9 +381,11 @@ bool virHostKernelModuleIsLoaded(const char *module)
static int
-virHostValidateAMDSev(virValidateLevel level)
+virHostValidateAMDSev(const char *hvname,
+ virValidateLevel level)
{
g_autofree char *mod_value = NULL;
+ uint32_t eax, ebx;
if (virFileReadValueString(&mod_value,
"/sys/module/kvm_amd/parameters/sev") < 0) {
virValidateFail(level, "AMD Secure Encrypted Virtualization not "
@@ -405,6 +408,32 @@ virHostValidateAMDSev(virValidateLevel level)
return VIR_VALIDATE_FAILURE(level);
}
+ virValidatePass();
+
+ virValidateCheck(hvname, "%s",
+ _("Checking for AMD Secure Encrypted Virtualization-Encrypted
State (SEV-ES)"));
+
+ virHostCPUX86GetCPUID(0x8000001F, 0, &eax, &ebx, NULL, NULL);
+
+ if (eax & (1U << 3)) {
+ virValidatePass();
+ } else {
+ virValidateFail(level,
+ "AMD SEV-ES is not supported");
+ return VIR_VALIDATE_FAILURE(level);
+ }
+
+ virValidateCheck(hvname, "%s",
+ _("Checking for AMD Secure Encrypted Virtualization-Secure
Nested Paging (SEV-SNP)"));
+
+ if (eax & (1U << 4)) {
+ virValidatePass();
+ } else {
+ virValidateFail(level,
+ "AMD SEV-SNP is not supported");
+ return VIR_VALIDATE_FAILURE(level);
+ }
+
return 1;
}
@@ -458,7 +487,7 @@ int virHostValidateSecureGuests(const char *hvname,
return VIR_VALIDATE_FAILURE(level);
}
} else if (hasAMDSev) {
- int rc = virHostValidateAMDSev(level);
+ int rc = virHostValidateAMDSev(hvname, level);
if (rc > 0)
virValidatePass();
--
2.44.2
1:54 p.m.
On Tue, Jun 25, 2024 at 11:48:45 +0200, Michal Privoznik wrote:
This is a promised follow up to:
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/7...
Michal Prívozník (8):
libvirt_private.syms: Export virDomainLaunchSecurity enum handlers
qemuxmlconftest; Explicitly enable QEMU_CAPS_SEV_SNP_GUEST for
"launch-security-sev-snp"
qemu_capabilities: Probe SEV capabilities even for
QEMU_CAPS_SEV_SNP_GUEST
domcaps: Report launchSecurity
qemu: Fill launchSecurity in domaincaps
qemu_validate: Use domaincaps to validate supported launchSecurity
type
virt-host-validate: Move AMD SEV into a separate func
virt-host-validate: Detect SEV-ES and SEV-SNP
Overall it looks OK (see replies to 3/8 and 5/8 for a few nits) and it
makes sense to me. But you should probably wait for a second look from
someone familiar with SEV to check the design makes sense.
Reviewed-by: Jiri Denemark <jdenemar(a)redhat.com>
2 p.m.
On Tue, Jun 25, 2024 at 01:54:59PM +0200, Jiri Denemark wrote:
On Tue, Jun 25, 2024 at 11:48:45 +0200, Michal Privoznik wrote:
> This is a promised follow up to:
>
>
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/7...
>
> Michal Prívozník (8):
> libvirt_private.syms: Export virDomainLaunchSecurity enum handlers
> qemuxmlconftest; Explicitly enable QEMU_CAPS_SEV_SNP_GUEST for
> "launch-security-sev-snp"
> qemu_capabilities: Probe SEV capabilities even for
> QEMU_CAPS_SEV_SNP_GUEST
> domcaps: Report launchSecurity
> qemu: Fill launchSecurity in domaincaps
> qemu_validate: Use domaincaps to validate supported launchSecurity
> type
> virt-host-validate: Move AMD SEV into a separate func
> virt-host-validate: Detect SEV-ES and SEV-SNP
Overall it looks OK (see replies to 3/8 and 5/8 for a few nits) and it
makes sense to me. But you should probably wait for a second look from
someone familiar with SEV to check the design makes sense.
Reviewed-by: Jiri Denemark <jdenemar(a)redhat.com>
Looks fine to me.
Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com>
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
87
days inactive
87
days old
12 comments
3 participants
participants (3)
-
Daniel P. Berrangé -
Jiri Denemark -
Michal Privoznik