From 0091d8af2205a593439a74419ef99b5d7e7fdf2b Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 4 Dec 2025 12:33:07 +0000 Subject: [PATCH] Import from AlmaLinux stable repository --- ...Quote-Generation-Service-QGS-support.patch | 141 - ...conf-Add-tdx-as-launch-security-type.patch | 379 - ...e-TDX-feature-in-domain-capabilities.patch | 164 - ...in-domain-launch-security-capability.patch | 90 - ...ent-mrConfigId-mrOwner-mrOwnerConfig.patch | 63 - ...dd-documentation-for-Intel-TDX-guest.patch | 94 - ...Add-FakeReboot-support-for-TDX-guest.patch | 139 - ...u-Add-QEMU_CAPS_TDX_GUEST-capability.patch | 72 - ...and-line-and-validation-for-TDX-type.patch | 118 - ...for-TDX-Quote-Generation-Service-QGS.patch | 84 - ...uplicate-FakeReboot-for-secure-guest.patch | 48 - ...-Domain-Extention-support-is-enabled.patch | 68 - ...ial-parameters-enabled-for-TDX-guest.patch | 73 - ...T_-STOPPED-STARTED-during-recreation.patch | 138 - ...t-domain-reset-command-for-TDX-guest.patch | 150 - ...qemu-Support-reboot-command-in-guest.patch | 96 - ...mu-log-the-crash-information-for-TDX.patch | 165 - ...ck-the-right-firmware-for-TDX-guests.patch | 122 - ...litiesdata-Document-inteltdx-variant.patch | 36 - ...e-on-x86_64-for-the-inteltdx-variant.patch | 51568 ---------------- ...ion-of-launch-security-tdx-test-data.patch | 211 - ...heck-for-Intel-in-virt-host-validate.patch | 107 - SPECS/libvirt.spec | 50 +- 23 files changed, 2 insertions(+), 54174 deletions(-) delete mode 100644 SOURCES/libvirt-conf-Add-Intel-TDX-Quote-Generation-Service-QGS-support.patch delete mode 100644 SOURCES/libvirt-conf-Add-tdx-as-launch-security-type.patch delete mode 100644 SOURCES/libvirt-conf-Expose-TDX-feature-in-domain-capabilities.patch delete mode 100644 SOURCES/libvirt-conf-Expose-TDX-type-in-domain-launch-security-capability.patch delete mode 100644 SOURCES/libvirt-conf-Validate-TDX-launchSecurity-element-mrConfigId-mrOwner-mrOwnerConfig.patch delete mode 100644 SOURCES/libvirt-docs-domain-Add-documentation-for-Intel-TDX-guest.patch delete mode 100644 SOURCES/libvirt-qemu-Add-FakeReboot-support-for-TDX-guest.patch delete mode 100644 SOURCES/libvirt-qemu-Add-QEMU_CAPS_TDX_GUEST-capability.patch delete mode 100644 SOURCES/libvirt-qemu-Add-command-line-and-validation-for-TDX-type.patch delete mode 100644 SOURCES/libvirt-qemu-Add-command-line-for-TDX-Quote-Generation-Service-QGS.patch delete mode 100644 SOURCES/libvirt-qemu-Avoid-duplicate-FakeReboot-for-secure-guest.patch delete mode 100644 SOURCES/libvirt-qemu-Check-if-INTEL-Trust-Domain-Extention-support-is-enabled.patch delete mode 100644 SOURCES/libvirt-qemu-Force-special-parameters-enabled-for-TDX-guest.patch delete mode 100644 SOURCES/libvirt-qemu-Send-event-VIR_DOMAIN_EVENT_-STOPPED-STARTED-during-recreation.patch delete mode 100644 SOURCES/libvirt-qemu-Support-domain-reset-command-for-TDX-guest.patch delete mode 100644 SOURCES/libvirt-qemu-Support-reboot-command-in-guest.patch delete mode 100644 SOURCES/libvirt-qemu-log-the-crash-information-for-TDX.patch delete mode 100644 SOURCES/libvirt-qemu_firmware-Pick-the-right-firmware-for-TDX-guests.patch delete mode 100644 SOURCES/libvirt-qemucapabilitiesdata-Document-inteltdx-variant.patch delete mode 100644 SOURCES/libvirt-qemucapabilitiestest-Add-data-for-the-qemu-10.1.0-dev-cycle-on-x86_64-for-the-inteltdx-variant.patch delete mode 100644 SOURCES/libvirt-qemuxmlconftest-Add-latest-version-of-launch-security-tdx-test-data.patch delete mode 100644 SOURCES/libvirt-tools-Secure-guest-check-for-Intel-in-virt-host-validate.patch diff --git a/SOURCES/libvirt-conf-Add-Intel-TDX-Quote-Generation-Service-QGS-support.patch b/SOURCES/libvirt-conf-Add-Intel-TDX-Quote-Generation-Service-QGS-support.patch deleted file mode 100644 index 73ee651..0000000 --- a/SOURCES/libvirt-conf-Add-Intel-TDX-Quote-Generation-Service-QGS-support.patch +++ /dev/null @@ -1,141 +0,0 @@ -From e3233ee7847c0b51267b511038724a0ab8a54484 Mon Sep 17 00:00:00 2001 -Message-ID: -From: Zhenzhong Duan -Date: Thu, 10 Jul 2025 03:21:16 -0400 -Subject: [PATCH] conf: Add Intel TDX Quote Generation Service(QGS) support -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Add element "quoteGenerationService" to tdx launch security type. -It contains only an optional unix socket address attribute, -when omitted, libvirt will use default QGS server address -"/var/run/tdx-qgs/qgs.socket". - -UNIX sockets offer the required functionality with greater -security than vsock, so libvirt only provides support for unix -socket. - -XML example: - - - 0x10000001 - xxx - xxx - xxx - - - -Reviewed-by: Daniel P. Berrangé -Signed-off-by: Zhenzhong Duan -(cherry picked from commit 8214980432191138f052c2e32d12ae284597c8b8) -Resolves: https://issues.redhat.com/browse/RHEL-111840 -Signed-off-by: Paolo Bonzini ---- - src/conf/domain_conf.c | 35 ++++++++++++++++++++++++++++++- - src/conf/domain_conf.h | 2 ++ - src/conf/schemas/domaincommon.rng | 9 ++++++++ - 3 files changed, 45 insertions(+), 1 deletion(-) - -diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c -index 92185080a9..38179a7e59 100644 ---- a/src/conf/domain_conf.c -+++ b/src/conf/domain_conf.c -@@ -3895,6 +3895,7 @@ virDomainSecDefFree(virDomainSecDef *def) - g_free(def->data.tdx.mrconfigid); - g_free(def->data.tdx.mrowner); - g_free(def->data.tdx.mrownerconfig); -+ g_free(def->data.tdx.qgs_unix_path); - break; - case VIR_DOMAIN_LAUNCH_SECURITY_PV: - case VIR_DOMAIN_LAUNCH_SECURITY_NONE: -@@ -13911,6 +13912,33 @@ virDomainSEVSNPDefParseXML(virDomainSEVSNPDef *def, - } - - -+static int -+virDomainTDXQGSDefParseXML(virDomainTDXDef *def, xmlXPathContextPtr ctxt) -+{ -+ g_autofree xmlNodePtr *nodes = NULL; -+ xmlNodePtr node; -+ int n; -+ -+ if ((n = virXPathNodeSet("./quoteGenerationService", ctxt, &nodes)) < 0) -+ return -1; -+ -+ if (!n) -+ return 0; -+ -+ if (n > 1) { -+ virReportError(VIR_ERR_XML_ERROR, "%s", -+ _("only a single QGS element is supported")); -+ return -1; -+ } -+ node = nodes[0]; -+ -+ def->haveQGS = true; -+ def->qgs_unix_path = virXMLPropString(node, "path"); -+ -+ return 0; -+} -+ -+ - static int - virDomainTDXDefParseXML(virDomainTDXDef *def, - xmlXPathContextPtr ctxt) -@@ -13930,7 +13958,7 @@ virDomainTDXDefParseXML(virDomainTDXDef *def, - def->mrowner = virXPathString("string(./mrOwner)", ctxt); - def->mrownerconfig = virXPathString("string(./mrOwnerConfig)", ctxt); - -- return 0; -+ return virDomainTDXQGSDefParseXML(def, ctxt); - } - - -@@ -27261,6 +27289,11 @@ virDomainTDXDefFormat(virBuffer *childBuf, virDomainTDXDef *def) - virBufferEscapeString(childBuf, "%s\n", def->mrconfigid); - virBufferEscapeString(childBuf, "%s\n", def->mrowner); - virBufferEscapeString(childBuf, "%s\n", def->mrownerconfig); -+ if (def->haveQGS) { -+ virBufferAddLit(childBuf, "qgs_unix_path); -+ virBufferAddLit(childBuf, "/>\n"); -+ } - } - - -diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h -index 0ea88e013b..85ef6fbf2c 100644 ---- a/src/conf/domain_conf.h -+++ b/src/conf/domain_conf.h -@@ -2965,6 +2965,8 @@ struct _virDomainTDXDef { - char *mrconfigid; - char *mrowner; - char *mrownerconfig; -+ bool haveQGS; -+ char *qgs_unix_path; - }; - - -diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng -index 552b2f4ced..93bc128dec 100644 ---- a/src/conf/schemas/domaincommon.rng -+++ b/src/conf/schemas/domaincommon.rng -@@ -652,6 +652,15 @@ - - - -+ -+ -+ -+ -+ -+ -+ -+ -+ - - - --- -2.51.0 diff --git a/SOURCES/libvirt-conf-Add-tdx-as-launch-security-type.patch b/SOURCES/libvirt-conf-Add-tdx-as-launch-security-type.patch deleted file mode 100644 index 6becfaa..0000000 --- a/SOURCES/libvirt-conf-Add-tdx-as-launch-security-type.patch +++ /dev/null @@ -1,379 +0,0 @@ -From 3f4f38e2f1f05b0484035f96e61ee0de130d3050 Mon Sep 17 00:00:00 2001 -Message-ID: <3f4f38e2f1f05b0484035f96e61ee0de130d3050.1759835600.git.jdenemar@redhat.com> -From: Zhenzhong Duan -Date: Thu, 10 Jul 2025 03:21:09 -0400 -Subject: [PATCH] conf: Add tdx as launch security type -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -When 'tdx' is used, the VM will be launched with Intel TDX feature enabled. -TDX feature supports running encrypted VM (Trust Domain, TD) under the -control of KVM. A TD runs in a CPU model which protects the confidentiality -of its memory and its CPU state from other software. - -There are four optional child elements. Element policy is 64bit hex, bit 0 -is set to enable TDX debug, bit 28 is set to enable sept-ve-disable, other -bits are reserved currently. When policy isn't specified, QEMU will use its -own default value 0x10000000. mrConfigId, mrOwner and mrOwnerConfig are -base64 encoded SHA384 digest string. - -For example: - - - 0x10000001 - xxx - xxx - xxx - - -Signed-off-by: Zhenzhong Duan -Reviewed-by: Daniel P. Berrangé -(cherry picked from commit e919a4dd374535511d962bee2cd64f22f1ac3fa1) -Resolves: https://issues.redhat.com/browse/RHEL-111840 -Signed-off-by: Paolo Bonzini - -RHEL: context ---- - src/conf/domain_conf.c | 49 +++++++++++++++++++++++++++++++ - src/conf/domain_conf.h | 11 +++++++ - src/conf/domain_validate.c | 1 + - src/conf/schemas/domaincommon.rng | 32 ++++++++++++++++++++ - src/conf/virconftypes.h | 2 ++ - src/qemu/qemu_cgroup.c | 1 + - src/qemu/qemu_command.c | 3 ++ - src/qemu/qemu_driver.c | 1 + - src/qemu/qemu_firmware.c | 1 + - src/qemu/qemu_namespace.c | 1 + - src/qemu/qemu_process.c | 2 ++ - src/qemu/qemu_validate.c | 1 + - src/security/security_dac.c | 2 ++ - 13 files changed, 107 insertions(+) - -diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c -index 286e59a4c7..92185080a9 100644 ---- a/src/conf/domain_conf.c -+++ b/src/conf/domain_conf.c -@@ -1538,6 +1538,7 @@ VIR_ENUM_IMPL(virDomainLaunchSecurity, - "sev", - "sev-snp", - "s390-pv", -+ "tdx", - ); - - VIR_ENUM_IMPL(virDomainPstoreBackend, -@@ -3890,6 +3891,11 @@ virDomainSecDefFree(virDomainSecDef *def) - g_free(def->data.sev_snp.id_auth); - g_free(def->data.sev_snp.host_data); - break; -+ case VIR_DOMAIN_LAUNCH_SECURITY_TDX: -+ g_free(def->data.tdx.mrconfigid); -+ g_free(def->data.tdx.mrowner); -+ g_free(def->data.tdx.mrownerconfig); -+ break; - case VIR_DOMAIN_LAUNCH_SECURITY_PV: - case VIR_DOMAIN_LAUNCH_SECURITY_NONE: - case VIR_DOMAIN_LAUNCH_SECURITY_LAST: -@@ -13905,6 +13911,29 @@ virDomainSEVSNPDefParseXML(virDomainSEVSNPDef *def, - } - - -+static int -+virDomainTDXDefParseXML(virDomainTDXDef *def, -+ xmlXPathContextPtr ctxt) -+{ -+ int rc; -+ -+ rc = virXPathULongLongBase("string(./policy)", ctxt, 16, &def->policy); -+ if (rc == 0) { -+ def->havePolicy = true; -+ } else if (rc == -2) { -+ virReportError(VIR_ERR_XML_ERROR, "%s", -+ _("failed to get launch security policy for launch security type TDX")); -+ return -1; -+ } -+ -+ def->mrconfigid = virXPathString("string(./mrConfigId)", ctxt); -+ def->mrowner = virXPathString("string(./mrOwner)", ctxt); -+ def->mrownerconfig = virXPathString("string(./mrOwnerConfig)", ctxt); -+ -+ return 0; -+} -+ -+ - static virDomainSecDef * - virDomainSecDefParseXML(xmlNodePtr lsecNode, - xmlXPathContextPtr ctxt) -@@ -13928,6 +13957,10 @@ virDomainSecDefParseXML(xmlNodePtr lsecNode, - if (virDomainSEVSNPDefParseXML(&sec->data.sev_snp, ctxt) < 0) - return NULL; - break; -+ case VIR_DOMAIN_LAUNCH_SECURITY_TDX: -+ if (virDomainTDXDefParseXML(&sec->data.tdx, ctxt) < 0) -+ return NULL; -+ break; - case VIR_DOMAIN_LAUNCH_SECURITY_PV: - break; - case VIR_DOMAIN_LAUNCH_SECURITY_NONE: -@@ -27219,6 +27252,18 @@ virDomainSEVSNPDefFormat(virBuffer *attrBuf, - } - - -+static void -+virDomainTDXDefFormat(virBuffer *childBuf, virDomainTDXDef *def) -+{ -+ if (def->havePolicy) -+ virBufferAsprintf(childBuf, "0x%llx\n", def->policy); -+ -+ virBufferEscapeString(childBuf, "%s\n", def->mrconfigid); -+ virBufferEscapeString(childBuf, "%s\n", def->mrowner); -+ virBufferEscapeString(childBuf, "%s\n", def->mrownerconfig); -+} -+ -+ - static void - virDomainSecDefFormat(virBuffer *buf, virDomainSecDef *sec) - { -@@ -27240,6 +27285,10 @@ virDomainSecDefFormat(virBuffer *buf, virDomainSecDef *sec) - virDomainSEVSNPDefFormat(&attrBuf, &childBuf, &sec->data.sev_snp); - break; - -+ case VIR_DOMAIN_LAUNCH_SECURITY_TDX: -+ virDomainTDXDefFormat(&childBuf, &sec->data.tdx); -+ break; -+ - case VIR_DOMAIN_LAUNCH_SECURITY_PV: - break; - -diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h -index e59d2e6c5f..1238f2001f 100644 ---- a/src/conf/domain_conf.h -+++ b/src/conf/domain_conf.h -@@ -2924,6 +2924,7 @@ typedef enum { - VIR_DOMAIN_LAUNCH_SECURITY_SEV, - VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP, - VIR_DOMAIN_LAUNCH_SECURITY_PV, -+ VIR_DOMAIN_LAUNCH_SECURITY_TDX, - - VIR_DOMAIN_LAUNCH_SECURITY_LAST, - } virDomainLaunchSecurity; -@@ -2958,11 +2959,21 @@ struct _virDomainSEVSNPDef { - }; - - -+struct _virDomainTDXDef { -+ bool havePolicy; -+ unsigned long long policy; -+ char *mrconfigid; -+ char *mrowner; -+ char *mrownerconfig; -+}; -+ -+ - struct _virDomainSecDef { - virDomainLaunchSecurity sectype; - union { - virDomainSEVDef sev; - virDomainSEVSNPDef sev_snp; -+ virDomainTDXDef tdx; - } data; - }; - -diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c -index 522fd0174f..2d4b79032b 100644 ---- a/src/conf/domain_validate.c -+++ b/src/conf/domain_validate.c -@@ -1860,6 +1860,7 @@ virDomainDefLaunchSecurityValidate(const virDomainDef *def) - case VIR_DOMAIN_LAUNCH_SECURITY_NONE: - case VIR_DOMAIN_LAUNCH_SECURITY_SEV: - case VIR_DOMAIN_LAUNCH_SECURITY_PV: -+ case VIR_DOMAIN_LAUNCH_SECURITY_TDX: - case VIR_DOMAIN_LAUNCH_SECURITY_LAST: - break; - } -diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng -index 1b153acc48..552b2f4ced 100644 ---- a/src/conf/schemas/domaincommon.rng -+++ b/src/conf/schemas/domaincommon.rng -@@ -528,6 +528,9 @@ - s390-pv - - -+ -+ -+ - - - -@@ -623,6 +626,35 @@ - - - -+ -+ -+ -+ tdx -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -