Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
virt-manager.24918
virtman-add-sev-memory-support.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File virtman-add-sev-memory-support.patch of Package virt-manager.24918
References: bsc#1196806, jsc#SLE-18834 Index: virt-manager-4.0.0/ui/details.ui =================================================================== --- virt-manager-4.0.0.orig/ui/details.ui +++ virt-manager-4.0.0/ui/details.ui @@ -1925,7 +1925,20 @@ </packing> </child> <child> - <placeholder/> + <object class="GtkCheckButton" id="launch-security"> + <property name="label" translatable="yes">Enable launch security</property> + <property name="visible">True</property> + <property name="can-focus">True</property> + <property name="receives-default">False</property> + <property name="halign">start</property> + <property name="use-underline">True</property> + <property name="draw-indicator">True</property> + <signal name="toggled" handler="on_mem_launch_security_toggled" swapped="no"/> + </object> + <packing> + <property name="left-attach">1</property> + <property name="top-attach">4</property> + </packing> </child> </object> <packing> Index: virt-manager-4.0.0/virtManager/details/details.py =================================================================== --- virt-manager-4.0.0.orig/virtManager/details/details.py +++ virt-manager-4.0.0/virtManager/details/details.py @@ -50,6 +50,7 @@ from ..delete import vmmDeleteStorage EDIT_MEM, EDIT_MEM_SHARED, + EDIT_MEM_SEV, EDIT_AUTOSTART, EDIT_BOOTORDER, @@ -87,7 +88,7 @@ from ..delete import vmmDeleteStorage EDIT_FS, - EDIT_HOSTDEV_ROMBAR) = range(1, 38) + EDIT_HOSTDEV_ROMBAR) = range(1, 39) # Columns in hw list model @@ -440,6 +441,7 @@ class vmmDetails(vmmGObjectUI): "on_mem_maxmem_changed": _e(EDIT_MEM), "on_mem_memory_changed": self._curmem_changed_cb, "on_mem_shared_access_toggled": _e(EDIT_MEM_SHARED), + "on_mem_launch_security_toggled": _e(EDIT_MEM_SEV), "on_boot_list_changed": self._boot_list_changed_cb, "on_boot_moveup_clicked": self._boot_moveup_clicked_cb, @@ -1516,6 +1518,9 @@ class vmmDetails(vmmGObjectUI): if self._edited(EDIT_MEM_SHARED): kwargs["mem_shared"] = self.widget("shared-memory").get_active() + if self._edited(EDIT_MEM_SEV): + kwargs["sevmem"] = self.widget("launch-security").get_active() + return self._change_config( self.vm.define_memory, kwargs, hotplug_args=hotplug_args) @@ -2021,6 +2026,14 @@ class vmmDetails(vmmGObjectUI): curmem.set_value(int(round(vm_cur_mem))) maxmem.set_value(int(round(vm_max_mem))) + domcaps = self.vm.get_domain_capabilities() + show_sev = domcaps.supports_sev_launch_security() + self.widget("launch-security").set_sensitive(show_sev and self.is_customize_dialog) + if self.vm.get_launch_security_type(): + self.widget("launch-security").set_active(True) + else: + self.widget("launch-security").set_active(False) + shared_mem, shared_mem_err = self.vm.has_shared_mem() self.widget("shared-memory").set_active(shared_mem) self.widget("shared-memory").set_sensitive(not bool(shared_mem_err)) Index: virt-manager-4.0.0/virtManager/object/domain.py =================================================================== --- virt-manager-4.0.0.orig/virtManager/object/domain.py +++ virt-manager-4.0.0/virtManager/object/domain.py @@ -688,15 +688,33 @@ class vmmDomain(vmmLibvirtObject): guest.memoryBacking.access_mode = access_mode def define_memory(self, memory=_SENTINEL, maxmem=_SENTINEL, - mem_shared=_SENTINEL): + mem_shared=_SENTINEL, sevmem=_SENTINEL): guest = self._make_xmlobj_to_define() + def _set_rombar(guest, value): + # Ideally turning rombar off would be done automatically + # by either libvirt or qemu when SEV is detected. + for nic in guest.devices.interface: + nic.set_rom_bar(value) + if memory != _SENTINEL: guest.currentMemory = int(memory) if maxmem != _SENTINEL: guest.memory = int(maxmem) if mem_shared != _SENTINEL: self._edit_shared_mem(guest, mem_shared) + if sevmem != _SENTINEL: + if sevmem is True: + domcaps = self.get_domain_capabilities() + guest.launchSecurity.type = "sev" + guest.launchSecurity.set_defaults(guest, domcaps.supports_sev_es_launch_security()) + guest.memoryBacking.set_locked(True) + _set_rombar(guest, "off") + else: + guest.launchSecurity.type = None + guest.launchSecurity.policy = None + guest.memoryBacking.set_locked(False) + _set_rombar(guest, None) self._redefine_xmlobj(guest) @@ -1310,6 +1328,9 @@ class vmmDomain(vmmLibvirtObject): def get_description(self): return self.get_xmlobj().description + def get_launch_security_type(self): + return self.get_xmlobj().launchSecurity.type + def get_boot_order(self): legacy = not self.can_use_device_boot_order() return self.xmlobj.get_boot_order(legacy=legacy) Index: virt-manager-4.0.0/virtinst/domain/memorybacking.py =================================================================== --- virt-manager-4.0.0.orig/virtinst/domain/memorybacking.py +++ virt-manager-4.0.0/virtinst/domain/memorybacking.py @@ -27,6 +27,9 @@ class DomainMemoryBacking(XMLBuilder): XML_NAME = "memoryBacking" _XML_PROP_ORDER = ["hugepages", "nosharepages", "locked", "pages"] + def set_locked(self, value): + self.locked = value + hugepages = XMLProperty("./hugepages", is_bool=True) nosharepages = XMLProperty("./nosharepages", is_bool=True) locked = XMLProperty("./locked", is_bool=True) Index: virt-manager-4.0.0/virtinst/domcapabilities.py =================================================================== --- virt-manager-4.0.0.orig/virtinst/domcapabilities.py +++ virt-manager-4.0.0/virtinst/domcapabilities.py @@ -93,6 +93,10 @@ def _make_capsblock(xml_root_name): class _SEV(XMLBuilder): XML_NAME = "sev" supported = XMLProperty("./@supported", is_yesno=True) + cbitpos = XMLProperty("./cbitpos") + reducedPhysBits = XMLProperty("./reducedPhysBits") + maxGuests = XMLProperty("./maxGuests") + maxESGuests = XMLProperty("./maxESGuests") ############################# @@ -398,6 +402,9 @@ class DomainCapabilities(XMLBuilder): """ return bool(self.features.sev.supported) + def supports_sev_es_launch_security(self): + return bool(self.features.sev.supported and self.features.sev.maxESGuests) + def supports_video_bochs(self): """ Returns False if either libvirt or qemu do not have support to bochs Index: virt-manager-4.0.0/virtinst/domain/launch_security.py =================================================================== --- virt-manager-4.0.0.orig/virtinst/domain/launch_security.py +++ virt-manager-4.0.0/virtinst/domain/launch_security.py @@ -18,9 +18,13 @@ class DomainLaunchSecurity(XMLBuilder): dhCert = XMLProperty("./dhCert") kernelHashes = XMLProperty("./@kernelHashes", is_yesno=True) - def _set_defaults_sev(self, guest): - if not guest.os.is_q35() or not guest.is_uefi(): - raise RuntimeError(_("SEV launch security requires a Q35 UEFI machine")) + def _set_defaults_sev(self, guest, sev_es): + if not guest.os.is_q35(): + raise RuntimeError(_("SEV launch security requires a Q35 machine")) + # Libvirt will select the appropriate firmware file if not specified + # as long as we enable efi. + if not guest.is_uefi(): + guest.os.firmware = 'efi' # 'policy' is a mandatory 4-byte argument for the SEV firmware, # if missing, let's use 0x03 which, according to the table at @@ -28,8 +32,11 @@ class DomainLaunchSecurity(XMLBuilder): # (bit 0) - disables the debugging mode # (bit 1) - disables encryption key sharing across multiple guests if self.policy is None: - self.policy = "0x03" + if sev_es: + self.policy = "0x07" + else: + self.policy = "0x03" - def set_defaults(self, guest): + def set_defaults(self, guest, sev_es=False): if self.type == "sev": - return self._set_defaults_sev(guest) + return self._set_defaults_sev(guest, sev_es) Index: virt-manager-4.0.0/virtinst/devices/interface.py =================================================================== --- virt-manager-4.0.0.orig/virtinst/devices/interface.py +++ virt-manager-4.0.0/virtinst/devices/interface.py @@ -287,6 +287,9 @@ class DeviceInterface(Device): self.type = nettype self.source = source + def set_rom_bar(self, value): + self.rom_bar = value + ################## # Default config # Index: virt-manager-4.0.0/virtManager/addhardware.py =================================================================== --- virt-manager-4.0.0.orig/virtManager/addhardware.py +++ virt-manager-4.0.0/virtManager/addhardware.py @@ -1438,6 +1438,9 @@ class vmmAddHardware(vmmGObjectUI): mac = self.widget("create-mac-address").get_text() dev = self._netlist.build_device(mac, model) + if self.vm.get_launch_security_type() == "sev": + dev.set_rom_bar("off") + return dev def _build_input(self):
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
