File b611b620-check-s390-secure-guest.patch of Package libvirt.22291

commit b611b620ceaf940017ba4d0b8b0638869c751509
Author: Paulo de Rezende Pinatti <ppinatti@linux.ibm.com>
Date:   Mon Jun 15 10:28:07 2020 +0200

    qemu: Check if s390 secure guest support is enabled
    
    This patch introduces a common function to verify if the
    availability of the so-called Secure Guest feature on the host
    has changed in order to invalidate the qemu capabilities cache.
    It can be used as an entry point for verification on different
    architectures.
    
    For s390 the verification consists of:
    - checking if /sys/firmware/uv is available: meaning the HW
    facility is available and the host OS supports it;
    - checking if the kernel cmdline contains 'prot_virt=1': meaning
    the host OS wants to use the feature.
    
    Whenever the availability of the feature does not match the secure
    guest flag in the cache then libvirt will re-build it in order to
    pick up the new set of capabilities available.
    
    Signed-off-by: Paulo de Rezende Pinatti <ppinatti@linux.ibm.com>
    Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
    Tested-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
    Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
    Reviewed-by: Erik Skultety <eskultet@redhat.com>

Index: libvirt-6.0.0/src/qemu/qemu_capabilities.c
===================================================================
--- libvirt-6.0.0.orig/src/qemu/qemu_capabilities.c
+++ libvirt-6.0.0/src/qemu/qemu_capabilities.c
@@ -23,6 +23,7 @@
 
 #include "qemu_capabilities.h"
 #include "viralloc.h"
+#include "virarch.h"
 #include "vircrypto.h"
 #include "virlog.h"
 #include "virerror.h"
@@ -608,6 +609,7 @@ struct _virQEMUCaps {
 
     bool usedQMP;
     bool kvmSupportsNesting;
+    bool kvmSupportsSecureGuest;
 
     char *binary;
     time_t ctime;
@@ -1769,6 +1771,7 @@ virQEMUCapsPtr virQEMUCapsNewCopy(virQEM
     ret->invalidation = qemuCaps->invalidation;
     ret->usedQMP = qemuCaps->usedQMP;
     ret->kvmSupportsNesting = qemuCaps->kvmSupportsNesting;
+    ret->kvmSupportsSecureGuest = qemuCaps->kvmSupportsSecureGuest;
 
     ret->ctime = qemuCaps->ctime;
 
@@ -4091,6 +4094,9 @@ virQEMUCapsLoadCache(virArch hostArch,
     if (virXPathBoolean("boolean(./kvmSupportsNesting)", ctxt) > 0)
         qemuCaps->kvmSupportsNesting = true;
 
+    if (virXPathBoolean("boolean(./kvmSupportsSecureGuest)", ctxt) > 0)
+        qemuCaps->kvmSupportsSecureGuest = true;
+
     ret = 0;
  cleanup:
     VIR_FREE(str);
@@ -4325,6 +4331,9 @@ virQEMUCapsFormatCache(virQEMUCapsPtr qe
     if (qemuCaps->kvmSupportsNesting)
         virBufferAddLit(&buf, "<kvmSupportsNesting/>\n");
 
+    if (qemuCaps->kvmSupportsSecureGuest)
+        virBufferAddLit(&buf, "<kvmSupportsSecureGuest/>\n");
+
     virBufferAdjustIndent(&buf, -2);
     virBufferAddLit(&buf, "</qemuCaps>\n");
 
@@ -4364,6 +4373,49 @@ virQEMUCapsSaveFile(void *data,
 }
 
 
+/*
+ * Check whether IBM Secure Execution (S390) is enabled
+ */
+static bool
+virQEMUCapsKVMSupportsSecureGuestS390(void)
+{
+
+    g_autofree char *cmdline = NULL;
+    static const char *kValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"};
+
+    if (!virFileIsDir("/sys/firmware/uv"))
+        return false;
+
+    if (virFileReadValueString(&cmdline, "/proc/cmdline") < 0)
+        return false;
+
+    /* we're prefix matching rather than equality matching here, because kernel
+     * would treat even something like prot_virt='yFOO' as enabled */
+    if (virKernelCmdlineMatchParam(cmdline, "prot_virt", kValues,
+                                   G_N_ELEMENTS(kValues),
+                                   VIR_KERNEL_CMDLINE_FLAGS_SEARCH_FIRST |
+                                   VIR_KERNEL_CMDLINE_FLAGS_CMP_PREFIX))
+        return true;
+
+    return false;
+}
+
+
+/*
+ * Check whether the secure guest functionality is enabled.
+ * See the specific architecture function for details on the verifications made.
+ */
+static bool
+virQEMUCapsKVMSupportsSecureGuest(void)
+{
+    virArch arch = virArchFromHost();
+
+    if (ARCH_IS_S390(arch))
+        return virQEMUCapsKVMSupportsSecureGuestS390();
+    return false;
+}
+
+
 /* Check the kernel module parameters 'nested' file to determine if enabled
  *
  *   Intel: 'kvm_intel' uses 'Y'
@@ -4543,6 +4595,13 @@ virQEMUCapsIsValid(void *data,
                      qemuCaps->binary, qemuCaps->kvmSupportsNesting);
             return false;
         }
+
+        if (virQEMUCapsKVMSupportsSecureGuest() != qemuCaps->kvmSupportsSecureGuest) {
+            VIR_DEBUG("Outdated capabilities for '%s': kvm kernel secure guest "
+                      "value changed from %d",
+                      qemuCaps->binary, qemuCaps->kvmSupportsSecureGuest);
+            return false;
+        }
     }
 
     return true;
@@ -5010,6 +5069,8 @@ virQEMUCapsNewForBinaryInternal(virArch
         qemuCaps->kernelVersion = g_strdup(kernelVersion);
 
         qemuCaps->kvmSupportsNesting = virQEMUCapsKVMSupportsNesting();
+
+        qemuCaps->kvmSupportsSecureGuest = virQEMUCapsKVMSupportsSecureGuest();
     }
 
     return qemuCaps;