Report whether QEMU on s390x supports the boot-certs feature via a new <bootCerts supported='yes|no'/> element in the domain capabilities OS section. QEMU 11.2.0 is the first version to support it. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomaincaps.rst | 19 +++++++++++++++++++ src/conf/domain_capabilities.c | 10 ++++++++++ src/conf/domain_capabilities.h | 6 ++++++ src/conf/schemas/domaincaps.rng | 9 +++++++++ src/qemu/qemu_capabilities.c | 16 ++++++++++++++++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + 14 files changed, 69 insertions(+) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index ed935c704d..7142686a67 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -234,6 +234,25 @@ alternative to pflash-based NVRAM storage. This is the only type of variable storage compatible with Secure Boot on non-x86 architectures, but it can be used on x86 too. +The ``<bootCerts/>`` element :since:`(since 12.9.0)` indicates whether +QEMU supports providing X.509 boot certificates to the s390x CCW firmware +for Secure Boot. When ``supported='yes'``, the ``<boot-certs>`` element may +be used in domain XML to supply PEM-format certificates. This capability is +only reported for the guest on s390x. + +:: + + <domainCapabilities> + ... + <arch>s390x</arch> + ... + <os supported='yes'> + ... + <bootCerts supported='yes'/> + </os> + ... + </domainCapabilities> + CPU configuration ~~~~~~~~~~~~~~~~~ diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c index 78b8e6e6e1..a87af269ee 100644 --- a/src/conf/domain_capabilities.c +++ b/src/conf/domain_capabilities.c @@ -457,6 +457,14 @@ virDomainCapsVarstoreFormat(virBuffer *buf, FORMAT_EPILOGUE(varstore); } +static void +virDomainCapsBootCertsFormat(virBuffer *buf, + const virDomainCapsBootCerts *bootCerts) +{ + FORMAT_PROLOGUE(bootCerts); + FORMAT_EPILOGUE(bootCerts); +} + static void virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsOS *os) @@ -464,6 +472,7 @@ virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures; const virDomainCapsLoader *loader = &os->loader; const virDomainCapsVarstore *varstore = &os->varstore; + const virDomainCapsBootCerts *bootCerts = &os->bootCerts; FORMAT_PROLOGUE(os); @@ -472,6 +481,7 @@ virDomainCapsOSFormat(virBuffer *buf, virDomainCapsFirmwareFeaturesFormat(&childBuf, firmwareFeatures); virDomainCapsLoaderFormat(&childBuf, loader); virDomainCapsVarstoreFormat(&childBuf, varstore); + virDomainCapsBootCertsFormat(&childBuf, bootCerts); FORMAT_EPILOGUE(os); } diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index 02344fd9b6..5a165812f5 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -66,6 +66,11 @@ struct _virDomainCapsVarstore { virTristateBool supported; }; +typedef struct _virDomainCapsBootCerts virDomainCapsBootCerts; +struct _virDomainCapsBootCerts { + virTristateBool supported; +}; + STATIC_ASSERT_ENUM(VIR_DOMAIN_OS_DEF_FIRMWARE_LAST); typedef struct _virDomainCapsOS virDomainCapsOS; struct _virDomainCapsOS { @@ -74,6 +79,7 @@ struct _virDomainCapsOS { virDomainCapsFirmwareFeatures firmwareFeatures; virDomainCapsLoader loader; /* Info about virDomainLoaderDef */ virDomainCapsVarstore varstore; + virDomainCapsBootCerts bootCerts; }; STATIC_ASSERT_ENUM(VIR_DOMAIN_MEMORY_SOURCE_LAST); diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng index 4682abbf41..6c0addf524 100644 --- a/src/conf/schemas/domaincaps.rng +++ b/src/conf/schemas/domaincaps.rng @@ -93,6 +93,12 @@ </element> </define> + <define name="bootCerts"> + <element name="bootCerts"> + <ref name="supported"/> + </element> + </define> + <define name="os"> <element name="os"> <interleave> @@ -107,6 +113,9 @@ <optional> <ref name="varstore"/> </optional> + <optional> + <ref name="bootCerts"/> + </optional> </interleave> </element> </define> diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 48a6bbbd6d..ff35fbc65c 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6607,6 +6607,19 @@ virQEMUCapsFillDomainVarstoreCaps(virDomainCapsVarstore *capsVarstore, } +static void +virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, + virQEMUCaps *qemuCaps) +{ + virDomainCapsBootCerts *bootCerts = &os->bootCerts; + + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) + bootCerts->supported = VIR_TRISTATE_BOOL_YES; + else + bootCerts->supported = VIR_TRISTATE_BOOL_NO; +} + + static int virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, virQEMUCaps *qemuCaps, @@ -6663,6 +6676,9 @@ virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, if (virQEMUCapsFillDomainVarstoreCaps(capsVarstore, varstore, qemuCaps) < 0) goto cleanup; + if (ARCH_IS_S390(arch)) + virQEMUCapsFillDomainOSS390Caps(os, qemuCaps); + ret = 0; cleanup: virFirmwareFreeList(firmwaresAlt, nfirmwaresAlt); diff --git a/tests/domaincapsdata/qemu_10.0.0.s390x.xml b/tests/domaincapsdata/qemu_10.0.0.s390x.xml index a88669528c..663f2da5c9 100644 --- a/tests/domaincapsdata/qemu_10.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.0.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_10.1.0.s390x.xml b/tests/domaincapsdata/qemu_10.1.0.s390x.xml index 3bb62be1ec..2d0cad76f4 100644 --- a/tests/domaincapsdata/qemu_10.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.0.0.s390x.xml b/tests/domaincapsdata/qemu_11.0.0.s390x.xml index b317835b51..5c1de2471c 100644 --- a/tests/domaincapsdata/qemu_11.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.0.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.1.0.s390x.xml b/tests/domaincapsdata/qemu_11.1.0.s390x.xml index 044df2701a..af77db4666 100644 --- a/tests/domaincapsdata/qemu_11.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsdata/qemu_11.2.0.s390x.xml index 6a02aa0df7..34693bea31 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='yes'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_8.1.0.s390x.xml b/tests/domaincapsdata/qemu_8.1.0.s390x.xml index 7971667460..744e496b65 100644 --- a/tests/domaincapsdata/qemu_8.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_8.2.0.s390x.xml b/tests/domaincapsdata/qemu_8.2.0.s390x.xml index 195630a24e..aa1e87a2af 100644 --- a/tests/domaincapsdata/qemu_8.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_9.1.0.s390x.xml b/tests/domaincapsdata/qemu_9.1.0.s390x.xml index 16f32f9465..1700576121 100644 --- a/tests/domaincapsdata/qemu_9.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_9.2.0.s390x.xml b/tests/domaincapsdata/qemu_9.2.0.s390x.xml index d9bbac632e..42b97d8aea 100644 --- a/tests/domaincapsdata/qemu_9.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> -- 2.56.0