Build boot-certs entries on the -machine command line for s390x guests. Validate that boot certificates are only used on s390x and that the QEMU binary supports the boot-certs machine property. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- src/qemu/qemu_command.c | 7 +++++++ src/qemu/qemu_validate.c | 13 +++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index bcddb9c922..25d22bb640 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7379,6 +7379,13 @@ qemuBuildMachineCommandLine(virCommand *cmd, qemuBuildMachineACPI(&buf, def, qemuCaps); + if (qemuDomainIsS390CCW(def)) { + for (i = 0; i < def->os.nbootCerts; i++) { + virBufferAsprintf(&buf, ",boot-certs.%zu.path=", i); + virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); + } + } + if (qemuDomainIsARMVirt(def)) { for (i = 0; i < def->ncontrollers; i++) { virDomainControllerDef *cont = def->controllers[i]; diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 08f5a6659d..e7f8f4d30f 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -866,6 +866,19 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } + if (def->os.nbootCerts > 0) { + if (!qemuDomainIsS390CCW(def)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is only supported for s390x CCW machine types")); + return -1; + } + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is not supported by this QEMU binary")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", -- 2.56.0