Populate the secureBoot firmware feature in domain capabilities for s390x. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomaincaps.rst | 12 ++++++++++++ src/qemu/qemu_capabilities.c | 12 ++++++++++++ tests/domaincapsdata/qemu_11.2.0.s390x.xml | 5 ++++- 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index 7142686a67..f980b8577e 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -240,6 +240,11 @@ for Secure Boot. When ``supported='yes'``, the ``<boot-certs>`` element may be used in domain XML to supply PEM-format certificates. This capability is only reported for the guest on s390x. +The ``secureBoot`` enum with values ``yes`` and ``no`` under +``<firmwareFeatures/>`` indicates support of Secure Boot on s390x +:since:`(since 12.9.0)`, which can be used to enable Secure Boot for the +s390 CCW firmware without requiring firmware autoselection. + :: <domainCapabilities> @@ -248,6 +253,13 @@ only reported for the guest on s390x. ... <os supported='yes'> ... + <firmwareFeatures supported='yes'> + <enum name='secureBoot'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='enrolledKeys'/> + </firmwareFeatures> <bootCerts supported='yes'/> </os> ... diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 53d26a8d3d..ef8fffdcc3 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6613,8 +6613,20 @@ static void virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, virQEMUCaps *qemuCaps) { + virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures; virDomainCapsBootCerts *bootCerts = &os->bootCerts; + /* + * No conflict with the secureBoot bits set via qemuFirmwareGetSupported() + * in virQEMUCapsFillDomainOSCaps(): s390-ccw is embedded in QEMU with no + * external firmware descriptor files, so featureSecureBoot is always 0 + * on s390 and those bits are left unset. + */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) { + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTATE_BOOL_YES); + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTATE_BOOL_NO); + } + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) bootCerts->supported = VIR_TRISTATE_BOOL_YES; else diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsdata/qemu_11.2.0.s390x.xml index 34693bea31..ab915a3607 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -8,7 +8,10 @@ <os supported='yes'> <enum name='firmware'/> <firmwareFeatures supported='yes'> - <enum name='secureBoot'/> + <enum name='secureBoot'> + <value>yes</value> + <value>no</value> + </enum> <enum name='enrolledKeys'/> </firmwareFeatures> <loader supported='yes'> -- 2.56.0