This series adds libvirt support for the s390x Secure IPL interface, which allows firmware to verify the integrity and authenticity of a boot image against a set of X.509 certificates before handing control to the guest OS. Two new machine properties on s390-ccw-virtio: boot-certs.N.path=<path> – supply one or more X.509 certificates or directory secure-boot=on|off – enable/disable secure boot On the XML side, a new <boot-certs> element under <os> stores the certificate paths, while the existing secure-boot firmware feature is reused to control the corresponding QEMU machine property. Providing certificates without enabling secure boot is a valid configuration and places the firmware into audit mode, allowing verification results to be reported without enforcing them. Usage example: <os> <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type> <firmware> <feature enabled='yes' name='secure-boot'/> </firmware> <boot-certs> <path>/path/to/cert_dir</path> <path>/path/to/cert1.pem</path> </boot-certs> </os> The series adds: * XML parsing and formatting for <boot-certs> and secure-boot on s390x * QEMU capability detection with updated s390x QMP reply fixtures for QEMU 8.1 through 11.2 * -machine argument generation for boot-certs and secure-boot * Validation (s390x-only, secure-boot requires certs, QEMU version) * Domain capabilities reporting in the <os> section * Documentation and tests Boris Fiuczynski (1): test: Add ABI update test for s390x secure-boot Zhuoying Cai (13): conf: Add s390x boot-certs XML support qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine property qemu: Add s390x boot-certs support conf: Add s390x boot-certs domain capabilities reporting docs: formatdomain: Document boot-certs element conf: Refactor firmware feature without auto select validation conf: Allow secure-boot firmware feature on s390x qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine property qemu: Add s390x secure-boot support qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities docs: Document s390x Secure IPL firmware feature test: Add tests for secure-boot and boot-certs attributes NEWS: Document s390x Secure Boot and boot certificates support NEWS.rst | 24 +++ docs/formatdomain.rst | 40 +++- docs/formatdomaincaps.rst | 31 +++ docs/kbase/secureboot.rst | 60 ++++++ src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 77 +++++++- src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 32 +++- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 9 + src/qemu/qemu_capabilities.c | 38 ++++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 16 ++ src/qemu/qemu_validate.c | 29 +++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 6 +- tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../caps_10.0.0_s390x.replies | 145 +++++++++++++- .../caps_10.1.0_s390x.replies | 150 ++++++++++++++- .../caps_11.0.0_s390x.replies | 156 ++++++++++++++- .../caps_11.1.0_s390x.replies | 156 ++++++++++++++- .../caps_11.2.0_s390x.replies | 181 +++++++++++++++++- .../caps_11.2.0_s390x.xml | 2 + .../caps_8.1.0_s390x.replies | 135 ++++++++++++- .../caps_8.2.0_s390x.replies | 135 ++++++++++++- .../caps_9.1.0_s390x.replies | 139 +++++++++++++- .../caps_9.2.0_s390x.replies | 144 +++++++++++++- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 ++++ .../s390-boot-certs-only.s390x-latest.xml | 30 +++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 ++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++ .../s390-secure-boot-audit-mode.xml | 18 ++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 ++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 ++++ .../s390-secure-boot-multi-certs.xml | 19 ++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 ++ .../s390-secure-boot.s390x-11.1.0.err | 1 + ...0-secure-boot.s390x-latest.abi-update.args | 32 ++++ ...90-secure-boot.s390x-latest.abi-update.xml | 33 ++++ .../s390-secure-boot.s390x-latest.args | 32 ++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++ tests/qemuxmlconftest.c | 14 ++ 60 files changed, 2120 insertions(+), 86 deletions(-) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml -- 2.56.0