Set secure-boot=on|off on the -machine command line for s390x guest. Reject the config if QEMU lacks the property or if no boot certificates are provided when enabling it. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- src/qemu/qemu_command.c | 9 +++++++++ src/qemu/qemu_validate.c | 16 ++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 25d22bb640..2fc6a028dc 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7380,6 +7380,15 @@ qemuBuildMachineCommandLine(virCommand *cmd, qemuBuildMachineACPI(&buf, def, qemuCaps); if (qemuDomainIsS390CCW(def)) { + virTristateSwitch secureBoot = VIR_TRISTATE_SWITCH_ABSENT; + + if (def->os.firmwareFeatures) + secureBoot = def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT]; + + if (secureBoot != VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(&buf, ",secure-boot=%s", + virTristateSwitchTypeToString(secureBoot)); + for (i = 0; i < def->os.nbootCerts; i++) { virBufferAsprintf(&buf, ",boot-certs.%zu.path=", i); virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index e7f8f4d30f..2cea51f97c 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -879,6 +879,22 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } + if (qemuDomainIsS390CCW(def) && def->os.firmwareFeatures) { + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] != VIR_TRISTATE_BOOL_ABSENT && + !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot machine property is not supported by this QEMU binary")); + return -1; + } + + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_YES && + def->os.nbootCerts == 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot requires boot certificates to be provided")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", -- 2.56.0