Allow firmware feature such as secure-boot to be specified on s390x. Update the parser and validator to allow this, and reject the enrolled-keys feature which is not supported on s390x. Preserve firmware features in migratable XML on s390x so the destination enables secure-boot as configured on the source. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- src/conf/domain_conf.c | 8 ++++++-- src/conf/domain_validate.c | 20 +++++++++++++++++--- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1dfb7b251a..5bd4583c36 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -18612,8 +18612,12 @@ virDomainDefParseBootFirmwareOptions(virDomainDef *def, * information to successfully define and start the domain, or it * will be a random configuration that lacks such information, in * which case a different failure will be reported anyway. + * + * Note that s390x is excluded from this early return because it supports + * firmware features (e.g. secure-boot) without firmware autoselection, + * so those <feature> tags carry meaningful configuration and must be parsed. */ - if (n > 0 && !firmware && !abiUpdate) + if (n > 0 && !firmware && !abiUpdate && !ARCH_IS_S390(def->os.arch)) return 0; if (n > 0) @@ -30213,7 +30217,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, virBufferAsprintf(buf, ">%s</type>\n", virDomainOSTypeToString(def->os.type)); - if (def->os.firmwareFeatures && !migratable) { + if (def->os.firmwareFeatures && (!migratable || ARCH_IS_S390(def->os.arch))) { virBufferAddLit(buf, "<firmware>\n"); virBufferAdjustIndent(buf, 2); diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index bdd44e42b3..63cfcaa61f 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1734,9 +1734,23 @@ virDomainDefOSValidateFirmwareFeaturesNoAutoselect(const virDomainDef *def) if (!f) return 0; - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); - return -1; + if (ARCH_IS_S390(def->os.arch)) { + /* + * s390x supports secure-boot via firmware features without full + * firmware autoselection, but enrolled-keys is not supported. + */ + if (f[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] != VIR_TRISTATE_BOOL_ABSENT) { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("firmware feature 'enrolled-keys' is not supported on s390x")); + return -1; + } + } else { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); + return -1; + } + + return 0; } -- 2.56.0