On 10/7/26 6:54 PM, Zhuoying Cai wrote:
This series adds libvirt support for the s390x Secure IPL interface, which allows firmware to verify the integrity and authenticity of a boot image against a set of X.509 certificates before handing control to the guest OS.
Two new machine properties on s390-ccw-virtio: boot-certs.N.path=<path> – supply one or more X.509 certificates or directory secure-boot=on|off – enable/disable secure boot
On the XML side, a new <boot-certs> element under <os> stores the certificate paths, while the existing secure-boot firmware feature is reused to control the corresponding QEMU machine property.
Providing certificates without enabling secure boot is a valid configuration and places the firmware into audit mode, allowing verification results to be reported without enforcing them.
Usage example:
<os> <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type> <firmware> <feature enabled='yes' name='secure-boot'/> </firmware> <boot-certs> <path>/path/to/cert_dir</path> <path>/path/to/cert1.pem</path> </boot-certs> </os>
The series adds: * XML parsing and formatting for <boot-certs> and secure-boot on s390x * QEMU capability detection with updated s390x QMP reply fixtures for QEMU 8.1 through 11.2 * -machine argument generation for boot-certs and secure-boot * Validation (s390x-only, secure-boot requires certs, QEMU version) * Domain capabilities reporting in the <os> section * Documentation and tests
Since posting this series, discussion has identified some migration-related considerations that will likely require follow-up changes on the libvirt side. The current direction is to preserve the <boot-certs> element in the migratable XML and add pre-migration checks to verify that the referenced certificate paths exist on the destination host. As a result, the current behavior of removing the <boot-certs> element from the migratable XML is no longer considered the preferred approach. I'll continue working through the migration requirements and plan to post an updated version of the series once that work is complete. Regards, Joy