Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- NEWS.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6ffc803118..4d7fe4c5c1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,30 @@ v12.9.0 (unreleased) * **New features** + * qemu: Support Secure Boot and boot certificates on s390x + + libvirt on s390x now supports Secure Boot and boot certificates configurations such as:: + + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature name='secure-boot' enabled='yes'/> + </firmware> + <boot-certs> + <path>/path/to/cert1.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + + The ``secure-boot`` firmware feature toggles QEMU's machine property to + enforce signature verification in the s390 CCW firmware during boot. + When Secure Boot is enabled, ``<boot-certs>`` is required and must + contain at least one certificate path in PEM format. + + Support for both features is also reported in domain capabilities + (requires QEMU 11.2.0 or newer). + * **Improvements** * **Bug fixes** -- 2.56.0