[PATCH v1 00/14] s390x: Secure Boot interface (boot-certs + secure-boot)
This series adds libvirt support for the s390x Secure IPL interface, which allows firmware to verify the integrity and authenticity of a boot image against a set of X.509 certificates before handing control to the guest OS. Two new machine properties on s390-ccw-virtio: boot-certs.N.path=<path> – supply one or more X.509 certificates or directory secure-boot=on|off – enable/disable secure boot On the XML side, a new <boot-certs> element under <os> stores the certificate paths, while the existing secure-boot firmware feature is reused to control the corresponding QEMU machine property. Providing certificates without enabling secure boot is a valid configuration and places the firmware into audit mode, allowing verification results to be reported without enforcing them. Usage example: <os> <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type> <firmware> <feature enabled='yes' name='secure-boot'/> </firmware> <boot-certs> <path>/path/to/cert_dir</path> <path>/path/to/cert1.pem</path> </boot-certs> </os> The series adds: * XML parsing and formatting for <boot-certs> and secure-boot on s390x * QEMU capability detection with updated s390x QMP reply fixtures for QEMU 8.1 through 11.2 * -machine argument generation for boot-certs and secure-boot * Validation (s390x-only, secure-boot requires certs, QEMU version) * Domain capabilities reporting in the <os> section * Documentation and tests Boris Fiuczynski (1): test: Add ABI update test for s390x secure-boot Zhuoying Cai (13): conf: Add s390x boot-certs XML support qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine property qemu: Add s390x boot-certs support conf: Add s390x boot-certs domain capabilities reporting docs: formatdomain: Document boot-certs element conf: Refactor firmware feature without auto select validation conf: Allow secure-boot firmware feature on s390x qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine property qemu: Add s390x secure-boot support qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities docs: Document s390x Secure IPL firmware feature test: Add tests for secure-boot and boot-certs attributes NEWS: Document s390x Secure Boot and boot certificates support NEWS.rst | 24 +++ docs/formatdomain.rst | 40 +++- docs/formatdomaincaps.rst | 31 +++ docs/kbase/secureboot.rst | 60 ++++++ src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 77 +++++++- src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 32 +++- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 9 + src/qemu/qemu_capabilities.c | 38 ++++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 16 ++ src/qemu/qemu_validate.c | 29 +++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 6 +- tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../caps_10.0.0_s390x.replies | 145 +++++++++++++- .../caps_10.1.0_s390x.replies | 150 ++++++++++++++- .../caps_11.0.0_s390x.replies | 156 ++++++++++++++- .../caps_11.1.0_s390x.replies | 156 ++++++++++++++- .../caps_11.2.0_s390x.replies | 181 +++++++++++++++++- .../caps_11.2.0_s390x.xml | 2 + .../caps_8.1.0_s390x.replies | 135 ++++++++++++- .../caps_8.2.0_s390x.replies | 135 ++++++++++++- .../caps_9.1.0_s390x.replies | 139 +++++++++++++- .../caps_9.2.0_s390x.replies | 144 +++++++++++++- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 ++++ .../s390-boot-certs-only.s390x-latest.xml | 30 +++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 ++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++ .../s390-secure-boot-audit-mode.xml | 18 ++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 ++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 ++++ .../s390-secure-boot-multi-certs.xml | 19 ++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 ++ .../s390-secure-boot.s390x-11.1.0.err | 1 + ...0-secure-boot.s390x-latest.abi-update.args | 32 ++++ ...90-secure-boot.s390x-latest.abi-update.xml | 33 ++++ .../s390-secure-boot.s390x-latest.args | 32 ++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++ tests/qemuxmlconftest.c | 14 ++ 60 files changed, 2120 insertions(+), 86 deletions(-) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml -- 2.56.0
Introduce a new <boot-certs> element inside <os> for s390x domains, holding one or more <path> children pointing to X.509 certificates used by the firmware during Secure IPL. Example: <os> <type arch='s390x' machine='s390-ccw-virtio-11.1'>hvm</type> <boot-certs> <path>/path/to/cert.pem</path> <path>/path/to/cert2.pem</path> </boot-certs> </os> Only the xml/conf layer is added here (parsing, formatting, and schema validation). The QEMU command-line translation of these paths onto: -machine s390-ccw-virtio,...,boot-certs.<n>.path=<path> is handled by QEMU itself and is not part of this patch. The <boot-certs> element is intentionally omitted from migratable XML. Certificate paths are host-local and will not exist on the destination host. The guest XML on the destination needs to be configured with <boot-certs> referencing certificate paths that are valid on the destination host. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- src/conf/domain_conf.c | 69 +++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 9 ++++ 3 files changed, 80 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 94a1f8bd8e..1dfb7b251a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4112,6 +4112,9 @@ virDomainOSDefClear(virDomainOSDef *os) for (i = 0; i < os->nacpiTables; i++) virDomainOSACPITableDefFree(os->acpiTables[i]); g_free(os->acpiTables); + for (i = 0; i < os->nbootCerts; i++) + g_free(os->bootCertPaths[i]); + g_free(os->bootCertPaths); virDomainLoaderDefFree(os->loader); virDomainVarstoreDefFree(os->varstore); g_free(os->bootloader); @@ -18753,6 +18756,58 @@ virDomainDefParseBootAcpiOptions(virDomainDef *def, } +static int +virDomainDefParseBootCertPaths(virDomainDef *def, + xmlXPathContextPtr ctxt) +{ + int n; + g_autofree xmlNodePtr *nodes = NULL; + size_t ncerts = 0; + char **certs = NULL; + size_t i; + + if (!virXPathNode("./os/boot-certs", ctxt)) + return 0; + + if ((n = virXPathNodeSet("./os/boot-certs/path", ctxt, &nodes)) < 0) + return -1; + + if (n == 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing <path> element in <boot-certs>")); + return -1; + } + + certs = g_new0(char *, n); + for (i = 0; i < n; i++) { + g_autofree char *path = virXMLNodeContentString(nodes[i]); + + if (!path) + goto error; + + if (virStringIsEmpty(path)) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("Paths for boot certificates must be provided")); + goto error; + } + + certs[ncerts] = virFileSanitizePath(path); + ncerts++; + } + + def->os.nbootCerts = ncerts; + def->os.bootCertPaths = certs; + + return 0; + + error: + for (i = 0; i < ncerts; i++) + g_free(certs[i]); + g_free(certs); + return -1; +} + + static int virDomainDefParseBootOptions(virDomainDef *def, xmlXPathContextPtr ctxt, @@ -18781,6 +18836,9 @@ virDomainDefParseBootOptions(virDomainDef *def, if (virDomainDefParseBootAcpiOptions(def, ctxt) < 0) return -1; + if (virDomainDefParseBootCertPaths(def, ctxt) < 0) + return -1; + if (virDomainDefParseBootXML(ctxt, def) < 0) return -1; @@ -30222,6 +30280,17 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, virBufferAddLit(buf, "</acpi>\n"); } + if (def->os.nbootCerts && !migratable) { + virBufferAddLit(buf, "<boot-certs>\n"); + virBufferAdjustIndent(buf, 2); + for (i = 0; i < def->os.nbootCerts; i++) { + virBufferEscapeString(buf, "<path>%s</path>\n", + def->os.bootCertPaths[i]); + } + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</boot-certs>\n"); + } + if (!def->os.bootloader) { for (n = 0; n < def->os.nBootDevs; n++) { const char *boottype = diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index eadb5a49a4..c8bc5d6604 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2604,6 +2604,8 @@ struct _virDomainOSDef { char *root; size_t nacpiTables; virDomainOSACPITableDef **acpiTables; + size_t nbootCerts; + char **bootCertPaths; virDomainLoaderDef *loader; virDomainVarstoreDef *varstore; char *bootloader; diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index d1b10c1c5f..db2365f592 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -315,6 +315,15 @@ </oneOrMore> </element> </optional> + <optional> + <element name="boot-certs"> + <oneOrMore> + <element name="path"> + <ref name="absFilePath"/> + </element> + </oneOrMore> + </element> + </optional> <optional> <element name="loader"> <optional> -- 2.56.0
Add QEMU_CAPS_MACHINE_S390_BOOT_CERTS to detect whether QEMU supports -machine s390-ccw-virtio,boot-certs.N.path=/path/to/cert. Update the s390x QMP reply test fixtures for QEMU 8.1 through 11.2 to include the new qom-list-properties probe for the s390-ccw-virtio machine type and renumber subsequent message IDs. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- src/qemu/qemu_capabilities.c | 8 + src/qemu/qemu_capabilities.h | 1 + .../caps_10.0.0_s390x.replies | 145 +++++++++++++- .../caps_10.1.0_s390x.replies | 150 ++++++++++++++- .../caps_11.0.0_s390x.replies | 156 ++++++++++++++- .../caps_11.1.0_s390x.replies | 156 ++++++++++++++- .../caps_11.2.0_s390x.replies | 181 +++++++++++++++++- .../caps_11.2.0_s390x.xml | 1 + .../caps_8.1.0_s390x.replies | 135 ++++++++++++- .../caps_8.2.0_s390x.replies | 135 ++++++++++++- .../caps_9.1.0_s390x.replies | 139 +++++++++++++- .../caps_9.2.0_s390x.replies | 144 +++++++++++++- 12 files changed, 1274 insertions(+), 77 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index bc2b0412dc..48a6bbbd6d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -776,6 +776,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "arm-smmuv3.cmdqv", /* QEMU_CAPS_ARM_SMMUV3_CMDQV */ "iothread.poll-weight", /* QEMU_CAPS_IOTHREAD_POLL_WEIGHT */ "win-dmp.guest-aware", /* QEMU_CAPS_WIN_DMP_GUEST_AWARE */ + "machine.s390-ccw-virtio.boot-certs", /* QEMU_CAPS_MACHINE_S390_BOOT_CERTS */ ); @@ -1883,6 +1884,10 @@ static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsVirt[] = { { "highmem-mmio-size", QEMU_CAPS_MACHINE_VIRT_HIGHMEM_MMIO_SIZE }, }; +static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsS390[] = { + { "boot-certs", QEMU_CAPS_MACHINE_S390_BOOT_CERTS }, +}; + static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsGeneric[] = { { "confidential-guest-support", QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT }, { "shim", QEMU_CAPS_MACHINE_SHIM }, @@ -1899,6 +1904,9 @@ static virQEMUCapsObjectTypeProps virQEMUCapsMachineProps[] = { { "virt", virQEMUCapsMachinePropsVirt, G_N_ELEMENTS(virQEMUCapsMachinePropsVirt), -1 }, + { "s390-ccw-virtio", virQEMUCapsMachinePropsS390, + G_N_ELEMENTS(virQEMUCapsMachinePropsS390), + -1 }, { "none", virQEMUCapsMachinePropsGeneric, G_N_ELEMENTS(virQEMUCapsMachinePropsGeneric), -1 }, diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 28303fd8f0..880ed29281 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -750,6 +750,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_ARM_SMMUV3_CMDQV, /* arm-smmuv3.cmdqv */ QEMU_CAPS_IOTHREAD_POLL_WEIGHT, /* -object iothread.poll-weight */ QEMU_CAPS_WIN_DMP_GUEST_AWARE, /* 'win-dmp' is offered only to a guest that can use it */ + QEMU_CAPS_MACHINE_S390_BOOT_CERTS, /* -machine s390-ccw-virtio,boot-certs.N.path= */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies index ecd9af85ce..3ae3a10359 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies @@ -31030,7 +31030,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-10.0-machine" }, "id": "libvirt-38" } @@ -31155,10 +31155,137 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-39" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "aux-ram-share", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + } + ], "id": "libvirt-39" } +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -31866,12 +31993,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -33149,7 +33276,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -33160,7 +33287,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -33232,7 +33359,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -33243,7 +33370,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } { @@ -33399,7 +33526,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } { diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies index 07d06fd029..926b3e2000 100644 --- a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies @@ -31913,7 +31913,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-10.1-machine" }, "id": "libvirt-38" } @@ -32043,10 +32043,142 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "aux-ram-share", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Console Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -32782,12 +32914,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34065,7 +34197,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34076,7 +34208,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34157,7 +34289,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34168,7 +34300,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } { @@ -34324,7 +34456,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } { diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies b/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies index 710df18515..73bce43e51 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies @@ -32153,7 +32153,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.0-machine" }, "id": "libvirt-38" } @@ -32289,10 +32289,148 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelerator guest handle on guest reset. Default: off (used only for testing/debugging).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Console Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33028,12 +33166,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34321,7 +34459,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34332,7 +34470,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34413,7 +34551,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34424,7 +34562,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } { @@ -34580,7 +34718,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } { diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies index 6ec196e3e6..eb7bda68a1 100644 --- a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies @@ -32360,7 +32360,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.1-machine" }, "id": "libvirt-38" } @@ -32496,10 +32496,148 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelerator guest handle on guest reset. Default: off (used only for testing/debugging).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Console Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33235,12 +33373,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34540,7 +34678,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34551,7 +34689,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34641,7 +34779,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34652,7 +34790,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } { @@ -34809,7 +34947,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } { diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies index fcc26052df..2aa64ba4ea 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies @@ -32672,7 +32672,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.2-machine" }, "id": "libvirt-38" } @@ -32798,6 +32798,31 @@ "description": "Overrides the \"compatible\" property of the dt root node", "type": "string" }, + { + "name": "loadparm", + "description": "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars converted to upper case) to pass to machine loader, boot manager, and guest kernel", + "type": "loadparm" + }, + { + "name": "aes-key-wrap", + "description": "enable/disable AES key wrapping using the CPACF wrapping key", + "type": "bool" + }, + { + "name": "dea-key-wrap", + "description": "enable/disable DEA key wrapping using the CPACF wrapping key", + "type": "bool" + }, + { + "name": "boot-certs", + "description": "provide paths to a directory and/or a certificate file for secure boot", + "type": "BootCertificatesList" + }, + { + "name": "secure-boot", + "description": "enable/disable secure boot", + "type": "bool" + }, { "name": "spcr", "description": "Set on/off to enable/disable ACPI Serial Port Console Redirection Table (spcr)", @@ -32808,10 +32833,148 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelerator guest handle on guest reset. Default: off (used only for testing/debugging).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Console Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33547,12 +33710,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34862,7 +35025,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -34873,7 +35036,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34957,7 +35120,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } { @@ -34968,7 +35131,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } { @@ -35128,7 +35291,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } { diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml index b1e839eed4..7a7f0beaf5 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml @@ -149,6 +149,7 @@ <flag name='object-monitor-qmp'/> <flag name='iothread.poll-weight'/> <flag name='win-dmp.guest-aware'/> + <flag name='machine.s390-ccw-virtio.boot-certs'/> <version>11001050</version> <microcodeVersion>39100288</microcodeVersion> <package>v11.1.0-1870-g81ce3a8773</package> diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies index 6bd4f80dc2..dc1d36439c 100644 --- a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies @@ -28300,7 +28300,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-8.1-machine" }, "id": "libvirt-35" } @@ -28419,10 +28419,131 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-36" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child<container>" + }, + { + "name": "peripheral", + "type": "child<container>" + } + ], "id": "libvirt-36" } +{ + "execute": "query-cpu-definitions", + "id": "libvirt-37" +} + { "return": [ { @@ -29184,12 +29305,12 @@ "deprecated": false } ], - "id": "libvirt-36" + "id": "libvirt-37" } { "execute": "query-command-line-options", - "id": "libvirt-37" + "id": "libvirt-38" } { @@ -30412,7 +30533,7 @@ "option": "drive" } ], - "id": "libvirt-37" + "id": "libvirt-38" } { @@ -30423,7 +30544,7 @@ "name": "host" } }, - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -30472,7 +30593,7 @@ } } }, - "id": "libvirt-38" + "id": "libvirt-39" } { diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies b/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies index 4ee07edb25..e3405decd5 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies @@ -29008,7 +29008,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-8.2-machine" }, "id": "libvirt-35" } @@ -29127,10 +29127,131 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-36" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child<container>" + }, + { + "name": "peripheral", + "type": "child<container>" + } + ], "id": "libvirt-36" } +{ + "execute": "query-cpu-definitions", + "id": "libvirt-37" +} + { "return": [ { @@ -29892,12 +30013,12 @@ "deprecated": false } ], - "id": "libvirt-36" + "id": "libvirt-37" } { "execute": "query-command-line-options", - "id": "libvirt-37" + "id": "libvirt-38" } { @@ -31128,7 +31249,7 @@ "option": "drive" } ], - "id": "libvirt-37" + "id": "libvirt-38" } { @@ -31139,7 +31260,7 @@ "name": "host" } }, - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -31188,7 +31309,7 @@ } } }, - "id": "libvirt-38" + "id": "libvirt-39" } { diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies index 4ea1a6a6f7..d7c7c70727 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies @@ -30077,7 +30077,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-9.1-machine" }, "id": "libvirt-36" } @@ -30196,10 +30196,131 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-37" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child<container>" + }, + { + "name": "peripheral", + "type": "child<container>" + } + ], "id": "libvirt-37" } +{ + "execute": "query-cpu-definitions", + "id": "libvirt-38" +} + { "return": [ { @@ -30835,12 +30956,12 @@ "deprecated": false } ], - "id": "libvirt-37" + "id": "libvirt-38" } { "execute": "query-command-line-options", - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -32079,7 +32200,7 @@ "option": "drive" } ], - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -32090,7 +32211,7 @@ "name": "host" } }, - "id": "libvirt-39" + "id": "libvirt-40" } { @@ -32162,7 +32283,7 @@ } } }, - "id": "libvirt-39" + "id": "libvirt-40" } { @@ -32173,7 +32294,7 @@ "name": "host" } }, - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -32245,7 +32366,7 @@ } } }, - "id": "libvirt-40" + "id": "libvirt-41" } { diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies index 78a59cf3e5..9c2488b2e4 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies @@ -30297,7 +30297,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-9.2-machine" }, "id": "libvirt-36" } @@ -30421,10 +30421,136 @@ } { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-37" } +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root node", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link<confidential-guest-support>" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based backend", + "type": "link<memory-backend>" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "peripheral-anon", + "type": "child<container>" + }, + { + "name": "peripheral", + "type": "child<container>" + } + ], + "id": "libvirt-37" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-38" +} + { "return": [ { @@ -31060,12 +31186,12 @@ "deprecated": false } ], - "id": "libvirt-37" + "id": "libvirt-38" } { "execute": "query-command-line-options", - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -32313,7 +32439,7 @@ "option": "drive" } ], - "id": "libvirt-38" + "id": "libvirt-39" } { @@ -32324,7 +32450,7 @@ "name": "host" } }, - "id": "libvirt-39" + "id": "libvirt-40" } { @@ -32396,7 +32522,7 @@ } } }, - "id": "libvirt-39" + "id": "libvirt-40" } { @@ -32407,7 +32533,7 @@ "name": "host" } }, - "id": "libvirt-40" + "id": "libvirt-41" } { @@ -32548,7 +32674,7 @@ } } }, - "id": "libvirt-40" + "id": "libvirt-41" } { -- 2.56.0
Build boot-certs entries on the -machine command line for s390x guests. Validate that boot certificates are only used on s390x and that the QEMU binary supports the boot-certs machine property. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- src/qemu/qemu_command.c | 7 +++++++ src/qemu/qemu_validate.c | 13 +++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index bcddb9c922..25d22bb640 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7379,6 +7379,13 @@ qemuBuildMachineCommandLine(virCommand *cmd, qemuBuildMachineACPI(&buf, def, qemuCaps); + if (qemuDomainIsS390CCW(def)) { + for (i = 0; i < def->os.nbootCerts; i++) { + virBufferAsprintf(&buf, ",boot-certs.%zu.path=", i); + virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); + } + } + if (qemuDomainIsARMVirt(def)) { for (i = 0; i < def->ncontrollers; i++) { virDomainControllerDef *cont = def->controllers[i]; diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 08f5a6659d..e7f8f4d30f 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -866,6 +866,19 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } + if (def->os.nbootCerts > 0) { + if (!qemuDomainIsS390CCW(def)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is only supported for s390x CCW machine types")); + return -1; + } + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is not supported by this QEMU binary")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", -- 2.56.0
Report whether QEMU on s390x supports the boot-certs feature via a new <bootCerts supported='yes|no'/> element in the domain capabilities OS section. QEMU 11.2.0 is the first version to support it. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomaincaps.rst | 19 +++++++++++++++++++ src/conf/domain_capabilities.c | 10 ++++++++++ src/conf/domain_capabilities.h | 6 ++++++ src/conf/schemas/domaincaps.rng | 9 +++++++++ src/qemu/qemu_capabilities.c | 16 ++++++++++++++++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + 14 files changed, 69 insertions(+) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index ed935c704d..7142686a67 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -234,6 +234,25 @@ alternative to pflash-based NVRAM storage. This is the only type of variable storage compatible with Secure Boot on non-x86 architectures, but it can be used on x86 too. +The ``<bootCerts/>`` element :since:`(since 12.9.0)` indicates whether +QEMU supports providing X.509 boot certificates to the s390x CCW firmware +for Secure Boot. When ``supported='yes'``, the ``<boot-certs>`` element may +be used in domain XML to supply PEM-format certificates. This capability is +only reported for the guest on s390x. + +:: + + <domainCapabilities> + ... + <arch>s390x</arch> + ... + <os supported='yes'> + ... + <bootCerts supported='yes'/> + </os> + ... + </domainCapabilities> + CPU configuration ~~~~~~~~~~~~~~~~~ diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c index 78b8e6e6e1..a87af269ee 100644 --- a/src/conf/domain_capabilities.c +++ b/src/conf/domain_capabilities.c @@ -457,6 +457,14 @@ virDomainCapsVarstoreFormat(virBuffer *buf, FORMAT_EPILOGUE(varstore); } +static void +virDomainCapsBootCertsFormat(virBuffer *buf, + const virDomainCapsBootCerts *bootCerts) +{ + FORMAT_PROLOGUE(bootCerts); + FORMAT_EPILOGUE(bootCerts); +} + static void virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsOS *os) @@ -464,6 +472,7 @@ virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures; const virDomainCapsLoader *loader = &os->loader; const virDomainCapsVarstore *varstore = &os->varstore; + const virDomainCapsBootCerts *bootCerts = &os->bootCerts; FORMAT_PROLOGUE(os); @@ -472,6 +481,7 @@ virDomainCapsOSFormat(virBuffer *buf, virDomainCapsFirmwareFeaturesFormat(&childBuf, firmwareFeatures); virDomainCapsLoaderFormat(&childBuf, loader); virDomainCapsVarstoreFormat(&childBuf, varstore); + virDomainCapsBootCertsFormat(&childBuf, bootCerts); FORMAT_EPILOGUE(os); } diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index 02344fd9b6..5a165812f5 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -66,6 +66,11 @@ struct _virDomainCapsVarstore { virTristateBool supported; }; +typedef struct _virDomainCapsBootCerts virDomainCapsBootCerts; +struct _virDomainCapsBootCerts { + virTristateBool supported; +}; + STATIC_ASSERT_ENUM(VIR_DOMAIN_OS_DEF_FIRMWARE_LAST); typedef struct _virDomainCapsOS virDomainCapsOS; struct _virDomainCapsOS { @@ -74,6 +79,7 @@ struct _virDomainCapsOS { virDomainCapsFirmwareFeatures firmwareFeatures; virDomainCapsLoader loader; /* Info about virDomainLoaderDef */ virDomainCapsVarstore varstore; + virDomainCapsBootCerts bootCerts; }; STATIC_ASSERT_ENUM(VIR_DOMAIN_MEMORY_SOURCE_LAST); diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng index 4682abbf41..6c0addf524 100644 --- a/src/conf/schemas/domaincaps.rng +++ b/src/conf/schemas/domaincaps.rng @@ -93,6 +93,12 @@ </element> </define> + <define name="bootCerts"> + <element name="bootCerts"> + <ref name="supported"/> + </element> + </define> + <define name="os"> <element name="os"> <interleave> @@ -107,6 +113,9 @@ <optional> <ref name="varstore"/> </optional> + <optional> + <ref name="bootCerts"/> + </optional> </interleave> </element> </define> diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 48a6bbbd6d..ff35fbc65c 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6607,6 +6607,19 @@ virQEMUCapsFillDomainVarstoreCaps(virDomainCapsVarstore *capsVarstore, } +static void +virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, + virQEMUCaps *qemuCaps) +{ + virDomainCapsBootCerts *bootCerts = &os->bootCerts; + + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) + bootCerts->supported = VIR_TRISTATE_BOOL_YES; + else + bootCerts->supported = VIR_TRISTATE_BOOL_NO; +} + + static int virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, virQEMUCaps *qemuCaps, @@ -6663,6 +6676,9 @@ virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, if (virQEMUCapsFillDomainVarstoreCaps(capsVarstore, varstore, qemuCaps) < 0) goto cleanup; + if (ARCH_IS_S390(arch)) + virQEMUCapsFillDomainOSS390Caps(os, qemuCaps); + ret = 0; cleanup: virFirmwareFreeList(firmwaresAlt, nfirmwaresAlt); diff --git a/tests/domaincapsdata/qemu_10.0.0.s390x.xml b/tests/domaincapsdata/qemu_10.0.0.s390x.xml index a88669528c..663f2da5c9 100644 --- a/tests/domaincapsdata/qemu_10.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.0.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_10.1.0.s390x.xml b/tests/domaincapsdata/qemu_10.1.0.s390x.xml index 3bb62be1ec..2d0cad76f4 100644 --- a/tests/domaincapsdata/qemu_10.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.0.0.s390x.xml b/tests/domaincapsdata/qemu_11.0.0.s390x.xml index b317835b51..5c1de2471c 100644 --- a/tests/domaincapsdata/qemu_11.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.0.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.1.0.s390x.xml b/tests/domaincapsdata/qemu_11.1.0.s390x.xml index 044df2701a..af77db4666 100644 --- a/tests/domaincapsdata/qemu_11.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsdata/qemu_11.2.0.s390x.xml index 6a02aa0df7..34693bea31 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='yes'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_8.1.0.s390x.xml b/tests/domaincapsdata/qemu_8.1.0.s390x.xml index 7971667460..744e496b65 100644 --- a/tests/domaincapsdata/qemu_8.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_8.2.0.s390x.xml b/tests/domaincapsdata/qemu_8.2.0.s390x.xml index 195630a24e..aa1e87a2af 100644 --- a/tests/domaincapsdata/qemu_8.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_9.1.0.s390x.xml b/tests/domaincapsdata/qemu_9.1.0.s390x.xml index 16f32f9465..1700576121 100644 --- a/tests/domaincapsdata/qemu_9.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.1.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> diff --git a/tests/domaincapsdata/qemu_9.2.0.s390x.xml b/tests/domaincapsdata/qemu_9.2.0.s390x.xml index d9bbac632e..42b97d8aea 100644 --- a/tests/domaincapsdata/qemu_9.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.2.0.s390x.xml @@ -27,6 +27,7 @@ </enum> </loader> <varstore supported='no'/> + <bootCerts supported='no'/> </os> <cpu> <mode name='host-passthrough' supported='yes'> -- 2.56.0
Add documentation for the new <boot-certs> element under <os>, including an XML example and a description of its child <path> elements. The feature is QEMU/s390x-only and available since 12.9.0. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomain.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index e4eb2d9ba3..17b8e0431d 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -194,6 +194,18 @@ harddisk, cdrom, network) determining where to obtain/find the boot image. </os> ... + <!-- QEMU s390x with boot certificates --> + ... + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot-certs> + <path>/path/to/cert1.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + ... + ``firmware`` The ``firmware`` attribute allows management applications to automatically fill ``<loader/>`` and ``<nvram/>`` or ``<varstore/>`` elements and possibly @@ -328,6 +340,18 @@ harddisk, cdrom, network) determining where to obtain/find the boot image. it possible to keep UEFI authenticated variables safe from tampering without requiring the use of SMM emulation. +``boot-certs`` + The optional ``boot-certs`` element contains one or more ``path`` child + elements, each specifying an absolute path to a host X.509 certificate + (in PEM format) or a directory containing certificates. Each path is + passed directly to QEMU's ``boot-certs`` machine property; QEMU itself + determines whether the path refers to a file or a directory and locates + the certificates accordingly. These certificates are used by the s390x + CCW firmware for Secure Boot signature verification. When only + ``boot-certs`` is provided, audit mode is enabled: verification failures + are reported as non-disruptive warnings. + :since:`Since 12.9.0 (QEMU only)` + ``boot`` The ``dev`` attribute takes one of the values "fd", "hd", "cdrom" or "network" and is used to specify the next boot device to consider. The -- 2.56.0
Extract the firmware features without autoselect check from virDomainDefOSValidate() into a new helper function. No functional change; preparatory for s390x-specific validation in a follow-up. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- src/conf/domain_validate.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 15e3bb29e6..bdd44e42b3 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1726,6 +1726,20 @@ virDomainDefMemtuneValidate(const virDomainDef *def) } +static int +virDomainDefOSValidateFirmwareFeaturesNoAutoselect(const virDomainDef *def) +{ + int *f = def->os.firmwareFeatures; + + if (!f) + return 0; + + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); + return -1; +} + + int virDomainDefOSValidate(const virDomainDef *def, virDomainXMLOption *xmlopt) @@ -1751,9 +1765,7 @@ virDomainDefOSValidate(const virDomainDef *def, return -1; } } else { - if (firmwareFeatures) { - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); + if (virDomainDefOSValidateFirmwareFeaturesNoAutoselect(def) < 0) { return -1; } -- 2.56.0
Allow firmware feature such as secure-boot to be specified on s390x. Update the parser and validator to allow this, and reject the enrolled-keys feature which is not supported on s390x. Preserve firmware features in migratable XML on s390x so the destination enables secure-boot as configured on the source. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- src/conf/domain_conf.c | 8 ++++++-- src/conf/domain_validate.c | 20 +++++++++++++++++--- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1dfb7b251a..5bd4583c36 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -18612,8 +18612,12 @@ virDomainDefParseBootFirmwareOptions(virDomainDef *def, * information to successfully define and start the domain, or it * will be a random configuration that lacks such information, in * which case a different failure will be reported anyway. + * + * Note that s390x is excluded from this early return because it supports + * firmware features (e.g. secure-boot) without firmware autoselection, + * so those <feature> tags carry meaningful configuration and must be parsed. */ - if (n > 0 && !firmware && !abiUpdate) + if (n > 0 && !firmware && !abiUpdate && !ARCH_IS_S390(def->os.arch)) return 0; if (n > 0) @@ -30213,7 +30217,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, virBufferAsprintf(buf, ">%s</type>\n", virDomainOSTypeToString(def->os.type)); - if (def->os.firmwareFeatures && !migratable) { + if (def->os.firmwareFeatures && (!migratable || ARCH_IS_S390(def->os.arch))) { virBufferAddLit(buf, "<firmware>\n"); virBufferAdjustIndent(buf, 2); diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index bdd44e42b3..63cfcaa61f 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1734,9 +1734,23 @@ virDomainDefOSValidateFirmwareFeaturesNoAutoselect(const virDomainDef *def) if (!f) return 0; - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); - return -1; + if (ARCH_IS_S390(def->os.arch)) { + /* + * s390x supports secure-boot via firmware features without full + * firmware autoselection, but enrolled-keys is not supported. + */ + if (f[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] != VIR_TRISTATE_BOOL_ABSENT) { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("firmware feature 'enrolled-keys' is not supported on s390x")); + return -1; + } + } else { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("cannot use feature-based firmware autoselection when firmware autoselection is disabled")); + return -1; + } + + return 0; } -- 2.56.0
Add QEMU_CAPS_MACHINE_S390_SECURE_BOOT to detect whether QEMU supports -machine s390-ccw-virtio,secure-boot=on|off. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml | 1 + 3 files changed, 4 insertions(+) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index ff35fbc65c..53d26a8d3d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -777,6 +777,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "iothread.poll-weight", /* QEMU_CAPS_IOTHREAD_POLL_WEIGHT */ "win-dmp.guest-aware", /* QEMU_CAPS_WIN_DMP_GUEST_AWARE */ "machine.s390-ccw-virtio.boot-certs", /* QEMU_CAPS_MACHINE_S390_BOOT_CERTS */ + "machine.s390-ccw-virtio.secure-boot", /* QEMU_CAPS_MACHINE_S390_SECURE_BOOT */ ); @@ -1886,6 +1887,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsVirt[] = { static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsS390[] = { { "boot-certs", QEMU_CAPS_MACHINE_S390_BOOT_CERTS }, + { "secure-boot", QEMU_CAPS_MACHINE_S390_SECURE_BOOT }, }; static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsGeneric[] = { diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 880ed29281..e505ce3749 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -751,6 +751,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_IOTHREAD_POLL_WEIGHT, /* -object iothread.poll-weight */ QEMU_CAPS_WIN_DMP_GUEST_AWARE, /* 'win-dmp' is offered only to a guest that can use it */ QEMU_CAPS_MACHINE_S390_BOOT_CERTS, /* -machine s390-ccw-virtio,boot-certs.N.path= */ + QEMU_CAPS_MACHINE_S390_SECURE_BOOT, /* -machine s390-ccw-virtio,secure-boot=on|off */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml index 7a7f0beaf5..98429e2b02 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml @@ -150,6 +150,7 @@ <flag name='iothread.poll-weight'/> <flag name='win-dmp.guest-aware'/> <flag name='machine.s390-ccw-virtio.boot-certs'/> + <flag name='machine.s390-ccw-virtio.secure-boot'/> <version>11001050</version> <microcodeVersion>39100288</microcodeVersion> <package>v11.1.0-1870-g81ce3a8773</package> -- 2.56.0
Set secure-boot=on|off on the -machine command line for s390x guest. Reject the config if QEMU lacks the property or if no boot certificates are provided when enabling it. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- src/qemu/qemu_command.c | 9 +++++++++ src/qemu/qemu_validate.c | 16 ++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 25d22bb640..2fc6a028dc 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7380,6 +7380,15 @@ qemuBuildMachineCommandLine(virCommand *cmd, qemuBuildMachineACPI(&buf, def, qemuCaps); if (qemuDomainIsS390CCW(def)) { + virTristateSwitch secureBoot = VIR_TRISTATE_SWITCH_ABSENT; + + if (def->os.firmwareFeatures) + secureBoot = def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT]; + + if (secureBoot != VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(&buf, ",secure-boot=%s", + virTristateSwitchTypeToString(secureBoot)); + for (i = 0; i < def->os.nbootCerts; i++) { virBufferAsprintf(&buf, ",boot-certs.%zu.path=", i); virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index e7f8f4d30f..2cea51f97c 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -879,6 +879,22 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } + if (qemuDomainIsS390CCW(def) && def->os.firmwareFeatures) { + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] != VIR_TRISTATE_BOOL_ABSENT && + !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot machine property is not supported by this QEMU binary")); + return -1; + } + + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_YES && + def->os.nbootCerts == 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot requires boot certificates to be provided")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", -- 2.56.0
Populate the secureBoot firmware feature in domain capabilities for s390x. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomaincaps.rst | 12 ++++++++++++ src/qemu/qemu_capabilities.c | 12 ++++++++++++ tests/domaincapsdata/qemu_11.2.0.s390x.xml | 5 ++++- 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index 7142686a67..f980b8577e 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -240,6 +240,11 @@ for Secure Boot. When ``supported='yes'``, the ``<boot-certs>`` element may be used in domain XML to supply PEM-format certificates. This capability is only reported for the guest on s390x. +The ``secureBoot`` enum with values ``yes`` and ``no`` under +``<firmwareFeatures/>`` indicates support of Secure Boot on s390x +:since:`(since 12.9.0)`, which can be used to enable Secure Boot for the +s390 CCW firmware without requiring firmware autoselection. + :: <domainCapabilities> @@ -248,6 +253,13 @@ only reported for the guest on s390x. ... <os supported='yes'> ... + <firmwareFeatures supported='yes'> + <enum name='secureBoot'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='enrolledKeys'/> + </firmwareFeatures> <bootCerts supported='yes'/> </os> ... diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 53d26a8d3d..ef8fffdcc3 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6613,8 +6613,20 @@ static void virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, virQEMUCaps *qemuCaps) { + virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures; virDomainCapsBootCerts *bootCerts = &os->bootCerts; + /* + * No conflict with the secureBoot bits set via qemuFirmwareGetSupported() + * in virQEMUCapsFillDomainOSCaps(): s390-ccw is embedded in QEMU with no + * external firmware descriptor files, so featureSecureBoot is always 0 + * on s390 and those bits are left unset. + */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) { + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTATE_BOOL_YES); + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTATE_BOOL_NO); + } + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) bootCerts->supported = VIR_TRISTATE_BOOL_YES; else diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsdata/qemu_11.2.0.s390x.xml index 34693bea31..ab915a3607 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -8,7 +8,10 @@ <os supported='yes'> <enum name='firmware'/> <firmwareFeatures supported='yes'> - <enum name='secureBoot'/> + <enum name='secureBoot'> + <value>yes</value> + <value>no</value> + </enum> <enum name='enrolledKeys'/> </firmwareFeatures> <loader supported='yes'> -- 2.56.0
On s390x the secure-boot firmware feature sets the QEMU machine secure-boot property for Secure IPL rather than selecting a firmware build. Update formatdomain.rst accordingly and add a "Secure Boot on s390x" section to kbase/secureboot.rst. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- docs/formatdomain.rst | 18 +++++++++--- docs/kbase/secureboot.rst | 60 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+), 4 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 17b8e0431d..856c793917 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -194,10 +194,13 @@ harddisk, cdrom, network) determining where to obtain/find the boot image. </os> ... - <!-- QEMU s390x with boot certificates --> + <!-- QEMU s390x with boot certificates and Secure IPL --> ... <os> <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature name='secure-boot' enabled='yes'/> + </firmware> <boot-certs> <path>/path/to/cert1.pem</path> <path>/path/to/cert2.pem</path> @@ -258,9 +261,16 @@ harddisk, cdrom, network) determining where to obtain/find the boot image. - ``enrolled-keys`` whether the selected nvram template has default certificate enrolled. Firmware with Secure Boot feature but without enrolled keys will successfully boot non-signed binaries as well. - Valid only for firmwares with Secure Boot feature. - - - ``secure-boot`` whether the firmware implements UEFI Secure boot feature. + Valid only for firmwares with Secure Boot feature. Not supported on + ``s390x``. + + - ``secure-boot`` whether the firmware implements Secure Boot. For + UEFI firmware architectures, this selects a firmware build with UEFI + Secure Boot support. For ``s390x``, this enables or disables the + QEMU machine ``secure-boot`` property for Secure IPL. When enabled, + boot certificates must be configured via ``<boot-certs>`` and the + s390x CCW firmware operates in secure mode, where verification errors + are reported and causes the boot process to abort. ``loader`` The optional ``loader`` tag refers to a firmware blob, which is specified by absolute path, used to assist the domain creation process. It is used by Xen diff --git a/docs/kbase/secureboot.rst b/docs/kbase/secureboot.rst index b411b65f00..133192dc4d 100644 --- a/docs/kbase/secureboot.rst +++ b/docs/kbase/secureboot.rst @@ -1,3 +1,5 @@ +.. role:: since + =========== Secure Boot =========== @@ -162,3 +164,61 @@ your own keys and securely run an operating system that you've built and signed yourself. If you are only planning to run existing, off-the-shelf operating system images, then the two configurations are functionally equivalent. + + +Secure Boot on s390x +==================== + +On s390x, the ``secure-boot`` firmware feature sets the QEMU machine +``secure-boot`` property to enable **Secure IPL** (Initial Program Load) +signature verification in the s390x CCW firmware. This differs from UEFI +architectures where it selects a firmware build: + +- No firmware binary selection, NVRAM, or varstore is involved. +- X.509 PEM certificates are supplied via ``<boot-certs>``. +- The ``enrolled-keys`` feature is not supported on s390x. + +:since:`Since 12.9.0 (QEMU and s390x only)` + +For more background on the QEMU-level mechanism, refer to the +`QEMU Secure IPL documentation +<https://www.qemu.org/docs/master/system/s390x/secure-ipl.html>`__. + + +Using Secure Boot on s390x +-------------------------- + +Set ``secure-boot`` to ``yes`` and provide signing certificates. The +``<boot-certs>`` element is required when ``secure-boot`` is enabled: + +:: + + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature name='secure-boot' enabled='yes'/> + </firmware> + <boot-certs> + <path>/path/to/cert1.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + +Providing ``<boot-certs>`` without specifying ``secure-boot``, or with +``secure-boot`` set to ``no``, enables **audit mode**, where all verifications +are performed and any failures are reported as warnings, but the boot process +continues. Setting ``secure-boot`` to ``yes`` enables **secure mode**, where any +verification failures are reported and cause the boot process to abort. + +You can verify QEMU support beforehand (see `Guest firmware +<../formatdomaincaps.html#guest-firmware>`__ for details on interpreting +the output): + +:: + + $ virsh domcapabilities --arch s390x --machine s390-ccw-virtio --virttype kvm + +The output should show ``<firmwareFeatures supported='yes'>`` with +``secureBoot`` listing ``yes`` and ``no`` as valid values, +and ``<bootCerts supported='yes'/>``. -- 2.56.0
Add XML configuration tests covering the main s390x Secure IPL scenarios: secure-boot enabled with one or multiple certificates, audit mode (secure-boot disabled but certs provided), and the following expected error cases: - secure-boot enabled without any boot certificates - enrolled-keys used on s390x (unsupported) - boot-certs specified on a non-s390x architecture - secure-boot or boot-certs on QEMU older than 11.2.0 Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 +++++++++++++++++ .../s390-boot-certs-only.s390x-latest.xml | 30 ++++++++++++++++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++++++++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 +++++++++++++++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++++++++++++++++ .../s390-secure-boot-audit-mode.xml | 18 ++++++++++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 +++++++++++++++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 +++++++++++++++++++ .../s390-secure-boot-multi-certs.xml | 19 +++++++++++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++++++++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++++++++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 +++++++++++ .../s390-secure-boot.s390x-11.1.0.err | 1 + .../s390-secure-boot.s390x-latest.args | 32 +++++++++++++++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++++++++++++++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++++++++++ tests/qemuxmlconftest.c | 13 +++++++ 24 files changed, 398 insertions(+) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args new file mode 100644 index 0000000000..fb79aafc4a --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml new file mode 100644 index 0000000000..febd55cbc1 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.xml b/tests/qemuxmlconfdata/s390-boot-certs-only.xml new file mode 100644 index 0000000000..9e9bfa41e1 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.xml @@ -0,0 +1,15 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args new file mode 100644 index 0000000000..7c8a8838ce --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=off,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml new file mode 100644 index 0000000000..9f298e7b59 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml new file mode 100644 index 0000000000..b4c89e8f5c --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml @@ -0,0 +1,18 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args new file mode 100644 index 0000000000..8a53b5ce17 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=on,boot-certs.0.path=/path/to/cert.pem,boot-certs.1.path=/path/to/cert2.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml new file mode 100644 index 0000000000..df841f8a67 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml @@ -0,0 +1,34 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml new file mode 100644 index 0000000000..ab2541aadc --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err new file mode 100644 index 0000000000..02192e334d --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: secure-boot machine property is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err new file mode 100644 index 0000000000..8de77af577 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err @@ -0,0 +1 @@ +unsupported configuration: secure-boot requires boot certificates to be provided diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml new file mode 100644 index 0000000000..4d20a5744d --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml @@ -0,0 +1,15 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1801</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err new file mode 100644 index 0000000000..268c15ef81 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is only supported for s390x CCW machine types diff --git a/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml new file mode 100644 index 0000000000..b4c5bc59c8 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml @@ -0,0 +1,15 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid> + <memory>1048576</memory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err new file mode 100644 index 0000000000..a2b7d96189 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err @@ -0,0 +1 @@ +firmware feature 'enrolled-keys' is not supported on s390x diff --git a/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml new file mode 100644 index 0000000000..56c2a7456b --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + <feature enabled='yes' name='enrolled-keys'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args new file mode 100644 index 0000000000..17c0c09f99 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=on,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml new file mode 100644 index 0000000000..32ed103bc2 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot.xml b/tests/qemuxmlconfdata/s390-secure-boot.xml new file mode 100644 index 0000000000..f46fc6e863 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.xml @@ -0,0 +1,18 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 555c029f58..f91611a177 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -3115,6 +3115,19 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-multi-certs", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-audit-mode", "s390x"); + DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("s390-secure-boot-no-certs", "s390x"); + DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("s390-secure-boot-with-enrolled-keys", "s390x"); + DO_TEST_CAPS_LATEST_PARSE_ERROR("s390-secure-boot-none-s390"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-no-certs", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-multi-certs", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-audit-mode", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_LATEST("s390-boot-certs-only", "s390x"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-boot-certs-only", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_LATEST_FULL("launch-security-tdx", "x86_64", ARG_CAPS_VARIANT, "+inteltdx", ARG_END); -- 2.56.0
From: Boris Fiuczynski <fiuczy@linux.ibm.com> Add DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE for s390-secure-boot to ensure the XML definition and formatting remain stable across ABI updates. Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com> --- ...0-secure-boot.s390x-latest.abi-update.args | 32 ++++++++++++++++++ ...90-secure-boot.s390x-latest.abi-update.xml | 33 +++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 3 files changed, 66 insertions(+) create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args new file mode 100644 index 0000000000..17c0c09f99 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=on,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml new file mode 100644 index 0000000000..32ed103bc2 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index f91611a177..c0f4cf2679 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -3116,6 +3116,7 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x"); DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot", "s390x"); + DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE("s390-secure-boot", "s390x"); DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-multi-certs", "s390x"); DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-audit-mode", "s390x"); DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("s390-secure-boot-no-certs", "s390x"); -- 2.56.0
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- NEWS.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6ffc803118..4d7fe4c5c1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,30 @@ v12.9.0 (unreleased) * **New features** + * qemu: Support Secure Boot and boot certificates on s390x + + libvirt on s390x now supports Secure Boot and boot certificates configurations such as:: + + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature name='secure-boot' enabled='yes'/> + </firmware> + <boot-certs> + <path>/path/to/cert1.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + + The ``secure-boot`` firmware feature toggles QEMU's machine property to + enforce signature verification in the s390 CCW firmware during boot. + When Secure Boot is enabled, ``<boot-certs>`` is required and must + contain at least one certificate path in PEM format. + + Support for both features is also reported in domain capabilities + (requires QEMU 11.2.0 or newer). + * **Improvements** * **Bug fixes** -- 2.56.0
On 10/7/26 6:54 PM, Zhuoying Cai wrote:
This series adds libvirt support for the s390x Secure IPL interface, which allows firmware to verify the integrity and authenticity of a boot image against a set of X.509 certificates before handing control to the guest OS.
Two new machine properties on s390-ccw-virtio: boot-certs.N.path=<path> – supply one or more X.509 certificates or directory secure-boot=on|off – enable/disable secure boot
On the XML side, a new <boot-certs> element under <os> stores the certificate paths, while the existing secure-boot firmware feature is reused to control the corresponding QEMU machine property.
Providing certificates without enabling secure boot is a valid configuration and places the firmware into audit mode, allowing verification results to be reported without enforcing them.
Usage example:
<os> <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type> <firmware> <feature enabled='yes' name='secure-boot'/> </firmware> <boot-certs> <path>/path/to/cert_dir</path> <path>/path/to/cert1.pem</path> </boot-certs> </os>
The series adds: * XML parsing and formatting for <boot-certs> and secure-boot on s390x * QEMU capability detection with updated s390x QMP reply fixtures for QEMU 8.1 through 11.2 * -machine argument generation for boot-certs and secure-boot * Validation (s390x-only, secure-boot requires certs, QEMU version) * Domain capabilities reporting in the <os> section * Documentation and tests
Since posting this series, discussion has identified some migration-related considerations that will likely require follow-up changes on the libvirt side. The current direction is to preserve the <boot-certs> element in the migratable XML and add pre-migration checks to verify that the referenced certificate paths exist on the destination host. As a result, the current behavior of removing the <boot-certs> element from the migratable XML is no longer considered the preferred approach. I'll continue working through the migration requirements and plan to post an updated version of the series once that work is complete. Regards, Joy
participants (1)
-
Zhuoying Cai