This series adds libvirt support for the s390x Secure IPL interface,
which allows firmware to verify the integrity and authenticity of a
boot image against a set of X.509 certificates before handing control
to the guest OS.

Two new machine properties on s390-ccw-virtio:
  boot-certs.N.path=<path>   – supply one or more X.509 certificates or directory
  secure-boot=on|off         – enable/disable secure boot

On the XML side, a new <boot-certs> element under <os> stores the
certificate paths, while the existing secure-boot firmware feature is
reused to control the corresponding QEMU machine property. 

Providing certificates without enabling secure boot is a valid
configuration and places the firmware into audit mode, allowing
verification results to be reported without enforcing them.

Usage example:

  <os>
    <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type>
    <firmware>
      <feature enabled='yes' name='secure-boot'/>
    </firmware>
    <boot-certs>
      <path>/path/to/cert_dir</path>
      <path>/path/to/cert1.pem</path>
    </boot-certs>
  </os>

The series adds:
  * XML parsing and formatting for <boot-certs> and secure-boot on s390x
  * QEMU capability detection with updated s390x QMP reply fixtures
    for QEMU 8.1 through 11.2
  * -machine argument generation for boot-certs and secure-boot
  * Validation (s390x-only, secure-boot requires certs, QEMU version)
  * Domain capabilities reporting in the <os> section
  * Documentation and tests

Boris Fiuczynski (1):
  test: Add ABI update test for s390x secure-boot

Zhuoying Cai (13):
  conf: Add s390x boot-certs XML support
  qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine
    property
  qemu: Add s390x boot-certs support
  conf: Add s390x boot-certs domain capabilities reporting
  docs: formatdomain: Document boot-certs element
  conf: Refactor firmware feature without auto select validation
  conf: Allow secure-boot firmware feature on s390x
  qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine
    property
  qemu: Add s390x secure-boot support
  qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities
  docs: Document s390x Secure IPL firmware feature
  test: Add tests for secure-boot and boot-certs attributes
  NEWS: Document s390x Secure Boot and boot certificates support

 NEWS.rst                                      |  24 +++
 docs/formatdomain.rst                         |  40 +++-
 docs/formatdomaincaps.rst                     |  31 +++
 docs/kbase/secureboot.rst                     |  60 ++++++
 src/conf/domain_capabilities.c                |  10 +
 src/conf/domain_capabilities.h                |   6 +
 src/conf/domain_conf.c                        |  77 +++++++-
 src/conf/domain_conf.h                        |   2 +
 src/conf/domain_validate.c                    |  32 +++-
 src/conf/schemas/domaincaps.rng               |   9 +
 src/conf/schemas/domaincommon.rng             |   9 +
 src/qemu/qemu_capabilities.c                  |  38 ++++
 src/qemu/qemu_capabilities.h                  |   2 +
 src/qemu/qemu_command.c                       |  16 ++
 src/qemu/qemu_validate.c                      |  29 +++
 tests/domaincapsdata/qemu_10.0.0.s390x.xml    |   1 +
 tests/domaincapsdata/qemu_10.1.0.s390x.xml    |   1 +
 tests/domaincapsdata/qemu_11.0.0.s390x.xml    |   1 +
 tests/domaincapsdata/qemu_11.1.0.s390x.xml    |   1 +
 tests/domaincapsdata/qemu_11.2.0.s390x.xml    |   6 +-
 tests/domaincapsdata/qemu_8.1.0.s390x.xml     |   1 +
 tests/domaincapsdata/qemu_8.2.0.s390x.xml     |   1 +
 tests/domaincapsdata/qemu_9.1.0.s390x.xml     |   1 +
 tests/domaincapsdata/qemu_9.2.0.s390x.xml     |   1 +
 .../caps_10.0.0_s390x.replies                 | 145 +++++++++++++-
 .../caps_10.1.0_s390x.replies                 | 150 ++++++++++++++-
 .../caps_11.0.0_s390x.replies                 | 156 ++++++++++++++-
 .../caps_11.1.0_s390x.replies                 | 156 ++++++++++++++-
 .../caps_11.2.0_s390x.replies                 | 181 +++++++++++++++++-
 .../caps_11.2.0_s390x.xml                     |   2 +
 .../caps_8.1.0_s390x.replies                  | 135 ++++++++++++-
 .../caps_8.2.0_s390x.replies                  | 135 ++++++++++++-
 .../caps_9.1.0_s390x.replies                  | 139 +++++++++++++-
 .../caps_9.2.0_s390x.replies                  | 144 +++++++++++++-
 .../s390-boot-certs-only.s390x-11.1.0.err     |   1 +
 .../s390-boot-certs-only.s390x-latest.args    |  32 ++++
 .../s390-boot-certs-only.s390x-latest.xml     |  30 +++
 .../qemuxmlconfdata/s390-boot-certs-only.xml  |  15 ++
 ...90-secure-boot-audit-mode.s390x-11.1.0.err |   1 +
 ...0-secure-boot-audit-mode.s390x-latest.args |  32 ++++
 ...90-secure-boot-audit-mode.s390x-latest.xml |  33 ++++
 .../s390-secure-boot-audit-mode.xml           |  18 ++
 ...0-secure-boot-multi-certs.s390x-11.1.0.err |   1 +
 ...-secure-boot-multi-certs.s390x-latest.args |  32 ++++
 ...0-secure-boot-multi-certs.s390x-latest.xml |  34 ++++
 .../s390-secure-boot-multi-certs.xml          |  19 ++
 ...s390-secure-boot-no-certs.s390x-11.1.0.err |   1 +
 ...s390-secure-boot-no-certs.s390x-latest.err |   1 +
 .../s390-secure-boot-no-certs.xml             |  15 ++
 ...90-secure-boot-none-s390.x86_64-latest.err |   1 +
 .../s390-secure-boot-none-s390.xml            |  15 ++
 ...e-boot-with-enrolled-keys.s390x-latest.err |   1 +
 .../s390-secure-boot-with-enrolled-keys.xml   |  19 ++
 .../s390-secure-boot.s390x-11.1.0.err         |   1 +
 ...0-secure-boot.s390x-latest.abi-update.args |  32 ++++
 ...90-secure-boot.s390x-latest.abi-update.xml |  33 ++++
 .../s390-secure-boot.s390x-latest.args        |  32 ++++
 .../s390-secure-boot.s390x-latest.xml         |  33 ++++
 tests/qemuxmlconfdata/s390-secure-boot.xml    |  18 ++
 tests/qemuxmlconftest.c                       |  14 ++
 60 files changed, 2120 insertions(+), 86 deletions(-)
 create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err
 create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args
 create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml
 create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml
 create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml

-- 
2.56.0

On 10/7/26 6:54 PM, Zhuoying Cai wrote:
> This series adds libvirt support for the s390x Secure IPL interface,
> which allows firmware to verify the integrity and authenticity of a
> boot image against a set of X.509 certificates before handing control
> to the guest OS.
> 
> Two new machine properties on s390-ccw-virtio:
>   boot-certs.N.path=<path>   – supply one or more X.509 certificates or directory
>   secure-boot=on|off         – enable/disable secure boot
> 
> On the XML side, a new <boot-certs> element under <os> stores the
> certificate paths, while the existing secure-boot firmware feature is
> reused to control the corresponding QEMU machine property. 
> 
> Providing certificates without enabling secure boot is a valid
> configuration and places the firmware into audit mode, allowing
> verification results to be reported without enforcing them.
> 
> Usage example:
> 
>   <os>
>     <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type>
>     <firmware>
>       <feature enabled='yes' name='secure-boot'/>
>     </firmware>
>     <boot-certs>
>       <path>/path/to/cert_dir</path>
>       <path>/path/to/cert1.pem</path>
>     </boot-certs>
>   </os>
> 
> The series adds:
>   * XML parsing and formatting for <boot-certs> and secure-boot on s390x
>   * QEMU capability detection with updated s390x QMP reply fixtures
>     for QEMU 8.1 through 11.2
>   * -machine argument generation for boot-certs and secure-boot
>   * Validation (s390x-only, secure-boot requires certs, QEMU version)
>   * Domain capabilities reporting in the <os> section
>   * Documentation and tests
> 
Since posting this series, discussion has identified some
migration-related considerations that will likely require follow-up
changes on the libvirt side.

The current direction is to preserve the <boot-certs> element in the
migratable XML and add pre-migration checks to verify that the
referenced certificate paths exist on the destination host. As a result,
the current behavior of removing the <boot-certs> element from the
migratable XML is no longer considered the preferred approach.

I'll continue working through the migration requirements and plan to
post an updated version of the series once that work is complete.

Regards,
Joy