From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791415087; cv=none; d=zohomail.com; s=zohoarc; b=ca24akTeXkStHxx5pKzsmwDgXwCgM7j6aF0+WZ6dWSWGsPt22uaRcbs4Kn+q23jyyWgxoVRtEzgFSMlE1QAKuNDHrhUeOOy5jmY9iPMCoekODoNhFDSl7dFJvMko3Sk59Kh4L2WFhB14b8MUN+r3rjyavDYUcLPG1+CRRAXGeP4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791415087; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=rOEtnvTb83sYx2Cmll3ZEwkpYi1zugRHIbspomSdr/Q=; b=I0cY3N1jXijYR45lC78s8Yio5JcB6s3YgxNfX/DAEE9LGNo3bStp+uVvUk8RAnyCVVTS2h+Q0gCdEu1FkXF4YiSv1aQOSHGsQWwf0RvWq0JgstAn2CQIrFUFgr3Uyq+TrFMgnDWNqPMejS9rgk5D7TtMTOnc5glgdlBA+FDWbJM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791415087181120.55745664800338; Wed, 7 Oct 2026 16:18:07 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E068B41CB4; Wed, 7 Oct 2026 19:18:05 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 1BC0141DCF; Wed, 7 Oct 2026 18:56:43 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AB4D13F31F; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 3DF2841994 for ; Wed, 7 Oct 2026 18:54:53 -0400 (EDT) Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6Or81912354 for ; Wed, 7 Oct 2026 22:54:52 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjw05w8-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:51 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWc972459739 for ; Wed, 7 Oct 2026 22:54:51 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h58d5mxuw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:51 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Msnxi63111634 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:49 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7DDAC5805D; Wed, 7 Oct 2026 22:54:49 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0C98B58056; Wed, 7 Oct 2026 22:54:49 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:48 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rOEtnvTb83sYx2Cml l3ZEwkpYi1zugRHIbspomSdr/Q=; b=nYFiCrDfFovhz+kLC/vc346QeUtUF7p90 2ZNwis0E+DPaCvrvQmjYvHFW0/foTA1oeVuuGVAhHCR8zRpzsZmgd8c+7cJmpPzz fW9Im+c+e7JcTywhn8+EuaNgpat7nyWbGG8/91qYP7VHYrG9AKwPxF0STv4IIKbf 2nniYaRZ0MjmxImizyahf4TUBOrQmsyuN1lp0vSM5inoFcKshFKmSk6jU4JXsAC3 grfNInJ0+pts8BK3o547UmnwaH9zPIx+k42IpoLyqhDTuUXqom5xQZYB9qLjcbcq 2jfxX2vIBQmiqUqlCRl+qYhbbqIRMnTpYg/EgMukr2y+Y0GYNxbHg== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 01/14] conf: Add s390x boot-certs XML support Date: Wed, 7 Oct 2026 18:54:32 -0400 Message-ID: <20261007225446.133542-2-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ppVqWP-I7KFXg1lXOM99XjdIiumDtANa X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfXyg6i4BoaSFAz mTcqIcvvbXqXvjsm2Zjs/3KrL7nQsHv0btq5pbyoyuwvIANVlBD9fQCZxXLO9++OvZ1y/S/B4RC ZbBWr2id++Zoc9N93Jv0I8M/XVjh1RNSBJeo5IznDKlf/4lKm/TKEJXUCvZkJINzelnbCx2F/re oPx8b+lbDEzyC5CoH+ybFphGf9aR+3q2CEoIstdDHkea9kb11cgHeHF2+KorRGev7pY7p5xlE46 28QcQ2/snb4U0DWvNsy+cnSp82nX8Vlt21R1wtgHapRkr8/05uv2kTsU5e2qkPIxX65o1YivOr6 xIlDnnvalsEM7ODTVsq3WVVGRD8oCtkHVVxOZE5NRVHSrP182VQIECpLSBZEhqfOeRkqP6tfp47 uB2vByYbsbQDiugYFOoa+Pw7MeuaO7KzMANqCONfbdH6YTc6T+HJCvUUH3YHY89GCpIkpTaAL9v cwr6B8gSsivjJUvX7Yw== X-Authority-Analysis: v=2.4 cv=cIt1IVeN c=1 sm=1 tr=0 ts=6ac6cdbb cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=N7YW3q7JYaFvBPiTsy4A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX2S4USJ5lch0W O8LUnflnqqTOm9T2Mbsi+HvKfNFXahYEor6IwCyEKvyzMWTZfJqF+3SC1xEFC8zOBtmmnLXeFpZ 9QEHL1puxs8HDjYcL9/JNg7FWOSB0ZE= X-Proofpoint-ORIG-GUID: ppVqWP-I7KFXg1lXOM99XjdIiumDtANa X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=0 spamscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: RWVR7B7ZZAKHSUDZALJLOHBXKF6ZZLLG X-Message-ID-Hash: RWVR7B7ZZAKHSUDZALJLOHBXKF6ZZLLG X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791415087506158500 Content-Type: text/plain; charset="utf-8" Introduce a new element inside for s390x domains, holding one or more children pointing to X.509 certificates used by the firmware during Secure IPL. Example: hvm /path/to/cert.pem /path/to/cert2.pem Only the xml/conf layer is added here (parsing, formatting, and schema validation). The QEMU command-line translation of these paths onto: -machine s390-ccw-virtio,...,boot-certs..path=3D is handled by QEMU itself and is not part of this patch. The element is intentionally omitted from migratable XML. Certificate paths are host-local and will not exist on the destination host. The guest XML on the destination needs to be configured with referencing certificate paths that are valid on the destination host. Signed-off-by: Zhuoying Cai --- src/conf/domain_conf.c | 69 +++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 9 ++++ 3 files changed, 80 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 94a1f8bd8e..1dfb7b251a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4112,6 +4112,9 @@ virDomainOSDefClear(virDomainOSDef *os) for (i =3D 0; i < os->nacpiTables; i++) virDomainOSACPITableDefFree(os->acpiTables[i]); g_free(os->acpiTables); + for (i =3D 0; i < os->nbootCerts; i++) + g_free(os->bootCertPaths[i]); + g_free(os->bootCertPaths); virDomainLoaderDefFree(os->loader); virDomainVarstoreDefFree(os->varstore); g_free(os->bootloader); @@ -18753,6 +18756,58 @@ virDomainDefParseBootAcpiOptions(virDomainDef *def, } =20 =20 +static int +virDomainDefParseBootCertPaths(virDomainDef *def, + xmlXPathContextPtr ctxt) +{ + int n; + g_autofree xmlNodePtr *nodes =3D NULL; + size_t ncerts =3D 0; + char **certs =3D NULL; + size_t i; + + if (!virXPathNode("./os/boot-certs", ctxt)) + return 0; + + if ((n =3D virXPathNodeSet("./os/boot-certs/path", ctxt, &nodes)) < 0) + return -1; + + if (n =3D=3D 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing element in ")); + return -1; + } + + certs =3D g_new0(char *, n); + for (i =3D 0; i < n; i++) { + g_autofree char *path =3D virXMLNodeContentString(nodes[i]); + + if (!path) + goto error; + + if (virStringIsEmpty(path)) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("Paths for boot certificates must be provided= ")); + goto error; + } + + certs[ncerts] =3D virFileSanitizePath(path); + ncerts++; + } + + def->os.nbootCerts =3D ncerts; + def->os.bootCertPaths =3D certs; + + return 0; + + error: + for (i =3D 0; i < ncerts; i++) + g_free(certs[i]); + g_free(certs); + return -1; +} + + static int virDomainDefParseBootOptions(virDomainDef *def, xmlXPathContextPtr ctxt, @@ -18781,6 +18836,9 @@ virDomainDefParseBootOptions(virDomainDef *def, if (virDomainDefParseBootAcpiOptions(def, ctxt) < 0) return -1; =20 + if (virDomainDefParseBootCertPaths(def, ctxt) < 0) + return -1; + if (virDomainDefParseBootXML(ctxt, def) < 0) return -1; =20 @@ -30222,6 +30280,17 @@ virDomainDefFormatInternalSetRootName(virDomainDef= *def, virBufferAddLit(buf, "\n"); } =20 + if (def->os.nbootCerts && !migratable) { + virBufferAddLit(buf, "\n"); + virBufferAdjustIndent(buf, 2); + for (i =3D 0; i < def->os.nbootCerts; i++) { + virBufferEscapeString(buf, "%s\n", + def->os.bootCertPaths[i]); + } + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "\n"); + } + if (!def->os.bootloader) { for (n =3D 0; n < def->os.nBootDevs; n++) { const char *boottype =3D diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index eadb5a49a4..c8bc5d6604 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2604,6 +2604,8 @@ struct _virDomainOSDef { char *root; size_t nacpiTables; virDomainOSACPITableDef **acpiTables; + size_t nbootCerts; + char **bootCertPaths; virDomainLoaderDef *loader; virDomainVarstoreDef *varstore; char *bootloader; diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincom= mon.rng index d1b10c1c5f..db2365f592 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -315,6 +315,15 @@ + + + + + + + + + --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414757; cv=none; d=zohomail.com; s=zohoarc; b=acxpzJM6Amcv2bw8E0PkTrFV7vK+QM0Xz63k6erwqWCK+LMITC71nCDeSNa6xgJoRpQCmDfFpZbRJDVba3j/FroxNneKGwf1FNVUzz3NobShwBeDTsrDidtKa5Uvfs6ypLKmjxGyXvErLb3S9GgmV3ggnb+FZibHYOVX7c2wPOg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414757; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=2vAzDGimmbEz7QP4F158EN1bv45Wq4eSKh9e/WiCttI=; b=Rw8OoCsc0T8Q5ZdJ5TmIxsG00S3DliadbNFyjFFgE7ic03eN2Fj2E9u1hJSSSKaCDGtY0/IQ+SlzVPlFgzqtNzNmmIICbYfmAmEsP6UQsUoPmorNntNFR9uLctdY5QOd47YYSgKxHMWUtAuhixJua+IPsmWlL8cuCUEaG4eSzm0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414757353142.7692824817459; Wed, 7 Oct 2026 16:12:37 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 9E3414198A; Wed, 7 Oct 2026 19:12:35 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 54C11418B7; Wed, 7 Oct 2026 18:56:16 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E60E14190E; Wed, 7 Oct 2026 18:55:01 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 5E55741934 for ; Wed, 7 Oct 2026 18:54:54 -0400 (EDT) Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6GsN1912262 for ; Wed, 7 Oct 2026 22:54:53 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjw05wa-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:52 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWXNt2479226 for ; Wed, 7 Oct 2026 22:54:52 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h58ek4wj4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:52 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697MsoQt5112348 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:50 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 21EE558065; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9716058056; Wed, 7 Oct 2026 22:54:49 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:49 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=2vAzDGimmbEz7QP4F 158EN1bv45Wq4eSKh9e/WiCttI=; b=TFMKZ8lwQ6czvpKpTfFcPvz/ajVYlzP/s 30kfubwOwusKiobi5e1SyU+TPufVruN72h6KHCZKs2rFBSLIK0NjFelkvsEJBDZc 2ozhinesSWHqT9hYJiyP2NQZg93ZpEHtdXk56ist0JjuG06+wWXM5dfBFhH46xQm qwzZnZDoWkK3J9Ly2fjOKi2p8k4YX2nF2zpfdVvfb5dzl8Yyk1M1Cl+WnJeDDSp+ OL+ReTsc2CQAzHH1eakdDg32KxFd+GumdW1sii3ZDuB/V1tJd+5+L3s65iGxlQCQ b+MyyU5rgu/K/LnLm7efGcR/Wn7z7yH/48eDuziOLcTSiCG6D1kZQ== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 02/14] qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine property Date: Wed, 7 Oct 2026 18:54:33 -0400 Message-ID: <20261007225446.133542-3-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: o0a6shfkaPWhLQHkKPXEjh1RgAoaKkGj X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX2VqwVoW3RRco tuh4wokRN6zPBNWhcRYFjUy9wEtSvpHd8Q1eMuJhXUuBHiyFAr5DQMwwp2OaaQ25pDtsQPB0JX+ sRlKVKPOD23n69i5ykpslDgR/JVy2yfcME9YnugWbYbvBwyV/PyB1aD1y6A/Mhz4xrZY7xpBadV cQ6U6N5hlWpZnxSZ5fbPmGHVv0Uqk0CSGi8c7Pb0cbQVMtjlBgX2/OaBqEUL30PTBPSuVmEIzUe mbijpS2iqhkh8G4lUFCZux7ocPOIrPFxJ2+Mrl+stBsEKfdvmXNZzgf/bkG2i75bo8aYZxJTY2o QOJUalmECTyf3peb6lm18/qNocd0Fvi2p8bJVCkICMV7CGyYPhWg8OZn/AgeDJsJFMldbtRfI9+ GtW5CQUZe8CMB66Adso1towFvno1lddKc5MEA2ImH7nUQ+LAQv4v2Q+AAPYa0vBEHcbS1gsoG2n 25e9cWVZtQ9f3Svc9FA== X-Authority-Analysis: v=2.4 cv=cIt1IVeN c=1 sm=1 tr=0 ts=6ac6cdbd cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=jVwBAxyOdyhfOztrzB4A:9 a=N7DO1FcNLAWZuCL2:21 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX/8xUqHLRX1bJ cwGsYcZQKS1Xrhfclt75qZuTx7Z8JkI0WA5sp2avjM8aFJhHpObxnFHjW+O9y3mLfVMrEzW6rIu TtQjKowsNqaro7flS4fOW+5aGPT8PfU= X-Proofpoint-ORIG-GUID: o0a6shfkaPWhLQHkKPXEjh1RgAoaKkGj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=0 spamscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: IPL5X3FZJ7PXWD2SPXNV3IYKFUDB6PPQ X-Message-ID-Hash: IPL5X3FZJ7PXWD2SPXNV3IYKFUDB6PPQ X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414758070158500 Content-Type: text/plain; charset="utf-8" Add QEMU_CAPS_MACHINE_S390_BOOT_CERTS to detect whether QEMU supports -machine s390-ccw-virtio,boot-certs.N.path=3D/path/to/cert. Update the s390x QMP reply test fixtures for QEMU 8.1 through 11.2 to include the new qom-list-properties probe for the s390-ccw-virtio machine type and renumber subsequent message IDs. Signed-off-by: Zhuoying Cai Reviewed-by: Boris Fiuczynski --- src/qemu/qemu_capabilities.c | 8 + src/qemu/qemu_capabilities.h | 1 + .../caps_10.0.0_s390x.replies | 145 +++++++++++++- .../caps_10.1.0_s390x.replies | 150 ++++++++++++++- .../caps_11.0.0_s390x.replies | 156 ++++++++++++++- .../caps_11.1.0_s390x.replies | 156 ++++++++++++++- .../caps_11.2.0_s390x.replies | 181 +++++++++++++++++- .../caps_11.2.0_s390x.xml | 1 + .../caps_8.1.0_s390x.replies | 135 ++++++++++++- .../caps_8.2.0_s390x.replies | 135 ++++++++++++- .../caps_9.1.0_s390x.replies | 139 +++++++++++++- .../caps_9.2.0_s390x.replies | 144 +++++++++++++- 12 files changed, 1274 insertions(+), 77 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index bc2b0412dc..48a6bbbd6d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -776,6 +776,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "arm-smmuv3.cmdqv", /* QEMU_CAPS_ARM_SMMUV3_CMDQV */ "iothread.poll-weight", /* QEMU_CAPS_IOTHREAD_POLL_WEIGHT */ "win-dmp.guest-aware", /* QEMU_CAPS_WIN_DMP_GUEST_AWARE */ + "machine.s390-ccw-virtio.boot-certs", /* QEMU_CAPS_MACHINE_S= 390_BOOT_CERTS */ ); =20 =20 @@ -1883,6 +1884,10 @@ static struct virQEMUCapsStringFlags virQEMUCapsMach= inePropsVirt[] =3D { { "highmem-mmio-size", QEMU_CAPS_MACHINE_VIRT_HIGHMEM_MMIO_SIZE }, }; =20 +static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsS390[] =3D { + { "boot-certs", QEMU_CAPS_MACHINE_S390_BOOT_CERTS }, +}; + static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsGeneric[] =3D { { "confidential-guest-support", QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SU= PPORT }, { "shim", QEMU_CAPS_MACHINE_SHIM }, @@ -1899,6 +1904,9 @@ static virQEMUCapsObjectTypeProps virQEMUCapsMachineP= rops[] =3D { { "virt", virQEMUCapsMachinePropsVirt, G_N_ELEMENTS(virQEMUCapsMachinePropsVirt), -1 }, + { "s390-ccw-virtio", virQEMUCapsMachinePropsS390, + G_N_ELEMENTS(virQEMUCapsMachinePropsS390), + -1 }, { "none", virQEMUCapsMachinePropsGeneric, G_N_ELEMENTS(virQEMUCapsMachinePropsGeneric), -1 }, diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 28303fd8f0..880ed29281 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -750,6 +750,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for = syntax-check */ QEMU_CAPS_ARM_SMMUV3_CMDQV, /* arm-smmuv3.cmdqv */ QEMU_CAPS_IOTHREAD_POLL_WEIGHT, /* -object iothread.poll-weight */ QEMU_CAPS_WIN_DMP_GUEST_AWARE, /* 'win-dmp' is offered only to a guest= that can use it */ + QEMU_CAPS_MACHINE_S390_BOOT_CERTS, /* -machine s390-ccw-virtio,boot-ce= rts.N.path=3D */ =20 QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies b/tests/q= emucapabilitiesdata/caps_10.0.0_s390x.replies index ecd9af85ce..3ae3a10359 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.replies @@ -31030,7 +31030,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-10.0-machine" }, "id": "libvirt-38" } @@ -31155,10 +31155,137 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-39" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "aux-ram-share", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + } + ], "id": "libvirt-39" } =20 +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -31866,12 +31993,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } =20 { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -33149,7 +33276,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -33160,7 +33287,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -33232,7 +33359,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -33243,7 +33370,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { @@ -33399,7 +33526,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies b/tests/q= emucapabilitiesdata/caps_10.1.0_s390x.replies index 07d06fd029..926b3e2000 100644 --- a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies @@ -31913,7 +31913,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-10.1-machine" }, "id": "libvirt-38" } @@ -32043,10 +32043,142 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } =20 +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "aux-ram-share", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Consol= e Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -32782,12 +32914,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } =20 { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34065,7 +34197,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34076,7 +34208,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34157,7 +34289,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34168,7 +34300,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { @@ -34324,7 +34456,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies b/tests/q= emucapabilitiesdata/caps_11.0.0_s390x.replies index 710df18515..73bce43e51 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.0.0_s390x.replies @@ -32153,7 +32153,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.0-machine" }, "id": "libvirt-38" } @@ -32289,10 +32289,148 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } =20 +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelera= tor guest handle on guest reset. Default: off (used only for testing/debugg= ing).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs= ", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Consol= e Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33028,12 +33166,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } =20 { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34321,7 +34459,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34332,7 +34470,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34413,7 +34551,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34424,7 +34562,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { @@ -34580,7 +34718,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies b/tests/q= emucapabilitiesdata/caps_11.1.0_s390x.replies index 6ec196e3e6..eb7bda68a1 100644 --- a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.1.0_s390x.replies @@ -32360,7 +32360,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.1-machine" }, "id": "libvirt-38" } @@ -32496,10 +32496,148 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } =20 +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelera= tor guest handle on guest reset. Default: off (used only for testing/debugg= ing).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs= ", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Consol= e Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33235,12 +33373,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } =20 { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34540,7 +34678,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34551,7 +34689,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34641,7 +34779,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34652,7 +34790,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { @@ -34809,7 +34947,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies b/tests/q= emucapabilitiesdata/caps_11.2.0_s390x.replies index fcc26052df..2aa64ba4ea 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.replies @@ -32672,7 +32672,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-11.2-machine" }, "id": "libvirt-38" } @@ -32798,6 +32798,31 @@ "description": "Overrides the \"compatible\" property of the dt root= node", "type": "string" }, + { + "name": "loadparm", + "description": "Up to 8 chars in set of [A-Za-z0-9. ] (lower case ch= ars converted to upper case) to pass to machine loader, boot manager, and g= uest kernel", + "type": "loadparm" + }, + { + "name": "aes-key-wrap", + "description": "enable/disable AES key wrapping using the CPACF wrap= ping key", + "type": "bool" + }, + { + "name": "dea-key-wrap", + "description": "enable/disable DEA key wrapping using the CPACF wrap= ping key", + "type": "bool" + }, + { + "name": "boot-certs", + "description": "provide paths to a directory and/or a certificate fi= le for secure boot", + "type": "BootCertificatesList" + }, + { + "name": "secure-boot", + "description": "enable/disable secure boot", + "type": "bool" + }, { "name": "spcr", "description": "Set on/off to enable/disable ACPI Serial Port Consol= e Redirection Table (spcr)", @@ -32808,10 +32833,148 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-39" } =20 +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "x-change-vmfd-on-reset", + "description": "Set on/off to enable/disable generating new accelera= tor guest handle on guest reset. Default: off (used only for testing/debugg= ing).", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "aux-ram-share", + "description": "Use anonymous shared memory for auxiliary guest RAMs= ", + "type": "bool" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "shim", + "description": "shim.efi file", + "type": "string" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "spcr", + "description": "Set on/off to enable/disable ACPI Serial Port Consol= e Redirection Table (spcr)", + "type": "bool" + } + ], + "id": "libvirt-39" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-40" +} + { "return": [ { @@ -33547,12 +33710,12 @@ "deprecated": false } ], - "id": "libvirt-39" + "id": "libvirt-40" } =20 { "execute": "query-command-line-options", - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34862,7 +35025,7 @@ "option": "drive" } ], - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -34873,7 +35036,7 @@ "name": "host" } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34957,7 +35120,7 @@ } } }, - "id": "libvirt-41" + "id": "libvirt-42" } =20 { @@ -34968,7 +35131,7 @@ "name": "host" } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { @@ -35128,7 +35291,7 @@ } } }, - "id": "libvirt-42" + "id": "libvirt-43" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_11.2.0_s390x.xml index b1e839eed4..7a7f0beaf5 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml @@ -149,6 +149,7 @@ + 11001050 39100288 v11.1.0-1870-g81ce3a8773 diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies b/tests/qe= mucapabilitiesdata/caps_8.1.0_s390x.replies index 6bd4f80dc2..dc1d36439c 100644 --- a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.replies @@ -28300,7 +28300,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-8.1-machine" }, "id": "libvirt-35" } @@ -28419,10 +28419,131 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-36" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child" + }, + { + "name": "peripheral", + "type": "child" + } + ], "id": "libvirt-36" } =20 +{ + "execute": "query-cpu-definitions", + "id": "libvirt-37" +} + { "return": [ { @@ -29184,12 +29305,12 @@ "deprecated": false } ], - "id": "libvirt-36" + "id": "libvirt-37" } =20 { "execute": "query-command-line-options", - "id": "libvirt-37" + "id": "libvirt-38" } =20 { @@ -30412,7 +30533,7 @@ "option": "drive" } ], - "id": "libvirt-37" + "id": "libvirt-38" } =20 { @@ -30423,7 +30544,7 @@ "name": "host" } }, - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -30472,7 +30593,7 @@ } } }, - "id": "libvirt-38" + "id": "libvirt-39" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies b/tests/qe= mucapabilitiesdata/caps_8.2.0_s390x.replies index 4ee07edb25..e3405decd5 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_8.2.0_s390x.replies @@ -29008,7 +29008,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-8.2-machine" }, "id": "libvirt-35" } @@ -29127,10 +29127,131 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-36" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child" + }, + { + "name": "peripheral", + "type": "child" + } + ], "id": "libvirt-36" } =20 +{ + "execute": "query-cpu-definitions", + "id": "libvirt-37" +} + { "return": [ { @@ -29892,12 +30013,12 @@ "deprecated": false } ], - "id": "libvirt-36" + "id": "libvirt-37" } =20 { "execute": "query-command-line-options", - "id": "libvirt-37" + "id": "libvirt-38" } =20 { @@ -31128,7 +31249,7 @@ "option": "drive" } ], - "id": "libvirt-37" + "id": "libvirt-38" } =20 { @@ -31139,7 +31260,7 @@ "name": "host" } }, - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -31188,7 +31309,7 @@ } } }, - "id": "libvirt-38" + "id": "libvirt-39" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies b/tests/qe= mucapabilitiesdata/caps_9.1.0_s390x.replies index 4ea1a6a6f7..d7c7c70727 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies @@ -30077,7 +30077,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-9.1-machine" }, "id": "libvirt-36" } @@ -30196,10 +30196,131 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, + "id": "libvirt-37" +} + +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "peripheral-anon", + "type": "child" + }, + { + "name": "peripheral", + "type": "child" + } + ], "id": "libvirt-37" } =20 +{ + "execute": "query-cpu-definitions", + "id": "libvirt-38" +} + { "return": [ { @@ -30835,12 +30956,12 @@ "deprecated": false } ], - "id": "libvirt-37" + "id": "libvirt-38" } =20 { "execute": "query-command-line-options", - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -32079,7 +32200,7 @@ "option": "drive" } ], - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -32090,7 +32211,7 @@ "name": "host" } }, - "id": "libvirt-39" + "id": "libvirt-40" } =20 { @@ -32162,7 +32283,7 @@ } } }, - "id": "libvirt-39" + "id": "libvirt-40" } =20 { @@ -32173,7 +32294,7 @@ "name": "host" } }, - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -32245,7 +32366,7 @@ } } }, - "id": "libvirt-40" + "id": "libvirt-41" } =20 { diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies b/tests/qe= mucapabilitiesdata/caps_9.2.0_s390x.replies index 78a59cf3e5..9c2488b2e4 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies +++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies @@ -30297,7 +30297,7 @@ { "execute": "qom-list-properties", "arguments": { - "typename": "none-machine" + "typename": "s390-ccw-virtio-9.2-machine" }, "id": "libvirt-36" } @@ -30421,10 +30421,136 @@ } =20 { - "execute": "query-cpu-definitions", + "execute": "qom-list-properties", + "arguments": { + "typename": "none-machine" + }, "id": "libvirt-37" } =20 +{ + "return": [ + { + "name": "type", + "type": "string" + }, + { + "name": "kernel", + "description": "Linux kernel image file", + "type": "string" + }, + { + "name": "dt-compatible", + "description": "Overrides the \"compatible\" property of the dt root= node", + "type": "string" + }, + { + "name": "suppress-vmdesc", + "description": "Set on to disable self-describing migration", + "type": "bool" + }, + { + "name": "boot", + "description": "Boot configuration", + "type": "BootConfiguration" + }, + { + "name": "memory", + "description": "Memory size configuration", + "type": "MemorySizeConfiguration" + }, + { + "name": "initrd", + "description": "Linux initial ramdisk file", + "type": "string" + }, + { + "name": "confidential-guest-support", + "description": "Set confidential guest scheme to support", + "type": "link" + }, + { + "name": "graphics", + "description": "Set on/off to enable/disable graphics emulation", + "type": "bool" + }, + { + "name": "usb", + "description": "Set on/off to enable/disable usb", + "type": "bool" + }, + { + "name": "firmware", + "description": "Firmware image", + "type": "string" + }, + { + "name": "memory-encryption", + "description": "Set memory encryption object to use", + "type": "string" + }, + { + "name": "smp", + "description": "CPU topology", + "type": "SMPConfiguration" + }, + { + "name": "dump-guest-core", + "description": "Include guest memory in a core dump", + "type": "bool" + }, + { + "name": "smp-cache", + "description": "Cache properties list for SMP machine", + "type": "SmpCachePropertiesWrapper" + }, + { + "name": "dumpdtb", + "description": "Dump current dtb to a file and quit", + "type": "string" + }, + { + "name": "phandle-start", + "description": "The first phandle ID we may generate dynamically", + "type": "int" + }, + { + "name": "memory-backend", + "description": "Set RAM backendValid value is ID of hostmem based ba= ckend", + "type": "link" + }, + { + "name": "mem-merge", + "description": "Enable/disable memory merge support", + "type": "bool" + }, + { + "name": "dtb", + "description": "Linux kernel device tree file", + "type": "string" + }, + { + "name": "append", + "description": "Linux kernel command line", + "type": "string" + }, + { + "name": "peripheral-anon", + "type": "child" + }, + { + "name": "peripheral", + "type": "child" + } + ], + "id": "libvirt-37" +} + +{ + "execute": "query-cpu-definitions", + "id": "libvirt-38" +} + { "return": [ { @@ -31060,12 +31186,12 @@ "deprecated": false } ], - "id": "libvirt-37" + "id": "libvirt-38" } =20 { "execute": "query-command-line-options", - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -32313,7 +32439,7 @@ "option": "drive" } ], - "id": "libvirt-38" + "id": "libvirt-39" } =20 { @@ -32324,7 +32450,7 @@ "name": "host" } }, - "id": "libvirt-39" + "id": "libvirt-40" } =20 { @@ -32396,7 +32522,7 @@ } } }, - "id": "libvirt-39" + "id": "libvirt-40" } =20 { @@ -32407,7 +32533,7 @@ "name": "host" } }, - "id": "libvirt-40" + "id": "libvirt-41" } =20 { @@ -32548,7 +32674,7 @@ } } }, - "id": "libvirt-40" + "id": "libvirt-41" } =20 { --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791413800; cv=none; d=zohomail.com; s=zohoarc; b=WMxdjyFZopVVigCCtDlJPJzOBdRrFWVVTzxTbkcKF2r69gQdO37f+i31Fn+WTCXxEKSr/pJBjLSAidKKgtU/nltIfZFMPQhO8RkTP/Ju/URXGOV3LfBd0OMRyJmisidooeUDWUAiMaGIEN73Fsif4pvb6Ti5p/b6SGOENirl5hU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791413800; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=Cc6/SN5p73ofzQZBiPDCcgMQY/Y1QdV+ySkJiBAWm8Q=; b=cF/Z4MX3ET6U256eLfXkRpCFfl4GkQQu1qgEq+b7Q3spb/mEYKrCFOQ3boyQWy+6sxLwYYkw1SY6kUPPXWGCv+De0NJM/t5QkY82by+L3fqqxPOW2MKiO4mZevGXyxLoFMiKwBlM4QXu5KChoPYdfurZc6hF2+FAYxswJ+1ge3A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791413800818514.830170213673; Wed, 7 Oct 2026 15:56:40 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id A139141B77; Wed, 7 Oct 2026 18:56:39 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id F18A041B6A; Wed, 7 Oct 2026 18:55:17 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 4DC7541939; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id E94AD41904 for ; Wed, 7 Oct 2026 18:54:53 -0400 (EDT) Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6dBL3715428 for ; Wed, 7 Oct 2026 22:54:53 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjvg57a-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:53 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWbn41242296 for ; Wed, 7 Oct 2026 22:54:52 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h5f3tup11-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:52 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Msotb5112350 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:51 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A7C9F58056; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3AADA58052; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Cc6/SN5p73ofzQZBi PDCcgMQY/Y1QdV+ySkJiBAWm8Q=; b=D732i8CHmSRKtHYk9aIgMqCWjDRXLSVM5 OYI1WI6FHo/iai6OXNoaK+KV2p93Vpjc7OSu7jBZuYn2Sj8xjyJebksm/3i9mcE6 CCxCH2tSHHEkJpM4ln9MbZHkiP+nAmf3U/gyE3FzbU9KXDil5Z58lICpWVpDRIJQ 7VplU4cL/cOo69QNwzvXqK8Q5r7l8HHMs023A1ywHF/COQioXRVd5Hx1R+5I1IEB Ri1dTiF/LUryCA9lUn3qvT2/J6WQ6tM8kh7ZPAMbnMhv33Z+52/PzfkZ1CW1q4ii LQGR8EeBI3vkPFaDIJq8XfsFoWseqngb2qe9wytP3cagBtZEbY3pw== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 03/14] qemu: Add s390x boot-certs support Date: Wed, 7 Oct 2026 18:54:34 -0400 Message-ID: <20261007225446.133542-4-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: zpTGdL09xRgqvXqAf72kscqwd9AeYdJt X-Proofpoint-ORIG-GUID: zpTGdL09xRgqvXqAf72kscqwd9AeYdJt X-Authority-Analysis: v=2.4 cv=FoOQbGrq c=1 sm=1 tr=0 ts=6ac6cdbd cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=qOZP-Rav23K8wBQTikAA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfXzQ0iK8IyVzkW sq+TzPoc3bWEoBnG0zzy0BbtZ61JRG8I6eJpCL/86TC8SkbPzDpBw5QPZdr3oncjxpZg7A6jWf3 JKMulCyHvUZ/PspdoRfoDQ3EKrzEuj8= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfXxguiIsj2lbmr Lr3NFDiSWZUplvgzRFJuu13SlW7DHhkcWNhMqL0HMqQi7BuXWGMzYdbnJmUYmPwK7BxH6FIEaxG 1nNSzcLmoZyy1/szrVR3t7Asm1KLeyRHwqE5jSDTdtRzgMIXI16r3FEqsW3Go02uKVUn/PR7pZj qgDryIL2pqKiMfUCB1yPaqdt3vCrtgQtl4UNWd5pG/Zrd464RHG+FIZjjoFJBxpl2JC7FAfm6Ky o4ORd03d7VyP9GhRVxil3ScgC0Oi0vd1ZsccDu44bj8eQKq5LIjLnErw/6XtzC9cyLfw3DKmG28 fVNdI60Kr2gcxoAfeDt7sGA611kyzcXYnqGCNnihYNYSx++d6A84HoNVWe7jI6JRVZm1SZGO5co kR5V9lOvRgHgN/ljhNygSzBOBmGjkUeir9yDDbpoMt0/5rvrIjjFs3Adg8oX9adoeN7ZQc/sXHl n4pCA1wRPxu3FRQSdWQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: KG5WUG5SIMAA4SDKYHJQTOJIW3NIPN6Z X-Message-ID-Hash: KG5WUG5SIMAA4SDKYHJQTOJIW3NIPN6Z X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791413801171158501 Content-Type: text/plain; charset="utf-8" Build boot-certs entries on the -machine command line for s390x guests. Validate that boot certificates are only used on s390x and that the QEMU binary supports the boot-certs machine property. Signed-off-by: Zhuoying Cai --- src/qemu/qemu_command.c | 7 +++++++ src/qemu/qemu_validate.c | 13 +++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index bcddb9c922..25d22bb640 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7379,6 +7379,13 @@ qemuBuildMachineCommandLine(virCommand *cmd, =20 qemuBuildMachineACPI(&buf, def, qemuCaps); =20 + if (qemuDomainIsS390CCW(def)) { + for (i =3D 0; i < def->os.nbootCerts; i++) { + virBufferAsprintf(&buf, ",boot-certs.%zu.path=3D", i); + virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); + } + } + if (qemuDomainIsARMVirt(def)) { for (i =3D 0; i < def->ncontrollers; i++) { virDomainControllerDef *cont =3D def->controllers[i]; diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 08f5a6659d..e7f8f4d30f 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -866,6 +866,19 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } =20 + if (def->os.nbootCerts > 0) { + if (!qemuDomainIsS390CCW(def)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is only supported for s390x CCW m= achine types")); + return -1; + } + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("boot-certs is not supported by this QEMU bin= ary")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414369; cv=none; d=zohomail.com; s=zohoarc; b=LUSzc5mTHHRrHD4EbWwjuG850j60Be4Q2nABcgkmIGjyuEpZqvjVI3Pep0caHEVtNgs+oUtOaK+QELHnClg7kXUrPx7dUdnCwfD1rDSmjiDfZHOKIBs9dewelFIPFiqFqmFq/nsHd2CDPULOOcp/dy/9Q5clUNYX497wV1Jr9kU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414369; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=QXPc7JbOccxtFjWoEGMPxNcTpjcinsZtmQiN5xeoIzw=; b=NecrTf4/wf1ivYrzRz56skLE5cbdRz0z92FI9moubjpQFBbf6twb0TDeygLd6V8S9hOV2uyII0kvqkTXx6+Mdx2vH64bw85Zcgi54FWmDMZSFGnFU54B39DymcDj62r7zkY4VCO62/SeADQaGc6e7zsx6Goe+Nkbt+k9vFKp19Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414369892296.53592311361297; Wed, 7 Oct 2026 16:06:09 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id A627341AF4; Wed, 7 Oct 2026 19:06:08 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id C671441D54; Wed, 7 Oct 2026 18:56:07 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AD0374193A; Wed, 7 Oct 2026 18:54:57 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 3B75C419A3 for ; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M5tc73777611 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjvr5us-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:53 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LlV4Q2476280 for ; Wed, 7 Oct 2026 22:54:52 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h5s34sesr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:52 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Mspq117498846 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:51 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4072C58056; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BFEDA58052; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:50 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=QXPc7JbOccxtFjWoE GMPxNcTpjcinsZtmQiN5xeoIzw=; b=UrVPVXIi5rJC/aB9lyAb4eWtkTW7fM6jW InClbZVcfSDFLwp/ol1ST+s1ZAZo5BDbAAVfpJP5rwQk2s4EgZytyMCOQBorEl0C zQhB2XDRro02o2snBc0FIZuixo1s/Tp2rED7GagGsa4MZqSHtrKBLG+39/uIv0CC TP/EiIAumYdBhJMZ92tAmwHTNdLLM4gKwbnKwFQZy8oRms72bbxu1+qoWLZoQbCa 1Wk1xV8hZUChklORMshEQb1PeJqUCp2h3dKccLFLU2lKwTkJjIrFRHtkEJlJMeT2 ENj4NMbbzOFjXsbxnW5qF4qSK/xH8R8ORK4YFaw6nAWByUzryXZmA== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 04/14] conf: Add s390x boot-certs domain capabilities reporting Date: Wed, 7 Oct 2026 18:54:35 -0400 Message-ID: <20261007225446.133542-5-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: ILFXLLiL2oe6QBGmDZAw8__xa7srLldT X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX+NUB/HPK67Wg U5urpbYZacZ3eLJ4t4HrWFiPwkXh9qP+6rOF8EP/GkLxt5z9AcCXLdFqFhrxK616b6b7QLveZcd S6mnYaEehsoYuVH1JvWqGCbiSdA2xEeRdrZ6vdFLi06El5nA/erPR7G4NE+EyG27GKRLmizDVGT WD+J8lIRxp5+l4ea2gk6Gy3kxLUx/LKPdbd5obPwrfMYCdJRqqJxpVh1KQXVVY9qb1hskFFl9Mo FInp0Ddb3kkyOiy8WL0mqFKrbu6Ivl6UiDGnwjr9x25y8Yu7iwXNiC6Oe0WAROfxv24tiMna6VR VeEaA1GjJE7++C1M/mmg7Pnu0eBcbAebS0E1QBK90yZdzJf/N7TbG60VudGa+vGcs5I5P751Faw RInHe3H7y8+GWWnMu4MyZY77r5atN/E0SJ+TVOtZvitdziEGbSdYGkZ8Ybpfke1SMtR5eTIsZDc py97D/Mbapjm6h07ODA== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX7lCQEfV0+O+y AbloMbXuFimcIVml9W9VlfAQwGClXzWkF6MAWMRJG2JM8/kqrmfHLZp1TH82DKC4P5oSFY0WDi9 NpdQ9qmRJM2SXwZfOWffWFQQ11ih5tA= X-Proofpoint-GUID: ILFXLLiL2oe6QBGmDZAw8__xa7srLldT X-Authority-Analysis: v=2.4 cv=FLCOVOos c=1 sm=1 tr=0 ts=6ac6cdbd cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=XwHF_3Iy7oNg0K6Nz1MA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 impostorscore=0 adultscore=0 priorityscore=1501 suspectscore=0 clxscore=1015 bulkscore=0 spamscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: 7IKIPVFANED2IO4IXU5BV4I4GXMGE43B X-Message-ID-Hash: 7IKIPVFANED2IO4IXU5BV4I4GXMGE43B X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414370258158500 Content-Type: text/plain; charset="utf-8" Report whether QEMU on s390x supports the boot-certs feature via a new element in the domain capabilities OS section. QEMU 11.2.0 is the first version to support it. Signed-off-by: Zhuoying Cai --- docs/formatdomaincaps.rst | 19 +++++++++++++++++++ src/conf/domain_capabilities.c | 10 ++++++++++ src/conf/domain_capabilities.h | 6 ++++++ src/conf/schemas/domaincaps.rng | 9 +++++++++ src/qemu/qemu_capabilities.c | 16 ++++++++++++++++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + 14 files changed, 69 insertions(+) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index ed935c704d..7142686a67 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -234,6 +234,25 @@ alternative to pflash-based NVRAM storage. This is the= only type of variable storage compatible with Secure Boot on non-x86 architectures, but it can be used on x86 too. =20 +The ```` element :since:`(since 12.9.0)` indicates whether +QEMU supports providing X.509 boot certificates to the s390x CCW firmware +for Secure Boot. When ``supported=3D'yes'``, the ```` element = may +be used in domain XML to supply PEM-format certificates. This capability is +only reported for the guest on s390x. + +:: + + + ... + s390x + ... + + ... + + + ... + + CPU configuration ~~~~~~~~~~~~~~~~~ =20 diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c index 78b8e6e6e1..a87af269ee 100644 --- a/src/conf/domain_capabilities.c +++ b/src/conf/domain_capabilities.c @@ -457,6 +457,14 @@ virDomainCapsVarstoreFormat(virBuffer *buf, FORMAT_EPILOGUE(varstore); } =20 +static void +virDomainCapsBootCertsFormat(virBuffer *buf, + const virDomainCapsBootCerts *bootCerts) +{ + FORMAT_PROLOGUE(bootCerts); + FORMAT_EPILOGUE(bootCerts); +} + static void virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsOS *os) @@ -464,6 +472,7 @@ virDomainCapsOSFormat(virBuffer *buf, const virDomainCapsFirmwareFeatures *firmwareFeatures =3D &os->firmwar= eFeatures; const virDomainCapsLoader *loader =3D &os->loader; const virDomainCapsVarstore *varstore =3D &os->varstore; + const virDomainCapsBootCerts *bootCerts =3D &os->bootCerts; =20 FORMAT_PROLOGUE(os); =20 @@ -472,6 +481,7 @@ virDomainCapsOSFormat(virBuffer *buf, virDomainCapsFirmwareFeaturesFormat(&childBuf, firmwareFeatures); virDomainCapsLoaderFormat(&childBuf, loader); virDomainCapsVarstoreFormat(&childBuf, varstore); + virDomainCapsBootCertsFormat(&childBuf, bootCerts); =20 FORMAT_EPILOGUE(os); } diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index 02344fd9b6..5a165812f5 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -66,6 +66,11 @@ struct _virDomainCapsVarstore { virTristateBool supported; }; =20 +typedef struct _virDomainCapsBootCerts virDomainCapsBootCerts; +struct _virDomainCapsBootCerts { + virTristateBool supported; +}; + STATIC_ASSERT_ENUM(VIR_DOMAIN_OS_DEF_FIRMWARE_LAST); typedef struct _virDomainCapsOS virDomainCapsOS; struct _virDomainCapsOS { @@ -74,6 +79,7 @@ struct _virDomainCapsOS { virDomainCapsFirmwareFeatures firmwareFeatures; virDomainCapsLoader loader; /* Info about virDomainLoaderDef */ virDomainCapsVarstore varstore; + virDomainCapsBootCerts bootCerts; }; =20 STATIC_ASSERT_ENUM(VIR_DOMAIN_MEMORY_SOURCE_LAST); diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.= rng index 4682abbf41..6c0addf524 100644 --- a/src/conf/schemas/domaincaps.rng +++ b/src/conf/schemas/domaincaps.rng @@ -93,6 +93,12 @@ =20 + + + + + + @@ -107,6 +113,9 @@ + + + diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 48a6bbbd6d..ff35fbc65c 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6607,6 +6607,19 @@ virQEMUCapsFillDomainVarstoreCaps(virDomainCapsVarst= ore *capsVarstore, } =20 =20 +static void +virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, + virQEMUCaps *qemuCaps) +{ + virDomainCapsBootCerts *bootCerts =3D &os->bootCerts; + + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) + bootCerts->supported =3D VIR_TRISTATE_BOOL_YES; + else + bootCerts->supported =3D VIR_TRISTATE_BOOL_NO; +} + + static int virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, virQEMUCaps *qemuCaps, @@ -6663,6 +6676,9 @@ virQEMUCapsFillDomainOSCaps(virDomainCapsOS *os, if (virQEMUCapsFillDomainVarstoreCaps(capsVarstore, varstore, qemuCaps= ) < 0) goto cleanup; =20 + if (ARCH_IS_S390(arch)) + virQEMUCapsFillDomainOSS390Caps(os, qemuCaps); + ret =3D 0; cleanup: virFirmwareFreeList(firmwaresAlt, nfirmwaresAlt); diff --git a/tests/domaincapsdata/qemu_10.0.0.s390x.xml b/tests/domaincapsd= ata/qemu_10.0.0.s390x.xml index a88669528c..663f2da5c9 100644 --- a/tests/domaincapsdata/qemu_10.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.0.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_10.1.0.s390x.xml b/tests/domaincapsd= ata/qemu_10.1.0.s390x.xml index 3bb62be1ec..2d0cad76f4 100644 --- a/tests/domaincapsdata/qemu_10.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_10.1.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_11.0.0.s390x.xml b/tests/domaincapsd= ata/qemu_11.0.0.s390x.xml index b317835b51..5c1de2471c 100644 --- a/tests/domaincapsdata/qemu_11.0.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.0.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_11.1.0.s390x.xml b/tests/domaincapsd= ata/qemu_11.1.0.s390x.xml index 044df2701a..af77db4666 100644 --- a/tests/domaincapsdata/qemu_11.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.1.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsd= ata/qemu_11.2.0.s390x.xml index 6a02aa0df7..34693bea31 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_8.1.0.s390x.xml b/tests/domaincapsda= ta/qemu_8.1.0.s390x.xml index 7971667460..744e496b65 100644 --- a/tests/domaincapsdata/qemu_8.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.1.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_8.2.0.s390x.xml b/tests/domaincapsda= ta/qemu_8.2.0.s390x.xml index 195630a24e..aa1e87a2af 100644 --- a/tests/domaincapsdata/qemu_8.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_8.2.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_9.1.0.s390x.xml b/tests/domaincapsda= ta/qemu_9.1.0.s390x.xml index 16f32f9465..1700576121 100644 --- a/tests/domaincapsdata/qemu_9.1.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.1.0.s390x.xml @@ -27,6 +27,7 @@ + diff --git a/tests/domaincapsdata/qemu_9.2.0.s390x.xml b/tests/domaincapsda= ta/qemu_9.2.0.s390x.xml index d9bbac632e..42b97d8aea 100644 --- a/tests/domaincapsdata/qemu_9.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_9.2.0.s390x.xml @@ -27,6 +27,7 @@ + --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791415012; cv=none; d=zohomail.com; s=zohoarc; b=IPTUBfhtdR0xoFEMuBqA1fyvfzwWvgDfhXJtNvqp0kS89tK9qlM4V6iQpcK7q7RJWvoTz8O5PlDgA3NcPq0zGXzQtiYkS8b7AdIiCVd18kNMX8HLZIjTFAkt+SuBg6sOGGrXD6jB6/Vi+VvziEthjI9sLjDBfxn8v8PZ8GM8G1U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791415012; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=5wF/nkKE/DSkt7rBGY4U+dK0N0Iv3FrdQpvGFuSRXA4=; b=UVYQqF8tiLpl4cvBfp3sYRJ+uFWhGnaOrv13j5+OmStx/cnk+Knk6RX3pM85lO1Xshl4lNDvyG94YtiAyY8hcX5rS6EtLErdUoGZYhSxOuiL0ERAphFqLiL2TCL/UGzeWCGeRLC7jUGYjG/Ax5rn6p2AorUSad8Z3tvb+teCrrg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791415012669713.914555400774; Wed, 7 Oct 2026 16:16:52 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 7B8BE41C0D; Wed, 7 Oct 2026 19:16:51 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 8D70043DB6; Wed, 7 Oct 2026 18:56:36 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id EEAB341AEE; Wed, 7 Oct 2026 18:54:56 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 165B2418C8 for ; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M66rl2499742 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xk1855e-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:54 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWVJs2479146 for ; Wed, 7 Oct 2026 22:54:53 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h58ek4wj5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:53 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Mspoi57803142 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:52 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C45E358056; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 58C9458052; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5wF/nkKE/DSkt7rBG Y4U+dK0N0Iv3FrdQpvGFuSRXA4=; b=I90Hq276Wo0tY5MIRmxaCtjqiGNWhCShC /SGK0PccwDNT4a3YxSt0+2sX/Ev4jwhPNO3Zlp6KtWOScbbQC/7mPNux17JIBp7G aFQiV90+O8c8ltroDkVkhHQfJeZR7CbVKoBK1MT+OaX1OSlYVnP3mqVVNqjqcCtX gnE4adhu6m+R4+LON5QFwRC/hsKWwZp1BafnIdM0RmHOfCJPzq2bZdDjDoQ6+/Rx cg9/V01CYDbzBXdP+P7lxf4tpmN/XjH9oqYYtHEeHoDj7DWHFY/zm/brDhEFpapi hrEHhXb6uikpkYUd0Fcqfa8If4sv9Tzsdo0GslHbTViyT1rjJcmuQ== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 05/14] docs: formatdomain: Document boot-certs element Date: Wed, 7 Oct 2026 18:54:36 -0400 Message-ID: <20261007225446.133542-6-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=YtCa1IYX c=1 sm=1 tr=0 ts=6ac6cdbe cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=Dw7smgpqMiDoEPkd50oA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX7EzvoQQa3s/L JF77VYXHK6Sqdg+glq10Nq6hyfwMeiEdmbQ52hrUfqfPQOYYWii42ek9DG17Qd8TvXjkFuHbmvj 9vjlek2xmEgxYjF4tcnvLlKezDymQZ5KLMjv3Lf7pr43QX2rpBbycXNa0SqgvyijKPb9mD9iLXN WsfOo4fnCp7BmIOv0CLYtImmt2L9T1j0W6AIVtb/2hNblDtlat07xuD0R0GyPaH51klNRohYbEW cziiKZH8yJZEzUEBbz/37gZR7TzaogfJrCPh3fyJnRFX1cTN1rpwI3yU8mXd6OxxPF7z/4WcKgl 13snMoKAGkqUKUUuh27PpvFqDFQjQBG8Bp1T0LC5mcdhvRhTw28FJ7SRNtAPvitozLz8ufbHJRh FLJzJ7eAROJfa7NhWYX30UdobBG4S35Ty8apwdBnHz+k3LspqU6e/K/6nl+tBIUUaMKxQtvmPhq IX0SQs/I5BfFIZwoBog== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX9tRCiMxuIkTn 5eCx9Ekqws3yvMC2ISHEOYGY4V8E1rRCelK+OJ3yscSUvvZTHc7ssWwHmZ5aaUcyq5omDWnW1Ym 2zG08HYufi0huXJJCQZF939W8Hb3+Mw= X-Proofpoint-GUID: xt9wCzZSDaOITNoK-teAaxIX9y19-nX0 X-Proofpoint-ORIG-GUID: xt9wCzZSDaOITNoK-teAaxIX9y19-nX0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: JZVHVIR4QWF3ROY4PKTK63OV5EALPMFZ X-Message-ID-Hash: JZVHVIR4QWF3ROY4PKTK63OV5EALPMFZ X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791415013070158500 Content-Type: text/plain; charset="utf-8" Add documentation for the new element under , including an XML example and a description of its child elements. The feature is QEMU/s390x-only and available since 12.9.0. Signed-off-by: Zhuoying Cai --- docs/formatdomain.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index e4eb2d9ba3..17b8e0431d 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -194,6 +194,18 @@ harddisk, cdrom, network) determining where to obtain/= find the boot image. ... =20 + + ... + + hvm + + /path/to/cert1.pem + /path/to/cert2.pem + + + + ... + ``firmware`` The ``firmware`` attribute allows management applications to automatica= lly fill ```` and ```` or ```` elements and pos= sibly @@ -328,6 +340,18 @@ harddisk, cdrom, network) determining where to obtain/= find the boot image. it possible to keep UEFI authenticated variables safe from tampering wi= thout requiring the use of SMM emulation. =20 +``boot-certs`` + The optional ``boot-certs`` element contains one or more ``path`` child + elements, each specifying an absolute path to a host X.509 certificate + (in PEM format) or a directory containing certificates. Each path is + passed directly to QEMU's ``boot-certs`` machine property; QEMU itself + determines whether the path refers to a file or a directory and locates + the certificates accordingly. These certificates are used by the s390x + CCW firmware for Secure Boot signature verification. When only + ``boot-certs`` is provided, audit mode is enabled: verification failures + are reported as non-disruptive warnings. + :since:`Since 12.9.0 (QEMU only)` + ``boot`` The ``dev`` attribute takes one of the values "fd", "hd", "cdrom" or "network" and is used to specify the next boot device to consider. The --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414232; cv=none; d=zohomail.com; s=zohoarc; b=GLK7RXAbNBIVMRgce/MTIB/1/CK82V0Yrbi5QrrpUe9aK9ec6NjAe2QR4EisaxQtuKakGdYzisdKUS/U+VeG5j4GUCJ1A/VtHPNSfpqoNGBAEbEhfx3suiVRVemYC3U0qMe6WAItXvDacwUcrOlGzEyQ+MdtQjIsUySMWAB4uik= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414232; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=8NruLUrSKXcXs0ED16jm2sl6zz3/q1/F/a56jZL6oh8=; b=RsZZUriZ88XiB2j2eE2DHs6l/FbI2IE/LWSdbJ2sjIy13XlseeAng7coug9qCtDunpOXDmwjAR8bWO9rtfxllQzRChGBzk9AM+P6QdkSvPiC4maP4T4SghLZxLpa4FOeV5ZRBkbLTODQ4VdG15iq8Q7u4V8EChQowvuXE3Xz/tE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414232112629.2263661283494; Wed, 7 Oct 2026 16:03:52 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E701E41AC4; Wed, 7 Oct 2026 19:03:50 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 33BA7419EE; Wed, 7 Oct 2026 18:56:02 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 45454417FC; Wed, 7 Oct 2026 18:54:56 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 0311541892 for ; Wed, 7 Oct 2026 18:54:54 -0400 (EDT) Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M5eIp3713926 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjvg57b-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:54 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWVsM2522319 for ; Wed, 7 Oct 2026 22:54:53 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h3dhh0n7x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:53 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Msq3c37749234 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:52 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5E1C258056; Wed, 7 Oct 2026 22:54:52 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DEA2158052; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:51 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8NruLUrSKXcXs0ED1 6jm2sl6zz3/q1/F/a56jZL6oh8=; b=MENpeHOyH4fWOMpjlYMshOSvozYk2RsKF tfDgCoArCD4DANkZDLt9sDxUcU95g3iz081k+aNPjXEqjDKdtK3sWBxGFJ8GGToL QNytpHLyRsBaB30KDs2pFGJz4cIGvexrbsD1rhBBW+0UxmyC13rQQO54AI3iwYgC yNLoTbSMBV6fd3wnnJmK3j4sRhKfegLNfUyAahyYEPPPbFfDS7ekDQhY9UxUrjkB tbM802dUJ7jgKiUObyGLzG0W4G1LvYVvaww954Nz0eRridrXs/6dZaBT5GtqhSQu 6CIrkB9kiGFB6E/8/Orz7t2C09kCNQIibLkVLmnqNgpmUleunIafA== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 06/14] conf: Refactor firmware feature without auto select validation Date: Wed, 7 Oct 2026 18:54:37 -0400 Message-ID: <20261007225446.133542-7-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: K8I5PLPljdX1O6IqVoN4GONa4YnKJR4o X-Proofpoint-ORIG-GUID: K8I5PLPljdX1O6IqVoN4GONa4YnKJR4o X-Authority-Analysis: v=2.4 cv=FoOQbGrq c=1 sm=1 tr=0 ts=6ac6cdbe cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=tJH5vg1uCFgSLNr-Qj4A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX+qgNfqZFoINN O8Ri/QF5PNgSFyMFvhomCCOL2XYLBh3085gnC96wr+lk8E/+fhs8OFkFFkgBvBbu0MmeauTiAUS tfE42N4TNxzV7Xmc8T53TorWfustjZk= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX4c8UpjZaYUkP Kz39aQYr/7XteM1vayo47DwcnanNet5PbTwh9CxchinQ9InM6kkhEb72FOuNU5nAI2OwlJ/uV4O Nyiego08WKQjBbOfOWG+28tTibnzzB2QixROHqyjEFL7TddZzYXRYFqRZ/7snpshWL2j5o0Ku1b eLxlo6IQkwOer+++qbzgZG2BVFrgi2AhlIoO1GtdjtLYepe/7g6AGKqG295MyXqj3fWd+0zzsHF abkGarFZdBMhpADBcOlPOpIB9cADVxOK6xHUEBOmyP7rKPXQJDeLEVmjboAW5A/0r69FUXmIwYM dp9K+/gloJQuHS1rgFKTedXMOshL9/JP8mv48HdxiTGRWPcxlWrkKtgTBjDTp4Ssuq95lGHHUEJ BvQjV8b+wS1cGespGdVWnCv9yWRwrYzvbRBd8wbSVrEiQjSyBZE5mAF8o/rOHKQ7XGVTORe8eG1 b1h82ug6uAIdm3yf1iw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: JAL3VSGSQTVIYELW5MIXCAX2UW4FZQ6D X-Message-ID-Hash: JAL3VSGSQTVIYELW5MIXCAX2UW4FZQ6D X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414233465158500 Content-Type: text/plain; charset="utf-8" Extract the firmware features without autoselect check from virDomainDefOSValidate() into a new helper function. No functional change; preparatory for s390x-specific validation in a follow-up. Signed-off-by: Zhuoying Cai --- src/conf/domain_validate.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 15e3bb29e6..bdd44e42b3 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1726,6 +1726,20 @@ virDomainDefMemtuneValidate(const virDomainDef *def) } =20 =20 +static int +virDomainDefOSValidateFirmwareFeaturesNoAutoselect(const virDomainDef *def) +{ + int *f =3D def->os.firmwareFeatures; + + if (!f) + return 0; + + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("cannot use feature-based firmware autoselection when= firmware autoselection is disabled")); + return -1; +} + + int virDomainDefOSValidate(const virDomainDef *def, virDomainXMLOption *xmlopt) @@ -1751,9 +1765,7 @@ virDomainDefOSValidate(const virDomainDef *def, return -1; } } else { - if (firmwareFeatures) { - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("cannot use feature-based firmware autoselect= ion when firmware autoselection is disabled")); + if (virDomainDefOSValidateFirmwareFeaturesNoAutoselect(def) < 0) { return -1; } =20 --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414954; cv=none; d=zohomail.com; s=zohoarc; b=AVpk7D2JvqjJafo2PAHpvz0mOmeJQU1gyytcvkzdlCbGyPWHtJ9GtOybHg3DGJ0G6fonGTqypQJ79Yv9Hi+Y6XKrDUGIZNC0Y7+W0eXd5jKeS5xIhfkBEZ2O53SWkkTwDab4AZrTV5PK7kcKTwoCiPgOqDAHw8uJ6DVzd7jccSM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414954; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=KJ0/RCLJ/HbU7MnUH5srNwJMH//hLpOPsT4xjLJOwoQ=; b=Ha1AqX+5PC3VK9WMKyIfsHg0XA8bvTATjqaHuq6AzRMnN3xL4And4TOX+ypqeFzp5EhZpDWhkaNRTrKMQseBkz5u6sm4GIfA+1GKgixHTHrZ3l8+zfV0qjPlU4Ir8eqiI66UtatzH2kxwLmBC2l+IZmB1SQ4HDRsyEs1aOYQhPs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414954276895.6950733988159; Wed, 7 Oct 2026 16:15:54 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 0E38A41C7B; Wed, 7 Oct 2026 19:15:53 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id CEAC641D3E; Wed, 7 Oct 2026 18:56:29 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 1245F419AA; Wed, 7 Oct 2026 18:54:57 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 70733419CD for ; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6GAe3714775 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjvg57c-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:54 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWYNm2459641 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h58d5mxv1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:54 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Msr6g21299766 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:53 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ED85558056; Wed, 7 Oct 2026 22:54:52 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 75B8258052; Wed, 7 Oct 2026 22:54:52 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:52 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=KJ0/RCLJ/HbU7MnUH 5srNwJMH//hLpOPsT4xjLJOwoQ=; b=VeZZ/My+rw3+yu5piqVr6RXadBIKcpPTJ WiAdl7F5TzWbqMQLXDJ7J4oN68mRxZTeS9OyPXnmEgRxWnlu4Kf4xv+r9E2Z23r/ 0OZCA5Le6tgsN/2Jj7c6UJTsFa/sYJZ+MztwAe1FM0VLahe/uH0NxSmjEdHbqtuS PTbikwREB5XilRYWXvgvU79d4S6+jx/HpSGJlSaXK1YnaBkmzO5g4MeSUkaK/Tm+ 6X8+vj+X6rB/XQwPNaRyVlQUoCWafG818XE9fOQOUzYzgusEF/2i0++UyW5SHDLL BE0hZQEfI9VvEjm8xBKcauq2mnbFImjMMZK4gMhIrNS+Q8sBo6mfQ== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 07/14] conf: Allow secure-boot firmware feature on s390x Date: Wed, 7 Oct 2026 18:54:38 -0400 Message-ID: <20261007225446.133542-8-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: T8m2uZ4ZIPQGPR9w9g93b0JZwjyrYfCX X-Proofpoint-ORIG-GUID: T8m2uZ4ZIPQGPR9w9g93b0JZwjyrYfCX X-Authority-Analysis: v=2.4 cv=FoOQbGrq c=1 sm=1 tr=0 ts=6ac6cdbe cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=dXV_vr4AYBJ83TB5IGMA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX5WkvV2ZFb5Z1 AyyEV6daBEFqmTVyd9SC74Zv88wD96jaP3GN44BvJ9YKSFG9aaS0+iqE7tDaaQJv3w0fngT33Iy hcVL0wewyMLwZn+KdiIqJ8jkIZFOWLU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX6OBVtX3iKilk 7vESCUW7Dcja6w4V8dwCxZTTzGD/tNoImdBycyzH5Eizkz1dmT2AMDZQDbEBzPsZwKGagzcqbfJ UoQrcJg2bFYAFgvLSRTRhOUBpUm98j4NISO70wJIr/e1c61m62PTazB5X+l/wzmFkqsArGoj2ia C9O5vAJNUhfaevWNPkGTxj/9TRWoAkdFGLPY3KDLxL4v7cV4x2OwAnZGf3QHKd6kyBtZ3fIi6iR 5WuadLioeG1r7c8IfXHm+MbApcjj83QBClE36ZqYt7dWLFaL1LgBnpKG7Py8WN/BNInRxvkeup5 oOQpZl8Tm6QvMmT4AGdiCXP6Uk8IARx64LAzT/kMrr0nWkOVmX4/l45EpLzss5eziRUEBdM0Piq Gc/TusFlDIgXIUQzLdbQraUPzcNJSyBdwZtij05r+tcdh4+JO4/4TJCUd8x4R6MIuvl5Bqp0/jW hDUNkVLnv56xQELCetA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: RD2KGVPYEUKKIRL4MSKTMWHXUI4A3ZFK X-Message-ID-Hash: RD2KGVPYEUKKIRL4MSKTMWHXUI4A3ZFK X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414955044158500 Content-Type: text/plain; charset="utf-8" Allow firmware feature such as secure-boot to be specified on s390x. Update the parser and validator to allow this, and reject the enrolled-keys feature which is not supported on s390x. Preserve firmware features in migratable XML on s390x so the destination enables secure-boot as configured on the source. Signed-off-by: Zhuoying Cai Reviewed-by: Boris Fiuczynski --- src/conf/domain_conf.c | 8 ++++++-- src/conf/domain_validate.c | 20 +++++++++++++++++--- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1dfb7b251a..5bd4583c36 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -18612,8 +18612,12 @@ virDomainDefParseBootFirmwareOptions(virDomainDef = *def, * information to successfully define and start the domain, or it * will be a random configuration that lacks such information, in * which case a different failure will be reported anyway. + * + * Note that s390x is excluded from this early return because it suppo= rts + * firmware features (e.g. secure-boot) without firmware autoselection, + * so those tags carry meaningful configuration and must be = parsed. */ - if (n > 0 && !firmware && !abiUpdate) + if (n > 0 && !firmware && !abiUpdate && !ARCH_IS_S390(def->os.arch)) return 0; =20 if (n > 0) @@ -30213,7 +30217,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef = *def, virBufferAsprintf(buf, ">%s\n", virDomainOSTypeToString(def->os.type)); =20 - if (def->os.firmwareFeatures && !migratable) { + if (def->os.firmwareFeatures && (!migratable || ARCH_IS_S390(def->os.a= rch))) { virBufferAddLit(buf, "\n"); virBufferAdjustIndent(buf, 2); =20 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index bdd44e42b3..63cfcaa61f 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1734,9 +1734,23 @@ virDomainDefOSValidateFirmwareFeaturesNoAutoselect(c= onst virDomainDef *def) if (!f) return 0; =20 - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("cannot use feature-based firmware autoselection when= firmware autoselection is disabled")); - return -1; + if (ARCH_IS_S390(def->os.arch)) { + /* + * s390x supports secure-boot via firmware features without full + * firmware autoselection, but enrolled-keys is not supported. + */ + if (f[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] !=3D VIR_T= RISTATE_BOOL_ABSENT) { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("firmware feature 'enrolled-keys' is not supp= orted on s390x")); + return -1; + } + } else { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("cannot use feature-based firmware autoselection = when firmware autoselection is disabled")); + return -1; + } + + return 0; } =20 =20 --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791415144; cv=none; d=zohomail.com; s=zohoarc; b=PjeqAAcqBv9tzIMSbsMCqHV47+djGbLJeGMBj5BTjMr2mZwfTf+mQbgr0n1lV6XQnDeAzrH6UdIBu94ZK+V10dYr5b5kFazy3U+LkmHl7BCvcoy4xMAPV4kNqNehRHexGAR4NyVucVFPFCFupBZIJeA4U4SXJjPcPr5F3gG4GMk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791415144; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=C1s38qLniZ6Odx+3s4LGvqisG5f533VAadzHz99vU4E=; b=SWSY6m/wRjwhZkDzeSr9dJAkFlHK18Fnnj07KBaEQdgvqs86s/6NwSwOvRMlM8Hg39jK5bf5e20JY3Z661hJ41JjH6wI1xhYy7XW6qwHerpkDlLmRmZF0B6+1CGaQAAWaoMpiMKhEbp+6pOcZ4I1Oe+0L4TC2xHmwuOjfCF54a8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791415144507396.1105945467242; Wed, 7 Oct 2026 16:19:04 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 616A541BCD; Wed, 7 Oct 2026 19:19:03 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 2BEA843EAF; Wed, 7 Oct 2026 18:56:50 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 9D0D841B8D; Wed, 7 Oct 2026 18:54:58 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id E64CB41904 for ; Wed, 7 Oct 2026 18:54:55 -0400 (EDT) Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M65CA2499697 for ; Wed, 7 Oct 2026 22:54:55 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xk1855f-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:55 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LlV4R2476280 for ; Wed, 7 Oct 2026 22:54:54 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h5s34sess-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:54 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697MsrP121299768 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:53 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8A3B158056; Wed, 7 Oct 2026 22:54:53 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 12EEA58052; Wed, 7 Oct 2026 22:54:53 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:52 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=C1s38qLniZ6Odx+3s 4LGvqisG5f533VAadzHz99vU4E=; b=BZTGhU6iXBLszzE6HAIGikiOdQvFB3AtP mnk5QlZ+86upV1DVPDkuvSxAEWT1jImcn7Mv6XpsW0YkYz9zEl2MKWLcHU8nqW3T Rnkuy49xdjDSUk/VCIiWvcWmeVTt243xSZPJGq8edjlvGaAdKbgoXswAx5o0wMVb dEarC3kONIbxyYtbK3PtzhBKxx832YH0Hqt6VlnM+K+c3UcBBAIZsJV1De5hPZnT nR4EMS6enScW0kIlVpaBD3hxdKp3tC38OfrynVMyl0b+QrUlnMYzA6Wp+V8sDKH/ UKo5Y6tla1Faf2SDuDSdRvNd6gJgeoWkGV3v8Ntu+RxrpwyIU3zfw== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 08/14] qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine property Date: Wed, 7 Oct 2026 18:54:39 -0400 Message-ID: <20261007225446.133542-9-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=YtCa1IYX c=1 sm=1 tr=0 ts=6ac6cdbf cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=wS9QBU42Ro0Wp0jkqvwA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX5vDC9uFvgRH/ RX4bQaNwu28/Tn3ml3Tn8ZGxfWot5tRbfXc9J/NdoqugEsmBuo08W6Ywg79cN4MdQxemRWa27HY jAV1srVmRFovN+5/lP/URVvx9I/xnn7zHMN76OUxm+U+nLJ2n5fm3LHHf/mT4gkGh3ns55adgJI qvlAH1x9dicgRH1FeCFkj6z+/PJ5KC3nqTRi57zsMpS8xQrOVzBWNigM0Pk/wufv1JBzTDpW7x0 YphYhJ0PQ2qgqZPjB1PV48ZKnlwKX0M1kbo/k0umuQR4OCqicprJKfqgLAcaHRUPgVG6SMRRoZ2 YAjltTdEKsjpYtzLm9ULr0WALPLKkz/qvkl2rPbReE36umDNPJHAznJpdcECq22moIfmruq8hwa XUakGI0k3V+UEKO6Jf+D1elHK6q7sTgzY5OiyMXRyZ52m3DfiEOln9Kyl9V5FpqGqTxqr8vK9gR 2Xg64WaoHBBDPoMesFw== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX6UMikh+XaIVs wEAoyAEJr66KrDroB7MPilF4L4ZY/S/pux0GCwAy2qInVMquTUc14l+SzUb39VMV65epItxIQ3V jTaThZ235+NUSr4pyTHugzZSoTMmUyw= X-Proofpoint-GUID: 8O3jHD6CSQ59LT1Z_A8GfeyhMnBablW6 X-Proofpoint-ORIG-GUID: 8O3jHD6CSQ59LT1Z_A8GfeyhMnBablW6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: 3UEJXWH3GIV6IQ2XAPB4VEGDRMDTBHNC X-Message-ID-Hash: 3UEJXWH3GIV6IQ2XAPB4VEGDRMDTBHNC X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791415145730158500 Content-Type: text/plain; charset="utf-8" Add QEMU_CAPS_MACHINE_S390_SECURE_BOOT to detect whether QEMU supports -machine s390-ccw-virtio,secure-boot=3Don|off. Signed-off-by: Zhuoying Cai --- src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml | 1 + 3 files changed, 4 insertions(+) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index ff35fbc65c..53d26a8d3d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -777,6 +777,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "iothread.poll-weight", /* QEMU_CAPS_IOTHREAD_POLL_WEIGHT */ "win-dmp.guest-aware", /* QEMU_CAPS_WIN_DMP_GUEST_AWARE */ "machine.s390-ccw-virtio.boot-certs", /* QEMU_CAPS_MACHINE_S= 390_BOOT_CERTS */ + "machine.s390-ccw-virtio.secure-boot", /* QEMU_CAPS_MACHINE_= S390_SECURE_BOOT */ ); =20 =20 @@ -1886,6 +1887,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsMachi= nePropsVirt[] =3D { =20 static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsS390[] =3D { { "boot-certs", QEMU_CAPS_MACHINE_S390_BOOT_CERTS }, + { "secure-boot", QEMU_CAPS_MACHINE_S390_SECURE_BOOT }, }; =20 static struct virQEMUCapsStringFlags virQEMUCapsMachinePropsGeneric[] =3D { diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 880ed29281..e505ce3749 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -751,6 +751,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for = syntax-check */ QEMU_CAPS_IOTHREAD_POLL_WEIGHT, /* -object iothread.poll-weight */ QEMU_CAPS_WIN_DMP_GUEST_AWARE, /* 'win-dmp' is offered only to a guest= that can use it */ QEMU_CAPS_MACHINE_S390_BOOT_CERTS, /* -machine s390-ccw-virtio,boot-ce= rts.N.path=3D */ + QEMU_CAPS_MACHINE_S390_SECURE_BOOT, /* -machine s390-ccw-virtio,secure= -boot=3Don|off */ =20 QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_11.2.0_s390x.xml index 7a7f0beaf5..98429e2b02 100644 --- a/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.2.0_s390x.xml @@ -150,6 +150,7 @@ + 11001050 39100288 v11.1.0-1870-g81ce3a8773 --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414076; cv=none; d=zohomail.com; s=zohoarc; b=elq4RWhYD55zSCnvl6J2l3PKntle2onJi/PrHRwUZhTSPfUdyHvPGoZSroyyXwKb0Q6cYcJZJXzg6Ryeq3t0ZZyagJ1v4jtY8zW03mJoRdIGHmmTuiAZfhWXcEqyvflgoSFKlJCLGbTgxhm260H7hgP9ZPzCf064AO0mcITqR2U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414076; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=e80NFjAhEpTrHg/t71nw5kf2AYPowIiqdQozq2bwGgQ=; b=UBfUQYj6sckt2Ax0FOcZeZkbQx4vrPwBT8lHJ2J9P59RchA0xNucHEUnTv1i2VynpHjXhNOcOKnwhHBDibCr7d5K0snocYFCopG2oX3Qby2X6CnkiAQg676MLNjtvSfz72ovoMn0P/B90jq+/g+hAxZchLiGYE30Bam+fDsek04= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414076727862.9323889841959; Wed, 7 Oct 2026 16:01:16 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 82DB441ACF; Wed, 7 Oct 2026 19:01:15 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 4226B41C25; Wed, 7 Oct 2026 18:55:44 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 994A23F320; Wed, 7 Oct 2026 18:54:59 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 4F0DD418C4 for ; Wed, 7 Oct 2026 18:54:57 -0400 (EDT) Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6BeD3575620 for ; Wed, 7 Oct 2026 22:54:56 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjw059t-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:56 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWX0I2517397 for ; Wed, 7 Oct 2026 22:54:55 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h5a6dmkx3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:55 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697MsslG7209748 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:54 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 19F2958065; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A25FC58052; Wed, 7 Oct 2026 22:54:53 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:53 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=e80NFjAhEpTrHg/t7 1nw5kf2AYPowIiqdQozq2bwGgQ=; b=PtQmN2Tho2GynbpwmvI7MfCzmZNXhTSSE a7uRitynWjmrrUNCHcc5g1QpmXySXABWG+nlxU/U1NqJeXKPdKSQWybeKF3DJZN9 KseNe8N8Wf+ZwDykH9y4qYVsrBoy9+FeAE8UJiTv9llgFiWzsHAIlhDSgf7DIAhQ 4NoeitzyNVN5r5isz4LROFTVR8PtEDPfY87SnRmxwj6Ow5FDWJTp6LnsSb0q3AL+ LVE5lAxk909xPQE0f/U/Wm8zQd5mj/yIFvZQx8WY1rYz5gEtZJkMwPn+z6/fQmWp yWRKzVqZj5XxUY75mTqcNDdEN4pt/lXKP6cC7/X9nZyRaFX7SG+3g== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 09/14] qemu: Add s390x secure-boot support Date: Wed, 7 Oct 2026 18:54:40 -0400 Message-ID: <20261007225446.133542-10-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX1tp4g9lt8LK8 y3canZ7xuv5J/FgkUM6RUejmPa3UUB+ZicDlhFZ0klsmn4bWrUOkCZSKh94hUVR7Ft1IFvO8CQI UYbfMjS9LhhLQuFB3edYtxZJoaljRRo= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX9llloHnt2m8b ePiG0lRdsUiMtsVvU9WsISgg9SjTt4kZV+MS61rEBuObkYUkY7PwKW2O7TfCBQaKJZjhrnQRoHT o7m9tXUXHztpb1Ak8la/MU29hx1/xtFH0f+B7nRSc0juFv7VUNLVscGO9BecZXgllD9DuifU5F9 ikfOFhtgBeyd5WJhvqaMZOcY0db92cshmSjXPhwUP1O44vIUGaeTlc8wV8Ii7LD3cVMI2Y6ihUM EG1mxUkRPQ+dnpq/HuVOpbHX2lB6OZuTt2FVmmRy6ZN7KWXAwkq9Cr4cT42CXcAdmkeeY3TtCEE 70xgL4QfrkX+sYJ3xSASTWxVqJmyPqOQLkBQM2L8rj/NFhpAdG2S+oOsAwO0C30At7xqXgmwcBG w7/FW9NNEfCNUuJX9cO+hoAHFDW5fCXe2VX7hUe4Fehs2pp4zNZeMsIvWR6bxpKlRaWV7imbKXJ SnoFTg/ayp7uNgWlr7w== X-Proofpoint-GUID: 7DixKwyiR04OhvQ3W8spYKTZJ93EH5_t X-Proofpoint-ORIG-GUID: 7DixKwyiR04OhvQ3W8spYKTZJ93EH5_t X-Authority-Analysis: v=2.4 cv=XcwcX455 c=1 sm=1 tr=0 ts=6ac6cdc0 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=NfkGD43K_dl5OSza3VYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 bulkscore=0 adultscore=0 spamscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: QBJZTSVROHHAKKKFK4SFBDWP4S4CYIVL X-Message-ID-Hash: QBJZTSVROHHAKKKFK4SFBDWP4S4CYIVL X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414078669158500 Content-Type: text/plain; charset="utf-8" Set secure-boot=3Don|off on the -machine command line for s390x guest. Reject the config if QEMU lacks the property or if no boot certificates are provided when enabling it. Signed-off-by: Zhuoying Cai Reviewed-by: Boris Fiuczynski --- src/qemu/qemu_command.c | 9 +++++++++ src/qemu/qemu_validate.c | 16 ++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 25d22bb640..2fc6a028dc 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7380,6 +7380,15 @@ qemuBuildMachineCommandLine(virCommand *cmd, qemuBuildMachineACPI(&buf, def, qemuCaps); =20 if (qemuDomainIsS390CCW(def)) { + virTristateSwitch secureBoot =3D VIR_TRISTATE_SWITCH_ABSENT; + + if (def->os.firmwareFeatures) + secureBoot =3D def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRM= WARE_FEATURE_SECURE_BOOT]; + + if (secureBoot !=3D VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(&buf, ",secure-boot=3D%s", + virTristateSwitchTypeToString(secureBoot)); + for (i =3D 0; i < def->os.nbootCerts; i++) { virBufferAsprintf(&buf, ",boot-certs.%zu.path=3D", i); virQEMUBuildBufferEscapeComma(&buf, def->os.bootCertPaths[i]); diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index e7f8f4d30f..2cea51f97c 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -879,6 +879,22 @@ qemuValidateDomainDefBoot(const virDomainDef *def, } } =20 + if (qemuDomainIsS390CCW(def) && def->os.firmwareFeatures) { + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SE= CURE_BOOT] !=3D VIR_TRISTATE_BOOL_ABSENT && + !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT))= { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot machine property is not supporte= d by this QEMU binary")); + return -1; + } + + if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SE= CURE_BOOT] =3D=3D VIR_TRISTATE_BOOL_YES && + def->os.nbootCerts =3D=3D 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("secure-boot requires boot certificates to be= provided")); + return -1; + } + } + if (def->os.shim && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_SHIM)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791413885; cv=none; d=zohomail.com; s=zohoarc; b=K0aZgV+WMe9kn/jDtYjs7e3HLfxrEniuhZ1gaheEJf+BpxqQ77GOVKXg/ryi9Xulxu5gCy26qFfFEzYYV8jxz697cFE+M/+Dh13Q8Zko4eUJLklsgchs59N9i7fisLNd9B0OM3sDX7Pv8Vlk9Ltqlr4IL4jm1Tbg96Rz4zWUuOw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791413885; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=5z86OHoQ2L+pPGq4qV/cfEUvyeaz0UszX1HHlxFV0sI=; b=W+6O/KbUI0QAwXHmst0OuVJrNk939GPLa0YF+qn/qo3kcLchpBN3q2apWpTmF+CVbxvQ1PMLFNqRlGUCdIHw3K4FniNx2Rp77Mny/buR+RTBT+79jNaKHmOvpiWCcO7LiuE5TzZfgUNxTZMran8osOQBin0Zl/nBuenmbYiWw24= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791413884919245.55974771629394; Wed, 7 Oct 2026 15:58:04 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 699C04196F; Wed, 7 Oct 2026 18:58:02 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 20FEE417FA; Wed, 7 Oct 2026 18:55:27 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id C85FE4193F; Wed, 7 Oct 2026 18:54:59 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 8173A41939 for ; Wed, 7 Oct 2026 18:54:58 -0400 (EDT) Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6DFj1912254 for ; Wed, 7 Oct 2026 22:54:57 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjw05wc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:57 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWXOM2479209 for ; Wed, 7 Oct 2026 22:54:56 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h58ek4wj9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:56 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697MsseX5047060 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:55 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A2B3458056; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 31DEA58052; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5z86OHoQ2L+pPGq4q V/cfEUvyeaz0UszX1HHlxFV0sI=; b=XkCy8av8CPEvWnW2B3DpuFK7l1IcWQsrz ywSMew3dtg7PW7hJDPtOImP4h0o75iwUqMMy5TE924l5MYg6IkoyYm9YqA4X3PuD 4WD+2ucqTwXsCKuMVu00+tWLZY/RwzocN7afSvKXL8775GH2ncsjYgT+uRzyGPoD hDzewiNJbZcHYCg42hQu2VjyZP8lyHc9PV94tIMvaZ4lk3MdC4XYFlgnlruOatwM tA94ZeBRyp5veCY4YXSIEOLx4bHt2ShODErrLoYnj78yv9ncoRLTgpb/ZILGMqZ2 4JsOXXWC8gv0+Ew7C2GeMRFWmyqkLbMzVJvx7UULbRg+E4bT8yayg== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 10/14] qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities Date: Wed, 7 Oct 2026 18:54:41 -0400 Message-ID: <20261007225446.133542-11-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: fVLtn7pfeeXN3z_JbHZOWnWnZNBY8vDj X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX9j1z2708VwCH 5PfguNLaTpheaPNBjIw042h8eJxYBr5nxL1BXZkFKv5cJByqGaPpdUiZ+oZD5aGph+vkj7uKXzp oHJdcQRcFVYGXosGElMPTrKeO88cMfYiiW7hflLlr4BDu/miYtWhjbvmcskV5odswxf5YgEUy7Q nW0Obw3ryS9ByKgR7LWFHQi4/iSvTP9qIEO+vWjcTBEoMiLhyj1LqoSch8ZgyN3FxtOf0uF/tHc i9jldG3efGmLlYs0i91hM+vHnC4Vqa4Z4qcnkpcHiQ0mf9yE9Di9MLPvUEgcE3Mq0UEKQ1Q19Cq R7/mlXOV17vKm1TRHC52nTtjn52MfOUvtGScVlzLvXbvB4ND1UK5iMfkwDwQ2D48kVUK3x5cNes ariAlXkn37VxMUSfBx6qCckPy82bsAo7kU4yw5YHDC5GtkCcFT+2M717ISIb+f6M4Dj/RAIBAPF P1KjJz1QvGLf5o/Mthw== X-Authority-Analysis: v=2.4 cv=cIt1IVeN c=1 sm=1 tr=0 ts=6ac6cdc1 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=_jCWi-pohOJQAFWfWmwA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX5xClcb7GmaVv 9Lvn6qaIl7W+Q83AiRlNE0vuknja+ZmbwfnkUG7jloBVoAvUZS/88Lv2zTQLnL+QTVMGYS4jwtJ tDdv1s4V6PlPoIGzyl21ZQngIRpDvkU= X-Proofpoint-ORIG-GUID: fVLtn7pfeeXN3z_JbHZOWnWnZNBY8vDj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 lowpriorityscore=0 suspectscore=0 spamscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: L2D4VWTGTB5SMIFGIK65E7BHCZFY75LO X-Message-ID-Hash: L2D4VWTGTB5SMIFGIK65E7BHCZFY75LO X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791413887461158500 Content-Type: text/plain; charset="utf-8" Populate the secureBoot firmware feature in domain capabilities for s390x. Signed-off-by: Zhuoying Cai --- docs/formatdomaincaps.rst | 12 ++++++++++++ src/qemu/qemu_capabilities.c | 12 ++++++++++++ tests/domaincapsdata/qemu_11.2.0.s390x.xml | 5 ++++- 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index 7142686a67..f980b8577e 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -240,6 +240,11 @@ for Secure Boot. When ``supported=3D'yes'``, the ```` element may be used in domain XML to supply PEM-format certificates. This capability is only reported for the guest on s390x. =20 +The ``secureBoot`` enum with values ``yes`` and ``no`` under +```` indicates support of Secure Boot on s390x +:since:`(since 12.9.0)`, which can be used to enable Secure Boot for the +s390 CCW firmware without requiring firmware autoselection. + :: =20 @@ -248,6 +253,13 @@ only reported for the guest on s390x. ... ... + + + yes + no + + + ... diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 53d26a8d3d..ef8fffdcc3 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -6613,8 +6613,20 @@ static void virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os, virQEMUCaps *qemuCaps) { + virDomainCapsFirmwareFeatures *firmwareFeatures =3D &os->firmwareFeatu= res; virDomainCapsBootCerts *bootCerts =3D &os->bootCerts; =20 + /* + * No conflict with the secureBoot bits set via qemuFirmwareGetSupport= ed() + * in virQEMUCapsFillDomainOSCaps(): s390-ccw is embedded in QEMU with= no + * external firmware descriptor files, so featureSecureBoot is always 0 + * on s390 and those bits are left unset. + */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) { + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTAT= E_BOOL_YES); + VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot, VIR_TRISTAT= E_BOOL_NO); + } + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS)) bootCerts->supported =3D VIR_TRISTATE_BOOL_YES; else diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml b/tests/domaincapsd= ata/qemu_11.2.0.s390x.xml index 34693bea31..ab915a3607 100644 --- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml +++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml @@ -8,7 +8,10 @@ - + + yes + no + --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791414840; cv=none; d=zohomail.com; s=zohoarc; b=aV78SAMvgHcmVvQ+rfxGDXdigtRfzRKjJNQ5tJldzHCg5pyXBzwxL5HCwbfh7ceoZr5V2F2XiO8wRK/sX+85NOWzct92hngPycnj4sZfWebzd9U8ZdY4Z+ZSvUoUjBM6SIImBqtdyNJyt/Nbk8T0zV+ex7Nv4dbT71AKNjRp+6k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791414840; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=YgGe+n4mSQzrT5dHTwhJZogXNt1Z05mflqXyZZDLo1k=; b=fg2OkVnsb9iaCjyiBuFD2k02hrKz2nGctIabvebQDR5MhbJtX7Q9hscZBEudgWplfBKi+vMP3s4N2Tnd8gPKF5F2QVc6wY/BnD3nQ7P/XyrrkSCz8Nw5KIESTlF7XJxC5fQJSCwAS4aubq0/iKk0AlyWO9tFGu9Gkjy0cGfxTLE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791414840781410.99048427025946; Wed, 7 Oct 2026 16:14:00 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 8F02241957; Wed, 7 Oct 2026 19:13:59 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 60A7741CCC; Wed, 7 Oct 2026 18:56:23 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 572CF419DB; Wed, 7 Oct 2026 18:54:59 -0400 (EDT) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id D1D30418E9 for ; Wed, 7 Oct 2026 18:54:57 -0400 (EDT) Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M6ERv3575694 for ; Wed, 7 Oct 2026 22:54:57 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjw059y-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:57 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWZBJ2522364 for ; Wed, 7 Oct 2026 22:54:56 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h3dhh0n83-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:56 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Mste228574388 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:55 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 384C558056; Wed, 7 Oct 2026 22:54:55 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BCB4858052; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:54 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=YgGe+n4mSQzrT5dHT whJZogXNt1Z05mflqXyZZDLo1k=; b=meA+gq2Dx5s5UpPbeEnEwTmTjN16BSKJ8 scO/HzLg8sXYFHGKHMgX04ZV5wKjD7HfLe50wU/jLpVIHxYe1+RFk/Mpz8ozKQfm pOuDbZHfGcCbQaE6H6CpLrOn+gKB6OOjdPR8V2xtWi0TxxvGZx7hJwk8p/Lv9667 56O8gteeQ6QRvFueGtTOsL1amtbP2cO9vy2Y/pujKQjBN1TfZd/rfyh81y8FTh2G Gbi6Out4v0ufSDj4NyZRmAIV3tPhxEsGKh07PiJEg1t/vQMBo1WBTSc50pOaRu8X fPnIbqWl9TI8ME31oz5l1T9MvbkC0DwzunMgbwlJ9ZSuRSlJugIvA== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 11/14] docs: Document s390x Secure IPL firmware feature Date: Wed, 7 Oct 2026 18:54:42 -0400 Message-ID: <20261007225446.133542-12-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX3qWyNu9RUjwa PfPfRxHMPBF8n8CPs6eB79MIZ+EzxUTzTzPsJPjMiuDNIZ0gO65BUan9pvyVskukfZf36SE3NSU edZ+o8jAf5GFFza/9pvaYO2lBTseknw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX4MXB7hwR5/jH PEaz0vYDKnsei6Z5oT6yXiGmBf+ylx/6uAvY5zig3N++5BzDEuyhov1Hc+aS7uFd/ZphuZV6AOs EENQq21WuBvI4/nfleuZJyYiplj3NMbIA0aC3A8Di3ThxX76WH2SCkLx6x2g2HfapHhp2JyR+lQ ZV5i6NYu+vb2NqGz0Ps5wmyKnbFfvAeHrmXcMNCw+mZkARxP6bXRywJM0tJ3euFlXjQDnDI+gFw a5XjeMTKHD5hGCCOJsTC92O+iUpKpvWTku0AHHxbMmA98QzMbCZejUVK9ehoonitKL/Q42wrVp8 uOvELrCRXdJyc5N+RW5nwcAAdlH6htnqZ0ZNBGPwqNEQ/GavcEz7/yI2J/CyDe23FFSwPeE60Tz AN6f3qr5SbPjHL9VEDxEiN3n2CJAtKI3BHS5YDzHAq7TQRpZpQ/6+w4jUgPXMIi/Sdzk76sBT/u t3KV03HD5t1FceRMUPg== X-Proofpoint-GUID: p3mL0MX5pSs4EfJpuzBlBs0tYbxujTDz X-Proofpoint-ORIG-GUID: p3mL0MX5pSs4EfJpuzBlBs0tYbxujTDz X-Authority-Analysis: v=2.4 cv=XcwcX455 c=1 sm=1 tr=0 ts=6ac6cdc1 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=ID6ng7r3AAAA:8 a=VnNF1IyMAAAA:8 a=E05UCAtFOXMhbN6QD9YA:9 a=AkheI1RvQwOzcTXhi5f4:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 bulkscore=0 adultscore=0 spamscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: YOQNWQ3BUKEK4XX5UD2TKZ46VMKQDGSY X-Message-ID-Hash: YOQNWQ3BUKEK4XX5UD2TKZ46VMKQDGSY X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791414842469158500 Content-Type: text/plain; charset="utf-8" On s390x the secure-boot firmware feature sets the QEMU machine secure-boot property for Secure IPL rather than selecting a firmware build. Update formatdomain.rst accordingly and add a "Secure Boot on s390x" section to kbase/secureboot.rst. Signed-off-by: Zhuoying Cai --- docs/formatdomain.rst | 18 +++++++++--- docs/kbase/secureboot.rst | 60 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+), 4 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 17b8e0431d..856c793917 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -194,10 +194,13 @@ harddisk, cdrom, network) determining where to obtain= /find the boot image. ... =20 - + ... hvm + + + /path/to/cert1.pem /path/to/cert2.pem @@ -258,9 +261,16 @@ harddisk, cdrom, network) determining where to obtain/= find the boot image. - ``enrolled-keys`` whether the selected nvram template has default certificate enrolled. Firmware with Secure Boot feature but with= out enrolled keys will successfully boot non-signed binaries as well. - Valid only for firmwares with Secure Boot feature. - - - ``secure-boot`` whether the firmware implements UEFI Secure boot= feature. + Valid only for firmwares with Secure Boot feature. Not supported= on + ``s390x``. + + - ``secure-boot`` whether the firmware implements Secure Boot. For + UEFI firmware architectures, this selects a firmware build with = UEFI + Secure Boot support. For ``s390x``, this enables or disables the + QEMU machine ``secure-boot`` property for Secure IPL. When enabl= ed, + boot certificates must be configured via ```` and the + s390x CCW firmware operates in secure mode, where verification e= rrors + are reported and causes the boot process to abort. ``loader`` The optional ``loader`` tag refers to a firmware blob, which is specifi= ed by absolute path, used to assist the domain creation process. It is used b= y Xen diff --git a/docs/kbase/secureboot.rst b/docs/kbase/secureboot.rst index b411b65f00..133192dc4d 100644 --- a/docs/kbase/secureboot.rst +++ b/docs/kbase/secureboot.rst @@ -1,3 +1,5 @@ +.. role:: since + =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Secure Boot =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D @@ -162,3 +164,61 @@ your own keys and securely run an operating system tha= t you've built and signed yourself. If you are only planning to run existing, off-the-shelf operating system images, then the two configurations are functionally equivalent. + + +Secure Boot on s390x +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +On s390x, the ``secure-boot`` firmware feature sets the QEMU machine +``secure-boot`` property to enable **Secure IPL** (Initial Program Load) +signature verification in the s390x CCW firmware. This differs from UEFI +architectures where it selects a firmware build: + +- No firmware binary selection, NVRAM, or varstore is involved. +- X.509 PEM certificates are supplied via ````. +- The ``enrolled-keys`` feature is not supported on s390x. + +:since:`Since 12.9.0 (QEMU and s390x only)` + +For more background on the QEMU-level mechanism, refer to the +`QEMU Secure IPL documentation +`__. + + +Using Secure Boot on s390x +-------------------------- + +Set ``secure-boot`` to ``yes`` and provide signing certificates. The +```` element is required when ``secure-boot`` is enabled: + +:: + + + hvm + + + + + /path/to/cert1.pem + /path/to/cert2.pem + + + + +Providing ```` without specifying ``secure-boot``, or with +``secure-boot`` set to ``no``, enables **audit mode**, where all verificat= ions +are performed and any failures are reported as warnings, but the boot proc= ess +continues. Setting ``secure-boot`` to ``yes`` enables **secure mode**, whe= re any +verification failures are reported and cause the boot process to abort. + +You can verify QEMU support beforehand (see `Guest firmware +<../formatdomaincaps.html#guest-firmware>`__ for details on interpreting +the output): + +:: + + $ virsh domcapabilities --arch s390x --machine s390-ccw-virtio --virttyp= e kvm + +The output should show ```` with +``secureBoot`` listing ``yes`` and ``no`` as valid values, +and ````. --=20 2.56.0 From nobody Sat Oct 24 20:20:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1791415379; cv=none; d=zohomail.com; s=zohoarc; b=RmmytD8gg7z8uwSUS0oAT5LmwwvxewZO3HMCDtVoihACsszxT6OlwyCg3Ji1pOvrKBsOAKM9PSxKCryq4hZN5bzMkS7FbHElXNcK5yFCzr2jwLhMHddlzQsyZ/1J9856JZBTBjL0tEC+GEsWvTRHKBY1ZbnT4Ca3yHfdoAxvQqY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791415379; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=4Kzm/HxHJZ38BkYjhRz1FsHPMGNT0p0XFrlX9RxVF5E=; b=fqKUitjDuboy5DJXXT3dz/oPtlHJmjbOyDLG2GYC3Zk0y4wT+w5vdMUw5Kq6b4qHZwFbHBACVNSeU1Ig/pFsEqxj/y666/5ew3DwocDCwvv6fjXq5XibqzcC3AFPQ9zzyHza5EDci06Xch9zgcYMLiB8+LXOdoIXOwpwY9+Nf1A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791415379360425.60752251834583; Wed, 7 Oct 2026 16:22:59 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 3744A3FCE2; Wed, 7 Oct 2026 19:22:58 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id D48CE43F22; Wed, 7 Oct 2026 18:56:56 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 089D14192F; Wed, 7 Oct 2026 18:55:06 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 42B4141937 for ; Wed, 7 Oct 2026 18:55:03 -0400 (EDT) Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 697M5gsA3687214 for ; Wed, 7 Oct 2026 22:54:58 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h5xjv85xc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:58 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 697LWXov2517390 for ; Wed, 7 Oct 2026 22:54:57 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h5a6dmkx4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Oct 2026 22:54:57 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 697Msu2k28181214 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 7 Oct 2026 22:54:56 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D545158056; Wed, 7 Oct 2026 22:54:55 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5E1FF58052; Wed, 7 Oct 2026 22:54:55 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.176.63]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 7 Oct 2026 22:54:55 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=4Kzm/HxHJZ38BkYjh Rz1FsHPMGNT0p0XFrlX9RxVF5E=; b=UqMlAlJj9toTK1f1Utt0Bu1ookngaE3c/ Qwy+bkNKtoz94GxaWzxJkgaL80LQmP7WX/fbVsO99Uypb/95UrR+rbPYG+A94XEv yu3yhXvRBM/n0lRS27SQ+QN9QjGDab+GwzxKhiG2eMXYePgiSOERLKwqSCr9JYsL M3RFH/9df3f5zDK0GcnrsqOnPbPHApI5nYHET28W7ySQf+klJoaLINm7G0vYYhTx I4KHdRqxA2Rt4n4N23zxuzoeugaJbfO/NBYcbekUIpW0vAUsBuTiUwT9iAPz2gOE 9m/tZslJnZkOkMrokcJvvmaF4KIxX55hyFp430n6v7Zv+Xjn0QMmw== From: Zhuoying Cai To: devel@lists.libvirt.org Subject: [PATCH v1 12/14] test: Add tests for secure-boot and boot-certs attributes Date: Wed, 7 Oct 2026 18:54:43 -0400 Message-ID: <20261007225446.133542-13-zycai@linux.ibm.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261007225446.133542-1-zycai@linux.ibm.com> References: <20261007225446.133542-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: lzSpE8V3hUlUrBGi_8xpqgsgnF04fOh7 X-Proofpoint-ORIG-GUID: lzSpE8V3hUlUrBGi_8xpqgsgnF04fOh7 X-Authority-Analysis: v=2.4 cv=H8NOUOYi c=1 sm=1 tr=0 ts=6ac6cdc2 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=LZ7pVzf8LDxy9Gh4QksA:9 a=_8aqHnHB8O65inRT:21 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfXzbzEhRW6e/1w oWXE/T7iqzzLbtw4IyJ9iEp0C9tTmiRcbdZT/tdhq8WhOTpSt4GDx/NbwC4M3s21ffx2IwA9Snf fVUyVnll9+4s3y0GSBFNajjgp5JKoOtsrxES7CB6VDszZH/oAw9YZP5TqsBFu2ygMK/RfFEU3ur lhsrL1lXnh6+tsahLkKohaL0svtB1dPZY8YqeWA0hS7qxltWNNQNwZgmn64DTmyCxbR8qd5t1uo so6DlIOJLo1K8LS8S/YGn0zW3JkrTPQXTdBaV2k5M3h06f8OzEsGsNVot4Z2ATvNJPKFsOVCda/ q4xUBhapJrWNf/0/Vslc8iULIJuLAPX1iWipdq/SNHA02/njPRMKq6L/ymjaAFDYRP+/3SCssaz yWwUb0WJNAi8LY3BJyYGDJckM2ziLmERVcJCA6/h5LcGIrRK+G0E3Lu1On7xwp4v2D1sq1DjZF+ kYP0bKAnXsawltusTKg== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA3MDA5MCBTYWx0ZWRfX8r10PiSH4k4I Kke50I5FVIkx2BMsPm6rPqnBLCvsL1H4Q9WspNSJ33Hor8HhHb0LIF1ou/39BAUzbGlsXDZXMW8 bmMqayg6XdD+lcQR6/miYHXmKBqpQWM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-07_07,2026-10-06_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 adultscore=0 phishscore=0 lowpriorityscore=0 impostorscore=0 clxscore=1015 spamscore=0 priorityscore=1501 malwarescore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610020000 definitions=main-2610070090 Message-ID-Hash: JD2JPPRBDLRM2H2FMMVYYK5QSGBEQ7ER X-Message-ID-Hash: JD2JPPRBDLRM2H2FMMVYYK5QSGBEQ7ER X-MailFrom: zycai@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: fiuczy@linux.ibm.com, shalini@linux.ibm.com, zycai@linux.ibm.com, walling@linux.ibm.com, jrossi@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1791415380890158500 Content-Type: text/plain; charset="utf-8" Add XML configuration tests covering the main s390x Secure IPL scenarios: secure-boot enabled with one or multiple certificates, audit mode (secure-boot disabled but certs provided), and the following expected error cases: - secure-boot enabled without any boot certificates - enrolled-keys used on s390x (unsupported) - boot-certs specified on a non-s390x architecture - secure-boot or boot-certs on QEMU older than 11.2.0 Signed-off-by: Zhuoying Cai --- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 +++++++++++++++++ .../s390-boot-certs-only.s390x-latest.xml | 30 ++++++++++++++++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++++++++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 +++++++++++++++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++++++++++++++++ .../s390-secure-boot-audit-mode.xml | 18 ++++++++++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 +++++++++++++++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 +++++++++++++++++++ .../s390-secure-boot-multi-certs.xml | 19 +++++++++++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++++++++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++++++++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 +++++++++++ .../s390-secure-boot.s390x-11.1.0.err | 1 + .../s390-secure-boot.s390x-latest.args | 32 +++++++++++++++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++++++++++++++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++++++++++ tests/qemuxmlconftest.c | 13 +++++++ 24 files changed, 398 insertions(+) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0= .err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest= .args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest= .xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x= -11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x= -latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x= -latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390= x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390= x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390= x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-1= 1.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-l= atest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64= -latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-ke= ys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-ke= ys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err b/= tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args b= /tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args new file mode 100644 index 0000000000..fb79aafc4a --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=3DC \ +PATH=3D/bin \ +HOME=3D/var/lib/libvirt/qemu/domain--1-guest \ +USER=3Dtest \ +LOGNAME=3Dtest \ +XDG_DATA_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=3Dguest,debug-threads=3Don \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/va= r/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=3Doff,dump-guest-core=3Doff,memory-backend=3D= s390.ram,boot-certs.0.path=3D/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=3D4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":429496729= 6}' \ +-overcommit mem-lock=3Doff \ +-smp 4,sockets=3D4,cores=3D1,threads=3D1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=3Dcharmonitor,fd=3D@mon-fd@,server=3Don,wait=3Doff \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}= ' \ +-rtc base=3Dutc \ +-no-shutdown \ +-boot strict=3Don \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000= "}' \ +-sandbox on,obsolete=3Ddeny,elevateprivileges=3Ddeny,spawn=3Ddeny,resource= control=3Ddeny \ +-msg timestamp=3Don diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml b/= tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml new file mode 100644 index 0000000000..febd55cbc1 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml @@ -0,0 +1,30 @@ + + guest + c7a5fdbd-edaf-9455-926a-d65c16db1809 + 4194304 + 4194304 + 4 + + hvm + + /path/to/cert.pem + + + + + qemu + + + destroy + restart + destroy + + /usr/bin/qemu-system-s390x + +