Populate the secureBoot firmware feature in domain capabilities for s390x.
Signed-off-by: Zhuoying Cai <[email protected]>
---
docs/formatdomaincaps.rst | 12 ++++++++++++
src/qemu/qemu_capabilities.c | 12 ++++++++++++
tests/domaincapsdata/qemu_11.2.0.s390x.xml | 5 ++++-
3 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
index 7142686a67..f980b8577e 100644
--- a/docs/formatdomaincaps.rst
+++ b/docs/formatdomaincaps.rst
@@ -240,6 +240,11 @@ for Secure Boot. When ``supported='yes'``, the
``<boot-certs>`` element may
be used in domain XML to supply PEM-format certificates. This capability is
only reported for the guest on s390x.
+The ``secureBoot`` enum with values ``yes`` and ``no`` under
+``<firmwareFeatures/>`` indicates support of Secure Boot on s390x
+:since:`(since 12.9.0)`, which can be used to enable Secure Boot for the
+s390 CCW firmware without requiring firmware autoselection.
+
::
<domainCapabilities>
@@ -248,6 +253,13 @@ only reported for the guest on s390x.
...
<os supported='yes'>
...
+ <firmwareFeatures supported='yes'>
+ <enum name='secureBoot'>
+ <value>yes</value>
+ <value>no</value>
+ </enum>
+ <enum name='enrolledKeys'/>
+ </firmwareFeatures>
<bootCerts supported='yes'/>
</os>
...
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index 53d26a8d3d..ef8fffdcc3 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -6613,8 +6613,20 @@ static void
virQEMUCapsFillDomainOSS390Caps(virDomainCapsOS *os,
virQEMUCaps *qemuCaps)
{
+ virDomainCapsFirmwareFeatures *firmwareFeatures = &os->firmwareFeatures;
virDomainCapsBootCerts *bootCerts = &os->bootCerts;
+ /*
+ * No conflict with the secureBoot bits set via qemuFirmwareGetSupported()
+ * in virQEMUCapsFillDomainOSCaps(): s390-ccw is embedded in QEMU with no
+ * external firmware descriptor files, so featureSecureBoot is always 0
+ * on s390 and those bits are left unset.
+ */
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_SECURE_BOOT)) {
+ VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot,
VIR_TRISTATE_BOOL_YES);
+ VIR_DOMAIN_CAPS_ENUM_SET(firmwareFeatures->secureBoot,
VIR_TRISTATE_BOOL_NO);
+ }
+
if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_S390_BOOT_CERTS))
bootCerts->supported = VIR_TRISTATE_BOOL_YES;
else
diff --git a/tests/domaincapsdata/qemu_11.2.0.s390x.xml
b/tests/domaincapsdata/qemu_11.2.0.s390x.xml
index 34693bea31..ab915a3607 100644
--- a/tests/domaincapsdata/qemu_11.2.0.s390x.xml
+++ b/tests/domaincapsdata/qemu_11.2.0.s390x.xml
@@ -8,7 +8,10 @@
<os supported='yes'>
<enum name='firmware'/>
<firmwareFeatures supported='yes'>
- <enum name='secureBoot'/>
+ <enum name='secureBoot'>
+ <value>yes</value>
+ <value>no</value>
+ </enum>
<enum name='enrolledKeys'/>
</firmwareFeatures>
<loader supported='yes'>
--
2.56.0
