This series adds libvirt support for the s390x Secure IPL interface,
which allows firmware to verify the integrity and authenticity of a
boot image against a set of X.509 certificates before handing control
to the guest OS.
Two new machine properties on s390-ccw-virtio:
boot-certs.N.path=<path> – supply one or more X.509 certificates or
directory
secure-boot=on|off – enable/disable secure boot
On the XML side, a new <boot-certs> element under <os> stores the
certificate paths, while the existing secure-boot firmware feature is
reused to control the corresponding QEMU machine property.
Providing certificates without enabling secure boot is a valid
configuration and places the firmware into audit mode, allowing
verification results to be reported without enforcing them.
Usage example:
<os>
<type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type>
<firmware>
<feature enabled='yes' name='secure-boot'/>
</firmware>
<boot-certs>
<path>/path/to/cert_dir</path>
<path>/path/to/cert1.pem</path>
</boot-certs>
</os>
The series adds:
* XML parsing and formatting for <boot-certs> and secure-boot on s390x
* QEMU capability detection with updated s390x QMP reply fixtures
for QEMU 8.1 through 11.2
* -machine argument generation for boot-certs and secure-boot
* Validation (s390x-only, secure-boot requires certs, QEMU version)
* Domain capabilities reporting in the <os> section
* Documentation and tests
Boris Fiuczynski (1):
test: Add ABI update test for s390x secure-boot
Zhuoying Cai (13):
conf: Add s390x boot-certs XML support
qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine
property
qemu: Add s390x boot-certs support
conf: Add s390x boot-certs domain capabilities reporting
docs: formatdomain: Document boot-certs element
conf: Refactor firmware feature without auto select validation
conf: Allow secure-boot firmware feature on s390x
qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine
property
qemu: Add s390x secure-boot support
qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities
docs: Document s390x Secure IPL firmware feature
test: Add tests for secure-boot and boot-certs attributes
NEWS: Document s390x Secure Boot and boot certificates support
NEWS.rst | 24 +++
docs/formatdomain.rst | 40 +++-
docs/formatdomaincaps.rst | 31 +++
docs/kbase/secureboot.rst | 60 ++++++
src/conf/domain_capabilities.c | 10 +
src/conf/domain_capabilities.h | 6 +
src/conf/domain_conf.c | 77 +++++++-
src/conf/domain_conf.h | 2 +
src/conf/domain_validate.c | 32 +++-
src/conf/schemas/domaincaps.rng | 9 +
src/conf/schemas/domaincommon.rng | 9 +
src/qemu/qemu_capabilities.c | 38 ++++
src/qemu/qemu_capabilities.h | 2 +
src/qemu/qemu_command.c | 16 ++
src/qemu/qemu_validate.c | 29 +++
tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_11.2.0.s390x.xml | 6 +-
tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 +
.../caps_10.0.0_s390x.replies | 145 +++++++++++++-
.../caps_10.1.0_s390x.replies | 150 ++++++++++++++-
.../caps_11.0.0_s390x.replies | 156 ++++++++++++++-
.../caps_11.1.0_s390x.replies | 156 ++++++++++++++-
.../caps_11.2.0_s390x.replies | 181 +++++++++++++++++-
.../caps_11.2.0_s390x.xml | 2 +
.../caps_8.1.0_s390x.replies | 135 ++++++++++++-
.../caps_8.2.0_s390x.replies | 135 ++++++++++++-
.../caps_9.1.0_s390x.replies | 139 +++++++++++++-
.../caps_9.2.0_s390x.replies | 144 +++++++++++++-
.../s390-boot-certs-only.s390x-11.1.0.err | 1 +
.../s390-boot-certs-only.s390x-latest.args | 32 ++++
.../s390-boot-certs-only.s390x-latest.xml | 30 +++
.../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++
...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 +
...0-secure-boot-audit-mode.s390x-latest.args | 32 ++++
...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++
.../s390-secure-boot-audit-mode.xml | 18 ++
...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 +
...-secure-boot-multi-certs.s390x-latest.args | 32 ++++
...0-secure-boot-multi-certs.s390x-latest.xml | 34 ++++
.../s390-secure-boot-multi-certs.xml | 19 ++
...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 +
...s390-secure-boot-no-certs.s390x-latest.err | 1 +
.../s390-secure-boot-no-certs.xml | 15 ++
...90-secure-boot-none-s390.x86_64-latest.err | 1 +
.../s390-secure-boot-none-s390.xml | 15 ++
...e-boot-with-enrolled-keys.s390x-latest.err | 1 +
.../s390-secure-boot-with-enrolled-keys.xml | 19 ++
.../s390-secure-boot.s390x-11.1.0.err | 1 +
...0-secure-boot.s390x-latest.abi-update.args | 32 ++++
...90-secure-boot.s390x-latest.abi-update.xml | 33 ++++
.../s390-secure-boot.s390x-latest.args | 32 ++++
.../s390-secure-boot.s390x-latest.xml | 33 ++++
tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++
tests/qemuxmlconftest.c | 14 ++
60 files changed, 2120 insertions(+), 86 deletions(-)
create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err
create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args
create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml
create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args
create mode 100644
tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml
create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml
--
2.56.0
