Add secure-boot as a parameter of s390-ccw-virtio machine type option. The `secure-boot=on|off` parameter is implemented to enable secure IPL.
By default, secure-boot is set to false if not specified in the command line. Signed-off-by: Zhuoying Cai <[email protected]> Reviewed-by: Thomas Huth <[email protected]> Reviewed-by: Collin Walling <[email protected]> --- docs/system/s390x/secure-ipl.rst | 22 +++++++++++++++++----- hw/s390x/s390-virtio-ccw.c | 29 +++++++++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 2 ++ qemu-options.hx | 6 +++++- 4 files changed, 53 insertions(+), 6 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ipl.rst index cf6ccf5d57..9e3955f8fc 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension. qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ... +Enabling Secure IPL +^^^^^^^^^^^^^^^^^^^ + +Secure IPL is enabled by explicitly setting ``secure-boot=on``; if not +specified, secure boot is considered off. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on|off + IPL Modes --------- Multiple IPL modes are available to differentiate between the various IPL -configurations. These modes are mutually exclusive and enabled based on the -``boot-certs`` option on the QEMU command line. +configurations. These modes are mutually exclusive and enabled based on specific +combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU +command line. Normal Mode ^^^^^^^^^^^ -The absence of certificates will attempt to IPL a guest without secure IPL -operations. No checks are performed, and no warnings/errors are reported. -This is the default mode. +The absence of both certificates and the ``secure-boot`` option will attempt to +IPL a guest without secure IPL operations. No checks are performed, and no +warnings/errors are reported. This is the default mode, and can be explicitly +enabled with ``secure-boot=off``. Configuration: diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index c68a760f75..662fb44e16 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -819,6 +819,27 @@ static void machine_set_boot_certs(Object *obj, Visitor *v, const char *name, ms->boot_certs = cert_list; } +static inline bool machine_get_secure_boot(Object *obj, Error **errp) +{ + S390CcwMachineState *ms = S390_CCW_MACHINE(obj); + + return ms->secure_boot; +} + +static inline void machine_set_secure_boot(Object *obj, bool value, + Error **errp) +{ + S390CcwMachineClass *s390mc = S390_CCW_MACHINE_GET_CLASS(obj); + S390CcwMachineState *ms = S390_CCW_MACHINE(obj); + + if (!s390mc->use_secure) { + error_setg(errp, "secure-boot is not supported by this machine version"); + return; + } + + ms->secure_boot = value; +} + /* * S390x-specific global compatibility properties. * @@ -845,6 +866,7 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data) s390mc->max_threads = 1; s390mc->use_cpi = true; s390mc->use_certs = true; + s390mc->use_secure = true; mc->reset = s390_machine_reset; mc->block_default_type = IF_VIRTIO; mc->no_cdrom = 1; @@ -893,6 +915,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data) machine_get_boot_certs, machine_set_boot_certs, NULL, NULL); object_class_property_set_description(oc, "boot-certs", "provide paths to a directory and/or a certificate file for secure boot"); + + object_class_property_add_bool(oc, "secure-boot", + machine_get_secure_boot, + machine_set_secure_boot); + object_class_property_set_description(oc, "secure-boot", + "enable/disable secure boot"); } static inline void s390_machine_initfn(Object *obj) @@ -981,6 +1009,7 @@ static void ccw_machine_11_0_class_options(MachineClass *mc) S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc); s390mc->use_certs = false; + s390mc->use_secure = false; /* * Preserve v11.0 and older version behavior: * keep legacy virtio-pci enabled. diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h index d30f1fcc4c..dcac486bc4 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -29,6 +29,7 @@ struct S390CcwMachineState { bool aes_key_wrap; bool dea_key_wrap; bool pv; + bool secure_boot; uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; @@ -58,6 +59,7 @@ struct S390CcwMachineClass { int max_threads; bool use_cpi; bool use_certs; + bool use_secure; }; #endif diff --git a/qemu-options.hx b/qemu-options.hx index 83915bd7ef..f6eee518cf 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -47,7 +47,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]\n" " sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid\n" " smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n" - " boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file provides paths to a directory and/or a certificate file\n", + " boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file provides paths to a directory and/or a certificate file\n" + " secure-boot=on|off enable/disable secure boot (default=off)\n", QEMU_ARCH_ALL) SRST ``-machine [type=]name[,prop=value[,...]]`` @@ -218,6 +219,9 @@ SRST ``boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file`` Provide paths to a directory and/or a certificate file on the host [s390x only]. + + ``secure-boot=on|off`` + Enables or disables secure boot on s390-ccw guest. The default is off. ERST DEF("M", HAS_ARG, QEMU_OPTION_M, -- 2.54.0
