[PATCH v16 27/33] Add secure-boot to s390-ccw-virtio machine type option
Add secure-boot as a parameter of s390-ccw-virtio machine type option.
The `secure-boot=on|off` parameter is implemented to enable secure IPL.
By default, secure-boot is set to false if not specified in
the command line.
Signed-off-by: Zhuoying Cai
Reviewed-by: Thomas Huth
Reviewed-by: Collin Walling
---
docs/system/s390x/secure-ipl.rst | 22 +-
hw/s390x/s390-virtio-ccw.c | 29 +
include/hw/s390x/s390-virtio-ccw.h | 2 ++
qemu-options.hx| 6 +-
4 files changed, 53 insertions(+), 6 deletions(-)
diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ipl.rst
index cf6ccf5d57..9e3955f8fc 100644
--- a/docs/system/s390x/secure-ipl.rst
+++ b/docs/system/s390x/secure-ipl.rst
@@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension.
qemu-system-s390x -machine
s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem
...
+Enabling Secure IPL
+^^^
+
+Secure IPL is enabled by explicitly setting ``secure-boot=on``; if not
+specified, secure boot is considered off.
+
+.. code-block:: shell
+
+qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on|off
+
IPL Modes
-
Multiple IPL modes are available to differentiate between the various IPL
-configurations. These modes are mutually exclusive and enabled based on the
-``boot-certs`` option on the QEMU command line.
+configurations. These modes are mutually exclusive and enabled based on
specific
+combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU
+command line.
Normal Mode
^^^
-The absence of certificates will attempt to IPL a guest without secure IPL
-operations. No checks are performed, and no warnings/errors are reported.
-This is the default mode.
+The absence of both certificates and the ``secure-boot`` option will attempt to
+IPL a guest without secure IPL operations. No checks are performed, and no
+warnings/errors are reported. This is the default mode, and can be explicitly
+enabled with ``secure-boot=off``.
Configuration:
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index c68a760f75..662fb44e16 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -819,6 +819,27 @@ static void machine_set_boot_certs(Object *obj, Visitor
*v, const char *name,
ms->boot_certs = cert_list;
}
+static inline bool machine_get_secure_boot(Object *obj, Error **errp)
+{
+S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+return ms->secure_boot;
+}
+
+static inline void machine_set_secure_boot(Object *obj, bool value,
+Error **errp)
+{
+S390CcwMachineClass *s390mc = S390_CCW_MACHINE_GET_CLASS(obj);
+S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+if (!s390mc->use_secure) {
+error_setg(errp, "secure-boot is not supported by this machine
version");
+return;
+}
+
+ms->secure_boot = value;
+}
+
/*
* S390x-specific global compatibility properties.
*
@@ -845,6 +866,7 @@ static void ccw_machine_class_init(ObjectClass *oc, const
void *data)
s390mc->max_threads = 1;
s390mc->use_cpi = true;
s390mc->use_certs = true;
+s390mc->use_secure = true;
mc->reset = s390_machine_reset;
mc->block_default_type = IF_VIRTIO;
mc->no_cdrom = 1;
@@ -893,6 +915,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const
void *data)
machine_get_boot_certs, machine_set_boot_certs,
NULL, NULL);
object_class_property_set_description(oc, "boot-certs",
"provide paths to a directory and/or a certificate file for secure
boot");
+
+object_class_property_add_bool(oc, "secure-boot",
+ machine_get_secure_boot,
+ machine_set_secure_boot);
+object_class_property_set_description(oc, "secure-boot",
+"enable/disable secure boot");
}
static inline void s390_machine_initfn(Object *obj)
@@ -981,6 +1009,7 @@ static void ccw_machine_11_0_class_options(MachineClass
*mc)
S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
s390mc->use_certs = false;
+s390mc->use_secure = false;
/*
* Preserve v11.0 and older version behavior:
* keep legacy virtio-pci enabled.
diff --git a/include/hw/s390x/s390-virtio-ccw.h
b/include/hw/s390x/s390-virtio-ccw.h
index d30f1fcc4c..dcac486bc4 100644
--- a/include/hw/s390x/s390-virtio-ccw.h
+++ b/include/hw/s390x/s390-virtio-ccw.h
@@ -29,6 +29,7 @@ struct S390CcwMachineState {
bool aes_key_wrap;
bool dea_key_wrap;
bool pv;
+bool secure_boot;
uint8_t loadparm[8];
uint64_t memory_limit;
uint64_t max_pagesize;
@@ -58,6 +59,7 @@ struct S390CcwMachineClass {
int max_threads;
bool use_cpi;
bool use_certs;
+bool use_secure;
};
#endif
diff --git a/qem
[PATCH v16 27/33] Add secure-boot to s390-ccw-virtio machine type option
Add secure-boot as a parameter of s390-ccw-virtio machine type option.
The `secure-boot=on|off` parameter is implemented to enable secure IPL.
By default, secure-boot is set to false if not specified in
the command line.
Signed-off-by: Zhuoying Cai
Reviewed-by: Thomas Huth
Reviewed-by: Collin Walling
---
docs/system/s390x/secure-ipl.rst | 22 +-
hw/s390x/s390-virtio-ccw.c | 29 +
include/hw/s390x/s390-virtio-ccw.h | 2 ++
qemu-options.hx| 6 +-
4 files changed, 53 insertions(+), 6 deletions(-)
diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ipl.rst
index cf6ccf5d57..9e3955f8fc 100644
--- a/docs/system/s390x/secure-ipl.rst
+++ b/docs/system/s390x/secure-ipl.rst
@@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension.
qemu-system-s390x -machine
s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem
...
+Enabling Secure IPL
+^^^
+
+Secure IPL is enabled by explicitly setting ``secure-boot=on``; if not
+specified, secure boot is considered off.
+
+.. code-block:: shell
+
+qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on|off
+
IPL Modes
-
Multiple IPL modes are available to differentiate between the various IPL
-configurations. These modes are mutually exclusive and enabled based on the
-``boot-certs`` option on the QEMU command line.
+configurations. These modes are mutually exclusive and enabled based on
specific
+combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU
+command line.
Normal Mode
^^^
-The absence of certificates will attempt to IPL a guest without secure IPL
-operations. No checks are performed, and no warnings/errors are reported.
-This is the default mode.
+The absence of both certificates and the ``secure-boot`` option will attempt to
+IPL a guest without secure IPL operations. No checks are performed, and no
+warnings/errors are reported. This is the default mode, and can be explicitly
+enabled with ``secure-boot=off``.
Configuration:
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index c68a760f75..662fb44e16 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -819,6 +819,27 @@ static void machine_set_boot_certs(Object *obj, Visitor
*v, const char *name,
ms->boot_certs = cert_list;
}
+static inline bool machine_get_secure_boot(Object *obj, Error **errp)
+{
+S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+return ms->secure_boot;
+}
+
+static inline void machine_set_secure_boot(Object *obj, bool value,
+Error **errp)
+{
+S390CcwMachineClass *s390mc = S390_CCW_MACHINE_GET_CLASS(obj);
+S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+if (!s390mc->use_secure) {
+error_setg(errp, "secure-boot is not supported by this machine
version");
+return;
+}
+
+ms->secure_boot = value;
+}
+
/*
* S390x-specific global compatibility properties.
*
@@ -845,6 +866,7 @@ static void ccw_machine_class_init(ObjectClass *oc, const
void *data)
s390mc->max_threads = 1;
s390mc->use_cpi = true;
s390mc->use_certs = true;
+s390mc->use_secure = true;
mc->reset = s390_machine_reset;
mc->block_default_type = IF_VIRTIO;
mc->no_cdrom = 1;
@@ -893,6 +915,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const
void *data)
machine_get_boot_certs, machine_set_boot_certs,
NULL, NULL);
object_class_property_set_description(oc, "boot-certs",
"provide paths to a directory and/or a certificate file for secure
boot");
+
+object_class_property_add_bool(oc, "secure-boot",
+ machine_get_secure_boot,
+ machine_set_secure_boot);
+object_class_property_set_description(oc, "secure-boot",
+"enable/disable secure boot");
}
static inline void s390_machine_initfn(Object *obj)
@@ -981,6 +1009,7 @@ static void ccw_machine_11_0_class_options(MachineClass
*mc)
S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
s390mc->use_certs = false;
+s390mc->use_secure = false;
/*
* Preserve v11.0 and older version behavior:
* keep legacy virtio-pci enabled.
diff --git a/include/hw/s390x/s390-virtio-ccw.h
b/include/hw/s390x/s390-virtio-ccw.h
index d30f1fcc4c..dcac486bc4 100644
--- a/include/hw/s390x/s390-virtio-ccw.h
+++ b/include/hw/s390x/s390-virtio-ccw.h
@@ -29,6 +29,7 @@ struct S390CcwMachineState {
bool aes_key_wrap;
bool dea_key_wrap;
bool pv;
+bool secure_boot;
uint8_t loadparm[8];
uint64_t memory_limit;
uint64_t max_pagesize;
@@ -58,6 +59,7 @@ struct S390CcwMachineClass {
int max_threads;
bool use_cpi;
bool use_certs;
+bool use_secure;
};
#endif
diff --git a/qem
