Add secure-boot to s390-ccw-virtio machine type option
Add secure-boot as a parameter of s390-ccw-virtio machine type option. The `secure-boot=on|off` parameter is implemented to enable secure IPL. By default, secure-boot is set to false if not specified in the command line. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-28-zycai@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>
Zhuoying Cai committed
Jul 30, 2026 at 17:46 UTC
d3f59e1f8f2e6abab0b4605fbcea78b6ebc4ff40
4 files changed
+53
-6
docs/system/s390x/secure-ipl.rst
+17
-5
@@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension.
19
20
qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ...
21
22
+Enabling Secure IPL
23
+^^^^^^^^^^^^^^^^^^^
24
+
25
+Secure IPL is enabled by explicitly setting ``secure-boot=on``; if not
26
+specified, secure boot is considered off.
27
+
28
+.. code-block:: shell
29
+
30
+ qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on|off
31
+
32
33
IPL Modes
34
---------
35
36
Multiple IPL modes are available to differentiate between the various IPL
27
-configurations. These modes are mutually exclusive and enabled based on the
28
-``boot-certs`` option on the QEMU command line.
37
+configurations. These modes are mutually exclusive and enabled based on specific
38
+combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU
39
+command line.
40
41
Normal Mode
42
^^^^^^^^^^^
43
33
-The absence of certificates will attempt to IPL a guest without secure IPL
34
-operations. No checks are performed, and no warnings/errors are reported.
35
-This is the default mode.
44
+The absence of both certificates and the ``secure-boot`` option will attempt to
45
+IPL a guest without secure IPL operations. No checks are performed, and no
46
+warnings/errors are reported. This is the default mode, and can be explicitly
47
+enabled with ``secure-boot=off``.
48
49
Configuration:
50
hw/s390x/s390-virtio-ccw.c
+29
@@ -817,6 +817,27 @@ static void machine_set_boot_certs(Object *obj, Visitor *v, const char *name,
817
ms->boot_certs = cert_list;
818
}
819
820
+static inline bool machine_get_secure_boot(Object *obj, Error **errp)
821
+{
822
+ S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
823
+
824
+ return ms->secure_boot;
825
+}
826
+
827
+static inline void machine_set_secure_boot(Object *obj, bool value,
828
+ Error **errp)
829
+{
830
+ S390CcwMachineClass *s390mc = S390_CCW_MACHINE_GET_CLASS(obj);
831
+ S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
832
+
833
+ if (!s390mc->use_secure) {
834
+ error_setg(errp, "secure-boot is not supported by this machine version");
835
+ return;
836
+ }
837
+
838
+ ms->secure_boot = value;
839
+}
840
+
841
/*
842
* S390x-specific global compatibility properties.
843
*
@@ -843,6 +864,7 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data)
864
s390mc->max_threads = 1;
865
s390mc->use_cpi = true;
866
s390mc->use_certs = true;
867
+ s390mc->use_secure = true;
868
mc->reset = s390_machine_reset;
869
mc->block_default_type = IF_VIRTIO;
870
mc->no_cdrom = 1;
@@ -891,6 +913,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data)
913
machine_get_boot_certs, machine_set_boot_certs, NULL, NULL);
914
object_class_property_set_description(oc, "boot-certs",
915
"provide paths to a directory and/or a certificate file for secure boot");
916
+
917
+ object_class_property_add_bool(oc, "secure-boot",
918
+ machine_get_secure_boot,
919
+ machine_set_secure_boot);
920
+ object_class_property_set_description(oc, "secure-boot",
921
+ "enable/disable secure boot");
922
}
923
924
static inline void s390_machine_initfn(Object *obj)
@@ -979,6 +1007,7 @@ static void ccw_machine_11_1_class_options(MachineClass *mc)
1007
S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
1008
1009
s390mc->use_certs = false;
1010
+ s390mc->use_secure = false;
1011
1012
ccw_machine_11_2_class_options(mc);
1013
compat_props_add(mc->compat_props, hw_compat_11_1, hw_compat_11_1_len);
include/hw/s390x/s390-virtio-ccw.h
+2
@@ -29,6 +29,7 @@ struct S390CcwMachineState {
29
bool aes_key_wrap;
30
bool dea_key_wrap;
31
bool pv;
32
+ bool secure_boot;
33
uint8_t loadparm[8];
34
uint64_t memory_limit;
35
uint64_t max_pagesize;
@@ -58,6 +59,7 @@ struct S390CcwMachineClass {
59
int max_threads;
60
bool use_cpi;
61
bool use_certs;
62
+ bool use_secure;
63
};
64
65
#endif
qemu-options.hx
+5
-1
@@ -47,7 +47,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
47
" cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]\n"
48
" sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid\n"
49
" smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n"
50
- " boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file provides paths to a directory and/or a certificate file\n",
50
+ " boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file provides paths to a directory and/or a certificate file\n"
51
+ " secure-boot=on|off enable/disable secure boot (default=off)\n",
52
QEMU_ARCH_ALL)
53
SRST
54
``-machine [type=]name[,prop=value[,...]]``
@@ -218,6 +219,9 @@ SRST
219
220
``boot-certs.0.path=/path/directory,boot-certs.1.path=/path/file``
221
Provide paths to a directory and/or a certificate file on the host [s390x only].
222
+
223
+ ``secure-boot=on|off``
224
+ Enables or disables secure boot on s390-ccw guest. The default is off.
225
ERST
226
227
DEF("M", HAS_ARG, QEMU_OPTION_M,