On 7/1/26 4:49 PM, Zhuoying Cai wrote: > Add documentation for secure IPL > > Signed-off-by: Collin Walling <[email protected]> > Signed-off-by: Zhuoying Cai <[email protected]> > Reviewed-by: Joshua Daley <[email protected]> > ---
... > +Constraints > +----------- > + > +The following constraints apply when attempting to boot an s390x guest in > secure > +mode: > + > +- z16 or "qemu" CPU model > +- certificates must be in X.509 PEM format > +- only support for SCSI scheme of virtio-blk/virtio-scsi devices > +- a boot device must be specified > +- any unsupported devices (e.g., ECKD and VFIO) or non-eligible devices > (e.g., > + network) will cause the entire boot process terminating early with an error to terminate early, with an... > + logged to the console. > + > + > +Secure IPL Quickstart > +--------------------- > + > +Build QEMU with gnutls enabled > +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > + > +.. code-block:: shell > + > + ./configure … --enable-gnutls > + > +Generate certificate (e.g. via certtool) > +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > + > +A private key is required before generating a certificate. This key must be > kept > +secure and confidential. > + > +Use an RSA private key for signing. > + > +.. code-block:: shell > + > + certtool --generate-privkey > key.pem > + > +A self-signed certificate requires the organization name. Use the > ``cert.info`` > +template to pre-fill values and avoid interactive prompts from certtool. > + > +.. code-block:: shell > + > + cat > cert.info <<EOF > + cn = "My Name" > + expiration_days = 36500 Maybe the example should be more realistic, like 365 days? With those changes (reminder, check for 80 columns): Reviewed-by: Matthew Rosato <[email protected]>
