On 7/3/26 1:00 PM, Zhuoying Cai wrote: > Create a certificate store for boot certificates used for secure IPL. > > Load certificates from the `boot-certs` parameter of s390-ccw-virtio > machine type option into the cert store. > > Currently, only X.509 certificates in PEM format are supported, as the > QEMU command line accepts certificates in PEM format only. > > The raw Base64 data is stored, as well as the certificate's size. The > binary (DER) size is stored as well, which may later be utilized for > secure boot (signature verification). > > Signed-off-by: Zhuoying Cai <[email protected]> > Reviewed-by: Farhan Ali<[email protected]>
Looks like v14 was coming out as a I commented on v13... Everything still applies here, so will repeat: Reviewed-by: Matthew Rosato <[email protected]> With a few minor things below: > --- > docs/specs/index.rst | 1 + > docs/specs/s390x-secure-ipl.rst | 20 +++ > hw/s390x/cert-store.c | 238 ++++++++++++++++++++++++++++++++ > hw/s390x/cert-store.h | 39 ++++++ > hw/s390x/ipl.c | 10 ++ > hw/s390x/ipl.h | 3 + > hw/s390x/meson.build | 1 + > include/hw/s390x/ipl/qipl.h | 2 + > 8 files changed, 314 insertions(+) > create mode 100644 docs/specs/s390x-secure-ipl.rst > create mode 100644 hw/s390x/cert-store.c > create mode 100644 hw/s390x/cert-store.h > > diff --git a/docs/specs/index.rst b/docs/specs/index.rst > index b7909a108a..76d439782c 100644 > --- a/docs/specs/index.rst > +++ b/docs/specs/index.rst > @@ -40,3 +40,4 @@ guest hardware that is specific to QEMU. > riscv-aia > aspeed-intc > iommu-testdev > + s390x-secure-ipl > diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.rst > new file mode 100644 > index 0000000000..d7c0d4eaac > --- /dev/null > +++ b/docs/specs/s390x-secure-ipl.rst > @@ -0,0 +1,20 @@ > +.. SPDX-License-Identifier: GPL-2.0-or-later > + > +s390 Certificate Store and Functions > +------------------------------------ > + > +s390 Certificate Store > +^^^^^^^^^^^^^^^^^^^^^^ > + > +A certificate store is implemented for s390-ccw guests to retain within > +memory all certificates provided by the user via the command-line, which > +are expected to be stored somewhere on the host's file system. The store > +will keep track of the number of certificates, their respective size, > +and a summation of the sizes. > + > +Each certificate is stroed in an S390IPLCertificate struct, which has a stored ... > +static int update_cert_store(S390IPLCertificateStore *cert_store, > + S390IPLCertificate *cert) > +{ > + size_t data_buf_size; > + size_t keyid_buf_size; > + size_t hash_buf_size; > + size_t cert_buf_size; > + > + /* length field is word aligned for later DIAG use */ > + keyid_buf_size = ROUND_UP(CERT_KEY_ID_LEN, 4); > + hash_buf_size = ROUND_UP(CERT_HASH_LEN, 4); > + cert_buf_size = ROUND_UP(cert->der_size, 4); > + data_buf_size = keyid_buf_size + hash_buf_size + cert_buf_size; > + > + if (cert_store->largest_cert_size < data_buf_size) { > + cert_store->largest_cert_size = data_buf_size; > + } > + > + if (cert_store->count >= MAX_CERTIFICATES) { > + error_report("Cert store is full"); > + return -1; > + } > + Seems we should check this first before updating largest_cert_size? I think ultimately it will not matter because we will exit anyway, but for debug may be useful to not have the largest_cert_size potentially clobbered by a cert that was never added.
