Emulate s390x secureboot / sipl in qemu

[Dimitri John Ledkov]

It would be nice if s390x qemu VMs could be "tricked" into booting as if they are sipl booted.

I.e. fake whichever calls needed in the firmware to hint to linux kernel that SIPL is available and was performed.

This would facilitate testing SIPL/lockdown kernel behaviour, versus not. At least for the initial boot.

[Dimitri John Ledkov (xnox)]

It seems like we want something like

# IPL_PL_FLAG_SIPL
bytes[4] |= 0x40
# IPL_PL_FLAG_IPLSR
bytes[4] |= 0x20

to be set by diag308 subcode 6 in the IPL parameter block

[Frank Heimes (fheimes)]

After discussing with IBM I've created the following RFE:
Emulate s390x secureboot / sipl in qemu
https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=138164

[Dimitri John Ledkov (xnox)]

In ppa:xnox/scratch there is qemu that forces "secure" to be 1 always on boot. And kernel locks itself down.

[ 0.068890] Kernel is locked down from Secure IPL; see man kernel_lockdown.7

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2019-12-04 13:54 EDT-------
OK, so we have discussed this internally and we do not see a reason why this would be an issue as we do not have any measurement with TPM and attestation anyway.

Could you maybe send your private patch to the upstream qemu mailing list (qemu-devel and qemu-s390x) to drive the discussion?

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2020-03-17 09:09 EDT-------
@Canonical: Can someone answer the question from comment #4. Many thanks in advance

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-03-19 08:45 EDT-------
Updated RFE with following comment:

This was now translated as a planned Candidate for a future release.
Will be addressed via a feature request by BZ/LP once committed.

[Frank Heimes (fheimes)]

Ok, good that the idea was picked up and is under consideration.
Since you are going to open a new BZ once available, I'm setting this to Opinion/Wishlist for now ...