IPL from virtio-scsi currently uses a non-standard parameter
type definition to pass boot parameters from QEMU to the
BIOS.

There are two potential issues with this approach:
o If the guest operating systems requests a re-ipl of type CCW
  where the boot device is a virtio-scsi HBA, this goes unnoticed
  by QEMU. The BIOS will detect that it's IPLing from a SCSI
  device, but it will boot the first LUN found, which might not
  be the one used for the initial boot.
o The guest operating system can be confused by an unknown
  IPL parameter block type. If the OS hasn't previously used 
  diag308 to store the IPL info but is changed to do so, a
  user-observable change in behavior will happen.

The following patches address the issues above. 

Viktor Mihajlovski (3):
  s390: Refactor IPL parameter block generation
  s390: Ensure IPL from SCSI works as expected
  s390: Do not pass inofficial IPL type to the guest

 hw/s390x/ipl.c             | 112 ++++++++++++++++++++++++++++++++-------------
 pc-bios/s390-ccw/bootmap.c |   7 +++
 pc-bios/s390-ccw/iplb.h    |  15 +++++-
 3 files changed, 100 insertions(+), 34 deletions(-)

-- 
1.9.1

On Thu,  5 Apr 2018 17:07:21 +0200
Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com> wrote:

> IPL from virtio-scsi currently uses a non-standard parameter
> type definition to pass boot parameters from QEMU to the
> BIOS.
> 
> There are two potential issues with this approach:
> o If the guest operating systems requests a re-ipl of type CCW
>   where the boot device is a virtio-scsi HBA, this goes unnoticed
>   by QEMU. The BIOS will detect that it's IPLing from a SCSI
>   device, but it will boot the first LUN found, which might not
>   be the one used for the initial boot.
> o The guest operating system can be confused by an unknown
>   IPL parameter block type. If the OS hasn't previously used 
>   diag308 to store the IPL info but is changed to do so, a
>   user-observable change in behavior will happen.
> 
> The following patches address the issues above. 
> 
> Viktor Mihajlovski (3):
>   s390: Refactor IPL parameter block generation
>   s390: Ensure IPL from SCSI works as expected
>   s390: Do not pass inofficial IPL type to the guest
> 
>  hw/s390x/ipl.c             | 112 ++++++++++++++++++++++++++++++++-------------
>  pc-bios/s390-ccw/bootmap.c |   7 +++
>  pc-bios/s390-ccw/iplb.h    |  15 +++++-
>  3 files changed, 100 insertions(+), 34 deletions(-)
> 

This looks reasonable enough to queue for 2.12 (with a bios rebuild),
especially as I also plan to queue the cpu_synchronize_state() patch.
Just waiting for a R-b on the bios part.

On 04/05/2018 05:07 PM, Viktor Mihajlovski wrote:
> IPL from virtio-scsi currently uses a non-standard parameter
> type definition to pass boot parameters from QEMU to the
> BIOS.
> 
> There are two potential issues with this approach:
> o If the guest operating systems requests a re-ipl of type CCW
>   where the boot device is a virtio-scsi HBA, this goes unnoticed
>   by QEMU. The BIOS will detect that it's IPLing from a SCSI
>   device, but it will boot the first LUN found, which might not
>   be the one used for the initial boot.
> o The guest operating system can be confused by an unknown
>   IPL parameter block type. If the OS hasn't previously used 
>   diag308 to store the IPL info but is changed to do so, a
>   user-observable change in behavior will happen.
> 
> The following patches address the issues above. 
> 
> Viktor Mihajlovski (3):
>   s390: Refactor IPL parameter block generation
>   s390: Ensure IPL from SCSI works as expected
>   s390: Do not pass inofficial IPL type to the guest
> 
>  hw/s390x/ipl.c             | 112 ++++++++++++++++++++++++++++++++-------------
>  pc-bios/s390-ccw/bootmap.c |   7 +++
>  pc-bios/s390-ccw/iplb.h    |  15 +++++-
>  3 files changed, 100 insertions(+), 34 deletions(-)
> 

Test looks good so far.

On Fri, 6 Apr 2018 14:30:45 +0200
Christian Borntraeger <borntraeger@de.ibm.com> wrote:

> On 04/05/2018 05:07 PM, Viktor Mihajlovski wrote:
> > IPL from virtio-scsi currently uses a non-standard parameter
> > type definition to pass boot parameters from QEMU to the
> > BIOS.
> > 
> > There are two potential issues with this approach:
> > o If the guest operating systems requests a re-ipl of type CCW
> >   where the boot device is a virtio-scsi HBA, this goes unnoticed
> >   by QEMU. The BIOS will detect that it's IPLing from a SCSI
> >   device, but it will boot the first LUN found, which might not
> >   be the one used for the initial boot.
> > o The guest operating system can be confused by an unknown
> >   IPL parameter block type. If the OS hasn't previously used 
> >   diag308 to store the IPL info but is changed to do so, a
> >   user-observable change in behavior will happen.
> > 
> > The following patches address the issues above. 
> > 
> > Viktor Mihajlovski (3):
> >   s390: Refactor IPL parameter block generation
> >   s390: Ensure IPL from SCSI works as expected
> >   s390: Do not pass inofficial IPL type to the guest
> > 
> >  hw/s390x/ipl.c             | 112 ++++++++++++++++++++++++++++++++-------------
> >  pc-bios/s390-ccw/bootmap.c |   7 +++
> >  pc-bios/s390-ccw/iplb.h    |  15 +++++-
> >  3 files changed, 100 insertions(+), 34 deletions(-)
> >   
> 
> Test looks good so far.

OK, I'll queue this to s390-fixes, then. I won't send a pull request
before Monday, so there's still a chance to fix this should problems
show up.

Thanks for testing!