From nobody Fri Dec 19 15:56:26 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1744129233; cv=none; d=zohomail.com; s=zohoarc; b=AQ85hIcu89aqxqYZwXzKXafPIKtBh3XWBlH99mACbwlISHX6D64odkwPelxxhy+VA7g5XMPdTiOCb9NOHKvKsCunQq/TdjzlXPSE45Kq+kzzi517/pgY5jfQx7PWmpz4vx5DnsZFEss5cLfrhMOYzbHT5NI/1II59thkn7C2vx0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1744129233; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=dbcORQsC9s7zSsT9cLAhUqLVVmz2ZpTnYQ2EPMisjU0=; b=FkwPb8ZJCqXYzaCjEwy2B3ui/J5Gl4CUYGCWdvyvSSNFxA+aaocdXS3gA2vfxyhAZfdhY9+Mb7ZdDFUV7qWbKIxdbMJo9C9URHakd1ITn7VfAAJTRFh9RWISsj9NS7hTH1eteD2KD7X+r9wvhSdHlMjBtmyDU+eZ+MrLeKXJVqA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1744129233208433.5635957480546; Tue, 8 Apr 2025 09:20:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1u2Bds-0006p7-9X; Tue, 08 Apr 2025 12:17:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u2BIs-0005Z4-5a; Tue, 08 Apr 2025 11:55:59 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u2BIp-0005vI-6T; Tue, 08 Apr 2025 11:55:57 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 538E3D2C013944; Tue, 8 Apr 2025 15:55:52 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 45w57prkw7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 08 Apr 2025 15:55:52 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 538DQGA2017826; Tue, 8 Apr 2025 15:55:50 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 45uh2kk5bp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 08 Apr 2025 15:55:50 +0000 Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 538Ftnui32572110 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 8 Apr 2025 15:55:50 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9C33F5803F; Tue, 8 Apr 2025 15:55:49 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3080058054; Tue, 8 Apr 2025 15:55:48 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.125.94]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Tue, 8 Apr 2025 15:55:48 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=dbcORQsC9s7zSsT9c LAhUqLVVmz2ZpTnYQ2EPMisjU0=; b=HUGXT+GRZq5vaQKrZSCwvH3XvCygrbCjt writs/wkV2G6WHRhK7pxhzv8PpR131EnbRLd32LTGSn2anVak35bRHSJbcjWAxUD iJXioetHcA7T63NALVglgcIJB4E65w/gRKPs4/UivRE3DDBxtNh8e7uNyGHGAnMx lHuSkKLBbfWf3asoW24JlH1HQoVy6fTTKPHDjKiNpGT6xpRNYY/RgMr7t3CIaX8M kCUAAwvqmR8XMmbg1XDe7Frs78MHIZUHuZFH0NqVuSTJs73Q6iSsTpLAjmgMTnQd 7n7hFBVboYG8Nn7IpS8WPS4DIAYaNb+VO5l2NKhkc22UxcD8dEDkA== From: Zhuoying Cai To: thuth@redhat.com, richard.henderson@linaro.org, david@redhat.com, pbonzini@redhat.com Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, jrossi@linux.ibm.com, fiuczy@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, iii@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org, zycai@linux.ibm.com Subject: [PATCH v1 12/24] hw/s390x/ipl: Add IPIB flags to IPL Parameter Block Date: Tue, 8 Apr 2025 11:55:14 -0400 Message-ID: <20250408155527.123341-13-zycai@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250408155527.123341-1-zycai@linux.ibm.com> References: <20250408155527.123341-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: cCqaywM2Ue_kdoXHwvnvv7-Jvux69UQ9 X-Proofpoint-GUID: cCqaywM2Ue_kdoXHwvnvv7-Jvux69UQ9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1095,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-04-08_06,2025-04-08_03,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 spamscore=0 suspectscore=0 lowpriorityscore=0 adultscore=0 mlxlogscore=821 priorityscore=1501 malwarescore=0 impostorscore=0 phishscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502280000 definitions=main-2504080107 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Tue, 08 Apr 2025 12:17:33 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1744129235258019100 Content-Type: text/plain; charset="utf-8" Add IPIB flags to IPL Parameter Block to determine if IPL needs to perform securely and if IPL Information Report Block (IIRB) exists. Secure boot in audit mode will perform if certificate(s) exist in the key store. IIRB will exist and results of verification will be stored in IIRB. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 20 ++++++++++++++++++++ include/hw/s390x/ipl/qipl.h | 6 +++++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index b0810c9191..59ec81181d 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -431,6 +431,13 @@ S390IPLCertificateStore *s390_ipl_get_certificate_stor= e(void) return &ipl->cert_store; } =20 +static bool s390_has_certificate(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return ipl->cert_store.count > 0; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -488,6 +495,19 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + /* + * Secure boot in audit mode will perform + * if certificate(s) exist in the key store. + * + * IPL Information Report Block (IIRB) will exist + * for secure boot in audit mode. + * + * Results of secure boot will be stored in IIRB. + */ + if (s390_has_certificate()) { + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; + } + return true; } =20 diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index b8e7d1da71..2355fcecbb 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -23,6 +23,9 @@ #define MAX_CERTIFICATES 64 #define CERT_MAX_SIZE (1024 * 8) =20 +#define DIAG308_IPIB_FLAGS_SIPL 0x40 +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 + /* * The QEMU IPL Parameters will be stored at absolute address * 204 (0xcc) which means it is 32-bit word aligned but not @@ -104,7 +107,8 @@ typedef struct IplBlockQemuScsi IplBlockQemuScsi; union IplParameterBlock { struct { uint32_t len; - uint8_t reserved0[3]; + uint8_t hdr_flags; + uint8_t reserved0[2]; uint8_t version; uint32_t blk0_len; uint8_t pbt; --=20 2.49.0