From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553472; cv=none; d=zohomail.com; s=zohoarc; b=c+t5rSKdvoRSAp2G+V2QSvA/8azvFaQfoBzuD/jBqtVDfUvfCBDfsFGQu0QK86d6jOZ+YASImtgyAfnjIjtr0hgUwOPO8y7ATPuXg02fw+xDqP0ijKEBLLwiPQSO+cGbXsvuuROWOUtM5M8mnaX3ed93rimUY8TgI/Wi/8hayqw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553472; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7apvQ9A/kJ8ERMN9sazt0thpVm2noENtPYQXJDPP/6w=; b=IRJT5gI43Wn0FCkL+oBXAS0VJJXXS/LDUU4eZ1iHmbDUis9v+shqX96OTj+m7TcEak+YlBwiS4uT5TlTbwUW8Wy4la+h9uoiziN/qoCs7cfgucEqPnwuDe5xUeGe/cVLeUGLv2frUCkHPXeCqWdtxGz5jMgiHDJueV4wmYnnZ70= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553472452866.3180996968792; Mon, 18 Aug 2025 14:44:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7di-0001ch-TF; Mon, 18 Aug 2025 17:43:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7df-0001bY-97; Mon, 18 Aug 2025 17:43:35 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dd-0003jX-6V; Mon, 18 Aug 2025 17:43:35 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ICNIX6002290; Mon, 18 Aug 2025 21:43:29 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jge3uces-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:28 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJs2f0002762; Mon, 18 Aug 2025 21:43:28 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cv9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:28 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhPRK27722262 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:26 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE7E658058; Mon, 18 Aug 2025 21:43:25 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B42D958057; Mon, 18 Aug 2025 21:43:24 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:24 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=7apvQ9A/kJ8ERMN9s azt0thpVm2noENtPYQXJDPP/6w=; b=IkNdieHcl8UMGxrmCYu1+jV2QNmR9ljdv 1yU5sEkPo2QBgaslUhqyR+X28apOK9yli6VuKusxTFgygnf9lx+qMLIRNv8Ipx7Q IlPNedbMZfhUXDckscpRELVB6fMGckIohM8fmOeDp8MHKNs0K6pLcHRJ3FaMlS4y Ti/+2IM+pjj/a3xZvJs6Ig4Z4gTd4MRATQnbk5/ZFwHmL2AZQskDSEyPI/9YNRsi J/avhYUN1PEsKJQ8yUJ0PhIjcEdY6np86rDEw4gx0QO8OG/OS1V6Af9u1VNlEkVx hU8O4/llvWg2PsnkBiqZwQqx2kTzbCiUMiov4VQDKUhc48/OeTNGg== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 01/29] Add boot-certs to s390-ccw-virtio machine type option Date: Mon, 18 Aug 2025 17:42:54 -0400 Message-ID: <20250818214323.529501-2-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=FcM3xI+6 c=1 sm=1 tr=0 ts=68a39e81 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=51CbwtZII9I6y_JNZ0sA:9 X-Proofpoint-GUID: QY2j_QagQ5pEoA6AvBvmXFj_CNw2-zoT X-Proofpoint-ORIG-GUID: QY2j_QagQ5pEoA6AvBvmXFj_CNw2-zoT X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAxMSBTYWx0ZWRfXwYnvvY0iu5X/ QBxPPWaz8auK2hYRoGrw87SOlKMYiepMgeVd+t3kZiZKYC0INvhIWNu57dbKE9i+qCfurdGfG7K LRQKt9+dW46RrmCYUvw9DaIAp4uAgiGd+YJPqQxVyGDAHJBm1gyQeSGNM2aHWrZCGTDmrMfPI1F to6hd/va5kxfEXIM1mMc86q2mYW52Clb6Tjt/B2+gCtgVSa+v4MS0/qB1jdv2tEiW6Qm41F/CPE 8rfJWPMrc5npY/PP974mv+5hzzM37hpO9yAA0MWs2mzG4JinGrq+7ywLrytk9iJmP139AfCnQ2e Mt6of1Es43PwD5/frOrRdlXmPSpT2BxfdgLIk3tdwIqQtimHaxwqF5X+pJ0ESENwaEpVdguqFSu 8/cVdxhY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 adultscore=0 phishscore=0 clxscore=1011 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160011 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553474732124100 Content-Type: text/plain; charset="utf-8" Introduce a new `boot-certs` machine type option for the s390-ccw-virtio machine. This allows users to specify one or more certificate file paths or directories to be used during secure boot. Each entry is specified using the syntax: boot-certs..path=3D/path/to/cert.pem Multiple paths can be specify using array properties: boot-certs.0.path=3D/path/to/cert.pem, boot-certs.1.path=3D/path/to/cert-dir, boot-certs.2.path=3D/path/to/another-dir... Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 20 ++++++++++++++++++++ hw/s390x/s390-virtio-ccw.c | 30 ++++++++++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 2 ++ qapi/machine-s390x.json | 24 ++++++++++++++++++++++++ qemu-options.hx | 6 +++++- 5 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 docs/system/s390x/secure-ipl.rst diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst new file mode 100644 index 0000000000..9b3fd25cc4 --- /dev/null +++ b/docs/system/s390x/secure-ipl.rst @@ -0,0 +1,20 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +Secure IPL Command Line Options +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D + +New parameters have been introduced to s390-ccw-virtio machine type option +to support secure IPL. These parameters allow users to provide certificates +and enable secure IPL directly via the command line. + +Providing Certificates +---------------------- + +The certificate store can be populated by supplying a list of certificate = file +paths or directories on the command-line: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio, \ + boot-certs.0.path=3D/.../qemu/certs, \ + boot-certs.1.path=3D/another/path/cert.pem = ... diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index c294106a74..9ac425c695 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -45,6 +45,7 @@ #include "target/s390x/kvm/pv.h" #include "migration/blocker.h" #include "qapi/visitor.h" +#include "qapi/qapi-visit-machine-s390x.h" #include "hw/s390x/cpu-topology.h" #include "kvm/kvm_s390x.h" #include "hw/virtio/virtio-md-pci.h" @@ -798,6 +799,30 @@ static void machine_set_loadparm(Object *obj, Visitor = *v, g_free(val); } =20 +static void machine_get_boot_certs(Object *obj, Visitor *v, + const char *name, void *opaque, + Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertPathList **certs =3D &ms->boot_certs; + + visit_type_BootCertPathList(v, name, certs, errp); +} + +static void machine_set_boot_certs(Object *obj, Visitor *v, const char *na= me, + void *opaque, Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertPathList *cert_list =3D NULL; + + visit_type_BootCertPathList(v, name, &cert_list, errp); + if (!cert_list) { + return; + } + + ms->boot_certs =3D cert_list; +} + static void ccw_machine_class_init(ObjectClass *oc, const void *data) { MachineClass *mc =3D MACHINE_CLASS(oc); @@ -851,6 +876,11 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars conve= rted" " to upper case) to pass to machine loader, boot manager," " and guest kernel"); + + object_class_property_add(oc, "boot-certs", "BootCertPath", + machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); + object_class_property_set_description(oc, "boot-certs", + "provide paths to a directory and/or a certificate file for se= cure boot"); } =20 static inline void s390_machine_initfn(Object *obj) diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index 526078a4e2..b90949355c 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -14,6 +14,7 @@ #include "hw/boards.h" #include "qom/object.h" #include "hw/s390x/sclp.h" +#include "qapi/qapi-types-machine-s390x.h" =20 #define TYPE_S390_CCW_MACHINE "s390-ccw-machine" =20 @@ -31,6 +32,7 @@ struct S390CcwMachineState { uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; + BootCertPathList *boot_certs; =20 SCLPDevice *sclp; }; diff --git a/qapi/machine-s390x.json b/qapi/machine-s390x.json index 966dbd61d2..3e89ef8320 100644 --- a/qapi/machine-s390x.json +++ b/qapi/machine-s390x.json @@ -119,3 +119,27 @@ { 'command': 'query-s390x-cpu-polarization', 'returns': 'CpuPolarizationIn= fo', 'features': [ 'unstable' ] } + +## +# @BootCertPath: +# +# Boot certificate path. +# +# @path: path of certificate(s) +# +# Since: 10.1 +## +{ 'struct': 'BootCertPath', + 'data': {'path': 'str'} } + +## +# @BootCerts: +# +# List of boot certificate paths. +# +# @boot-certs: List of BootCertPath +# +# Since: 10.1 +## +{ 'struct': 'BootCerts', + 'data': {'boot-certs': ['BootCertPath'] } } diff --git a/qemu-options.hx b/qemu-options.hx index ab23f14d21..ac497eb3a0 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -44,7 +44,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ #endif " memory-backend=3D'backend-id' specifies explicitly pr= ovided backend for main RAM (default=3Dnone)\n" " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" - " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n", + " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -205,6 +206,9 @@ SRST :: =20 -machine smp-cache.0.cache=3Dl1d,smp-cache.0.topology=3Dcore,s= mp-cache.1.cache=3Dl1i,smp-cache.1.topology=3Dcore + + ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` + Provide paths to a directory and/or a certificate file on the host= [s390x only]. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553472; cv=none; d=zohomail.com; s=zohoarc; b=ZQ2IKAADkjt1gtJkCJeXM1AjaBj3jq9IO4h8taBHTH2BjFRRBWAfBKXtm3JgQnoCPjocmy61Q3xV0WFiio99vgP33JTonGj/AqYnBDL4PMoRJJcl/fVQm8eBhqwrQdHerCIFaeJ6IYxQE8jLitpSG95PvyDSZ0KMoN5wy32Kkgs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553472; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9ew3Jc5y+V+2UAkyHlG8hfSEjxHxlN9XFba8BovmwUU=; b=gl8TpQRQ6LkHl3MUIKqAxDnaK8R0eSonqbrrt4TJvFlbFnsXEqpjJw2ZIBF4teART+ZeR2AMXxED1T/duwplrvNzy9RaRfL/BUmjRbECLjMLvBuCfus7D1525H+Be4kUA2W7EN9OSVB+QZwRFSXnWS//Jcmq516STEnAvC2VDqY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553472255592.9840579540795; Mon, 18 Aug 2025 14:44:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7dk-0001dG-3C; Mon, 18 Aug 2025 17:43:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7df-0001bV-1j; Mon, 18 Aug 2025 17:43:35 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dd-0003jR-4Y; Mon, 18 Aug 2025 17:43:34 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IFaoKr030623; Mon, 18 Aug 2025 21:43:30 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jfdrujhu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:29 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IK0KlK003199; Mon, 18 Aug 2025 21:43:29 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cvb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:29 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhRFK31392054 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:27 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 138D158058; Mon, 18 Aug 2025 21:43:27 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EFFFE58057; Mon, 18 Aug 2025 21:43:25 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:25 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9ew3Jc5y+V+2UAkyH lG8hfSEjxHxlN9XFba8BovmwUU=; b=maAn7OS64fbmATL9Fh4aQ2GMW7dH0P4O0 7Aly0NrUBxasM5wKuLYu96GIwT8Lmj3ULeThnguVLl8AXBG0wY3Wg1S40hVAeuOn 8Bkz7pmhoF7qDVpSmg5TRF9mNaRSMfSOMPquuSPsYqk7ipbR1y74t8yoj1GSvtIX 6yCNNKymblrRM1qJESFKfgCuUfI38EjxS+xxwXzQDl0qfBB/bKE64lcocL2tEcqQ Rc8OsEVw8Co2JXhweai9H/1PC5Ijy5YWHEOUeLkkkCiGxhh5u3PTimU3yZW6Fath PXe8Y/W2kuTkv3KgJylMLZ0GjDDyfDqQVe82hJaZ2HAiTpGJC27ew== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 02/29] crypto/x509-utils: Refactor with GNUTLS fallback Date: Mon, 18 Aug 2025 17:42:55 -0400 Message-ID: <20250818214323.529501-3-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: gJge_D62jom_x8eEkfDxm0zpCpvH64dD X-Proofpoint-GUID: gJge_D62jom_x8eEkfDxm0zpCpvH64dD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAwMSBTYWx0ZWRfX8mLryBa7IlGW A2ygN8H15xBlofUEZryr0066t5s361ulaFwqiAHFNJX3VkU9TThrSUzXvtWHxhedNFARl0DK8St I3mabQEjJJWEBQRuzaAs6R9syZxse7GcXl4FQ3FDX0iisu0pjFdfLdzZteYGd0Cpwxc4JCDOupJ PPxnqOwO0Icu6v/xgcc+991JcRPo3+cJ+1njHD7PJBF969Bd6x8lVdLkZnIiPfv9Vo+KY22S7K/ K39oNPmYodOBcTiHGHeQnRCLv0QeL9B/ef7QQ64aAUToWJ3IAwMbrlosJzVuVN6h32FDWAmJC2l QZb57DW0Gd7HbwcZqlaEquU1AesfsWu6IFVjvTV1JXJYHncKVW8Y1Yg8AvTHgHh89Ibaws8FXWk 4h02YnMc X-Authority-Analysis: v=2.4 cv=GotC+l1C c=1 sm=1 tr=0 ts=68a39e82 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=T_s58H7i8r0Cr3xvmrYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160001 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553474047116600 Content-Type: text/plain; charset="utf-8" Always compile x509-utils.c and add a fallback when GNUTLS is unavailable. Signed-off-by: Zhuoying Cai --- crypto/meson.build | 5 +---- crypto/x509-utils.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/crypto/meson.build b/crypto/meson.build index 735635de1f..0614bfa914 100644 --- a/crypto/meson.build +++ b/crypto/meson.build @@ -22,12 +22,9 @@ crypto_ss.add(files( 'tlscredsx509.c', 'tlssession.c', 'rsakey.c', + 'x509-utils.c', )) =20 -if gnutls.found() - crypto_ss.add(files('x509-utils.c')) -endif - if nettle.found() crypto_ss.add(nettle, files('hash-nettle.c', 'hmac-nettle.c', 'pbkdf-net= tle.c')) if hogweed.found() diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 39bb6d4d8c..6176a88653 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -11,6 +11,8 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "crypto/x509-utils.h" + +#ifdef CONFIG_GNUTLS #include #include #include @@ -78,3 +80,17 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, gnutls_x509_crt_deinit(crt); return ret; } + +#else /* ! CONFIG_GNUTLS */ + +int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, + QCryptoHashAlgo hash, + uint8_t *result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get fingerprint"); + return -1; +} + +#endif /* ! CONFIG_GNUTLS */ --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553576; cv=none; d=zohomail.com; s=zohoarc; b=FgxFProPiv/HUof+jwtTHAhvBM2fM6QXMDLXnqLgFfN7p2WWnexyPMTOfD8NiZVgg+mn1NrbiYQoLLaAQrW3/pyJJmgs85LCZq7cK8ztM0s5X6NaVUJhJgb0qiItDa7peH/d/M43GKWMSULA7JhrxueM02XxnduRhkuVGF92shg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553576; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Tc6gtpCISL/AyOlr9M1U/DjVwlLpl3G1fQU1fpsiGVs=; b=giUuhcvrse7O7Vs2gj34iBD+jZSOWA3kPbRCMGXC2W/CznqTyUcC8JcrDsTkGmK3Gb4wyU8X+al91UVzY66KKgj1KASHbaFv+3h34AZQ1VddBECf0M9jLOTnuv4mdg8VAjiIbv+an3yhQFUzP19bdXiz8FFhGPq95sbv16cBdbk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553576596471.266809082043; Mon, 18 Aug 2025 14:46:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7dn-0001f0-10; Mon, 18 Aug 2025 17:43:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dg-0001c1-Dg; Mon, 18 Aug 2025 17:43:36 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dd-0003jd-LY; Mon, 18 Aug 2025 17:43:36 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IBk1wA006715; Mon, 18 Aug 2025 21:43:31 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhny3gea-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:31 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHC6Dq010675; Mon, 18 Aug 2025 21:43:30 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k4au7r84-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:30 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhSMa6357672 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:28 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 37C5F58058; Mon, 18 Aug 2025 21:43:28 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2379A58057; Mon, 18 Aug 2025 21:43:27 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:27 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Tc6gtpCISL/AyOlr9 M1U/DjVwlLpl3G1fQU1fpsiGVs=; b=WT8oL++ujq1puYoLRXm3gRx1tetRGMCK1 pVMJlJsPl2Msx6T27Ttf+Gi3tnNBd/9fvuC4YeXtqT8NAGlU3LJW3cqWYafOEybu AJ6hTs0CdgTFYO9qBSxQ3QjngNqxZvuLPy6wgqGi3EiRyRGtzIErW5jrC4tzfkwf GHWyK4f9lI65+clz+bjVf3VmA05T8Lgkbsu924mtlVRv0Dt2NlP33vWwWqVeUT1a y84kbBFOVmzfaz8ED4Ggdz+lawsF5JWe7coxrlR23yi6o3/WCw6eHnyZTwMmoGfo u5+deVVmcgpbSRx4/xsssC70iH5mre5kuMsgZvhEYcPrOiLJe3nPw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 03/29] crypto/x509-utils: Add helper functions for certificate store Date: Mon, 18 Aug 2025 17:42:56 -0400 Message-ID: <20250818214323.529501-4-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XbqJzJ55 c=1 sm=1 tr=0 ts=68a39e83 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=rS3Z-B4KkOQ9K9HQ9W4A:9 X-Proofpoint-ORIG-GUID: Uvab926dsOxwk8URBrMmG9jU8QEMZk6v X-Proofpoint-GUID: Uvab926dsOxwk8URBrMmG9jU8QEMZk6v X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX3p5430nAxM1C 8BTMnnsIHjKGD1bSDtuMGFk+Atct60kRH9aPxfiPc1YIvso6Bz7b6dikI+QP93zo+cF3DrXg9Yw 9y5YoggSjmujeLJIDY5Vu58sq21xmI41gKqY1btpRPuoPTFzCQxXx8YNSYxvXJmI1VYNQF+ximL kHBuFQNzdl/b7/RLG3yAk3m5GT2ynNhKzm6ONeK/Juw8UZMj2qWg+pCNg15lvu6wMy8mMkXWj20 qmpHLu3KA69BTWTErPZEwgz2R1hQhCQDJexrF/kJtFLz6/cqSYQpCSCUG9rhVD5RRMXtpPZMCiz ZBFo3j7AvW3Lp8dSPGYCMMbUg43aqXhceh/tJrGsGhdCVGeyquzZAHh9BOyXwU4JGVjp6VSNk/H zyPctRud X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 adultscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 malwarescore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553578004124100 Content-Type: text/plain; charset="utf-8" Introduce new helper functions for x509 certificate, which will be used by the certificate store: qcrypto_x509_convert_cert_der() - converts a certificate from PEM to DER fo= rmat These functions provide support for certificate format conversion. Signed-off-by: Zhuoying Cai --- crypto/x509-utils.c | 51 +++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 20 +++++++++++++++ 2 files changed, 71 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 6176a88653..29d5146bb2 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -81,6 +81,48 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, return ret; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + if (*resultlen =3D=3D 0) { + error_setg(errp, "Invalid buffer size"); + goto cleanup; + } + + *result =3D g_malloc0(*resultlen); + rc =3D gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_DER, *result, resul= tlen); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert certificate to DER format: %s", + gnutls_strerror(rc)); + g_clear_pointer(result, g_free); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -93,4 +135,13 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, si= ze_t size, return -1; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export X.509 certificate"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 1e99661a71..4239e3e55a 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -19,4 +19,24 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_convert_cert_der + * @cert: pointer to the raw certificate data in PEM format + * @size: size of the certificate + * @result: output location for the allocated buffer for the certificate i= n DER format + (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + (will be updated with the actual size of the DER-encoded ce= rtificate) + * @errp: error pointer + * + * Convert the given @cert from PEM to DER format. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp); + #endif --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553767; cv=none; d=zohomail.com; s=zohoarc; b=dhz+OzK8u6l8aK6CQ9LF12+Pon8KI/hYSXYRBCiLZBwarUb1d0w0hBfyw8BEu2ae4UtuUxH+jINkMJb23dF7SMQMHpOeaTSqLwr6mQ8ha5w6Z2ILbo6aw4oQYlyYrGDZRBJ54ve6FOt6jrPE1GNDnwnZxkM+xTomRNTF8223dgU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553767; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=AxBD3Vy3YQ+Fr8LS/PcTAbRc+upKA12aoitR5bvoyrE=; b=NnlFLxU1YFbkTT4I6+dbnAsNtYbUxYlH3MBU3j2+Pcs9MlVTssSUgw95rJTC0cVLpIoVywBCuQGQt4K9G1fhvqHocR+PXTTy0rm1KsOBLz+DqoGF24CmHChXrvFb0PNR3+YRDGj2hXyzlLUefqo4qyka+MD2bhscp2473EODC7U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553767891598.5780901109639; Mon, 18 Aug 2025 14:49:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7do-0001gG-61; Mon, 18 Aug 2025 17:43:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dh-0001cH-3d; Mon, 18 Aug 2025 17:43:37 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dd-0003ji-Rq; Mon, 18 Aug 2025 17:43:36 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ICU3DT012534; Mon, 18 Aug 2025 21:43:32 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhn3u87h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:32 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHxa5O001507; Mon, 18 Aug 2025 21:43:31 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k4q0qq4c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:31 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhLQW2949664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:21 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7905D58061; Mon, 18 Aug 2025 21:43:29 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5528958059; Mon, 18 Aug 2025 21:43:28 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=AxBD3Vy3YQ+Fr8LS/ PcTAbRc+upKA12aoitR5bvoyrE=; b=GADDnW9r+2yQutgafhVAN6qewcTkisIiJ bjeHrf3Fw0iSlLvzEWE59HImqP498FEV+DyDAs8dW2fvE4FrjQ6Axrl/DK2ZyAJK qAL/1kMnJGE7iJx1U+HgB3UwP06iR1fcuI5hoNzmnbpxRWI3ha07xUCeXnvQAcps Y/TzP3CceFbK8A60No88Q5lU4D9OlXkCr5O9oiSwXHdgSJOKoHqnNEYgGbnQOUOA LxqBduyRCapJcQBiyvR8dK3mZzj80e4jnCaywt6n6ZtNUoIsejHBBh0W334nhxFu d8cCFzDrG/0RV+8CuyUwfqN2cLCGGr1YMQevU9VJHk1i+jEQ5DW9Q== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 04/29] hw/s390x/ipl: Create certificate store Date: Mon, 18 Aug 2025 17:42:57 -0400 Message-ID: <20250818214323.529501-5-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: eFqwXLRAqRM_3TqhhvaQ-AbwvJ2d3y2F X-Authority-Analysis: v=2.4 cv=L6wdQ/T8 c=1 sm=1 tr=0 ts=68a39e84 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=smFJfXSDhdy2xMIsNT8A:9 X-Proofpoint-GUID: eFqwXLRAqRM_3TqhhvaQ-AbwvJ2d3y2F X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX9EfG/nMdGZkS 7h7QIXdzSjYsvPhnUj2PNtbRYOp1mnaklzi3LllPn4LrZxk4ig1RZjCCpNekOqMlQ4Rip6XI85B vIyaeJCxvfxyJNt74Wk/IxSGIXOdLiHk0jfL4Nq4hgCP3T5eJO+SJlvfak2x20D6a+3FycF9Qkn 6pxK2W9rQGaxecuyNJnH0OXlZ/aK1R0yqCmkVAR8aHF0dzp8ttA+YyOE2dZFsWFpObrCcaz7/48 tHHCB9HyNiNj0NF9oPHWUarNQrLf8ynGv0XWW3H1RCQjuGrEyoIm9sbv+uDrOnfbh4uE+yX45Iu HbzClvTyHnZvMeYtHKHesBqtY4sWy7IrmssqWXio3WDeTiqC2QUXunduoOGb0s1qGuSaw7AVtv7 amr4NftP X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 clxscore=1015 phishscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553769237116600 Content-Type: text/plain; charset="utf-8" Create a certificate store for boot certificates used for secure IPL. Load certificates from the `boot-certs` parameter of s390-ccw-virtio machine type option into the cert store. Currently, only X.509 certificates in PEM format are supported, as the QEMU command line accepts certificates in PEM format only. Signed-off-by: Zhuoying Cai --- hw/s390x/cert-store.c | 201 ++++++++++++++++++++++++++++++++++++ hw/s390x/cert-store.h | 38 +++++++ hw/s390x/ipl.c | 9 ++ hw/s390x/ipl.h | 3 + hw/s390x/meson.build | 1 + include/hw/s390x/ipl/qipl.h | 2 + 6 files changed, 254 insertions(+) create mode 100644 hw/s390x/cert-store.c create mode 100644 hw/s390x/cert-store.h diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c new file mode 100644 index 0000000000..81e748a912 --- /dev/null +++ b/hw/s390x/cert-store.c @@ -0,0 +1,201 @@ +/* + * S390 certificate store implementation + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "cert-store.h" +#include "qapi/error.h" +#include "qemu/error-report.h" +#include "qemu/option.h" +#include "qemu/config-file.h" +#include "hw/s390x/ebcdic.h" +#include "hw/s390x/s390-virtio-ccw.h" +#include "qemu/cutils.h" +#include "crypto/x509-utils.h" +#include "qapi/qapi-types-machine-s390x.h" + +static BootCertPathList *s390_get_boot_certs(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->boot_certs; +} + +static size_t cert2buf(char *path, char **cert_buf) +{ + size_t size; + + if (!g_file_get_contents(path, cert_buf, &size, NULL) || size =3D=3D 0= ) { + return 0; + } + + return size; +} + +static S390IPLCertificate *init_cert_x509(size_t size, uint8_t *raw, Error= **errp) +{ + S390IPLCertificate *q_cert =3D NULL; + g_autofree uint8_t *cert_der =3D NULL; + size_t der_len =3D size; + int rc; + + rc =3D qcrypto_x509_convert_cert_der(raw, size, &cert_der, &der_len, e= rrp); + if (rc !=3D 0) { + return NULL; + } + + q_cert =3D g_new0(S390IPLCertificate, 1); + q_cert->size =3D size; + q_cert->der_size =3D der_len; + q_cert->key_id_size =3D QCRYPTO_HASH_DIGEST_LEN_SHA256; + q_cert->hash_size =3D QCRYPTO_HASH_DIGEST_LEN_SHA256; + q_cert->raw =3D raw; + + return q_cert; +} + +static S390IPLCertificate *init_cert(char *path) +{ + char *buf; + size_t size; + char vc_name[VC_NAME_LEN_BYTES]; + g_autofree gchar *filename =3D NULL; + S390IPLCertificate *qcert =3D NULL; + Error *local_err =3D NULL; + + filename =3D g_path_get_basename(path); + + size =3D cert2buf(path, &buf); + if (size =3D=3D 0) { + error_report("Failed to load certificate: %s", path); + return NULL; + } + + qcert =3D init_cert_x509(size, (uint8_t *)buf, &local_err); + if (qcert =3D=3D NULL) { + error_reportf_err(local_err, "Failed to initialize certificate: %s= : ", path); + g_free(buf); + return NULL; + } + + /* + * Left justified certificate name with padding on the right with blan= ks. + * Convert certificate name to EBCDIC. + */ + strpadcpy(vc_name, VC_NAME_LEN_BYTES, filename, ' '); + ebcdic_put(qcert->vc_name, vc_name, VC_NAME_LEN_BYTES); + + return qcert; +} + +static void update_cert_store(S390IPLCertificateStore *cert_store, + S390IPLCertificate *qcert) +{ + size_t data_buf_size; + size_t keyid_buf_size; + size_t hash_buf_size; + size_t cert_buf_size; + + /* length field is word aligned for later DIAG use */ + keyid_buf_size =3D ROUND_UP(qcert->key_id_size, 4); + hash_buf_size =3D ROUND_UP(qcert->hash_size, 4); + cert_buf_size =3D ROUND_UP(qcert->der_size, 4); + data_buf_size =3D keyid_buf_size + hash_buf_size + cert_buf_size; + + if (cert_store->max_cert_size < data_buf_size) { + cert_store->max_cert_size =3D data_buf_size; + } + + cert_store->certs[cert_store->count] =3D *qcert; + cert_store->total_bytes +=3D data_buf_size; + cert_store->count++; +} + +static GPtrArray *get_cert_paths(void) +{ + BootCertPathList *path_list =3D NULL; + BootCertPathList *list =3D NULL; + gchar *cert_path; + GDir *dir =3D NULL; + const gchar *filename; + g_autoptr(GError) err =3D NULL; + g_autoptr(GPtrArray) cert_path_builder =3D g_ptr_array_new_full(0, g_f= ree); + + path_list =3D s390_get_boot_certs(); + if (path_list =3D=3D NULL) { + return g_steal_pointer(&cert_path_builder); + } + + for (list =3D path_list; list; list =3D list->next) { + cert_path =3D list->value->path; + + if (g_strcmp0(cert_path, "") =3D=3D 0) { + error_report("Empty path in certificate path list is not allow= ed"); + exit(1); + } + + struct stat st; + if (stat(cert_path, &st) !=3D 0) { + error_report("Failed to stat path '%s': %s", cert_path, g_stre= rror(errno)); + exit(1); + } + + if (S_ISREG(st.st_mode)) { + if (g_str_has_suffix(cert_path, ".pem")) { + g_ptr_array_add(cert_path_builder, g_strdup(cert_path)); + } + } else if (S_ISDIR(st.st_mode)) { + dir =3D g_dir_open(cert_path, 0, &err); + if (dir =3D=3D NULL) { + error_report("Failed to open directory '%s': %s", + cert_path, err->message); + exit(1); + } + + while ((filename =3D g_dir_read_name(dir))) { + if (g_str_has_suffix(filename, ".pem")) { + g_ptr_array_add(cert_path_builder, + g_build_filename(cert_path, filename, = NULL)); + } + } + + g_dir_close(dir); + } else { + error_report("Path '%s' is neither a file nor a directory", ce= rt_path); + } + } + + qapi_free_BootCertPathList(path_list); + return g_steal_pointer(&cert_path_builder); +} + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store) +{ + GPtrArray *cert_path_builder; + + cert_path_builder =3D get_cert_paths(); + if (cert_path_builder->len =3D=3D 0) { + g_ptr_array_free(cert_path_builder, TRUE); + return; + } + + cert_store->max_cert_size =3D 0; + cert_store->total_bytes =3D 0; + + for (int i =3D 0; i < cert_path_builder->len; i++) { + if (i > MAX_CERTIFICATES - 1) { + error_report("Maximum %d certificates are allowed", MAX_CERTIF= ICATES); + exit(1); + } + + S390IPLCertificate *qcert =3D init_cert((char *) cert_path_builder= ->pdata[i]); + if (qcert) { + update_cert_store(cert_store, qcert); + } + } + + g_ptr_array_free(cert_path_builder, TRUE); +} diff --git a/hw/s390x/cert-store.h b/hw/s390x/cert-store.h new file mode 100644 index 0000000000..f030c8846c --- /dev/null +++ b/hw/s390x/cert-store.h @@ -0,0 +1,38 @@ +/* + * S390 certificate store + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HW_S390_CERT_STORE_H +#define HW_S390_CERT_STORE_H + +#include "hw/s390x/ipl/qipl.h" +#include "crypto/x509-utils.h" + +#define VC_NAME_LEN_BYTES 64 + +struct S390IPLCertificate { + uint8_t vc_name[VC_NAME_LEN_BYTES]; + size_t size; + size_t der_size; + size_t key_id_size; + size_t hash_size; + uint8_t *raw; +}; +typedef struct S390IPLCertificate S390IPLCertificate; + +struct S390IPLCertificateStore { + uint16_t count; + size_t max_cert_size; + size_t total_bytes; + S390IPLCertificate certs[MAX_CERTIFICATES]; +} QEMU_PACKED; +typedef struct S390IPLCertificateStore S390IPLCertificateStore; + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store); + +#endif diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 2f082396c7..186be923d7 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -35,6 +35,7 @@ #include "qemu/option.h" #include "qemu/ctype.h" #include "standard-headers/linux/virtio_ids.h" +#include "cert-store.h" =20 #define KERN_IMAGE_START 0x010000UL #define LINUX_MAGIC_ADDR 0x010008UL @@ -422,6 +423,13 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t= *ebcdic_lp) } } =20 +S390IPLCertificateStore *s390_ipl_get_certificate_store(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return &ipl->cert_store; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -717,6 +725,7 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) =20 if (!ipl->kernel || ipl->iplb_valid) { cpu->env.psw.addr =3D ipl->bios_start_addr; + s390_ipl_create_cert_store(&ipl->cert_store); if (!ipl->iplb_valid) { ipl->iplb_valid =3D s390_init_all_iplbs(ipl); } else { diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 8f83c7da29..bee72dfbb3 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -13,6 +13,7 @@ #ifndef HW_S390_IPL_H #define HW_S390_IPL_H =20 +#include "cert-store.h" #include "cpu.h" #include "exec/target_page.h" #include "system/address-spaces.h" @@ -35,6 +36,7 @@ int s390_ipl_pv_unpack(struct S390PVResponse *pv_resp); void s390_ipl_prepare_cpu(S390CPU *cpu); IplParameterBlock *s390_ipl_get_iplb(void); IplParameterBlock *s390_ipl_get_iplb_pv(void); +S390IPLCertificateStore *s390_ipl_get_certificate_store(void); =20 enum s390_reset { /* default is a reset not triggered by a CPU e.g. issued by QMP */ @@ -64,6 +66,7 @@ struct S390IPLState { IplParameterBlock iplb; IplParameterBlock iplb_pv; QemuIplParameters qipl; + S390IPLCertificateStore cert_store; uint64_t start_addr; uint64_t compat_start_addr; uint64_t bios_start_addr; diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build index 8866012ddc..80d3d4a74d 100644 --- a/hw/s390x/meson.build +++ b/hw/s390x/meson.build @@ -17,6 +17,7 @@ s390x_ss.add(files( 'sclpcpu.c', 'sclpquiesce.c', 'tod.c', + 'cert-store.c', )) s390x_ss.add(when: 'CONFIG_KVM', if_true: files( 'tod-kvm.c', diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 6824391111..e505f44020 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -20,6 +20,8 @@ #define LOADPARM_LEN 8 #define NO_LOADPARM "\0\0\0\0\0\0\0\0" =20 +#define MAX_CERTIFICATES 64 + /* * The QEMU IPL Parameters will be stored at absolute address * 204 (0xcc) which means it is 32-bit word aligned but not --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553513; cv=none; d=zohomail.com; s=zohoarc; b=KXCeJWKGHcduCWF0A4nbH4hZWvq5UTrXmU3mYtHKC/MTziTl7mAra1fKkDlx4xtFmBAckBDr8e0abInYT3ZzhoT7EMkLtIvngYq4qP5lvdtIQjdhB8drNutxE3LdEJ3cM0CJaaUSF4/YOL/4qbRp1lkhCo/dw2M4Vcytvu4Rfts= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553513; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FPH9eGhcIiMCph2cvtmm158R+iC0SuN7EdfUeNpBu2w=; b=df1mE4geiSdun6bkiYLQFXMfrMfb7p8zRbBiGA4OPTthVbpz3Q1PTOGoen1GQynOzJjX/nGxwTGq1N3dAbxgyqTUunrdBmVb8VecfzsB4Fz759LX6ILxqTnMMqm3WcNi3r6fqT1YYSya1mcuTPf+dE+YEAeBbm+kqQdTnsnyUFI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553513253413.2986573289619; Mon, 18 Aug 2025 14:45:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eD-0001mk-4X; Mon, 18 Aug 2025 17:44:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7di-0001cg-6H; Mon, 18 Aug 2025 17:43:38 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7df-0003k7-Uv; Mon, 18 Aug 2025 17:43:37 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ILCpQ8010477; Mon, 18 Aug 2025 21:43:33 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhq9ughh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:33 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIfXrP028710; Mon, 18 Aug 2025 21:43:32 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5apfjyp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:32 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhU9K21693050 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:30 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B87F358058; Mon, 18 Aug 2025 21:43:30 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 93E4158057; Mon, 18 Aug 2025 21:43:29 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:29 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=FPH9eGhcIiMCph2cv tmm158R+iC0SuN7EdfUeNpBu2w=; b=pCSHS7NJ1Jcr2S0UxnXEvX8nJefeL9LLM fIvY9Ii0SZ551cLVhV+V3AVSLQwqweqIZ8UoXQYb/31jJd7jt6zeGXYdfQbC2gjP WzL+P1TaMQk4tYw0Dh8axyVia86PgBY58GVBqc0mQUUGJze2pXeHGAYe8SrJjxRT mPP05byavl7ZR0yUFelO/xQTXuU4bn+zSNd5++gmEM+6GpY5uweZHGRW+tyzdXKd hD6C140z9WzWX5VSMdSE661PDx+0dXM4HrzMWFkksnQWNI1YPQgdDiqJlxp73XG6 CbcJ/lr32SCPvN4WM4UPiDKRqJhjqkA3bZfqaWzeqwMLjHIUI+v0g== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 05/29] s390x/diag: Introduce DIAG 320 for Certificate Store Facility Date: Mon, 18 Aug 2025 17:42:58 -0400 Message-ID: <20250818214323.529501-6-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=N50pF39B c=1 sm=1 tr=0 ts=68a39e85 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=mM8oulnVqnlOJU-pfAMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX9bGvjSaVsZIe WLxBwSMBBKfGDoEa4r0dsy1Wtw3CYaakK/jnk7l2O4jCKBen4QVOmwYer1hNRyn0KuVbB4vFzez TSoQi+wj4PZPEw/zIeOvTOHJHw3PqCRAMfhLqWB3OQBosw+rFaVfcZmUjicIFhw56JQQK5IISLb hPzEs7Czl5mVZf13kUzAd72ZXwOPyIk2B82nzrhqmixn5tA2ub0WeFn9j4GQRZR6V3BjuMgrGg5 q5BoQVHjTzvWb7MVf3L+FpeW1pgG2BlPcMCLaueTzAkhv3pk8ui2TmIvb3kFkwD2oj/lntcAbSF 0+zIDPerGY1Jm0aA6aEpOmcnZqqkyIvbvLa/Qj6x3d/1RyJsf0oqEP44hn5IOHMYSBRoaQhIdVv vLeNfAwi X-Proofpoint-GUID: F5gIMebOdaTv1Bgl_i8bMKnzRN-NV0zO X-Proofpoint-ORIG-GUID: F5gIMebOdaTv1Bgl_i8bMKnzRN-NV0zO X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553514490116600 Content-Type: text/plain; charset="utf-8" DIAGNOSE 320 is introduced to support Certificate Store (CS) Facility, which includes operations such as query certificate storage information and provide certificates in the certificate store. Currently, only subcode 0 is supported with this patch, which is used to query the Installed Subcodes Mask (ISM). This subcode is only supported when the CS facility is enabled. Availability of CS facility is determined by byte 134 bit 5 of the SCLP Read Info block. Byte 134's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Note: secure IPL is not available for Secure Execution (SE) guests, as their images are already integrity protected, and an additional protection of the kernel by secure IPL is not necessary. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 25 ++++++++++++++++ include/hw/s390x/ipl/diag320.h | 20 +++++++++++++ target/s390x/cpu_features.c | 1 + target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 2 ++ target/s390x/diag.c | 44 +++++++++++++++++++++++++++++ target/s390x/gen-features.c | 3 ++ target/s390x/kvm/kvm.c | 16 +++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++ 10 files changed, 121 insertions(+) create mode 100644 docs/specs/s390x-secure-ipl.rst create mode 100644 include/hw/s390x/ipl/diag320.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst new file mode 100644 index 0000000000..70e9a66fe0 --- /dev/null +++ b/docs/specs/s390x-secure-ipl.rst @@ -0,0 +1,25 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +s390 Certificate Store and Functions +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +s390 Certificate Store +---------------------- + +A certificate store is implemented for s390-ccw guests to retain within +memory all certificates provided by the user via the command-line, which +are expected to be stored somewhere on the host's file system. The store +will keep track of the number of certificates, their respective size, +and a summation of the sizes. + +DIAGNOSE function code 'X'320' - Certificate Store Facility +----------------------------------------------------------- + +DIAGNOSE 'X'320' is used to provide support for userspace to directly +query the s390 certificate store. Userspace may be the s390-ccw BIOS or +the guest kernel. + +Subcode 0 - query installed subcodes + Returns a 256-bit installed subcodes mask (ISM) stored in the installed + subcodes block (ISB). This mask indicates which sucodes are currently + installed and available for use. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h new file mode 100644 index 0000000000..aa04b699c6 --- /dev/null +++ b/include/hw/s390x/ipl/diag320.h @@ -0,0 +1,20 @@ +/* + * S/390 DIAGNOSE 320 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG320_H +#define S390X_DIAG320_H + +#define DIAG_320_SUBC_QUERY_ISM 0 + +#define DIAG_320_RC_OK 0x0001 +#define DIAG_320_RC_NOT_SUPPORTED 0x0102 + +#define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 + +#endif diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 4b5be6798e..436471f4b4 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -147,6 +147,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC134: clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; default: return; diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index c017bffcdc..941a69e013 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -138,6 +138,7 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s =20 /* Features exposed via SCLP SCCB Facilities byte 134 (bit numbers relativ= e to byte-134) */ DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") +DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Provide Certificate Store = functions") =20 /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 954a7a99a9..6b8471700e 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -248,6 +248,7 @@ bool s390_has_feat(S390Feat feat) if (s390_is_pv()) { switch (feat) { case S390_FEAT_DIAG_318: + case S390_FEAT_CERT_STORE: case S390_FEAT_HPMA2: case S390_FEAT_SIE_F2: case S390_FEAT_SIE_SKEY: @@ -505,6 +506,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_PTFF_STOUE, S390_FEAT_MULTIPLE_EPOCH }, { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/diag.c b/target/s390x/diag.c index cff9fbc4b0..a35d808fd7 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -18,6 +18,7 @@ #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" #include "hw/s390x/ipl.h" +#include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -191,3 +192,46 @@ out: break; } } + +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + S390CPU *cpu =3D env_archcpu(env); + uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if (!s390_has_feat(S390_FEAT_CERT_STORE)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + if ((subcode & ~0x000ffULL) || (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + switch (subcode) { + case DIAG_320_SUBC_QUERY_ISM: + /* + * The Installed Subcode Block (ISB) can be up 8 words in size, + * but the current set of subcodes can fit within a single word + * for now. + */ + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + + if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return; + } + + env->regs[r1 + 1] =3D DIAG_320_RC_OK; + break; + default: + env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; + break; + } +} diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index 8218e6470e..6c20c3a862 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -720,6 +720,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_PAIE, S390_FEAT_UV_FEAT_AP, S390_FEAT_UV_FEAT_AP_INTR, + S390_FEAT_CERT_STORE, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -919,6 +920,8 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_KIMD_SHA_512, S390_FEAT_KLMD_SHA_512, S390_FEAT_PRNO_TRNG, + S390_FEAT_EXTENDED_LENGTH_SCCB, + S390_FEAT_CERT_STORE, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 8ee33924df..5510fc2fc5 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -98,6 +98,7 @@ #define DIAG_TIMEREVENT 0x288 #define DIAG_IPL 0x308 #define DIAG_SET_CONTROL_PROGRAM_CODES 0x318 +#define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 =20 @@ -1560,6 +1561,16 @@ static void handle_diag_318(S390CPU *cpu, struct kvm= _run *run) } } =20 +static void kvm_handle_diag_320(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1590,6 +1601,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_KVM_BREAKPOINT: r =3D handle_sw_breakpoint(cpu, run); break; + case DIAG_CERT_STORE: + kvm_handle_diag_320(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); @@ -2490,6 +2504,8 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) set_bit(S390_FEAT_DIAG_318, model->features); } =20 + set_bit(S390_FEAT_CERT_STORE, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index 56cce2e7f5..ecff2d07a1 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -391,6 +391,8 @@ int mmu_translate_real(CPUS390XState *env, target_ulong= raddr, int rw, int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3); void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index f7101be574..412c34ed93 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -142,6 +142,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) /* time bomb (watchdog) */ r =3D handle_diag_288(env, r1, r3); break; + case 0x320: + /* cert store */ + bql_lock(); + handle_diag_320(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553701; cv=none; d=zohomail.com; s=zohoarc; b=Di3oR6QfXCyPKkSLvzCY50vBTiBQD2HWIDQcKBXpv6JksmJiuOIKVwmlf2Zz1kcEPzfEskvoCO/PSgxmlkDXhF53/p8BMHLQ+BHdYNR2Q/ZuyAVHQ21n7WWZjQ7x1FtQpgFi+I6YN1NX2QVLfLnNNL0BXu0ccUg7Qq+YsErgDJ8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553701; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=THpkQTG4LTlWFhOgO9Qn5YiL1fa1RQNXXgd+IgH2YWw=; b=hJg9mr9bHCOTLtwRjxX1DA4BiAEP1srxaBGqm2V/kPLsK6gPxhe+v+C7aKit1L48tFrFvWt9+gefuOOWmbJ28RpkHgZcECj5fhZuoUHYDRj6G+8ot43Sk0EhIFDRQ1LYOfuagZig0Twm803tO11XxL4SkyD04y3+ah0S1Ojumo8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553701789585.2061623826173; Mon, 18 Aug 2025 14:48:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7do-0001gE-3p; Mon, 18 Aug 2025 17:43:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dh-0001cb-PA; Mon, 18 Aug 2025 17:43:38 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dg-0003kF-9h; Mon, 18 Aug 2025 17:43:37 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKP24g007701; Mon, 18 Aug 2025 21:43:34 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhn3u87n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:34 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57II3jBf001467; Mon, 18 Aug 2025 21:43:33 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k4q0qq4g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:33 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhWSN22282768 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:32 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3F4A558058; Mon, 18 Aug 2025 21:43:32 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F5DD58057; Mon, 18 Aug 2025 21:43:31 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:30 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=THpkQTG4LTlWFhOgO 9Qn5YiL1fa1RQNXXgd+IgH2YWw=; b=YXL2RO1Ci07F6HNZMhFxubLl8QYF1Ijsc u+myernGwUlz1S92g6gqldnMyucAGKXJCFK1oC3G1HPIRqV0vTb14dB9u8hlm8cZ EYks0nBZVHw84t3b3w81nBwXZCtyaN9wDhIgD7F9cGD1CqyXjz0DLmxnxPw5SL+j l5E8Yd2DcsryRWJptsI+sfv0URoOpgyQ8iJYlf2qDHTCXFU5anrmT828/6AiPxK9 yoo4JCtpI2MZxjxlOHtS0LOLJcGYGLDwVphu/M6ODnMMlLwcpSxxOOpSo6x9yET8 Uhnci+N0dTFDUp9JSNV+2LuPQv6CPSPrmuwsElbNc/wHk6my7Skww== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 06/29] s390x/diag: Refactor address validation check from diag308_parm_check Date: Mon, 18 Aug 2025 17:42:59 -0400 Message-ID: <20250818214323.529501-7-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: WwbNKxAqMpKaAOrcwumRzTpeZgy4zJnz X-Authority-Analysis: v=2.4 cv=L6wdQ/T8 c=1 sm=1 tr=0 ts=68a39e86 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=130TwiEZxdn8fhqcL5YA:9 X-Proofpoint-GUID: WwbNKxAqMpKaAOrcwumRzTpeZgy4zJnz X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX/mizZgh3VrGP GbjroM0oxkni59NiLWG6shsB203zhLfhjtRYwLg8wHlQ+iGB0SwlU4bvqzGlQAqTVm3uVWIV8CY rk/GEsJD0EdiA5TNywhhXJyofJ+zGE+2MkM1ojh1bgbmtZqhB8TMi52u6MogvW++qwZEMlku4Ul XDNukc9/WYAAQ4e7hVwrNmOr1F2Lvw3wGiDArcYsuCkd37U4mPR46BcFmIfl9qMSTmbg4I9J3aG D9EoQPHHXATLwp48ff3muZJkifux7NOk/Y+9rArcxrXuPHZdfKP1E8q7UAcKAT/kb2NnK61gYKQ EuXaVkg76UONpTjGG+ari/2dYVzaldvxpRHHA25xSQQYXjj1UwvgrLGy1xb5+Hv/U3VwMf4geqk Fr59ybyV X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 clxscore=1011 phishscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553702370116600 Content-Type: text/plain; charset="utf-8" Create a function to validate the address parameter of DIAGNOSE. Refactor the function for reuse in the next patch, which allows address validation in read or write operation of DIAGNOSE. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.h | 6 ++++++ target/s390x/diag.c | 4 +--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index bee72dfbb3..e26fc1cd6a 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -118,6 +118,12 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "= alignment of iplb wrong"); #define S390_IPLB_MIN_FCP_LEN 384 #define S390_IPLB_MIN_QEMU_SCSI_LEN 200 =20 +static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) +{ + return address_space_access_valid(&address_space_memory, addr, + size, write, MEMTXATTRS_UNSPECIFIED); +} + static inline bool iplb_valid_len(IplParameterBlock *iplb) { return be32_to_cpu(iplb->len) <=3D sizeof(IplParameterBlock); diff --git a/target/s390x/diag.c b/target/s390x/diag.c index a35d808fd7..e67ee57f01 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -65,9 +65,7 @@ static int diag308_parm_check(CPUS390XState *env, uint64_= t r1, uint64_t addr, s390_program_interrupt(env, PGM_SPECIFICATION, ra); return -1; } - if (!address_space_access_valid(&address_space_memory, addr, - sizeof(IplParameterBlock), write, - MEMTXATTRS_UNSPECIFIED)) { + if (!diag_parm_addr_valid(addr, sizeof(IplParameterBlock), write)) { s390_program_interrupt(env, PGM_ADDRESSING, ra); return -1; } --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553686; cv=none; d=zohomail.com; s=zohoarc; b=IanbxvYQtgDvR9Gypryf+mU2pbWd844B0uxmunWlQR8qqbPW+TTMrKbysWzmQOvSDYr56t1qXTBH/2v63yabyFQkuBXFv3NN6f3bb+YSkh2vTKJU70YdPyfH8ruJc9+ltqGVkrRv8/9KPHwRx9WaiF9frLBIcwIb5Yi0qjIc0yY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553686; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zb5TX4Xl/DXStBzQlpP7Rn8L+sSaY72SPmrBoOhE2yk=; b=fHrM8C8kAoDeeA9R8d3J+p1YTVYYkEEVALIl9tZY2zb8udWWNLb6etocLcXTYBmL2NftB6MjpzBRavaYxQVH6cc0Tk0zdLCoB1JON0v6yFzwM1nVG5xYY+6agPvqTlp4X0utOErlGrmNwrQkf44KQ9kT93W2q4DDXccCaeUJJoc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553686184120.60466234114801; Mon, 18 Aug 2025 14:48:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eT-0001w8-SH; Mon, 18 Aug 2025 17:44:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dj-0001dH-6Z; Mon, 18 Aug 2025 17:43:39 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dh-0003kb-4w; Mon, 18 Aug 2025 17:43:38 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIgvnk009345; Mon, 18 Aug 2025 21:43:35 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhn3u87p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:35 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJLfpI003190; Mon, 18 Aug 2025 21:43:34 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cvg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:34 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhXT020382434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:33 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9CD2F58058; Mon, 18 Aug 2025 21:43:33 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5BE8258057; Mon, 18 Aug 2025 21:43:32 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zb5TX4Xl/DXStBzQl pP7Rn8L+sSaY72SPmrBoOhE2yk=; b=AR8HTLLnMlwYKRw0q+euHyyjIzFSjGCzp Z5Xa7UHd8P5hC3jhS9akz7U4EosRfTvQTKWnZ9qrwvlSlTCCiBCHyzM7KvmcYj4O m2oZjQGWh/itW1FEvy/jWJkOGiqYx9fVgBex4efVBas+Rc/VhM9wQtlrFSNuN3Yb 5OHIadFSQMpFLcUnX1fBW9f+r2STKUwiZgdIbvcfb3UQpsbKgkq/UIfnRNADwBOt I5WsFJw8ZmgCBKzueAiOibIlCzyOY34RjV5vCC45lb8Tke6ijOUWoKVPYOtjI+ws duXp4gYFIa6+usIpUPbBjYvi+n8nZxgiWWqd+S5drX6aZh+sdnnkQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 07/29] s390x/diag: Implement DIAG 320 subcode 1 Date: Mon, 18 Aug 2025 17:43:00 -0400 Message-ID: <20250818214323.529501-8-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: W9WRZw4DS2mM6HUYjuCpWPlhl5VUBLxw X-Authority-Analysis: v=2.4 cv=L6wdQ/T8 c=1 sm=1 tr=0 ts=68a39e87 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=vmAlfMB145uIY6ZofiUA:9 X-Proofpoint-GUID: W9WRZw4DS2mM6HUYjuCpWPlhl5VUBLxw X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfXyX2uiPjSVrgX 9r7lvQh6AkMrPnRFavKpNeZvfFTzBf1PS/rJyP4tODMnNH6MN0wA/doLGn0nxvQ630wgtUNX+eC q6CBARK0RUXgamU+KVM4TRiUsnF+Hbaq0ekHX/MCjiiAmc3run6cj3SgK9gK5X42CWLQTM+RB0f Xw74yD+U+UpNCk0KHtnbZpSglNcsxrrFwbFYW0SzyiKuRaferWIzIHzUL1tZhM4HaA5rNrCwyfO Iwl/rg2x+U4TvjDKb0u4lTSf1B+lffz+uOYl5ZYvVdaaKkV44sZqEOgShWPDSuec0eCjmbq4Sb2 HuTtim4kB7QA+cTiuJJKYmCFCz15Dx3aBKPwohLfjcMmox9MCAzKB9I1cvNrbWrqNiHkwHRPbCy GL4IEhT4 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 clxscore=1015 phishscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553688570116600 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 1 provides information needed to determine the amount of storage to store one or more certificates from the certificate store. Upon successful completion, this subcode returns information of the current cert store, such as the number of certificates stored and allowed in the ce= rt store, amount of space may need to be allocate to store a certificate, etc for verification-certificate blocks (VCBs). The subcode value is denoted by setting the left-most bit of an 8-byte field. The verification-certificate-storage-size block (VCSSB) contains the output data when the operation completes successfully. A VCSSB length of 4 indicates that no certificate are available in the cert store. Signed-off-by: Zhuoying Cai --- docs/specs/s390x-secure-ipl.rst | 10 ++++++ include/hw/s390x/ipl/diag320.h | 22 +++++++++++++ target/s390x/diag.c | 56 ++++++++++++++++++++++++++++++++- 3 files changed, 87 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 70e9a66fe0..ddc15f0322 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -23,3 +23,13 @@ Subcode 0 - query installed subcodes Returns a 256-bit installed subcodes mask (ISM) stored in the installed subcodes block (ISB). This mask indicates which sucodes are currently installed and available for use. + +Subcode 1 - query verification certificate storage information + Provides the information required to determine the amount of memory ne= eded to + store one or more verification-certificates (VCs) from the certificate= store (CS). + + Upon successful completion, this subcode returns various storage size = values for + verification-certificate blocks (VCBs). + + The output is returned in the verification-certificate-storage-size bl= ock (VCSSB). + A VCSSB length of 4 indicates that no certificates are available in th= e CS. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index aa04b699c6..6e4779c699 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -11,10 +11,32 @@ #define S390X_DIAG320_H =20 #define DIAG_320_SUBC_QUERY_ISM 0 +#define DIAG_320_SUBC_QUERY_VCSI 1 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 +#define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 +#define DIAG_320_ISM_QUERY_VCSI 0x40000000 + +#define VCSSB_NO_VC 4 +#define VCSSB_MIN_LEN 128 +#define VCE_HEADER_LEN 128 +#define VCB_HEADER_LEN 64 + +struct VCStorageSizeBlock { + uint32_t length; + uint8_t reserved0[3]; + uint8_t version; + uint32_t reserved1[6]; + uint16_t total_vc_ct; + uint16_t max_vc_ct; + uint32_t reserved3[11]; + uint32_t max_single_vcb_len; + uint32_t total_vcb_len; + uint32_t reserved4[10]; +}; +typedef struct VCStorageSizeBlock VCStorageSizeBlock; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index e67ee57f01..b42cf8fe98 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -191,11 +191,47 @@ out: } } =20 +static int handle_diag320_query_vcsi(S390CPU *cpu, uint64_t addr, uint64_t= r1, + uintptr_t ra, S390IPLCertificateStore= *qcs) +{ + g_autofree VCStorageSizeBlock *vcssb =3D NULL; + + vcssb =3D g_new0(VCStorageSizeBlock, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcssb, sizeof(*vcssb))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + if (be32_to_cpu(vcssb->length) < VCSSB_MIN_LEN) { + return DIAG_320_RC_INVAL_VCSSB_LEN; + } + + if (!qcs->count) { + vcssb->length =3D cpu_to_be32(VCSSB_NO_VC); + } else { + vcssb->version =3D 0; + vcssb->total_vc_ct =3D cpu_to_be16(qcs->count); + vcssb->max_vc_ct =3D cpu_to_be16(MAX_CERTIFICATES); + vcssb->max_single_vcb_len =3D cpu_to_be32(VCB_HEADER_LEN + VCE_HEA= DER_LEN + + qcs->max_cert_size); + vcssb->total_vcb_len =3D cpu_to_be32(VCB_HEADER_LEN + qcs->count *= VCE_HEADER_LEN + + qcs->total_bytes); + } + + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcssb, be32_to_cpu(vcssb->l= ength))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + return DIAG_320_RC_OK; +} + void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { S390CPU *cpu =3D env_archcpu(env); + S390IPLCertificateStore *qcs =3D s390_ipl_get_certificate_store(); uint64_t subcode =3D env->regs[r3]; uint64_t addr =3D env->regs[r1]; + int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { s390_program_interrupt(env, PGM_PRIVILEGED, ra); @@ -219,7 +255,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * but the current set of subcodes can fit within a single word * for now. */ - uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | + DIAG_320_ISM_QUERY_VCSI); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -228,6 +265,23 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 env->regs[r1 + 1] =3D DIAG_320_RC_OK; break; + case DIAG_320_SUBC_QUERY_VCSI: + if (!diag_parm_addr_valid(addr, sizeof(VCStorageSizeBlock), true))= { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + if (addr & 0x7) { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag320_query_vcsi(cpu, addr, r1, ra, qcs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553502; cv=none; d=zohomail.com; s=zohoarc; b=Q9nUxwv06NHs5/x/NW4/uYzQsrFuZNZzIXrU4dNmKNji8G5m5u7/qFVUfy6rNwbxhez0lD8VAKC1OXCTJJETgiC80FELUxrXaUzQ08mWNgUMib9mY7NFv/t0wPICONeQjXRn9Iw7p342fPGMEL3JFndmTj+vYMW9a33pnqjTiwA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553502; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=L+xqdLVpYgg9p5Lx1oPqwThkNwq5V6ZHqTAR5xJdNrM=; b=QSxUmvKPB6In9KpG7c3p2+j8VMaoslD38BQsppqFzYmSV2XvYua5bEgZ14X7ozK6gQhtFttIBvJGhNVjPjSU2I9FkAdW2JOMiUvVYQC0kPfrckHnk8B5q9Vs6S/SF6cPBFX2US30fd1SJr+MrfrCkZYc+EtXlVp7L8lRorCBRNE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553502559936.1321735820436; Mon, 18 Aug 2025 14:45:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7dq-0001gw-Np; Mon, 18 Aug 2025 17:43:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dk-0001dW-6y; Mon, 18 Aug 2025 17:43:40 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7di-0003l1-8J; Mon, 18 Aug 2025 17:43:39 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IBaPXm007990; Mon, 18 Aug 2025 21:43:37 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jfdrujj4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:36 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHBsii011695; Mon, 18 Aug 2025 21:43:35 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k4au7r8a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:35 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhYr619858032 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:34 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BA15D58058; Mon, 18 Aug 2025 21:43:34 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B844458057; Mon, 18 Aug 2025 21:43:33 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=L+xqdLVpYgg9p5Lx1 oPqwThkNwq5V6ZHqTAR5xJdNrM=; b=HAPUGkY7UF4NhmclKE6m/1LKIdetq1U8S QPQd8EvnvXZrYh0Jgw5/143wsf+5W2Hjd5udDIKXK+KAEQLcTkUpc8Td//s5z3el ysTaWi+8dLbmB2qxQHKPiw+z2DYlFpGhKjesC7MLI2nFDuv4KG72qrpym5aSp6mb EN2xSG4sDHYKNejZtO9WD7FCcMgldjjERVGyVlQQMOkbfMhbuzEqZGFf4wjQ0W5U hBQCMhCy2tRQVkQ7MLlwLU1rynNSoFwkBxBg4U/SZjaRYoJBByNZA5N0xzJAxcpR 3FtR3RzroaGCJ+I5ZtfGaoA/WiaaWUizVmHfz/OVLlWJuQLqFoWdQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 08/29] crypto/x509-utils: Add helper functions for DIAG 320 subcode 2 Date: Mon, 18 Aug 2025 17:43:01 -0400 Message-ID: <20250818214323.529501-9-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: Odk_vX-gzRzsz3Nk8-tu74uhkFNJJLw2 X-Proofpoint-GUID: Odk_vX-gzRzsz3Nk8-tu74uhkFNJJLw2 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAwMSBTYWx0ZWRfXyFamHn+W/YZh bLvxNUYOj7g3N+Yx+qI1Z6Ugv/3416TFB8WApyy6UmmdIIoxGf64GZF1haoyW3jEAKUnsnp5YJq npEX4R5L+ug0GZpM6uuLzafYeoy+7LJKumoUzagzz79e0LMBtX8qqetwrLOL/uz73O9TfuqF1Vr fjf/WwZW7M808SSA1V1FUoxLQGf674x4QFbvaDrptLdRvz3qBHL4hD/NOTtv5vGHLYfsI95hUSq 9GQf/KUK0iRrxQjlo1gZ2AOSPDa2v3F1+XJoFzklUrjxHnVIo7JtOSaFzJZLRWx/Y1XxpUwPo/g p5ryGZXW9yHjzhLpUTVtlubPB6QEXJ/C+3Fhx/zmaohexbkNH9TR2pZJk+EbXM3kW5C6lNYxPZi TaAJOhi5 X-Authority-Analysis: v=2.4 cv=GotC+l1C c=1 sm=1 tr=0 ts=68a39e88 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=m1npDw3cYSwZ3_DRQmoA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160001 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553505201124100 Content-Type: text/plain; charset="utf-8" Introduce new helper functions to extract certificate metadata needed for DIAG 320 subcode 2: qcrypto_x509_check_cert_times() - validates the certificate's validity peri= od against the current time qcrypto_x509_get_pk_algorithm() - returns the public key algorithm used in = the certificate qcrypto_x509_get_cert_key_id() - extracts the key ID from the certificate These functions provide support for metadata extraction and validity checki= ng for X.509 certificates. Signed-off-by: Zhuoying Cai --- crypto/x509-utils.c | 174 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 58 ++++++++++++ 2 files changed, 232 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 29d5146bb2..67b42aad1f 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -27,6 +27,21 @@ static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_= HASH_ALGO__MAX] =3D { [QCRYPTO_HASH_ALGO_RIPEMD160] =3D GNUTLS_DIG_RMD160, }; =20 +static const int gnutls_to_qcrypto_pk_alg_map[] =3D { + [GNUTLS_PK_RSA] =3D QCRYPTO_PK_ALGO_RSA, + [GNUTLS_PK_DSA] =3D QCRYPTO_PK_ALGO_DSA, + [GNUTLS_PK_ECDSA] =3D QCRYPTO_PK_ALGO_ECDSA, + [GNUTLS_PK_RSA_OAEP] =3D QCRYPTO_PK_ALGO_RSA_OAEP, + [GNUTLS_PK_EDDSA_ED25519] =3D QCRYPTO_PK_ALGO_ED25519, + [GNUTLS_PK_EDDSA_ED448] =3D QCRYPTO_PK_ALGO_ED448, +}; + +static const int qcrypto_to_gnutls_keyid_flags_map[] =3D { + [QCRYPTO_HASH_ALGO_SHA1] =3D GNUTLS_KEYID_USE_SHA1, + [QCRYPTO_HASH_ALGO_SHA256] =3D GNUTLS_KEYID_USE_SHA256, + [QCRYPTO_HASH_ALGO_SHA512] =3D GNUTLS_KEYID_USE_SHA512, +}; + int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, QCryptoHashAlgo alg, uint8_t *result, @@ -123,6 +138,143 @@ cleanup: return ret; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + time_t now =3D time(0); + time_t exp_time; + time_t act_time; + + if (now =3D=3D ((time_t)-1)) { + error_setg_errno(errp, errno, "Cannot get current time"); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + exp_time =3D gnutls_x509_crt_get_expiration_time(crt); + if (exp_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate expiration time"); + goto cleanup; + } + if (exp_time < now) { + error_setg(errp, "The certificate has expired"); + goto cleanup; + } + + act_time =3D gnutls_x509_crt_get_activation_time(crt); + if (act_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate activation time"); + goto cleanup; + } + if (act_time > now) { + error_setg(errp, "The certificate is not yet active"); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +int qcrypto_x509_get_pk_algorithm(uint8_t *cert, size_t size, Error **errp) +{ + int rc; + int ret =3D -1; + unsigned int bits; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_get_pk_algorithm(crt, &bits); + if (rc >=3D G_N_ELEMENTS(gnutls_to_qcrypto_pk_alg_map)) { + error_setg(errp, "Unknown public key algorithm %d", rc); + goto cleanup; + } + + ret =3D gnutls_to_qcrypto_pk_alg_map[rc]; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + if (hash_alg >=3D G_N_ELEMENTS(qcrypto_to_gnutls_keyid_flags_map)) { + error_setg(errp, "Unknow hash algorithm %d", hash_alg); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + *resultlen =3D gnutls_hash_get_len(qcrypto_to_gnutls_hash_alg_map[hash= _alg]); + if (*resultlen =3D=3D 0) { + error_setg(errp, "Failed to get hash algorithn length: %s", gnutls= _strerror(rc)); + goto cleanup; + } + + *result =3D g_malloc0(*resultlen); + if (gnutls_x509_crt_get_key_id(crt, + qcrypto_to_gnutls_keyid_flags_map[hash_= alg], + *result, resultlen) !=3D 0) { + error_setg(errp, "Failed to get key ID from certificate"); + g_clear_pointer(result, g_free); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -144,4 +296,26 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_= t size, return -1; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + error_setg(errp, "GNUTLS is required to get certificate times"); + return -1; +} + +int qcrypto_x509_get_pk_algorithm(uint8_t *cert, size_t size, Error **errp) +{ + error_setg(errp, "GNUTLS is required to get public key algorithm"); + return -1; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get key ID"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 4239e3e55a..f169df81cb 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -13,6 +13,15 @@ =20 #include "crypto/hash.h" =20 +typedef enum { + QCRYPTO_PK_ALGO_RSA, + QCRYPTO_PK_ALGO_DSA, + QCRYPTO_PK_ALGO_ECDSA, + QCRYPTO_PK_ALGO_RSA_OAEP, + QCRYPTO_PK_ALGO_ED25519, + QCRYPTO_PK_ALGO_ED448, +} QCryptoPkAlgo; + int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, QCryptoHashAlgo hash, uint8_t *result, @@ -39,4 +48,53 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t = size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_check_cert_times + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Check whether the activation and expiration times of @cert + * are valid at the current time. + * + * Returns: 0 if the certificate times are valid, + * -1 on error. + */ +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp= ); + +/** + * qcrypto_x509_get_pk_algorithm + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Determine the public key algorithm of the @cert. + * + * Returns: a value from the QCryptoPkAlgo enum on success, + * -1 on error. + */ +int qcrypto_x509_get_pk_algorithm(uint8_t *cert, size_t size, Error **errp= ); + +/** + * qcrypto_x509_get_cert_key_id + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @hash_alg: the hash algorithm flag + * @result: output location for the allocated buffer for key ID + (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + (will be updated with the actual size of key id) + * @errp: error pointer + * + * Retrieve the key ID from the @cert based on the specified @flag. + * + * Returns: 0 if key ID was successfully stored in @result, + * -1 on error. + */ +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp); + #endif --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553472; cv=none; d=zohomail.com; s=zohoarc; b=cIoXF5kOLY6eZ0WBwIk0LLcHC0/TpvMVgKExO4HM7tJD0I21+srr/snf8XtY+DNmZW4OeaRPU99/G8foC9V5BOU2p48nlK7c/lDID98ziDhAZWNALdRBOlZN+Fr8QHPwY8aabLGTBybQAPl+vqJsUxJFKNDidfaxUuD8RKV6kcQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553472; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=cIFl8QUkvc9rkLeWjHRvvINIONuCW4qqySiXGR4kxHk=; b=IjuGNNnNLhhWF13+huHQaQ++lC1ZIRpT1FXEJRnUUis/P49tTeivZvZyVaRRMMX23ZLeBT/yO/9qB+Zmwe/V51YNAAb8PCOG28AlleeNr2bv3OBCvyzIB874rGdYJZHwbtPMdIh3fI7EDkHYp22hMK5Ue1viHicGseAcFSG3DsQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553472264816.126742514033; Mon, 18 Aug 2025 14:44:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7e9-0001m5-EO; Mon, 18 Aug 2025 17:44:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dm-0001em-Qa; Mon, 18 Aug 2025 17:43:42 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dk-0003lc-Jd; Mon, 18 Aug 2025 17:43:42 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IL2teK002048; Mon, 18 Aug 2025 21:43:39 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jfdrujj5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:38 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IK4nFL002362; Mon, 18 Aug 2025 21:43:38 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9w2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:38 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhadE23069420 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:36 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 19C2058058; Mon, 18 Aug 2025 21:43:36 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D158A58057; Mon, 18 Aug 2025 21:43:34 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:34 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cIFl8QUkvc9rkLeWj HRvvINIONuCW4qqySiXGR4kxHk=; b=U2EfVyADIntRlpTLT+ka5lwKLUi0zeYc6 Pi+LD2eNheoWQvPMh1wS+mjoCU8fkpiPtLsvEYsuEcgKJ3hTGTb1+54SqxI1REvn hmiXhIxIxbknwxMoCkH2Uhs07OVRq8yVeBkYhn3UlnAwLE5pOvb8Ef/dlB9f3RtZ 1To/o7J+RNKMRabDNIGEc5wto1PqtQgRBKB1TdyuKMh5rWQWX97tmAnAAW4CAdEo Q0X+cxwD/EXrwy+JfBxMK49lvj2V76bK63MbmYAOj9iNFJWiv+xAkXpRNSQ8w67W 9ssSqseHEZweJWvZdvB4nIw/C4iFMD8bza3EoATD1VHP1gc3W59Dw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 09/29] s390x/diag: Implement DIAG 320 subcode 2 Date: Mon, 18 Aug 2025 17:43:02 -0400 Message-ID: <20250818214323.529501-10-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: zWW9hZUrn3_W2860qpp2ljmAeAB0L3jQ X-Proofpoint-GUID: zWW9hZUrn3_W2860qpp2ljmAeAB0L3jQ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAwMSBTYWx0ZWRfX77pHBRKyxt64 kc3zZME9r4RMt7bbPcixFCktCwshpLvD8zEVs2Al4gArYyBGgPCaOCslszJotCHdqGow9Xvld1t BiI3yqYkC4OAIYODorh/no1c3V1Uf/7RXGcamzHyIQrVIgTvht1duE5MIQsZ1mzYcg23SCunn2S 1ufJRP7xaKPSVIN4zFI5kYKgELz54z7UwOotHY+ll3+AYep9DgtizQc9xwrG1LiZaDLncCA81I4 /lQdLPnM2ZQKDsjvHbMrIJnXXCQ8hFyBLCdk9jUCOxh2T6pCryF5y4MVxnht3Kc1owN3K74suT9 u2hPTfuwAQ55nuW+lMqRm9CV9PaNaRPrZCgU8bZJLZW1OSnHm6l0w+PxupjVRfslnNEWU5YO0P7 Oz+tLtN3 X-Authority-Analysis: v=2.4 cv=GotC+l1C c=1 sm=1 tr=0 ts=68a39e8b cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=xHnrawAp1QBLmOVMci8A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160001 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553474299116600 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 2 provides verification-certificates (VCs) that are in the certificate store. Only X509 certificates in DER format and SHA-256 hash type are recognized. The subcode value is denoted by setting the second-left-most bit of an 8-byte field. The Verification Certificate Block (VCB) contains the output data when the operation completes successfully. It includes a common header followed by zero or more Verification Certificate Entries (VCEs), depending on the VCB input length and the VC range (from the first VC index to the last VC index) in the certificate store. Each VCE contains information about a certificate retrieved from the S390IPLCertificateStore, such as the certificate name, key type, key ID length, hash length, and the raw certificate data. The key ID and hash are extracted from the raw certificate by the crypto AP= I. Note: SHA2-256 VC hash type is required for retrieving the hash (fingerprint) of the certificate. Signed-off-by: Zhuoying Cai --- docs/specs/s390x-secure-ipl.rst | 13 ++ include/hw/s390x/ipl/diag320.h | 49 ++++++ target/s390x/diag.c | 286 +++++++++++++++++++++++++++++++- 3 files changed, 347 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index ddc15f0322..16868aa823 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -33,3 +33,16 @@ Subcode 1 - query verification certificate storage infor= mation =20 The output is returned in the verification-certificate-storage-size bl= ock (VCSSB). A VCSSB length of 4 indicates that no certificates are available in th= e CS. + +Subcode 2 - store verification certificates + Provides VCs that are in the certificate store. + + The output is provided in a VCB, which includes a common header follow= ed by zero + or more verification-certificate entries (VCEs). + + The first-VC index and last-VC index fields of VCB specify the range o= f VCs + to be stored by subcode 2. Stored count and remained count fields spec= ify the + number of VCs stored and could not be stored in the VCB due to insuffi= cient + storage specified in the VCB input length field. + + VCE contains various information of a VC from the CS. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index 6e4779c699..9d37dea665 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -12,19 +12,30 @@ =20 #define DIAG_320_SUBC_QUERY_ISM 0 #define DIAG_320_SUBC_QUERY_VCSI 1 +#define DIAG_320_SUBC_STORE_VC 2 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 #define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 +#define DIAG_320_RC_INVAL_VCB_LEN 0x0204 +#define DIAG_320_RC_BAD_RANGE 0x0302 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 #define DIAG_320_ISM_QUERY_VCSI 0x40000000 +#define DIAG_320_ISM_STORE_VC 0x20000000 =20 #define VCSSB_NO_VC 4 #define VCSSB_MIN_LEN 128 #define VCE_HEADER_LEN 128 +#define VCE_INVALID_LEN 72 #define VCB_HEADER_LEN 64 =20 +#define DIAG_320_VCE_FLAGS_VALID 0x80 +#define DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING 0 +#define DIAG_320_VCE_KEYTYPE_ECDSA 1 +#define DIAG_320_VCE_FORMAT_X509_DER 1 +#define DIAG_320_VCE_HASHTYPE_SHA2_256 1 + struct VCStorageSizeBlock { uint32_t length; uint8_t reserved0[3]; @@ -39,4 +50,42 @@ struct VCStorageSizeBlock { }; typedef struct VCStorageSizeBlock VCStorageSizeBlock; =20 +struct VCBlock { + uint32_t in_len; + uint32_t reserved0; + uint16_t first_vc_index; + uint16_t last_vc_index; + uint32_t reserved1[5]; + uint32_t out_len; + uint8_t reserved2[3]; + uint8_t version; + uint16_t stored_ct; + uint16_t remain_ct; + uint32_t reserved3[5]; + uint8_t vce_buf[]; +}; +typedef struct VCBlock VCBlock; + +struct VCEntry { + uint32_t len; + uint8_t flags; + uint8_t key_type; + uint16_t cert_idx; + uint32_t name[16]; + uint8_t format; + uint8_t reserved0; + uint16_t keyid_len; + uint8_t reserved1; + uint8_t hash_type; + uint16_t hash_len; + uint32_t reserved2; + uint32_t cert_len; + uint32_t reserved3[2]; + uint16_t hash_offset; + uint16_t cert_offset; + uint32_t reserved4[7]; + uint8_t cert_buf[]; +}; +typedef struct VCEntry VCEntry; + #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index b42cf8fe98..820f45a0bd 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -17,6 +17,7 @@ #include "s390x-internal.h" #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" +#include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" @@ -24,6 +25,7 @@ #include "kvm/kvm_s390x.h" #include "target/s390x/kvm/pv.h" #include "qemu/error-report.h" +#include "crypto/x509-utils.h" =20 =20 int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3) @@ -225,6 +227,280 @@ static int handle_diag320_query_vcsi(S390CPU *cpu, ui= nt64_t addr, uint64_t r1, return DIAG_320_RC_OK; } =20 +static bool is_cert_valid(S390IPLCertificate qcert) +{ + int rc; + Error *err =3D NULL; + + rc =3D qcrypto_x509_check_cert_times(qcert.raw, qcert.size, &err); + if (rc !=3D 0) { + error_report_err(err); + return false; + } + + return true; +} + +static void handle_key_id(VCEntry *vce, S390IPLCertificate qcert) +{ + int rc; + g_autofree unsigned char *key_id_data =3D NULL; + Error *err =3D NULL; + + /* key id and key id len */ + rc =3D qcrypto_x509_get_cert_key_id(qcert.raw, qcert.size, + QCRYPTO_HASH_ALGO_SHA256, + &key_id_data, &qcert.key_id_size, &e= rr); + if (rc < 0) { + error_report_err(err); + return; + } + vce->keyid_len =3D cpu_to_be16(qcert.key_id_size); + + memcpy(vce->cert_buf, key_id_data, qcert.key_id_size); +} + +static int handle_hash(VCEntry *vce, S390IPLCertificate qcert, uint16_t ke= yid_field_len) +{ + int rc; + uint16_t hash_offset; + g_autofree void *hash_data =3D NULL; + Error *err =3D NULL; + + /* hash and hash len */ + hash_data =3D g_malloc0(qcert.hash_size); + rc =3D qcrypto_get_x509_cert_fingerprint(qcert.raw, qcert.size, + QCRYPTO_HASH_ALGO_SHA256, + hash_data, &qcert.hash_size, &e= rr); + if (rc < 0) { + error_report_err(err); + return -1; + } + vce->hash_len =3D cpu_to_be16(qcert.hash_size); + + /* hash type */ + vce->hash_type =3D DIAG_320_VCE_HASHTYPE_SHA2_256; + + hash_offset =3D VCE_HEADER_LEN + keyid_field_len; + vce->hash_offset =3D cpu_to_be16(hash_offset); + + memcpy((uint8_t *)vce + hash_offset, hash_data, qcert.hash_size); + + return 0; +} + +static int handle_cert(VCEntry *vce, S390IPLCertificate qcert, uint16_t ha= sh_field_len) +{ + int rc; + uint16_t cert_offset; + g_autofree uint8_t *cert_der =3D NULL; + Error *err =3D NULL; + + /* certificate in DER format */ + rc =3D qcrypto_x509_convert_cert_der(qcert.raw, qcert.size, + &cert_der, &qcert.der_size, &err); + if (rc < 0) { + error_report_err(err); + return -1; + } + vce->format =3D DIAG_320_VCE_FORMAT_X509_DER; + vce->cert_len =3D cpu_to_be32(qcert.der_size); + cert_offset =3D be16_to_cpu(vce->hash_offset) + hash_field_len; + vce->cert_offset =3D cpu_to_be16(cert_offset); + + memcpy((uint8_t *)vce + cert_offset, cert_der, qcert.der_size); + + return 0; +} + +static int build_vce_header(VCEntry *vce, S390IPLCertificate qcert, int id= x) +{ + int algo; + Error *err =3D NULL; + + vce->len =3D cpu_to_be32(VCE_HEADER_LEN); + vce->cert_idx =3D cpu_to_be16(idx + 1); + strncpy((char *)vce->name, (char *)qcert.vc_name, VC_NAME_LEN_BYTES); + + /* public key algorithm */ + algo =3D qcrypto_x509_get_pk_algorithm(qcert.raw, qcert.size, &err); + if (algo < 0) { + error_report_err(err); + return -1; + } + + if (algo =3D=3D QCRYPTO_PK_ALGO_ECDSA) { + vce->key_type =3D DIAG_320_VCE_KEYTYPE_ECDSA; + } else { + vce->key_type =3D DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING; + } + + return 0; +} + +static int build_vce_data(VCEntry *vce, S390IPLCertificate qcert) +{ + uint16_t keyid_field_len; + uint16_t hash_field_len; + uint32_t cert_field_len; + int rc; + + handle_key_id(vce, qcert); + /* vce key id field length - can be 0 if failed to retrieve */ + keyid_field_len =3D ROUND_UP(be16_to_cpu(vce->keyid_len), 4); + + rc =3D handle_hash(vce, qcert, keyid_field_len); + if (rc) { + return -1; + } + hash_field_len =3D ROUND_UP(be16_to_cpu(vce->hash_len), 4); + + rc =3D handle_cert(vce, qcert, hash_field_len); + if (rc || !is_cert_valid(qcert)) { + return -1; + } + /* vce certificate field length */ + cert_field_len =3D ROUND_UP(be32_to_cpu(vce->cert_len), 4); + + /* The certificate is valid and VCE contains the certificate */ + vce->flags |=3D DIAG_320_VCE_FLAGS_VALID; + + /* Update vce length to reflect the acutal size used by vce */ + vce->len +=3D cpu_to_be32(keyid_field_len + hash_field_len + cert_fiel= d_len); + + return 0; +} + +static VCEntry *diag_320_build_vce(S390IPLCertificate qcert, uint32_t vce_= len, int idx) +{ + g_autofree VCEntry *vce =3D NULL; + int rc; + + /* + * Construct VCE + * Allocate enough memory for all certificate data (key id, hash and c= ertificate). + * Unused area following the VCE field contains zeros. + */ + vce =3D g_malloc0(vce_len); + rc =3D build_vce_header(vce, qcert, idx); + if (rc) { + vce->len =3D cpu_to_be32(VCE_INVALID_LEN); + goto out; + } + vce->len =3D cpu_to_be32(VCE_HEADER_LEN); + + rc =3D build_vce_data(vce, qcert); + if (rc) { + vce->len =3D cpu_to_be32(VCE_INVALID_LEN); + } + +out: + return g_steal_pointer(&vce); +} + +static int handle_diag320_store_vc(S390CPU *cpu, uint64_t addr, uint64_t r= 1, uintptr_t ra, + S390IPLCertificateStore *qcs) +{ + g_autofree VCBlock *vcb =3D NULL; + size_t vce_offset; + size_t remaining_space; + uint32_t vce_len; + uint16_t first_vc_index; + uint16_t last_vc_index; + uint32_t in_len; + + vcb =3D g_new0(VCBlock, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcb, sizeof(*vcb))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + in_len =3D be32_to_cpu(vcb->in_len); + first_vc_index =3D be16_to_cpu(vcb->first_vc_index); + last_vc_index =3D be16_to_cpu(vcb->last_vc_index); + + if (in_len % TARGET_PAGE_SIZE !=3D 0) { + return DIAG_320_RC_INVAL_VCB_LEN; + } + + if (first_vc_index > last_vc_index) { + return DIAG_320_RC_BAD_RANGE; + } + + if (first_vc_index =3D=3D 0) { + /* + * Zero is a valid index for the first and last VC index. + * Zero index results in the VCB header and zero certificates retu= rned. + */ + if (last_vc_index =3D=3D 0) { + goto out; + } + + /* DIAG320 certificate store remains a one origin for cert entries= */ + vcb->first_vc_index =3D 1; + first_vc_index =3D 1; + } + + vce_offset =3D VCB_HEADER_LEN; + vcb->out_len =3D VCB_HEADER_LEN; + remaining_space =3D in_len - VCB_HEADER_LEN; + + for (int i =3D first_vc_index - 1; i < last_vc_index && i < qcs->count= ; i++) { + VCEntry *vce; + S390IPLCertificate qcert =3D qcs->certs[i]; + /* + * Each VCE is word aligned. + * Each variable length field within the VCE is also word aligned. + */ + vce_len =3D VCE_HEADER_LEN + + ROUND_UP(qcert.key_id_size, 4) + + ROUND_UP(qcert.hash_size, 4) + + ROUND_UP(qcert.der_size, 4); + + /* + * If there is no more space to store the cert, + * set the remaining verification cert count and + * break early. + */ + if (remaining_space < vce_len) { + vcb->remain_ct =3D cpu_to_be16(last_vc_index - i); + break; + } + + vce =3D diag_320_build_vce(qcert, vce_len, i); + + /* Write VCE */ + if (s390_cpu_virt_mem_write(cpu, addr + vce_offset, r1, + vce, be32_to_cpu(vce->len))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + vce_offset +=3D be32_to_cpu(vce->len); + vcb->out_len +=3D be32_to_cpu(vce->len); + remaining_space -=3D be32_to_cpu(vce->len); + vcb->stored_ct++; + + g_free(vce); + } + + vcb->out_len =3D cpu_to_be32(vcb->out_len); + vcb->stored_ct =3D cpu_to_be16(vcb->stored_ct); + +out: + /* + * Write VCB header + * All VCEs have been populated with the latest information + * and write VCB header last. + */ + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcb, VCB_HEADER_LEN)) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + return DIAG_320_RC_OK; +} + void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { S390CPU *cpu =3D env_archcpu(env); @@ -256,7 +532,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * for now. */ uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | - DIAG_320_ISM_QUERY_VCSI); + DIAG_320_ISM_QUERY_VCSI | + DIAG_320_ISM_STORE_VC); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -282,6 +559,13 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) } env->regs[r1 + 1] =3D rc; break; + case DIAG_320_SUBC_STORE_VC: + rc =3D handle_diag320_store_vc(cpu, addr, r1, ra, qcs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553588; cv=none; d=zohomail.com; s=zohoarc; b=jidevjbO5PZjQIcY7r5mTlqVr55oshDi1/4IYVWBguEEXGdjqR+AI66nPhI6qZrFqbx3UvgsBIpJHLkzpCMRW4DLimXEXzDB6WET0q28P7BvJaJ0X1VQV4BfEo2eC8BqHl4wzmbfsVtA78bx1kqYzRIblZkEFqlczu9vy9sQNBA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553588; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=rm3fELxOOuu1CiT0XpxhilywM4X6QFGJ0LLNUY5NYYQ=; b=Jga+eLh86l2KMLFiTp7XyZmKTWG9SvYGjVVgw/nvMompd63qgMSPRLYXJfUsX3cG7NRi1JdA4WSaoLvZtEwC1XxT6/skym2HczQbYOyHw7Bwtmo33uSGEIZ0L18xsiu8rlBKjvy0pDlQ5m2vfg0GmmFks0HkVdVrhynIlB88uww= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553588100217.93549423871923; Mon, 18 Aug 2025 14:46:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eW-0001yB-7d; Mon, 18 Aug 2025 17:44:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7do-0001gj-M5; Mon, 18 Aug 2025 17:43:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dm-0003lx-S2; Mon, 18 Aug 2025 17:43:44 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IEHcw1011891; Mon, 18 Aug 2025 21:43:40 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhny3geu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:40 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKROol002397; Mon, 18 Aug 2025 21:43:39 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9w4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:39 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhbXK31392326 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:37 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8BBEF5805D; Mon, 18 Aug 2025 21:43:37 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4302A58057; Mon, 18 Aug 2025 21:43:36 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:36 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rm3fELxOOuu1CiT0X pxhilywM4X6QFGJ0LLNUY5NYYQ=; b=ffGJQrYG2QuTvcQ2K703AUWFqjt7Wmn/g 4h/Tsr55kYXQhdTQqeGf00eZ97rUTX7grWl0UzRVV8hRsyJr3B2rgGsEvpG5ATih 7Pi/sJqCO+SKkRWf7j04rgYsXuWNnOFEcm1166pDzzgoMfR0DW60TKF5ndyC9trL bvZne3GBKQBg2+L7SpH62OeV3dvp0HGiQt5+pzjhAOSUxDbvvu4wUrNXHKaN2U/Z rci+Up0vwjLs5B7H5nZGpZBdGKXn6kbr2xdiD1GPqaMu/KdSfWEyUJe0kP191WBB TmcblLcaCVSyMM6gU4v4ZqFApe7lp/O+/mYEnaqsHT5VNSd+rPUKw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 10/29] s390x/diag: Introduce DIAG 508 for secure IPL operations Date: Mon, 18 Aug 2025 17:43:03 -0400 Message-ID: <20250818214323.529501-11-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XbqJzJ55 c=1 sm=1 tr=0 ts=68a39e8c cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=hXQcL9AfcS-IPDpH2m0A:9 X-Proofpoint-ORIG-GUID: yOEIGaaf-gZWsLOCRSV68k2ecQg5as5e X-Proofpoint-GUID: yOEIGaaf-gZWsLOCRSV68k2ecQg5as5e X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX7+Lf1u5l+Zw4 BR0ZbqD3+V/CbwHWbG9liuOifXSX2+t6qH6oteTz4PJ8+y8hKk2ZElCir/sn43slK+n61yhIAdc CIifMwtrZ0SPEDwouTeyanVW4r59+On7BLZ00oIukrdHgJ/BHi3EkHZ169oQucTNmriF5NjEuvu eBGDHnQctaD37Juy43E4TeOCZUrH0ze0TiiUijy4r0YtOijmiGR8yPxPiNOT0hbuA4o0vHp0zr6 7Jh7caeCElSevceHxHHnJYsO2LROFbzbGC3sv5v61z46fTlLxc1lMpPUdPJKFgk+NRW7cNdStye zWCM355ThA4KwhXQcoXqW6L4kmXA3oEjDxbWMDkBfqInS+R0GHnc3Vem1pA4Zh9EQBiYsOUaiTV to4ZbFxF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 adultscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 malwarescore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553590589124101 Content-Type: text/plain; charset="utf-8" From: Collin Walling In order to support secure IPL (aka secure boot) for the s390-ccw BIOS, a new s390 DIAGNOSE instruction is introduced to leverage QEMU for handling operations such as signature verification and certificate retrieval. Currently, only subcode 0 is supported with this patch, which is used to query a bitmap of which subcodes are supported. Signed-off-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 18 ++++++++++++++++++ include/hw/s390x/ipl/diag508.h | 15 +++++++++++++++ target/s390x/diag.c | 27 +++++++++++++++++++++++++++ target/s390x/kvm/kvm.c | 14 ++++++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++++ 6 files changed, 83 insertions(+) create mode 100644 include/hw/s390x/ipl/diag508.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 16868aa823..6b3249173f 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -46,3 +46,21 @@ Subcode 2 - store verification certificates storage specified in the VCB input length field. =20 VCE contains various information of a VC from the CS. + + +Secure IPL Data Structures, Facilities, and Functions +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D + +DIAGNOSE function code 'X'508' - KVM IPL extensions +--------------------------------------------------- + +DIAGNOSE 'X'508' is reserved for KVM guest use in order to facilitate +communication of additional IPL operations that cannot be handled by users= pace, +such as signature verification for secure IPL. + +If the function code specifies 0x508, KVM IPL extension functions are perf= ormed. +These functions are meant to provide extended functionality for s390 guest= boot +that requires assistance from QEMU. + +Subcode 0 - query installed subcodes + Returns a 64-bit mask indicating which subcodes are supported. diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h new file mode 100644 index 0000000000..6281ad8299 --- /dev/null +++ b/include/hw/s390x/ipl/diag508.h @@ -0,0 +1,15 @@ +/* + * S/390 DIAGNOSE 508 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Collin Walling + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG508_H +#define S390X_DIAG508_H + +#define DIAG_508_SUBC_QUERY_SUBC 0x0000 + +#endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 820f45a0bd..6519a3cedc 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -20,6 +20,7 @@ #include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" +#include "hw/s390x/ipl/diag508.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -571,3 +572,29 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) break; } } + +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + uint64_t subcode =3D env->regs[r3]; + int rc; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if ((subcode & ~0x0ffffULL) || (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + switch (subcode) { + case DIAG_508_SUBC_QUERY_SUBC: + rc =3D 0; + break; + default: + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + env->regs[r1 + 1] =3D rc; +} diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 5510fc2fc5..ae6cd3d506 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -101,6 +101,7 @@ #define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 +#define DIAG_SECURE_IPL 0x508 =20 #define ICPT_INSTRUCTION 0x04 #define ICPT_PROGRAM 0x08 @@ -1571,6 +1572,16 @@ static void kvm_handle_diag_320(S390CPU *cpu, struct= kvm_run *run) handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); } =20 +static void kvm_handle_diag_508(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_508(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1604,6 +1615,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_CERT_STORE: kvm_handle_diag_320(cpu, run); break; + case DIAG_SECURE_IPL: + kvm_handle_diag_508(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index ecff2d07a1..7cca8a67de 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -393,6 +393,8 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra); void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index 412c34ed93..ddbf495118 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -149,6 +149,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) bql_unlock(); r =3D 0; break; + case 0x508: + /* secure ipl operations */ + bql_lock(); + handle_diag_508(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553578; cv=none; d=zohomail.com; s=zohoarc; b=dG0IiF0MvYGzDUekraxoH0tpRw4O4Mi4h0V0SNgpimptEbg2ne1Tp0iYHFXI788iJaYYyk0sMqKrQwhvWA0YnkvBPG02msV9+nNuYRIf3/vPbvd6ssBy1jTBbm3plOd0xFenACez/HVbTnvpWSeLl/i+t9xjrca1FUzCpkofunc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553578; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5hzX6zzvOb1EfclVIP0O6jxDqootMn/oL420wqUNcSg=; b=jCr4WKEkE7SuJhhGEN5+JA4Ok2wPyH4oQPcOrICfRDWnRKcEp+tjXCPnQMoHH0azRmzO2jTt5ajej0PNV4DOY2dqpPI5GJMU0Pf5X+jL26A2uHD9GcWHLzdpD2ShVim6Hp/jeyqYpigU3vc9sIwmZ/44wXFawb0I+tAlu2YFKu0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553578197733.6963510176179; Mon, 18 Aug 2025 14:46:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eX-0001zJ-Rs; Mon, 18 Aug 2025 17:44:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dp-0001gk-E9; Mon, 18 Aug 2025 17:43:46 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dn-0003m6-Er; Mon, 18 Aug 2025 17:43:45 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ID7cao031324; Mon, 18 Aug 2025 21:43:41 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cnu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:40 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKJKmA002381; Mon, 18 Aug 2025 21:43:40 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9w5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:40 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhdmh20709892 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:39 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 14A5C58057; Mon, 18 Aug 2025 21:43:39 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A3C7B58058; Mon, 18 Aug 2025 21:43:37 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:37 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=5hzX6z zvOb1EfclVIP0O6jxDqootMn/oL420wqUNcSg=; b=GwHX6wgDp6LkGWtZORpr2L 5xiLxfnHkdog3tCSxdRk1G/Ky6YkHwKSG65wExZPBYY8/GtVFl31vu+Jq8WvfoB2 1CUItZx+gExFePpnVXAtcOO4sCARmpBgHChFBb8QU3pFJ7xg+Y58buYgB9oGVyHE XCEkAmmk8KrZ+T/u4AwhfvSSaj0rJ6ixOzrFcpvMMPl4mtBqm0MicJ1Uqa2OaNSB Tr/WhGyO/PO4Rm9shTVj9rGszjczonUOYX9oCt34K5kJYjLI1SYxgFSVA0haojsh ZY7lPvWHEpc8I9NmlFQSy5oRPglolZDbHgDYe3wdUhBaOAUWTDBxMqxCCygzzO+Q == From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 11/29] crypto/x509-utils: Add helper functions for DIAG 508 subcode 1 Date: Mon, 18 Aug 2025 17:43:04 -0400 Message-ID: <20250818214323.529501-12-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _Sm9C0wKQx291DhepiDPSUX1Tq1vdwEP X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e8d cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=Ehcw9bocbOASTidboh8A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-GUID: _Sm9C0wKQx291DhepiDPSUX1Tq1vdwEP X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX3b3VP9bo/KFH Q6AYSSxHPNF7MCVN5LdoN6M0p46hOdu3aIPKgAp68FurNg5+E5swA/kJjrgmOAA67zcu2NuB4im CdXJGVtRZHy6wEw4AVRMAM/+8pd4tUO1TCVyXTSpb5dJHUpvLXjZcAUvTpa/2LB48wgZKV4Ru6r OpblCBm7bVPoesuw5P8anXL9aXh4KzCSprpkJ4TanrjAHlgddcN34X36yVqkWgO0wIA78lLnFI0 I9x39BNT/ETRc4+w0isBzNxtBI9/XulKNf35W7RCu1MJHSx8vN9E4NYDBWuC5zUbA9KlUGPDoTX ZvQEuNnsiVJeNrUmrBAeAbAMwrQ7EsfGU/W5fH+GJtU1U7GmX68xRYvIqHd4e0rhgLSswbcUnhe yjU9wUL1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553579931124100 Introduce helper functions to support signature verification required by DIAG 508 subcode 1: qcrypto_pkcs7_convert_sig_pem() =E2=80=93 converts a signature from DER to = PEM format qcrypto_x509_verify_sig() =E2=80=93 verifies the provided data against the = given signature These functions enable basic signature verification support. Signed-off-by: Zhuoying Cai --- crypto/x509-utils.c | 108 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 39 +++++++++++++ 2 files changed, 147 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 67b42aad1f..f582e2ee48 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -16,6 +16,7 @@ #include #include #include +#include =20 static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_HASH_ALGO__MAX] = =3D { [QCRYPTO_HASH_ALGO_MD5] =3D GNUTLS_DIG_MD5, @@ -275,6 +276,96 @@ cleanup: return ret; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_pkcs7_t signature; + gnutls_datum_t sig_datum_der =3D {.data =3D sig, .size =3D sig_size}; + gnutls_datum_t sig_datum_pem =3D { 0, }; + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initalize pkcs7 data: %s", gnutls_stre= rror(rc)); + return ret; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum_der, GNUTLS_X509_FMT_= DER); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_export2(signature, GNUTLS_X509_FMT_PEM, &sig_datum= _pem); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert signature to PEM format: %s", + gnutls_strerror(rc)); + gnutls_free(sig_datum_pem.data); + goto cleanup; + } + + *result =3D g_steal_pointer(&sig_datum_pem.data); + *resultlen =3D sig_datum_pem.size; + + ret =3D 0; + +cleanup: + gnutls_pkcs7_deinit(signature); + return ret; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt =3D NULL; + gnutls_pkcs7_t signature =3D NULL; + gnutls_datum_t cert_datum =3D {.data =3D cert, .size =3D cert_size}; + gnutls_datum_t data_datum =3D {.data =3D comp, .size =3D comp_size}; + gnutls_datum_t sig_datum =3D {.data =3D sig, .size =3D sig_size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_import(crt, &cert_datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initalize pkcs7 data: %s", gnutls_stre= rror(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum , GNUTLS_X509_FMT_PEM= ); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_verify_direct(signature, crt, 0, &data_datum, 0); + if (rc !=3D 0) { + error_setg(errp, "Failed to verify signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + gnutls_pkcs7_deinit(signature); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -318,4 +409,21 @@ int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t= size, return -1; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export pkcs7 signature"); + return -1; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + error_setg(errp, "GNUTLS is required for signature-verification suppor= t"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index f169df81cb..c4073fd265 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -97,4 +97,43 @@ int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t s= ize, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_pkcs7_convert_sig_pem + * @sig: pointer to the PKCS#7 signature in DER format + * @sig_size: size of the signature + * @result: output location for the allocated buffer for the signature in = PEM format + (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + (will be updated with the actual size of the PEM-encoded si= gnature) + * @errp: error pointer + * + * Convert given PKCS#7 @sig from DER to PEM format. + * + * Returns: 0 if PEM-encoded signature was successfully stored in @result, + * -1 on error. + */ +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp); + +/** + * qcrypto_x509_verify_sig + * @cert: pointer to the raw certificate data + * @cert_size: size of the certificate + * @comp: pointer to the component to be verified + * @comp_size: size of the component + * @sig: pointer to the signature + * @sig_size: size of the signature + * @errp: error pointer + * + * Verify the provided @comp against the @sig and @cert. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp); + #endif --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553745; cv=none; d=zohomail.com; s=zohoarc; b=ebFJMzgIqK01AxGxq0aDkRJbNmzon0ZqGW0zbtdcvlV1V1hV86oD6xzUol1Th8SAQSyQOGFrSmEdPwMkQrt5QTMz8EgiaX80/X+J+P0GOcPUBF4kBF7B05R3xzjTCoOzXq3jEN2wEh/9K1AX3yhiy5vTBbTgIWYOsEyJ4bqIRvw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553745; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5sCY091RE+vTIef3gkdp/DqTC7/Pdj4qMj960hJor/0=; b=mezxc6QGVBajb18YbrfqFHr+hKKaWjaybScDGzCe6vlXxzgz2TLefup1HU65rBdLJlJsaab0h27+tRIV8q3dFZV+prMtx8Urv9D+bX6+bBLqXlszDBBC0cO7IIXPlY0s8wJE84qojG9+O0xr5A99DIPAzVRlf9c3br2vkTj/xqw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553745541912.2566311362275; Mon, 18 Aug 2025 14:49:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eV-0001xG-30; Mon, 18 Aug 2025 17:44:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0001ou-Ip; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dq-0003mY-2Z; Mon, 18 Aug 2025 17:44:09 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHpNKZ025716; Mon, 18 Aug 2025 21:43:43 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhq9ugj5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:43 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ9QTE014728; Mon, 18 Aug 2025 21:43:41 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgnq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:41 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhe4b26083718 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:40 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 37BB258057; Mon, 18 Aug 2025 21:43:40 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2DBC258058; Mon, 18 Aug 2025 21:43:39 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:39 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5sCY091RE+vTIef3g kdp/DqTC7/Pdj4qMj960hJor/0=; b=AiACi4KW+twRwt1V+NnuVhOdQo+NnjaJq KHcAPkN/58Kuuqh5TykE8tlK31ddWqYSbPjb6chDSkEA7MvRXAIf9X/L3zOgJ3pD gZyE63qIugzTtVHDy7ITzO/Y7Z8GlAkkpBLOPz4dwKS2HET2t7Iy6ICEXu9VL60/ jDgxL5PGTtTsxAJhzlt6aT9iLy5l4QsIcqNmkUzLBixXTG6jnuUJGdt1I5cwvxJJ P4f2yyNfK6R3kCWualmSQ5J7Wjzkq6c6M0pPh43ZcdhBPb50jXY/GyuIlLW6Sryf fUUb5MBDtFnPp9mw9CGofQ2PQnVuxR4ucDYBIS3TiU19TALZGaGiw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 12/29] s390x/diag: Implement DIAG 508 subcode 1 for signature verification Date: Mon, 18 Aug 2025 17:43:05 -0400 Message-ID: <20250818214323.529501-13-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=N50pF39B c=1 sm=1 tr=0 ts=68a39e8f cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=QUeH2xgz5R9ERI6wYg0A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX26j1X59KjhXw lUGj7ZULR2/1WDQdW0w6YaOdgkWmSJcqsbDrhQ8BySIZbZ7Bc9O72L4pH2QoI1nbVqQWkyKyyxR KqHiT1BaFy5m+SLCDRN54NNvEs6/oyYT+SWvZCV7uvC8/dxomp1E+NZjEMC52bob4ahK3cMdQbF VDtM1XFpJGdy6NNVL+HXyBauVNLzcwaAgQ3EUlnwbOodxrfgcgIkYiEXi735rGhbECDvEUBBdnZ DCBkNQJ/wX6QPqnqGKbVCnuSyqEP+Lon+/ZMAf2QewYUPNqs45ThMp7tWDlBKQqp+kW97yY/bFk AoZzPf9lfhSyrjOiimNqOZ9mOkRtv+xaJD+VVXXpjjBMngoXwtTWOoC20pyGyP+rMOHDpq6Re1N vj4qpJU0 X-Proofpoint-GUID: Y5DKEQ3N9iNHSZva8BVcEgC4_l59lZqG X-Proofpoint-ORIG-GUID: Y5DKEQ3N9iNHSZva8BVcEgC4_l59lZqG X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553748133124100 Content-Type: text/plain; charset="utf-8" From: Collin Walling DIAG 508 subcode 1 performs signature-verification on signed components. A signed component may be a Linux kernel image, or any other signed binary. **Verification of initrd is not supported.** The instruction call expects two item-pairs: an address of a device component, an address of the analogous signature file (in PKCS#7 DER format= ), and their respective lengths. All of this data should be encapsulated within a Diag508SignatureVerificationBlock, with the CertificateStoreInfo fields ignored. The DIAG handler will read from the provided addresses to retrieve the necessary data, parse the signature file, then perform the signature-verification. Because there is no way to correlate a specific certificate to a component, each certificate in the store is tried until either verification succeeds, or all certs have been exhausted. The subcode value is denoted by setting the second-to-left-most bit of a 2-byte field. A return code of 1 indicates success, and the index and length of the corresponding certificate will be set in the CertificateStoreInfo portion of the SigVerifBlock. The following values indicate failure: 0x0102: certificate not available 0x0202: component data is invalid 0x0302: signature is not in PKCS#7 format 0x0402: signature-verification failed Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai --- docs/specs/s390x-secure-ipl.rst | 5 ++ include/hw/s390x/ipl/diag508.h | 23 +++++++ target/s390x/diag.c | 112 +++++++++++++++++++++++++++++++- 3 files changed, 139 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 6b3249173f..385f8d85a8 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -64,3 +64,8 @@ that requires assistance from QEMU. =20 Subcode 0 - query installed subcodes Returns a 64-bit mask indicating which subcodes are supported. + +Subcode 1 - perform signature verification + Perform signature-verification on a signed component, using certificat= es + from the certificate store and leveraging qcrypto libraries to perform + this operation. diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h index 6281ad8299..c99c6705c0 100644 --- a/include/hw/s390x/ipl/diag508.h +++ b/include/hw/s390x/ipl/diag508.h @@ -11,5 +11,28 @@ #define S390X_DIAG508_H =20 #define DIAG_508_SUBC_QUERY_SUBC 0x0000 +#define DIAG_508_SUBC_SIG_VERIF 0x8000 + +#define DIAG_508_RC_OK 0x0001 +#define DIAG_508_RC_NO_CERTS 0x0102 +#define DIAG_508_RC_INVAL_COMP_DATA 0x0202 +#define DIAG_508_RC_INVAL_PKCS7_SIG 0x0302 +#define DIAG_508_RC_FAIL_VERIF 0x0402 + +struct Diag508CertificateStoreInfo { + uint8_t idx; + uint8_t reserved[7]; + uint64_t len; +}; +typedef struct Diag508CertificateStoreInfo Diag508CertificateStoreInfo; + +struct Diag508SignatureVerificationBlock { + Diag508CertificateStoreInfo csi; + uint64_t comp_len; + uint64_t comp_addr; + uint64_t sig_len; + uint64_t sig_addr; +}; +typedef struct Diag508SignatureVerificationBlock Diag508SignatureVerificat= ionBlock; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 6519a3cedc..2fe25a2c66 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -573,9 +573,107 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1,= uint64_t r3, uintptr_t ra) } } =20 +static int diag_508_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size) +{ + g_autofree uint8_t *sig_pem =3D NULL; + size_t sig_size_pem; + int rc; + + /* + * PKCS#7 signature with DER format + * Convert to PEM format for signature verification + */ + rc =3D qcrypto_pkcs7_convert_sig_pem(sig, sig_size, &sig_pem, &sig_siz= e_pem, NULL); + if (rc < 0) { + return -1; + } + + /* + * Ignore errors from signature format convertion and verification, + * because currently in the certificate lookup process. + * + * Any error is treated as a verification failure, + * and the final result (verified or not) will be reported later. + */ + rc =3D qcrypto_x509_verify_sig(cert, cert_size, + comp, comp_size, + sig_pem, sig_size_pem, NULL); + if (rc < 0) { + return -1; + } + + return 0; +} + +static int handle_diag508_sig_verif(uint64_t addr, size_t csi_size, size_t= svb_size, + S390IPLCertificateStore *qcs) +{ + int rc; + int verified; + uint64_t comp_len, comp_addr; + uint64_t sig_len, sig_addr; + g_autofree uint8_t *svb_comp =3D NULL; + g_autofree uint8_t *svb_sig =3D NULL; + g_autofree Diag508SignatureVerificationBlock *svb =3D NULL; + + if (!qcs || !qcs->count) { + return DIAG_508_RC_NO_CERTS; + } + + svb =3D g_new0(Diag508SignatureVerificationBlock, 1); + cpu_physical_memory_read(addr, svb, svb_size); + + comp_len =3D be64_to_cpu(svb->comp_len); + comp_addr =3D be64_to_cpu(svb->comp_addr); + sig_len =3D be64_to_cpu(svb->sig_len); + sig_addr =3D be64_to_cpu(svb->sig_addr); + + if (!comp_len || !comp_addr) { + return DIAG_508_RC_INVAL_COMP_DATA; + } + + if (!sig_len || !sig_addr) { + return DIAG_508_RC_INVAL_PKCS7_SIG; + } + + svb_comp =3D g_malloc0(comp_len); + cpu_physical_memory_read(comp_addr, svb_comp, comp_len); + + svb_sig =3D g_malloc0(sig_len); + cpu_physical_memory_read(sig_addr, svb_sig, sig_len); + + rc =3D DIAG_508_RC_FAIL_VERIF; + /* + * It is uncertain which certificate contains + * the analogous key to verify the signed data + */ + for (int i =3D 0; i < qcs->count; i++) { + verified =3D diag_508_verify_sig(qcs->certs[i].raw, + qcs->certs[i].size, + svb_comp, comp_len, + svb_sig, sig_len); + if (verified =3D=3D 0) { + svb->csi.idx =3D i; + svb->csi.len =3D cpu_to_be64(qcs->certs[i].der_size); + cpu_physical_memory_write(addr, &svb->csi, be32_to_cpu(csi_siz= e)); + rc =3D DIAG_508_RC_OK; + break; + } + } + + return rc; +} + +QEMU_BUILD_BUG_MSG(sizeof(Diag508SignatureVerificationBlock) !=3D 48, + "size of Diag508SignatureVerificationBlock is wrong"); + void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { + S390IPLCertificateStore *qcs =3D s390_ipl_get_certificate_store(); uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { @@ -590,7 +688,19 @@ void handle_diag_508(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 switch (subcode) { case DIAG_508_SUBC_QUERY_SUBC: - rc =3D 0; + rc =3D DIAG_508_SUBC_SIG_VERIF; + break; + case DIAG_508_SUBC_SIG_VERIF: + size_t csi_size =3D sizeof(Diag508CertificateStoreInfo); + size_t svb_size =3D sizeof(Diag508SignatureVerificationBlock); + + if (!diag_parm_addr_valid(addr, svb_size, false) || + !diag_parm_addr_valid(addr, csi_size, true)) { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag508_sig_verif(addr, csi_size, svb_size, qcs); break; default: s390_program_interrupt(env, PGM_SPECIFICATION, ra); --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553628; cv=none; d=zohomail.com; s=zohoarc; b=mDABR/M2bhGIf7y4XJNlJagoJ/cKQzyBx3ovJ8WACQeSUjqecWNs6fCKVLoOU13S4wPQ4xYrzIc1h+ULCFEhyAwxFivC1YOFPtQpJ1aECcS658SsMxWvEomViwzdJW091R3XIHQ7guM74UdLhECPLy2tbXU1NAPOSDTiAGKuhis= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553628; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zVsRMy487YGqQYGnZb7xNwEfj7PaB5rOAdrql2G9ZBU=; b=EcgBRbVIcWS4m8MXSOPMRiSCXVqquHSsd5m70zb2SPIDy+qo/KXU64XKsGrPZAjZQOtV0ly9qSqnDB7nqfEiLqMP/sk507QgF3nMwcWkm4ngoQIKcCx9QdG8+cdqBqtqjs/nf8Rp/ro5t2/JB+bT9YGeMkiGsAzsl3W9i2Ujerg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553628473773.3787941806166; Mon, 18 Aug 2025 14:47:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ef-0002AI-Ai; Mon, 18 Aug 2025 17:44:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eH-0001p1-1K; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ds-0003mf-73; Mon, 18 Aug 2025 17:44:12 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ILWDJ2027407; Mon, 18 Aug 2025 21:43:44 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cnw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:44 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHQGrE011893; Mon, 18 Aug 2025 21:43:43 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k4au7r8m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:43 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhf3R6357688 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:41 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5002D58057; Mon, 18 Aug 2025 21:43:41 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 517F258058; Mon, 18 Aug 2025 21:43:40 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zVsRMy487YGqQYGnZ b7xNwEfj7PaB5rOAdrql2G9ZBU=; b=tIQgTQ6cL88nMOAwcLKeZpV+PGotcxGIU HzaR1lboNPuIJOU5W3dOG8C9bxjT5yNSUv2bvgzfLfIG428brftaYIdga2nHNB66 +qwo0MN/OtMAbYS/l1LaMX5Fu1oCeRMaoiRfdHULxm/ds+UREprIBfIOyedT6G/b Rm6C+mQxFvomTjFJdVs/aztUfUA98v373R1UfUaERWMGJS7NLqY96m2mTV+ivXuc QTW2irVsKNJZ9ht9vwxpnjnwL/E/oI/khkgbPlXm5SNb3kXBa4gOCQQRH8prlSOB QMVwaWYmLqQGrn5RlFM2WlTWx6xkuOn6eGj9b1fBA8T0gDCEh6GJA== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 13/29] pc-bios/s390-ccw: Introduce IPL Information Report Block (IIRB) Date: Mon, 18 Aug 2025 17:43:06 -0400 Message-ID: <20250818214323.529501-14-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: YwWHryfinL9UWaqMO5OfW3Mi-LHiXlar X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e90 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=1JLT7A-2tSAM-sJnsQYA:9 X-Proofpoint-GUID: YwWHryfinL9UWaqMO5OfW3Mi-LHiXlar X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX1/6VPndZ/A76 HTMUA8Tk9L48RaSvWr6m2gF0RIZDSMvg7oKO0U0g4TC1kChpcfyqcwGCS5XoOoOPYtnhheMpQmd LFi68kOECWDwl70dQbISqGH6NMMdveP+nujtFlmcWONueIpWcQdw/sTLDE2+DJyJhsYiep3peEJ ixKzBoqGOxymx7BgDrfgekK47Omb8yjEYvfB7UqDNpOt9qnBECGRRnzl78CvgTV0gpDEsoPNDpo htqIxe/9EzCxrEziP5vyxvk0dL6+iF63OhzB7Aa3YJsvzA1D/64TmnBK4/ocSAZ0MMLE2TXLRJe EczAEkpCIjqubkhprbfPBxOwidRg8jLDQnxK6ZTVuHsrXNM4cyjP54W428EynRRUBs5iqT6l+Gb 3rVaE+qj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553630655124100 Content-Type: text/plain; charset="utf-8" The IPL information report block (IIRB) contains information used to locate IPL records and to report the results of signature verification of one or more secure components of the load device. IIRB is stored immediately following the IPL Parameter Block. Results on component verification in any case (failure or success) are stored. Signed-off-by: Zhuoying Cai --- docs/specs/s390x-secure-ipl.rst | 14 ++++++++ pc-bios/s390-ccw/iplb.h | 62 +++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 385f8d85a8..4bc330c399 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -69,3 +69,17 @@ Subcode 1 - perform signature verification Perform signature-verification on a signed component, using certificat= es from the certificate store and leveraging qcrypto libraries to perform this operation. + + +IPL Information Report Block +---------------------------- + +The IPL Parameter Block (IPLPB), utilized for IPL operation, is extended w= ith an +IPL Information Report Block (IIRB), which contains the results from secur= e IPL +operations such as: + +* component data +* verification results +* certificate data + +The guest kernel will inspect the IIRB and build the keyring. diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index 08f259ff31..bdbc733e16 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -23,6 +23,68 @@ extern QemuIplParameters qipl; extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); extern bool have_iplb; =20 +struct IplInfoReportBlockHeader { + uint32_t len; + uint8_t iirb_flags; + uint8_t reserved1[2]; + uint8_t version; + uint8_t reserved2[8]; +} __attribute__ ((packed)); +typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; + +struct IplInfoBlockHeader { + uint32_t len; + uint8_t ibt; + uint8_t reserved1[3]; + uint8_t reserved2[8]; +} __attribute__ ((packed)); +typedef struct IplInfoBlockHeader IplInfoBlockHeader; + +enum IplIbt { + IPL_IBT_CERTIFICATES =3D 1, + IPL_IBT_COMPONENTS =3D 2, +}; + +struct IplSignatureCertificateEntry { + uint64_t addr; + uint64_t len; +} __attribute__ ((packed)); +typedef struct IplSignatureCertificateEntry IplSignatureCertificateEntry; + +struct IplSignatureCertificateList { + IplInfoBlockHeader ipl_info_header; + IplSignatureCertificateEntry cert_entries[MAX_CERTIFICATES]; +} __attribute__ ((packed)); +typedef struct IplSignatureCertificateList IplSignatureCertificateList; + +#define S390_IPL_COMPONENT_FLAG_SC 0x80 +#define S390_IPL_COMPONENT_FLAG_CSV 0x40 + +struct IplDeviceComponentEntry { + uint64_t addr; + uint64_t len; + uint8_t flags; + uint8_t reserved1[5]; + uint16_t cert_index; + uint8_t reserved2[8]; +} __attribute__ ((packed)); +typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; + +struct IplDeviceComponentList { + IplInfoBlockHeader ipl_info_header; + IplDeviceComponentEntry device_entries[MAX_CERTIFICATES]; +} __attribute__ ((packed)); +typedef struct IplDeviceComponentList IplDeviceComponentList; + +#define COMP_LIST_MAX sizeof(IplDeviceComponentList) +#define CERT_LIST_MAX sizeof(IplSignatureCertificateList) + +struct IplInfoReportBlock { + IplInfoReportBlockHeader hdr; + uint8_t info_blks[COMP_LIST_MAX + CERT_LIST_MAX]; +} __attribute__ ((packed)); +typedef struct IplInfoReportBlock IplInfoReportBlock; + #define S390_IPL_TYPE_FCP 0x00 #define S390_IPL_TYPE_CCW 0x02 #define S390_IPL_TYPE_QEMU_SCSI 0xff --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553574; cv=none; d=zohomail.com; s=zohoarc; b=ZdABsmT9GPeJ9Om43rgSK0m7eu/BKI9Cq/61b3gRJHr8WG6gUi8UpRGUi5QytHV+tAWxaVOoyd8u6u8B9fbgZxhjTFohleGxHuthPNBc20e+YTSP9yS5kQJ5wuGm1Hs+06EOF0MfVgL+x5R+yh+hVbFuI3CUrtrrybYM9Ez67Ng= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553574; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=h/9gLqKZ2pwi+5jMezmd7tVq/SfgaUSCgXtI9/dn5jE=; b=cgGm/Y0HoWxXsUIlpbLi/5MlqHqspm0qcc+IG+LazMBtciskZwD61VVQxyv4HFGSo3Mz28CzqhIonRrmWLyTAbHTdKqg5F5QZASZmA2i8FN39dysnQ42Z5HB4xyossHBQIjDrzL38mzSQaRcEsddp7naLWo/a+Yux4kZqU5wgw8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553574207203.0663057566718; Mon, 18 Aug 2025 14:46:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eT-0001w7-S2; Mon, 18 Aug 2025 17:44:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0001ot-HJ; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7dq-0003md-5d; Mon, 18 Aug 2025 17:43:52 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IBbanp031118; Mon, 18 Aug 2025 21:43:44 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jfdrujja-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:44 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ9QTF014728; Mon, 18 Aug 2025 21:43:44 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgns-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:44 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhYqP21955174 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:34 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 68DCA58059; Mon, 18 Aug 2025 21:43:42 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 67DC858058; Mon, 18 Aug 2025 21:43:41 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:41 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=h/9gLqKZ2pwi+5jMe zmd7tVq/SfgaUSCgXtI9/dn5jE=; b=gIqEGzGj5bi4RwtBhKLIpcVc/LbsF/0Nh MUo7Ch88AMeo0n22sJEOeZXfUDy6015ewNTNvPHvqRJD/NMEe2Mfx9QbjSBl5jsI 9aMSrOaFDwouXV/i1BAJXO7Qa4VRU4qltXZlU5IxpRxUwxf1q7UqE8AxUKxSo9KE xrHoUS59p2hikt99f4I69JZjwwqR3XKsWFEhgWbqdj6Z2f/ycG+s1P+3Np4tB+So WBGlw+VOIObCYs2FaXvpsY4NIPnppl0mB8x9M05mj3JSAHFUmnhycP1yaYuzUZHE NMcEtpNWpjhg+We1z3oWiorPDeA3ecYJSMBzrGAarg2Swm2WNA3ng== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 14/29] pc-bios/s390-ccw: Define memory for IPLB and convert IPLB to pointers Date: Mon, 18 Aug 2025 17:43:07 -0400 Message-ID: <20250818214323.529501-15-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 5C_WkDAQMnpc2iufOlCi2H6GIICQJ4li X-Proofpoint-GUID: 5C_WkDAQMnpc2iufOlCi2H6GIICQJ4li X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAwMSBTYWx0ZWRfX6ibOmCuavB2V 8+Qj/Aj//QT0LiCaa5S3jf+84cuKsTNBVZBAX3OXPfzH52KAXZdXsB91lPuw79cLcQS0t56V8Xp dl68LRE5Ji94ddLSCsMTv6NzVQ77tOhyhwkOL2MKotn7A09nUhpH1LcCEZfZVWqKiCIXDWbO2HB bD53zvp16i0XaFbfScO5RBb8dAfKjXD1kckHH/F0ODSDFllq5ul0mPAeekeYUHcutqxrb2GaOGD 8q4hiOlPb6afsrGzvE3UvbYiPnXRkiyzgCVFmjoUFiMo26qMqzQlgTg/KO9V65cGgsPm7KGqItd 6OCxKiRgTWd9zvvPk/V9JEyNFx/Jr90vA+Wjh4gmPey8w50fVR4ACpKebeyVc20g20jcQj0p2eb 7xFzD8lq X-Authority-Analysis: v=2.4 cv=GotC+l1C c=1 sm=1 tr=0 ts=68a39e90 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=_GZQR2ZoBes7ElOevS0A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160001 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553576013124100 Content-Type: text/plain; charset="utf-8" Define a memory space for both IPL Parameter Block (IPLB) and IPL Information Report Block (IIRB) since IIRB is stored immediately following IPLB. Convert IPLB to pointer and it points to the start of the defined memory sp= ace. IIRB points to the end of IPLB. Signed-off-by: Zhuoying Cai --- pc-bios/s390-ccw/iplb.h | 12 ++++++++++-- pc-bios/s390-ccw/jump2ipl.c | 6 +++--- pc-bios/s390-ccw/main.c | 34 +++++++++++++++++++--------------- pc-bios/s390-ccw/netmain.c | 8 ++++---- 4 files changed, 36 insertions(+), 24 deletions(-) diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index bdbc733e16..11302e004d 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -20,7 +20,7 @@ #include =20 extern QemuIplParameters qipl; -extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +extern IplParameterBlock *iplb; extern bool have_iplb; =20 struct IplInfoReportBlockHeader { @@ -85,6 +85,14 @@ struct IplInfoReportBlock { } __attribute__ ((packed)); typedef struct IplInfoReportBlock IplInfoReportBlock; =20 +struct IplBlocks { + IplParameterBlock iplb; + IplInfoReportBlock iirb; +} __attribute__ ((packed)); +typedef struct IplBlocks IplBlocks; + +extern IplBlocks ipl_data __attribute__((__aligned__(PAGE_SIZE))); + #define S390_IPL_TYPE_FCP 0x00 #define S390_IPL_TYPE_CCW 0x02 #define S390_IPL_TYPE_QEMU_SCSI 0xff @@ -127,7 +135,7 @@ static inline bool load_next_iplb(void) =20 qipl.index++; next_iplb =3D (IplParameterBlock *) qipl.next_iplb; - memcpy(&iplb, next_iplb, sizeof(IplParameterBlock)); + memcpy(iplb, next_iplb, sizeof(IplParameterBlock)); =20 qipl.chain_len--; qipl.next_iplb =3D qipl.next_iplb + sizeof(IplParameterBlock); diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c index 86321d0f46..fa2ca5cbe1 100644 --- a/pc-bios/s390-ccw/jump2ipl.c +++ b/pc-bios/s390-ccw/jump2ipl.c @@ -43,11 +43,11 @@ int jump_to_IPL_code(uint64_t address) * The IPLB for QEMU SCSI type devices must be rebuilt during re-ipl. = The * iplb.devno is set to the boot position of the target SCSI device. */ - if (iplb.pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { - iplb.devno =3D qipl.index; + if (iplb->pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { + iplb->devno =3D qipl.index; } =20 - if (have_iplb && !set_iplb(&iplb)) { + if (have_iplb && !set_iplb(iplb)) { panic("Failed to set IPLB"); } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 76bf743900..c9328f1c51 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -22,7 +22,9 @@ static SubChannelId blk_schid =3D { .one =3D 1 }; static char loadparm_str[LOADPARM_LEN + 1]; QemuIplParameters qipl; -IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +/* Ensure that IPLB and IIRB are page aligned and sequential in memory */ +IplBlocks ipl_data; +IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ @@ -51,7 +53,7 @@ void write_subsystem_identification(void) void write_iplb_location(void) { if (cutype =3D=3D CU_TYPE_VIRTIO && virtio_get_device_type() !=3D VIRT= IO_ID_NET) { - lowcore->ptr_iplb =3D ptr2u32(&iplb); + lowcore->ptr_iplb =3D ptr2u32(iplb); } } =20 @@ -162,7 +164,7 @@ static void menu_setup(void) return; } =20 - switch (iplb.pbt) { + switch (iplb->pbt) { case S390_IPL_TYPE_CCW: case S390_IPL_TYPE_QEMU_SCSI: menu_set_parms(qipl.qipl_flags & BOOT_MENU_FLAG_MASK, @@ -191,8 +193,8 @@ static void boot_setup(void) { char lpmsg[] =3D "LOADPARM=3D[________]\n"; =20 - if (have_iplb && memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) !=3D= 0) { - ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN= ); + if (have_iplb && memcmp(iplb->loadparm, NO_LOADPARM, LOADPARM_LEN) != =3D 0) { + ebcdic_to_ascii((char *) iplb->loadparm, loadparm_str, LOADPARM_LE= N); } else { sclp_get_loadparm_ascii(loadparm_str); } @@ -216,21 +218,21 @@ static bool find_boot_device(void) VDev *vdev =3D virtio_get_device(); bool found =3D false; =20 - switch (iplb.pbt) { + switch (iplb->pbt) { case S390_IPL_TYPE_CCW: vdev->scsi_device_selected =3D false; - debug_print_int("device no. ", iplb.ccw.devno); - blk_schid.ssid =3D iplb.ccw.ssid & 0x3; + debug_print_int("device no. ", iplb->ccw.devno); + blk_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", blk_schid.ssid); - found =3D find_subch(iplb.ccw.devno); + found =3D find_subch(iplb->ccw.devno); break; case S390_IPL_TYPE_QEMU_SCSI: vdev->scsi_device_selected =3D true; - vdev->selected_scsi_device.channel =3D iplb.scsi.channel; - vdev->selected_scsi_device.target =3D iplb.scsi.target; - vdev->selected_scsi_device.lun =3D iplb.scsi.lun; - blk_schid.ssid =3D iplb.scsi.ssid & 0x3; - found =3D find_subch(iplb.scsi.devno); + vdev->selected_scsi_device.channel =3D iplb->scsi.channel; + vdev->selected_scsi_device.target =3D iplb->scsi.target; + vdev->selected_scsi_device.lun =3D iplb->scsi.lun; + blk_schid.ssid =3D iplb->scsi.ssid & 0x3; + found =3D find_subch(iplb->scsi.devno); break; default: puts("Unsupported IPLB"); @@ -311,10 +313,12 @@ static void probe_boot_device(void) =20 void main(void) { + iplb =3D &ipl_data.iplb; + copy_qipl(); sclp_setup(); css_setup(); - have_iplb =3D store_iplb(&iplb); + have_iplb =3D store_iplb(iplb); if (!have_iplb) { boot_setup(); probe_boot_device(); diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c index a9521dff41..457fbc3095 100644 --- a/pc-bios/s390-ccw/netmain.c +++ b/pc-bios/s390-ccw/netmain.c @@ -528,11 +528,11 @@ static bool virtio_setup(void) */ enable_mss_facility(); =20 - if (have_iplb || store_iplb(&iplb)) { - IPL_assert(iplb.pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expect= ed"); - dev_no =3D iplb.ccw.devno; + if (have_iplb || store_iplb(iplb)) { + IPL_assert(iplb->pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expec= ted"); + dev_no =3D iplb->ccw.devno; debug_print_int("device no. ", dev_no); - net_schid.ssid =3D iplb.ccw.ssid & 0x3; + net_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", net_schid.ssid); found =3D find_net_dev(&schib, dev_no); } else { --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553772; cv=none; d=zohomail.com; s=zohoarc; b=FPrWWgMnNmg2pQ8svpF6FjZGMeL/q1Fm800JoVjj4M11tEtY/30CdRaMT6WX9dYojfI24Y3uYxT3/rQ0m5UKTzvq1X9jGTnsR+dcbVhQsjHXel7+C9hBIJ1UwyvUCFb8YqgTsTUSi/iuL9G7LuvNdZebPUoDbtQ0IRAbdg5Joqw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553772; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zMZV2dJ55d5cstVJVOfgpzvXsobNNVktqx+Kvy71dIg=; b=KlbSDOlYXtCOBQ9zWWb5x8Mj1D4HBKru0YRMQVqqPvhEjKDQLBsugQXpKOtXPv7DZYyVUEyoifppS+8NAS70nGVXnslTHTlbEELemau6imFfpV+kgcVe5LzhYr7dgH0eTy3CQb4PUp6LrML1HFvM9ttDHaxuABoZLrvvyfvOeQA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 175555377268473.53332703291676; Mon, 18 Aug 2025 14:49:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eZ-00021C-Ct; Mon, 18 Aug 2025 17:44:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eH-0001p0-01; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7e9-0003mw-PV; Mon, 18 Aug 2025 17:44:12 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IFcU0Z015098; Mon, 18 Aug 2025 21:43:45 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jge3ucff-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:45 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIfHRp029080; Mon, 18 Aug 2025 21:43:44 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5apfjyy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:44 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhh7D25100994 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:43 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7CDEA58057; Mon, 18 Aug 2025 21:43:43 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8103858058; Mon, 18 Aug 2025 21:43:42 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zMZV2dJ55d5cstVJV OfgpzvXsobNNVktqx+Kvy71dIg=; b=L2oJ2v/S9rXDnbY0hHRx+AOK3VFG/4tiX iN1JmU/87vHdWZnMrqplUgLw5s0oCQ4WDLMphNPakxttQm4VNLW1RcVoLmPO1zho Sdwr5GoVyjUWExGrGONRUJ+ayYnQLj8mIkGB3LPzK5qPha/1N5ag+flDXmp4KAZr PIKucfgQ53NiMgYVtAAkeIMw9oJoSMi01QQvBNBu4U0ku4Ig3DoFslsfbdyiPtEB nynvICkqiWqtWbMKxAvLc+fgS4fhUJSdXaY0cLWiVC04kKIDG7gaicwq53wZgtMq 3Rms36KB3xY0gmU4w25Nz56d6UU0acuUX8aotJhxmEhZ99KxTNUmg== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 15/29] hw/s390x/ipl: Add IPIB flags to IPL Parameter Block Date: Mon, 18 Aug 2025 17:43:08 -0400 Message-ID: <20250818214323.529501-16-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=FcM3xI+6 c=1 sm=1 tr=0 ts=68a39e91 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=pRDxXoIMCsLN3o0rcVsA:9 X-Proofpoint-GUID: acFGPIvcsrpFx_jBu7GLupleHoyn-Ykq X-Proofpoint-ORIG-GUID: acFGPIvcsrpFx_jBu7GLupleHoyn-Ykq X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAxMSBTYWx0ZWRfX/nLIq6j2Licy AqKPUAFPy9yWAnedOHuDXEEnBSMYl6CGan5UMDrJ7CZamlvgBDXkeK1Cp6HMCvXTlcLaTTPubCX VwUDZdQ9cL3J9migwp/08LpNXIK2uDA5l4s1j1EcDd8bitPUTh+4liicEwv/whHxAT+tmLm6nUi 2HipXXaIVhUAe8BOlu3g5SuStt29a9DG9d6dc60oZPsNXNEgq15AKCM3fWx6eL3lytPDNZHxU+l BL6XxbGPmY6Ur76veuR03I9zfvCgpcpASQkZM4uth6rufmbqktV/g7NwZPSq/z6tTOeEG6e5itC k5C7NmI0NRqywReING9Z4OMBjqqZXX1p42CMq1dd0bfwtK9Rtme5bSxJG4bwjl1SS3wHvOykPuw m/rXQsvA X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 adultscore=0 phishscore=0 clxscore=1015 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160011 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553774508124100 Content-Type: text/plain; charset="utf-8" Add IPIB flags to IPL Parameter Block to determine if IPL needs to perform securely and if IPL Information Report Block (IIRB) exists. Move DIAG308 flags to a separated header file and add flags for secure IPL. Secure boot in audit mode will perform if certificate(s) exist in the key store. IIRB will exist and results of verification will be stored in IIRB. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 20 ++++++++++++++++++++ hw/s390x/ipl.h | 17 ----------------- include/hw/s390x/ipl/diag308.h | 34 ++++++++++++++++++++++++++++++++++ include/hw/s390x/ipl/qipl.h | 5 ++++- 4 files changed, 58 insertions(+), 18 deletions(-) create mode 100644 include/hw/s390x/ipl/diag308.h diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 186be923d7..8ac0cee73d 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -430,6 +430,13 @@ S390IPLCertificateStore *s390_ipl_get_certificate_stor= e(void) return &ipl->cert_store; } =20 +static bool s390_has_certificate(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return ipl->cert_store.count > 0; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -487,6 +494,19 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + /* + * Secure boot in audit mode will perform + * if certificate(s) exist in the key store. + * + * IPL Information Report Block (IIRB) will exist + * for secure boot in audit mode. + * + * Results of secure boot will be stored in IIRB. + */ + if (s390_has_certificate()) { + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; + } + return true; } =20 diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index e26fc1cd6a..3b8cc5474e 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -23,7 +23,6 @@ #include "qom/object.h" #include "target/s390x/kvm/pv.h" =20 -#define DIAG308_FLAGS_LP_VALID 0x80 #define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex= */ =20 void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp); @@ -91,22 +90,6 @@ struct S390IPLState { }; QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wr= ong"); =20 -#define DIAG_308_RC_OK 0x0001 -#define DIAG_308_RC_NO_CONF 0x0102 -#define DIAG_308_RC_INVALID 0x0402 -#define DIAG_308_RC_NO_PV_CONF 0x0902 -#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 - -#define DIAG308_RESET_MOD_CLR 0 -#define DIAG308_RESET_LOAD_NORM 1 -#define DIAG308_LOAD_CLEAR 3 -#define DIAG308_LOAD_NORMAL_DUMP 4 -#define DIAG308_SET 5 -#define DIAG308_STORE 6 -#define DIAG308_PV_SET 8 -#define DIAG308_PV_STORE 9 -#define DIAG308_PV_START 10 - #define S390_IPL_TYPE_FCP 0x00 #define S390_IPL_TYPE_CCW 0x02 #define S390_IPL_TYPE_PV 0x05 diff --git a/include/hw/s390x/ipl/diag308.h b/include/hw/s390x/ipl/diag308.h new file mode 100644 index 0000000000..6e62f29215 --- /dev/null +++ b/include/hw/s390x/ipl/diag308.h @@ -0,0 +1,34 @@ +/* + * S/390 DIAGNOSE 308 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG308_H +#define S390X_DIAG308_H + +#define DIAG_308_RC_OK 0x0001 +#define DIAG_308_RC_NO_CONF 0x0102 +#define DIAG_308_RC_INVALID 0x0402 +#define DIAG_308_RC_NO_PV_CONF 0x0902 +#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 + +#define DIAG308_RESET_MOD_CLR 0 +#define DIAG308_RESET_LOAD_NORM 1 +#define DIAG308_LOAD_CLEAR 3 +#define DIAG308_LOAD_NORMAL_DUMP 4 +#define DIAG308_SET 5 +#define DIAG308_STORE 6 +#define DIAG308_PV_SET 8 +#define DIAG308_PV_STORE 9 +#define DIAG308_PV_START 10 + +#define DIAG308_FLAGS_LP_VALID 0x80 + +#define DIAG308_IPIB_FLAGS_SIPL 0x40 +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 + +#endif diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index e505f44020..5c2bf3051c 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -12,6 +12,8 @@ #ifndef S390X_QIPL_H #define S390X_QIPL_H =20 +#include "diag308.h" + /* Boot Menu flags */ #define QIPL_FLAG_BM_OPTS_CMD 0x80 #define QIPL_FLAG_BM_OPTS_ZIPL 0x40 @@ -103,7 +105,8 @@ typedef struct IplBlockQemuScsi IplBlockQemuScsi; union IplParameterBlock { struct { uint32_t len; - uint8_t reserved0[3]; + uint8_t hdr_flags; + uint8_t reserved0[2]; uint8_t version; uint32_t blk0_len; uint8_t pbt; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553711; cv=none; d=zohomail.com; s=zohoarc; b=dp6UysRxsix2XYj/gXPQkzzKl8cGMZLYsGhqqybseF3sFXJd39u8I7sLZUpxVtSPtc7Smrb1I70m8onrSeg8vI35b4WvHIvsAPUpb+Up+ZfU0xmaretHls6vJhKlXNr/O4zl1Yf66okASFj1e2Xomi/w3DAlzNx0bM1GLiDj3Xc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553711; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OSwEtJZh8CYe1LcRJy6nbo08IOE1vIPc++nQlIVs2+0=; b=IUdUzipmzGRGxq7vaisj4ecsS05ZD1x9X/sH3QHu+FbT+kIdhYfwJzR/T6hJybvXyCe3o5ZQcEDGpNXqZzUfbT71vB56hg7mLs1FYXaHlwS1/j4SPJIlsj26z2UjBvyUbF3GokCw7fynCNyygSSLk5mWijtFIr8wsKpjS6qpWPE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 175555371186151.569232656728445; Mon, 18 Aug 2025 14:48:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eU-0001wW-Le; Mon, 18 Aug 2025 17:44:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eK-0001pp-1A; Mon, 18 Aug 2025 17:44:18 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003n8-VP; Mon, 18 Aug 2025 17:44:15 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKJO8h016893; Mon, 18 Aug 2025 21:43:46 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cp2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:46 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKJKmC002381; Mon, 18 Aug 2025 21:43:45 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9wc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:45 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhijw26346172 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:44 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9C22158057; Mon, 18 Aug 2025 21:43:44 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9513A58058; Mon, 18 Aug 2025 21:43:43 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:43 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=OSwEtJZh8CYe1LcRJ y6nbo08IOE1vIPc++nQlIVs2+0=; b=K8p+Dvg9X74K3FAV7R8r1xx64wd5cEPWH 8CC98eJ7n6IuEsE3trPzFHlyEc8cCtBgpmyRN5hxyt7GLn6XqyUkQSYjcOx/Sj6s zZhtO0k2dWO+bWofBx8XrGJfXi2KnTuxCFnrBqeJuH4+0Guaagy/k5hpJWfPvwcB b4mM9J6aknDPSZoaqBDDY4/wVzV7WQvtesbRoLxXrUVz7U1391KDQMiqTq3VRmyd cDogtjrkCTzCLZm1Hiu2fxUHGDRq+HFKYI69LenzXWzR+mdmZ8xXcf/3Q8Y6mpZZ 4AQvYsgq8oJysKAGTh4Z8KojdfzWGicaKfSWn4OWw147x2RbbROPQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 16/29] hw/s390x/ipl: Set iplb->len to maximum length of IPL Parameter Block Date: Mon, 18 Aug 2025 17:43:09 -0400 Message-ID: <20250818214323.529501-17-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: grXQFdALiC0zAXrpTamYmItBV9AQu4R4 X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e92 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=MJvGgyB-O-neVO77w_cA:9 X-Proofpoint-GUID: grXQFdALiC0zAXrpTamYmItBV9AQu4R4 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX1rgXcWkdTOao 4n7L225PT4FhOAYb+nyiFItbz6PY3axtaiz3QjzSfqwODmgpBrOMUeD95sbz1xjpNWgI3WjTdfm 1u/GmJ2meX4fZsX/VJA8Kt/JjDkugcJ0vLjHMDKPsTEi4msXrYh9J3Kz7nbhYMHRT6V3tcyLYSM eKYz/Et/EeRqw01hcJ+TZbYnkONWb2iEbKxoba023i3Pr9MTyZd2tRD3hiqZ9BzHO37DORBNCL1 YXm/svpuYAAYpzdaMU9uzqVPld8PkyfNZcd9pZi9rJTNDbLKlikGWcUe0JJy5UgKcBA4OlgWJvX hMmPCx3IxsTKqPon7vJYuAn4HVfuCoKPD2vU6wipJR7FEpB9HTJirlgkxH8fsEubpAzkm1EQmSk ydhMNujJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553713688124100 Content-Type: text/plain; charset="utf-8" The IPL Information Report Block (IIRB) immediately follows the IPL Parameter Block (IPLB). The IPLB struct is allocated 4KB in memory, and iplb->len indicates the amount of memory currently used by the IPLB. To ensure proper alignment of the IIRB and prevent overlap, set iplb->len to the maximum length of the IPLB, allowing alignment constraints to be determined based on its size. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 6 +++--- hw/s390x/ipl.h | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 8ac0cee73d..d1a972ac8d 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -459,7 +459,7 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) if (scsi_lp && strlen(scsi_lp) > 0) { lp =3D scsi_lp; } - iplb->len =3D cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN); + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); iplb->blk0_len =3D cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN - S390_IPLB_HEADER= _LEN); iplb->pbt =3D S390_IPL_TYPE_QEMU_SCSI; @@ -470,14 +470,14 @@ static bool s390_build_iplb(DeviceState *dev_st, IplP= arameterBlock *iplb) iplb->scsi.ssid =3D ccw_dev->sch->ssid & 3; break; case CCW_DEVTYPE_VFIO: - iplb->len =3D cpu_to_be32(S390_IPLB_MIN_CCW_LEN); + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); iplb->pbt =3D S390_IPL_TYPE_CCW; iplb->ccw.devno =3D cpu_to_be16(ccw_dev->sch->devno); iplb->ccw.ssid =3D ccw_dev->sch->ssid & 3; break; case CCW_DEVTYPE_VIRTIO_NET: case CCW_DEVTYPE_VIRTIO: - iplb->len =3D cpu_to_be32(S390_IPLB_MIN_CCW_LEN); + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); iplb->blk0_len =3D cpu_to_be32(S390_IPLB_MIN_CCW_LEN - S390_IPLB_HEADER_LEN); iplb->pbt =3D S390_IPL_TYPE_CCW; diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 3b8cc5474e..01922d80c4 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -100,6 +100,7 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "a= lignment of iplb wrong"); #define S390_IPLB_MIN_CCW_LEN 200 #define S390_IPLB_MIN_FCP_LEN 384 #define S390_IPLB_MIN_QEMU_SCSI_LEN 200 +#define S390_IPLB_MAX_LEN 4096 =20 static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) { --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553485; cv=none; d=zohomail.com; s=zohoarc; b=iI1bAgcrgW9J/gulPGfRk6M//AUzhA3lVR44K0cuc+kZLVHcSPYdODBArMVCmegxlFGelYPPhODuK9rYywCdPBWdcNN06cIlsfzuYxnO09nmq8VysJEBxr54pjdZFFR9UNEZrTelEVffz+ekhP/nVBa06Tyk0RAK+bqxXW1jIbE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553485; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=d5bPuYDvjwf/7W3RgfKplBajs4cI5ARmjAL5KNJj9QI=; b=d4zpGhusoydbpcsbqx45pr68FmLWnyzN71vsq2/SZgWZ2pup3mIK8r2vpq6Bs8rRnAWn1snwwhU8PR4TQ9NpIZtPBTFsO5irINWdArLgGZyKnjfzQoCjuJ5J7Z/AAuIJv8PxPO5p3vJiCYEBcW+MA+fiO3Sk6yxbsoGf3xxaxJI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553485184776.37301174232; Mon, 18 Aug 2025 14:44:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eY-0001zw-Jc; Mon, 18 Aug 2025 17:44:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eJ-0001pm-Qk; Mon, 18 Aug 2025 17:44:18 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003nb-Rz; Mon, 18 Aug 2025 17:44:15 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IC2N1f024667; Mon, 18 Aug 2025 21:43:48 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cp3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:47 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IK55UA002385; Mon, 18 Aug 2025 21:43:46 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9we-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:46 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhjOV26215148 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:45 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B5EEC58059; Mon, 18 Aug 2025 21:43:45 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B47B058058; Mon, 18 Aug 2025 21:43:44 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:44 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=d5bPuYDvjwf/7W3Rg fKplBajs4cI5ARmjAL5KNJj9QI=; b=cD1c4STl4uekpMj9n1kkVvLGPR2wCdYV6 Hq6VOkD5RLzw7S1CytVOCiZ+pjBK2WCd2KREqiTmtnqLPSDzGlyMWpybtnINQlaj XYBPVPmdH3wuHAwt/KAlkDe/TAwJfN2gALVmp7cEqmyuhPe3iKZ2n4+ZK5VnkmpL sHcBImPNBmFKkYStTBOCUhOqLlTThfEW5oN1qn1HX/dx1EGcX3Mwu+/KR8Em1gsi usWzTXdWqOscp86MTUo07uNvVwvjOLbDP1La2UpH9j5GWpt0TrLGPtxKiaJsxU16 GOVtBnZSNOFcx4Pf5ApS1kjNHpmAPrP/BayjnpFOTlr8n4j0QujFg== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 17/29] s390x: Guest support for Secure-IPL Facility Date: Mon, 18 Aug 2025 17:43:10 -0400 Message-ID: <20250818214323.529501-18-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: MNn7Ov5n8eG0eLdk1N2m-vLlNqJs2O9l X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e93 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=Bichc5AjJS213ZhIJUEA:9 X-Proofpoint-GUID: MNn7Ov5n8eG0eLdk1N2m-vLlNqJs2O9l X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfXzVLb4pNY9evG vc/xpGNdIRIisbFCFClPbD1Z/NiD8UAu8RAFwbeET9Mx8HPgu3YEVNhWafE8vxwBvHFjAMGeEPc pB+aV5+xDnFW/TYnL3HNcsEFHSF0dg4gJbovs0hhqwNn1TEVk/+poi/PwhgPytiwZmfTobSZa8Z rdPLF0dCgDUJ7/3QDRBKZi/pb1bHHPaN6/W6FPjaYYhDhyoJgiDw/p3wJ11/zMnjWUc0xCHQdKK 9EjeE9aIZafPRHt4JpTF9EhCx/ZnDmVx3CVK6f3+tWufk6fg6XhRTf6xlfkSOfA/fZLTeCJh19A SDAOJFteDRGi1XxQxWo5S6Z68RIdSti74GXOcjNsHEUFBpEddYNX5I/eW9x1UHVJ/24ScXf3KZC 1d/2//98 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553485984116600 Content-Type: text/plain; charset="utf-8" Introduce Secure-IPL (SIPL) facility. Use fac_ipl to represent bytes 136 and 137 for IPL device facilities of the SCLP Read Info block. Availability of SIPL facility is determined by byte 136 bit 1 of the SCLP Read Info block. Byte 136's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Secure IPL is not available for guests under protected virtualization. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- hw/s390x/sclp.c | 2 ++ include/hw/s390x/sclp.h | 4 +++- target/s390x/cpu_features.c | 4 ++++ target/s390x/cpu_features.h | 1 + target/s390x/cpu_features_def.h.inc | 3 +++ target/s390x/cpu_models.c | 2 ++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 3 +++ 8 files changed, 20 insertions(+), 1 deletion(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 9718564fa4..69d3328a3d 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -145,6 +145,8 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb) if (s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB)) { s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC134, &read_info->fac134); + s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC_IPL, + read_info->fac_ipl); } =20 read_info->facilities =3D cpu_to_be64(SCLP_HAS_CPU_INFO | diff --git a/include/hw/s390x/sclp.h b/include/hw/s390x/sclp.h index d32f6180e0..bfd330c340 100644 --- a/include/hw/s390x/sclp.h +++ b/include/hw/s390x/sclp.h @@ -136,7 +136,9 @@ typedef struct ReadInfo { uint32_t hmfai; uint8_t _reserved7[134 - 128]; /* 128-133 */ uint8_t fac134; - uint8_t _reserved8[144 - 135]; /* 135-143 */ + uint8_t _reserved8; + uint8_t fac_ipl[2]; /* 136-137 */ + uint8_t _reserved9[144 - 137]; /* 138-143 */ struct CPUEntry entries[]; /* * When the Extended-Length SCCB (ELS) feature is enabled the diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 436471f4b4..200bd8c15b 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -119,6 +119,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * Some facilities are not available for CPUs in protected mode: * - All SIE facilities because SIE is not available * - DIAG318 + * - Secure IPL Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -149,6 +150,9 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; + case S390_FEAT_TYPE_SCLP_FAC_IPL: + clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + break; default: return; } diff --git a/target/s390x/cpu_features.h b/target/s390x/cpu_features.h index 5635839d03..b038198555 100644 --- a/target/s390x/cpu_features.h +++ b/target/s390x/cpu_features.h @@ -24,6 +24,7 @@ typedef enum { S390_FEAT_TYPE_SCLP_CONF_CHAR, S390_FEAT_TYPE_SCLP_CONF_CHAR_EXT, S390_FEAT_TYPE_SCLP_FAC134, + S390_FEAT_TYPE_SCLP_FAC_IPL, S390_FEAT_TYPE_SCLP_CPU, S390_FEAT_TYPE_MISC, S390_FEAT_TYPE_PLO, diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index 941a69e013..55eef618b8 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -140,6 +140,9 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Provide Certificate Store = functions") =20 +/* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ +DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") + /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") DEF_FEAT(SIE_SKEY, "skey", SCLP_CPU, 5, "SIE: Storage-key facility") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 6b8471700e..f99536ef9a 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -263,6 +263,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_CMMA: case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: + case S390_FEAT_SIPL: case S390_FEAT_CONFIGURATION_TOPOLOGY: return false; break; @@ -507,6 +508,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index 6c20c3a862..bd2060ab93 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -721,6 +721,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP, S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -922,6 +923,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_PRNO_TRNG, S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index ae6cd3d506..31bd574dec 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2520,6 +2520,9 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 set_bit(S390_FEAT_CERT_STORE, model->features); =20 + /* Some Secure IPL facilities are emulated by QEMU */ + set_bit(S390_FEAT_SIPL, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553744; cv=none; d=zohomail.com; s=zohoarc; b=hnVj8mWiaZHgfBYN3tS6KsG1Rl78L8pGWConuY71BK1VIBPTO9idjOjBF1nm0QKGaYY499pWgdCSxRkYszwhbXz7CzVs3SHYoVMXcJOIHERwubKw78WVMGGWj4PKgMMN+CyJv7cB8oP3AiOMVGJBziN6A9j3tFckNuj7IQP85YU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553744; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qCi60XLWq3Ji+xPA3ABpj9Y/77045NeKJ2JtqS3rM0Q=; b=mPdsFPvtvrJafFBSgo4bNhyeUwdztky6kLv8XqX7Vbd2Zb3PUWb94W8/TX2RazE2BA73Q6wLLIi9zCyVQC5ao+C/K0fT27sSmkHxMsokFzQQ3I4pqSQFoguuAa+QThhOU5nVrucPWYLjVTdtkd2h2CxXVsY5ADste7U/cerZHuU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553744603865.5099831920089; Mon, 18 Aug 2025 14:49:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eV-0001y4-Qd; Mon, 18 Aug 2025 17:44:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eI-0001pV-Fk; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003ng-Kv; Mon, 18 Aug 2025 17:44:14 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IH1uoG011561; Mon, 18 Aug 2025 21:43:49 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhny3gf9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:48 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IK55UB002385; Mon, 18 Aug 2025 21:43:47 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9wf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:47 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhkx624248964 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:46 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C882F58057; Mon, 18 Aug 2025 21:43:46 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CDEB258058; Mon, 18 Aug 2025 21:43:45 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qCi60XLWq3Ji+xPA3 ABpj9Y/77045NeKJ2JtqS3rM0Q=; b=MmG7eTXr4AIZxLk4Lu7eVO3T3d2M+FdEw 5jm0hp/pNEKtnIAD2nsTnVRnjZZ9znqw6aoyxuYbekU6jwrjudAJVGUZLLK/GSAX UnyoMe7mu8lBvUrdd8QxzGRW9UfyGXtCIkyfxzgJGTlEwwTERl4+G58LtO1yp4Fu Lc1w/H56QWgzkbnIGO5gLwf2vbO5TLDsT+9SMwyixJo+Gf1CCIXkbHyexNaNNxew TvPDptain+lXBXG2TtIepw4vYPftLWOwOn4mZDbQjMSYr1a+LQ+md9sIur9x15Ku GZ08nIjvbfiKBHbaZiwuV+lWR4DiixkOb0Vr9i+dAQRqpqRmrYJBw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 18/29] pc-bios/s390-ccw: Refactor zipl_run() Date: Mon, 18 Aug 2025 17:43:11 -0400 Message-ID: <20250818214323.529501-19-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XbqJzJ55 c=1 sm=1 tr=0 ts=68a39e94 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=Ew_Uh9inpcQo8UAwJ4EA:9 X-Proofpoint-ORIG-GUID: y9ar5xq38UOcooWBD7DlbPCxPkyvJ95z X-Proofpoint-GUID: y9ar5xq38UOcooWBD7DlbPCxPkyvJ95z X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX78J1zWyRCdGx OBCxRmFUUsAut9Iyp/mTvCNxUAlTR//1R1jBJG1Ry8ImV2hAVSXtPyUiquHGv5LnnfBfahiVzAL YEsRvN+MF2DcUxMXTzGfaTm5hKu1xdH2z2PAUTmLVbj1Zqa5lGaEPR8H0+n53pbiucdCjBYhzEW IKcljaAp7drsy3xV/g1sA7TCDOFtCVS+EXnV9gLU29trMiFP2PiJ+pD8+udw+Uc1kfDUaaeGrnj N1tKTudRIqxZFB8+myat8g5YXL1NoExVbZ+Sv9uzpAkFfMG1cHZoeftcsde2dgqkdAUYw+rbcOk 2tix1pxlvwCC5qY2PJmI2rwo+JApyNXk+D0jk/ezpt3a/mvu/4ajbtPSbK0u8dxVE0Bj8g73cGP QxDdnrWp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 adultscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 malwarescore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553746143124100 Content-Type: text/plain; charset="utf-8" Refactor to enhance readability before enabling secure IPL in later patches. Signed-off-by: Zhuoying Cai --- pc-bios/s390-ccw/bootmap.c | 49 ++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 18 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 0f8baa0198..ff0fa78cf0 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -674,6 +674,35 @@ static int zipl_load_segment(ComponentEntry *entry) return 0; } =20 +static int zipl_run_normal(ComponentEntry **entry_ptr, uint8_t *tmp_sec) +{ + ComponentEntry *entry =3D *entry_ptr; + + while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || + entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + + /* Secure boot is off, so we skip signature entries */ + if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + entry++; + continue; + } + + if (zipl_load_segment(entry)) { + return -1; + } + + entry++; + + if ((uint8_t *)&entry[1] > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + return -EINVAL; + } + } + + *entry_ptr =3D entry; + return 0; +} + /* Run a zipl program */ static int zipl_run(ScsiBlockPtr *pte) { @@ -700,25 +729,9 @@ static int zipl_run(ScsiBlockPtr *pte) =20 /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); - while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || - entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - - /* We don't support secure boot yet, so we skip signature entries = */ - if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - entry++; - continue; - } =20 - if (zipl_load_segment(entry)) { - return -1; - } - - entry++; - - if ((uint8_t *)(&entry[1]) > (tmp_sec + MAX_SECTOR_SIZE)) { - puts("Wrong entry value"); - return -EINVAL; - } + if (zipl_run_normal(&entry, tmp_sec)) { + return -1; } =20 if (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553765; cv=none; d=zohomail.com; s=zohoarc; b=UJG7C7uMmjH4j1JwiQTUptAyVky6mD08W+4ohUjSTIRC5nr/oWOPT+y1PIMMwONekOeD8HqvfHlRokEVexUixbVTyt18Nhao0sGXbSWvirL/lLEZE+mstzFzVGuBD1hzbzA79/tvPp5PtfrgLk2aUBQjpOZWkVEsPj940putXdE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553765; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=kLdVofY4hPyhuje9mjmy1qv2Ka3w03SmG1oFPwghPZY=; b=S0+FjaSihgOctjofMRYUdLZpX77/Xyz10OdV1KZ0KzqBIDoNlytQGsilDU+PzCK+3p5hHP5MdhRPazsHkokD1rM/rD1Mln5ylMBg3D9X+LpfzaQHDRmRADfTexpTVnXeuf7LRLdzJG1KkfoU6zJ40qa/sBXUzBROf9sOufw/GzQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553765042953.6944508882159; Mon, 18 Aug 2025 14:49:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eo-0002Vd-7D; Mon, 18 Aug 2025 17:44:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ec-0002AP-Sf; Mon, 18 Aug 2025 17:44:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ea-0003np-SS; Mon, 18 Aug 2025 17:44:34 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ID7cap031324; Mon, 18 Aug 2025 21:43:50 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cp6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:49 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKAK8R002213; Mon, 18 Aug 2025 21:43:48 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k712y9wg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:48 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhlnE26346206 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:48 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D937B58057; Mon, 18 Aug 2025 21:43:47 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E0ADB58058; Mon, 18 Aug 2025 21:43:46 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:46 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=kLdVofY4hPyhuje9m jmy1qv2Ka3w03SmG1oFPwghPZY=; b=MGOn4QzY6+dBzfTfb70maENJPgKTG44Tr NeppCxJNVUxSTnw0S0wP0Zn+icjBIszPjvQCeB/bpNqtQIWDE/8iFjgWoI649mpN mcxSqejGxhEM579FTEVqbax+Ho8cbjRw8uTYeAGbNq3SlOBv7rXNCPe7XA+KmgLi 9yKp44sJhm+DmbPInmeRY6LzWhlZ3Z+yhGn9ZReIiWJDsNpNAswELAjgGxkE3s3F 4g+nwNuQMjlTwLpeUtMCziWxviorn/opdw9omGGGOuSk2axdXLQF5xt3QaOWrNRv IRFWoFMGEvD8jjX92VhyQ/vAUJSj0nRqQ38Bl3Q2nRa3/iFWzze0g== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 19/29] pc-bios/s390-ccw: Rework zipl_load_segment function Date: Mon, 18 Aug 2025 17:43:12 -0400 Message-ID: <20250818214323.529501-20-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: lO7QuHRJ9s4-ulAXDu8GstFOnpwJMY8d X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e95 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=wVZWP19Ib8Popp5rDVAA:9 X-Proofpoint-GUID: lO7QuHRJ9s4-ulAXDu8GstFOnpwJMY8d X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX8WPsiF5os3Sx XKmUdU6iUrA/uKNCyMA8YlDY6WARZw2MV49NgRj7dCBOEq/D6tsOKcrSwY6leUzCLDNja2gBigB X18wunq9qZNhyYbXF9OUDVYwP576yH6uol39zxgtSzwtEChDjKCnSAKBLhqY0iZE3bTRSnewzCd zUZfnc7JaWd4onpyYFjAPLqsOJdEpXqNmU84LmNSiX+PtAKtfAPm9g6NufHKpkOZ20YFw9nREwR EBWe0rJN3Dn+ZdKnzTIRa9PFnnw52h7boekVdBwT7xRJOQitJPZZGXqANEoNk36pt7RdqxGGeJC h/TQK/sv0oaCnPrtheORU5A4xPqoiltP/y3HD2QKlDLU4cvkxVoWb+toK0hYwJkQ3Kct1iRU5+v geZt8Y2O X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553766964116600 Content-Type: text/plain; charset="utf-8" Make the address variable a parameter of zipl_load_segment and return segment length. Modify this function to allow the caller to specify a memory address where segment data should be loaded into. seg_len variable is necessary to store the calculated segment length and is used during signature verification. Return the length on success, or a negative return code on failure. Signed-off-by: Zhuoying Cai --- pc-bios/s390-ccw/bootmap.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index ff0fa78cf0..4f54c643ff 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -613,19 +613,22 @@ static int ipl_eckd(void) * IPL a SCSI disk */ =20 -static int zipl_load_segment(ComponentEntry *entry) +/* + * Returns: length of the segment on sucess, + * negative value on error. + */ +static int zipl_load_segment(ComponentEntry *entry, uint64_t address) { const int max_entries =3D (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr)); ScsiBlockPtr *bprs =3D (void *)sec; const int bprs_size =3D sizeof(sec); block_number_t blockno; - uint64_t address; int i; char err_msg[] =3D "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ"; char *blk_no =3D &err_msg[30]; /* where to print blockno in (those ZZs= ) */ + int seg_len =3D 0; =20 blockno =3D entry->data.blockno; - address =3D entry->compdat.load_addr; =20 debug_print_int("loading segment at block", blockno); debug_print_int("addr", address); @@ -668,10 +671,12 @@ static int zipl_load_segment(ComponentEntry *entry) puts("zIPL load segment failed"); return -EIO; } + + seg_len +=3D bprs->size * (bprs[i].blockct + 1); } } while (blockno); =20 - return 0; + return seg_len; } =20 static int zipl_run_normal(ComponentEntry **entry_ptr, uint8_t *tmp_sec) @@ -687,7 +692,7 @@ static int zipl_run_normal(ComponentEntry **entry_ptr, = uint8_t *tmp_sec) continue; } =20 - if (zipl_load_segment(entry)) { + if (zipl_load_segment(entry, entry->compdat.load_addr) < 0) { return -1; } =20 --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553685; cv=none; d=zohomail.com; s=zohoarc; b=FrUFxWnxTZdq2HwS4vYqS7Fyy2ARxhF6dEb0uj3K8zAgXRHesKkgdFBcWtjqtKsqCJWzfMFPdVz3A9uThN+UeJsVW7qI20n1/2k61d04KnnQPgZrAdNtSPIHIFoPQdBy8sf2w12qiUppgAvv3w45Kqa1n0nINIUIaHmpDqpkBwI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553685; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ou7jpiUBYA5KMuH93/bxXWUrXKs7BpIY7bqnZib/GM0=; b=a/m3sp23oMW3ZYFQsdURiWgvF5/kats1Tq7hvPWcUtlFkD+fJ9qcOlshGlQe/cpPNBy88VSc8RfZc+X+mLawXSScUG8THPejfiB/bP/2f7uDqwnIhZsNAy8kEYyk4pT1MTN4sDVLsFyDh8R5+78s/RTh2zpT4ZgK7vRoXdsU18k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553685119659.8512748912132; Mon, 18 Aug 2025 14:48:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ei-0002ID-Ux; Mon, 18 Aug 2025 17:44:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eN-0001qn-3m; Mon, 18 Aug 2025 17:44:20 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003o2-Rx; Mon, 18 Aug 2025 17:44:16 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJpxL0002979; Mon, 18 Aug 2025 21:43:52 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhq9ugjk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:52 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIHhJJ011683; Mon, 18 Aug 2025 21:43:51 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k4au7r8t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:51 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhnwR30016148 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:49 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0A1835805D; Mon, 18 Aug 2025 21:43:49 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F116858058; Mon, 18 Aug 2025 21:43:47 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:47 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Ou7jpiUBYA5KMuH93 /bxXWUrXKs7BpIY7bqnZib/GM0=; b=UDkRWFMO1JVB40MqTbI2J/x3LqePFo/hs kJoGuFJbmnLu26D+KH+ZZJsxTOVQUXvyaofV83YIznW7jyv4PK87CWNejIdvpfz+ ESzhBsriCoJnn1sZGW5cATIZvjzznU8piN52M6LjGbrNscg4ZfjNjn97NfvNJxVH DQJ5FGik/MIebz1wV5kD/odXPaOc6KAtAcgsIdJiefhlcJSDLfSP3YTKKAyDZIdR 0W/Ka1fuDwS1vu5J+ABtqrwPr24yJQuV9vZIcFLEKFvFXdc+c2mFoJW1W7pkAU2v CDG27qbsNtNm23w6hpy+QreT1z1zuEEIEQcanPpoEewIVZS5EfaWQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 20/29] pc-bios/s390-ccw: Add signature verification for secure IPL in audit mode Date: Mon, 18 Aug 2025 17:43:13 -0400 Message-ID: <20250818214323.529501-21-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=N50pF39B c=1 sm=1 tr=0 ts=68a39e98 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=noympsQM67q5SXC5lO4A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX8AZYHIIf+kSK qun5EV980wnpxn0ros0EHsjM1v03XARMTiViPHZuhQcBCFIU8nteneYJf5k38clnGNzFLqXTW+v HxneNpVk2hSETmOgJYU9wGe/wDKdMEnaXj1FCEbr8SIq4tlkx9ItB0woycYD5SyiqMSNJM3TMX9 QXmGP8S1LMaO9C2aGE1j/qdHwpLIh72IPKV7wwij6KBe2ektUonFru7K1uyjaCgWOgQEggwgPZe BWx/SL2qqiEK5GDAwUYMq7m+LwYkpxSnMxQRjUUjpIIALhe7f+qu/30VRPQ26wmw6dqRV3zDWae tj0NPIwe5c2xmd0aLx0HMTbxUkFAjwEqUIq4S0gh3OXVOaIhl3bgArnlxvDYfTvZp5ePNmjOTzk lKrHMskk X-Proofpoint-GUID: qZnjRH5cL9L_9CRwtSNiytjRiqzUItl_ X-Proofpoint-ORIG-GUID: qZnjRH5cL9L_9CRwtSNiytjRiqzUItl_ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553686446116600 Content-Type: text/plain; charset="utf-8" Enable secure IPL in audit mode, which performs signature verification, but any error does not terminate the boot process. Only warnings will be logged to the console instead. Add a comp_len variable to store the length of a segment in zipl_load_segment. comp_len variable is necessary to store the calculated segment length and is used during signature verification. Return the length on success, or a negative return code on failure. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities (Secure IPL Facility, Certificate Store Facility and secure IPL extension support). Note: Secure IPL in audit mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 36 ++++ pc-bios/s390-ccw/Makefile | 3 +- pc-bios/s390-ccw/bootmap.c | 39 +++- pc-bios/s390-ccw/bootmap.h | 11 + pc-bios/s390-ccw/main.c | 9 + pc-bios/s390-ccw/s390-ccw.h | 15 ++ pc-bios/s390-ccw/sclp.c | 44 ++++ pc-bios/s390-ccw/sclp.h | 6 + pc-bios/s390-ccw/secure-ipl.c | 357 +++++++++++++++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 93 ++++++++ 10 files changed, 610 insertions(+), 3 deletions(-) create mode 100644 pc-bios/s390-ccw/secure-ipl.c create mode 100644 pc-bios/s390-ccw/secure-ipl.h diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 9b3fd25cc4..40a5781c7d 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -18,3 +18,39 @@ paths or directories on the command-line: qemu-system-s390x -machine s390-ccw-virtio, \ boot-certs.0.path=3D/.../qemu/certs, \ boot-certs.1.path=3D/another/path/cert.pem = ... + + +IPL Modes +=3D=3D=3D=3D=3D=3D=3D=3D=3D + +The concept of IPL Modes are introduced to differentiate between the IPL c= onfigurations. +These modes are mutually exclusive and enabled based on the ``boot-certs``= option on the +QEMU command line. + +Normal Mode +----------- + +The absence of certificates will attempt to IPL a guest without secure IPL= operations. +No checks are performed, and no warnings/errors are reported. This is the = default mode. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio ... + +Audit Mode +---------- + +With *only* the presence of certificates in the store, it is assumed that = secure +boot operations should be performed with errors reported as warnings. As s= uch, +the secure IPL operations will be performed, and any errors that stem from= these +operations will report a warning via the SCLP console. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio, \ + boot-certs.0.path=3D/.../qemu/certs, \ + boot-certs.1.path=3D/another/path/cert.pem = ... diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile index a0f24c94a8..603761a857 100644 --- a/pc-bios/s390-ccw/Makefile +++ b/pc-bios/s390-ccw/Makefile @@ -34,7 +34,8 @@ QEMU_DGFLAGS =3D -MMD -MP -MT $@ -MF $(@D)/$(*F).d .PHONY : all clean build-all distclean =20 OBJECTS =3D start.o main.o bootmap.o jump2ipl.o sclp.o menu.o netmain.o \ - virtio.o virtio-net.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o + virtio.o virtio-net.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o \ + secure-ipl.o =20 SLOF_DIR :=3D $(SRC_PATH)/../../roms/SLOF =20 diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 4f54c643ff..3922e7cdde 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -15,6 +15,7 @@ #include "bootmap.h" #include "virtio.h" #include "bswap.h" +#include "secure-ipl.h" =20 #ifdef DEBUG /* #define DEBUG_FALLBACK */ @@ -617,7 +618,7 @@ static int ipl_eckd(void) * Returns: length of the segment on sucess, * negative value on error. */ -static int zipl_load_segment(ComponentEntry *entry, uint64_t address) +int zipl_load_segment(ComponentEntry *entry, uint64_t address) { const int max_entries =3D (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr)); ScsiBlockPtr *bprs =3D (void *)sec; @@ -735,7 +736,19 @@ static int zipl_run(ScsiBlockPtr *pte) /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); =20 - if (zipl_run_normal(&entry, tmp_sec)) { + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + if (zipl_run_secure(&entry, tmp_sec)) { + return -1; + } + break; + case ZIPL_BOOT_MODE_NORMAL: + if (zipl_run_normal(&entry, tmp_sec)) { + return -1; + } + break; + default: + puts("Unknown boot mode"); return -1; } =20 @@ -1101,17 +1114,35 @@ static int zipl_load_vscsi(void) * IPL starts here */ =20 +ZiplBootMode zipl_mode(uint8_t hdr_flags) +{ + bool sipl_set =3D hdr_flags & DIAG308_IPIB_FLAGS_SIPL; + bool iplir_set =3D hdr_flags & DIAG308_IPIB_FLAGS_IPLIR; + + if (!sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE_AUDIT; + } + + return ZIPL_BOOT_MODE_NORMAL; +} + void zipl_load(void) { VDev *vdev =3D virtio_get_device(); =20 if (vdev->is_cdrom) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + panic("Secure boot from ISO image is not supported!"); + } ipl_iso_el_torito(); puts("Failed to IPL this ISO image!"); return; } =20 if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + panic("Virtio net boot device does not support secure boot!"); + } netmain(); puts("Failed to IPL from this network!"); return; @@ -1122,6 +1153,10 @@ void zipl_load(void) return; } =20 + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + panic("ECKD boot device does not support secure boot!"); + } + switch (virtio_get_device_type()) { case VIRTIO_ID_BLOCK: zipl_load_vblk(); diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h index 95943441d3..90fd530256 100644 --- a/pc-bios/s390-ccw/bootmap.h +++ b/pc-bios/s390-ccw/bootmap.h @@ -88,9 +88,18 @@ typedef struct BootMapTable { BootMapPointer entry[]; } __attribute__ ((packed)) BootMapTable; =20 +#define DER_SIGNATURE_FORMAT 1 + +typedef struct SignatureInformation { + uint8_t format; + uint8_t reserved[3]; + uint32_t sig_len; +} __attribute__((packed)) SignatureInformation; + typedef union ComponentEntryData { uint64_t load_psw; uint64_t load_addr; + SignatureInformation sig_info; } ComponentEntryData; =20 typedef struct ComponentEntry { @@ -113,6 +122,8 @@ typedef struct ScsiMbr { ScsiBlockPtr pt; /* block pointer to program table */ } __attribute__ ((packed)) ScsiMbr; =20 +int zipl_load_segment(ComponentEntry *entry, uint64_t address); + #define ZIPL_MAGIC "zIPL" #define ZIPL_MAGIC_EBCDIC "\xa9\xc9\xd7\xd3" #define IPL1_MAGIC "\xc9\xd7\xd3\xf1" /* =3D=3D "IPL1" in EBCDIC */ diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index c9328f1c51..668660e64d 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -28,6 +28,7 @@ IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ +ZiplBootMode boot_mode; =20 #define LOADPARM_PROMPT "PROMPT " #define LOADPARM_EMPTY " " @@ -272,9 +273,17 @@ static int virtio_setup(void) =20 static void ipl_boot_device(void) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_UNSPECIFIED) { + boot_mode =3D zipl_mode(iplb->hdr_flags); + } + switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + panic("Passthrough (vfio) device does not support secure boot!= "); + } + dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index b1dc35cded..c2ba40d067 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -39,6 +39,9 @@ typedef unsigned long long u64; #define MIN_NON_ZERO(a, b) ((a) =3D=3D 0 ? (b) : \ ((b) =3D=3D 0 ? (a) : (MIN(a, b)))) #endif +#ifndef ROUND_UP +#define ROUND_UP(n, d) (((n) + (d) - 1) & -(0 ? (n) : (d))) +#endif =20 #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0])) =20 @@ -64,6 +67,8 @@ void sclp_print(const char *string); void sclp_set_write_mask(uint32_t receive_mask, uint32_t send_mask); void sclp_setup(void); void sclp_get_loadparm_ascii(char *loadparm); +bool sclp_is_diag320_on(void); +bool sclp_is_sipl_on(void); int sclp_read(char *str, size_t count); =20 /* virtio.c */ @@ -76,6 +81,16 @@ int virtio_read(unsigned long sector, void *load_addr); /* bootmap.c */ void zipl_load(void); =20 +typedef enum ZiplBootMode { + ZIPL_BOOT_MODE_UNSPECIFIED =3D 0, + ZIPL_BOOT_MODE_NORMAL =3D 1, + ZIPL_BOOT_MODE_SECURE_AUDIT =3D 2, +} ZiplBootMode; + +extern ZiplBootMode boot_mode; + +ZiplBootMode zipl_mode(uint8_t hdr_flags); + /* jump2ipl.c */ void write_reset_psw(uint64_t psw); int jump_to_IPL_code(uint64_t address); diff --git a/pc-bios/s390-ccw/sclp.c b/pc-bios/s390-ccw/sclp.c index 4a07de018d..0b03c3164f 100644 --- a/pc-bios/s390-ccw/sclp.c +++ b/pc-bios/s390-ccw/sclp.c @@ -113,6 +113,50 @@ void sclp_get_loadparm_ascii(char *loadparm) } } =20 +static void sclp_get_fac134(uint8_t *fac134) +{ + + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + *fac134 =3D sccb->fac134; + } +} + +bool sclp_is_diag320_on(void) +{ + uint8_t fac134 =3D 0; + + sclp_get_fac134(&fac134); + return fac134 & SCCB_FAC134_DIAG320_BIT; +} + +/* + * Get fac_ipl (byte 136 and byte 137 of the SCLP Read Info block) + * for IPL device facilities. + */ +static void sclp_get_fac_ipl(uint16_t *fac_ipl) +{ + + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + *fac_ipl =3D sccb->fac_ipl; + } +} + +bool sclp_is_sipl_on(void) +{ + uint16_t fac_ipl =3D 0; + + sclp_get_fac_ipl(&fac_ipl); + return fac_ipl & SCCB_FAC_IPL_SIPL_BIT; +} + int sclp_read(char *str, size_t count) { ReadEventData *sccb =3D (void *)_sccb; diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index 64b53cad29..cf147f4634 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -50,6 +50,8 @@ typedef struct SCCBHeader { } __attribute__((packed)) SCCBHeader; =20 #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) +#define SCCB_FAC134_DIAG320_BIT 0x4 +#define SCCB_FAC_IPL_SIPL_BIT 0x4000 =20 typedef struct ReadInfo { SCCBHeader h; @@ -57,6 +59,10 @@ typedef struct ReadInfo { uint8_t rnsize; uint8_t reserved[13]; uint8_t loadparm[LOADPARM_LEN]; + uint8_t reserved1[102]; + uint8_t fac134; + uint8_t reserved2; + uint16_t fac_ipl; } __attribute__((packed)) ReadInfo; =20 typedef struct SCCB { diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c new file mode 100644 index 0000000000..80cbfa41a0 --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -0,0 +1,357 @@ +/* + * S/390 Secure IPL + * + * Functions to support IPL in secure boot mode (DIAG 320, DIAG 508, + * signature verification, and certificate handling). + * + * For secure IPL overview: docs/system/s390x/secure-ipl.rst + * For secure IPL technical: docs/specs/s390x-secure-ipl.rst + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include +#include +#include "bootmap.h" +#include "s390-ccw.h" +#include "secure-ipl.h" + +uint8_t vcssb_data[VCSSB_MIN_LEN] __attribute__((__aligned__(PAGE_SIZE))); + +VCStorageSizeBlock *zipl_secure_get_vcssb(void) +{ + VCStorageSizeBlock *vcssb; + int rc; + + vcssb =3D (VCStorageSizeBlock *)vcssb_data; + /* avoid retrieving vcssb multiple times */ + if (vcssb->length >=3D VCSSB_MIN_LEN) { + return vcssb; + } + + vcssb->length =3D VCSSB_MIN_LEN; + rc =3D diag320(vcssb, DIAG_320_SUBC_QUERY_VCSI); + if (rc !=3D DIAG_320_RC_OK) { + return NULL; + } + + return vcssb; +} + +static uint32_t get_certs_length(void) +{ + VCStorageSizeBlock *vcssb; + uint32_t len; + + vcssb =3D zipl_secure_get_vcssb(); + if (vcssb =3D=3D NULL) { + return 0; + } + + len =3D vcssb->total_vcb_len - VCB_HEADER_LEN - vcssb->total_vc_ct * V= CE_HEADER_LEN; + + return len; +} + +static uint32_t request_certificate(uint64_t *cert, uint8_t index) +{ + VCStorageSizeBlock *vcssb; + VCBlock *vcb; + VCEntry *vce; + uint64_t rc =3D 0; + uint32_t cert_len =3D 0; + + /* Get Verification Certificate Storage Size block with DIAG320 subcod= e 1 */ + vcssb =3D zipl_secure_get_vcssb(); + if (vcssb =3D=3D NULL) { + return 0; + } + + /* + * Request single entry + * Fill input fields of single-entry VCB + */ + vcb =3D malloc(MAX_SECTOR_SIZE * 4); + vcb->in_len =3D ROUND_UP(vcssb->max_single_vcb_len, PAGE_SIZE); + vcb->first_vc_index =3D index + 1; + vcb->last_vc_index =3D index + 1; + + rc =3D diag320(vcb, DIAG_320_SUBC_STORE_VC); + if (rc =3D=3D DIAG_320_RC_OK) { + vce =3D (VCEntry *)vcb->vce_buf; + /* Make sure vce contains a valid certificate */ + if (!is_vce_cert_valid(vce->flags, vce->len)) { + goto out; + } + + cert_len =3D vce->cert_len; + memcpy(cert, (uint8_t *)vce + vce->cert_offset, vce->cert_len); + } + +out: + free(vcb); + return cert_len; +} + +static void cert_list_add(IplSignatureCertificateList *certs, int cert_ind= ex, + uint64_t *cert, uint64_t cert_len) +{ + if (cert_index > MAX_CERTIFICATES - 1) { + printf("Warning: Ignoring cert entry [%d] because it's over %d ent= ires\n", + cert_index + 1, MAX_CERTIFICATES); + return; + } + + certs->cert_entries[cert_index].addr =3D (uint64_t)cert; + certs->cert_entries[cert_index].len =3D cert_len; + certs->ipl_info_header.len +=3D sizeof(certs->cert_entries[cert_index]= ); +} + +static void comp_list_add(IplDeviceComponentList *comps, int comp_index, + int cert_index, uint64_t comp_addr, + uint64_t comp_len, uint8_t flags) +{ + if (comp_index > MAX_CERTIFICATES - 1) { + printf("Warning: Ignoring comp entry [%d] because it's over %d ent= ires\n", + comp_index + 1, MAX_CERTIFICATES); + return; + } + + comps->device_entries[comp_index].addr =3D comp_addr; + comps->device_entries[comp_index].len =3D comp_len; + comps->device_entries[comp_index].flags =3D flags; + comps->device_entries[comp_index].cert_index =3D cert_index; + comps->ipl_info_header.len +=3D sizeof(comps->device_entries[comp_inde= x]); +} + +static int update_iirb(IplDeviceComponentList *comps, IplSignatureCertific= ateList *certs) +{ + IplInfoReportBlock *iirb; + IplDeviceComponentList *iirb_comps; + IplSignatureCertificateList *iirb_certs; + uint32_t iirb_hdr_len; + uint32_t comps_len; + uint32_t certs_len; + + if (iplb->len % 8 !=3D 0) { + panic("IPL parameter block length field value is not multiple of 8= bytes"); + } + + iirb_hdr_len =3D sizeof(IplInfoReportBlockHeader); + comps_len =3D comps->ipl_info_header.len; + certs_len =3D certs->ipl_info_header.len; + if ((comps_len + certs_len + iirb_hdr_len) > sizeof(IplInfoReportBlock= )) { + puts("Not enough space to hold all components and certificates in = IIRB"); + return -1; + } + + /* IIRB immediately follows IPLB */ + iirb =3D &ipl_data.iirb; + iirb->hdr.len =3D iirb_hdr_len; + + /* Copy IPL device component list after IIRB Header */ + iirb_comps =3D (IplDeviceComponentList *) iirb->info_blks; + memcpy(iirb_comps, comps, comps_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D comps_len; + + /* Copy IPL sig cert list after IPL device component list */ + iirb_certs =3D (IplSignatureCertificateList *) (iirb->info_blks + + iirb_comps->ipl_info_hea= der.len); + memcpy(iirb_certs, certs, certs_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D certs_len; + + return 0; +} + +static bool secure_ipl_supported(void) +{ + if (!sclp_is_sipl_on()) { + puts("Secure IPL Facility is not supported by the hypervisor!"); + return false; + } + + if (!is_secure_ipl_extension_supported()) { + puts("Secure IPL extensions are not supported by the hypervisor!"); + return false; + } + + if (!(sclp_is_diag320_on() && is_cert_store_facility_supported())) { + puts("Certificate Store Facility is not supported by the hyperviso= r!"); + return false; + } + + return true; +} + +static void init_lists(IplDeviceComponentList *comps, IplSignatureCertific= ateList *certs) +{ + comps->ipl_info_header.ibt =3D IPL_IBT_COMPONENTS; + comps->ipl_info_header.len =3D sizeof(comps->ipl_info_header); + + certs->ipl_info_header.ibt =3D IPL_IBT_CERTIFICATES; + certs->ipl_info_header.len =3D sizeof(certs->ipl_info_header); +} + +static uint32_t zipl_load_signature(ComponentEntry *entry, uint64_t sig_se= c) +{ + uint32_t sig_len; + + if (zipl_load_segment(entry, sig_sec) < 0) { + return -1; + } + + if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { + puts("Signature is not in DER format"); + return -1; + } + sig_len =3D entry->compdat.sig_info.sig_len; + + return sig_len; +} + +static int handle_certificate(int *cert_table, uint64_t **cert, + uint64_t cert_len, uint8_t cert_idx, + IplSignatureCertificateList *certs, int cert_= index) +{ + bool unused; + + unused =3D cert_table[cert_idx] =3D=3D -1; + if (unused) { + if (request_certificate(*cert, cert_idx)) { + cert_list_add(certs, cert_index, *cert, cert_len); + cert_table[cert_idx] =3D cert_index; + *cert +=3D cert_len; + } else { + puts("Could not get certificate"); + return -1; + } + + /* increment cert_index for the next cert entry */ + return ++cert_index; + } + + return cert_index; +} + +int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t *tmp_sec) +{ + IplDeviceComponentList comps; + IplSignatureCertificateList certs; + ComponentEntry *entry =3D *entry_ptr; + uint64_t *cert =3D NULL; + uint64_t *sig =3D NULL; + int cert_index =3D 0; + int comp_index =3D 0; + uint64_t comp_addr; + int comp_len; + uint32_t sig_len =3D 0; + uint64_t cert_len =3D -1; + uint8_t cert_idx =3D -1; + bool verified; + uint32_t certs_len; + /* + * Store indices of cert entry that have already used for signature ve= rification + * to prevent allocating the same certificate multiple times. + * cert_table index: index of certificate from qemu cert store used fo= r verification + * cert_table value: index of cert entry in cert list that contains th= e certificate + */ + int cert_table[MAX_CERTIFICATES] =3D { [0 ... MAX_CERTIFICATES - 1] = =3D -1}; + int signed_count =3D 0; + + if (!secure_ipl_supported()) { + return -1; + } + + init_lists(&comps, &certs); + certs_len =3D get_certs_length(); + cert =3D malloc(certs_len); + sig =3D malloc(MAX_SECTOR_SIZE); + + while (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { + switch (entry->component_type) { + case ZIPL_COMP_ENTRY_SIGNATURE: + if (sig_len) { + goto out; + } + + sig_len =3D zipl_load_signature(entry, (uint64_t)sig); + if (sig_len < 0) { + goto out; + } + break; + case ZIPL_COMP_ENTRY_LOAD: + comp_addr =3D entry->compdat.load_addr; + comp_len =3D zipl_load_segment(entry, comp_addr); + if (comp_len < 0) { + goto out; + } + + if (!sig_len) { + break; + } + + verified =3D verify_signature(comp_len, comp_addr, sig_len, (u= int64_t)sig, + &cert_len, &cert_idx); + + if (verified) { + cert_index =3D handle_certificate(cert_table, &cert, cert_= len, cert_idx, + &certs, cert_index); + if (cert_index =3D=3D -1) { + goto out; + } + + puts("Verified component"); + comp_list_add(&comps, comp_index, cert_table[cert_idx], + comp_addr, comp_len, + S390_IPL_COMPONENT_FLAG_SC | S390_IPL_COMPON= ENT_FLAG_CSV); + } else { + comp_list_add(&comps, comp_index, -1, + comp_addr, comp_len, + S390_IPL_COMPONENT_FLAG_SC); + zipl_secure_handle("Could not verify component"); + } + + comp_index++; + signed_count +=3D 1; + /* After a signature is used another new one can be accepted */ + sig_len =3D 0; + break; + default: + puts("Unknown component entry type"); + return -1; + } + + entry++; + + if ((uint8_t *)(&entry[1]) > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + return -EINVAL; + } + } + + if (signed_count =3D=3D 0) { + zipl_secure_handle("Secure boot is on, but components are not sign= ed"); + } + + if (update_iirb(&comps, &certs)) { + zipl_secure_handle("Failed to write IPL Information Report Block"); + } + + *entry_ptr =3D entry; + free(sig); + + return 0; +out: + free(cert); + free(sig); + + return -1; +} diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h new file mode 100644 index 0000000000..5d02f202b6 --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -0,0 +1,93 @@ +/* + * S/390 Secure IPL + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef _PC_BIOS_S390_CCW_SECURE_IPL_H +#define _PC_BIOS_S390_CCW_SECURE_IPL_H + +#include +#include + +VCStorageSizeBlock *zipl_secure_get_vcssb(void); +int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t *tmp_sec); + +static inline void zipl_secure_handle(const char *message) +{ + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + IPL_check(false, message); + break; + default: + break; + } +} + +static inline uint64_t diag320(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x320\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_vce_cert_valid(uint8_t vce_flags, uint32_t vce_len) +{ + return (vce_flags & DIAG_320_VCE_FLAGS_VALID) && (vce_len > VCE_INVALI= D_LEN); +} + +static inline bool is_cert_store_facility_supported(void) +{ + uint32_t d320_ism; + + diag320(&d320_ism, DIAG_320_SUBC_QUERY_ISM); + return (d320_ism & DIAG_320_ISM_QUERY_SUBCODES) && + (d320_ism & DIAG_320_ISM_QUERY_VCSI) && + (d320_ism & DIAG_320_ISM_STORE_VC); +} + +static inline uint64_t _diag508(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x508\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_secure_ipl_extension_supported(void) +{ + uint64_t d508_subcodes; + + d508_subcodes =3D _diag508(NULL, DIAG_508_SUBC_QUERY_SUBC); + return d508_subcodes & DIAG_508_SUBC_SIG_VERIF; +} + +static inline bool verify_signature(uint64_t comp_len, uint64_t comp_addr, + uint64_t sig_len, uint64_t sig_addr, + uint64_t *cert_len, uint8_t *cert_idx) +{ + Diag508SignatureVerificationBlock svb =3D {{}, comp_len, comp_addr, + sig_len, sig_addr }; + + if (_diag508(&svb, DIAG_508_SUBC_SIG_VERIF) =3D=3D DIAG_508_RC_OK) { + *cert_len =3D svb.csi.len; + *cert_idx =3D svb.csi.idx; + return true; + } + + return false; +} + +#endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */ --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553683; cv=none; d=zohomail.com; s=zohoarc; b=NBGKes81wiQtCqIW2Tgd3ckgedvPgVB5yiH1rSQHI4ebr1o8rZKin6sC66CXCH7H/naaD5a5NqGPablchLgCVbtoCGIMhV1fR0KsMWg+dXaDAJ7lzRG2aEBGx3QtmE4h6T7J0DiP6asqWolaUAQr6JQu/DtOESVMN8wwnRbccoc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553683; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ni0Ed3X4Jvi4CMBLQdRl+F9Nwqp4QzUVj1+5zs05+5o=; b=njGEaGu64CIQaBkLh2H43y/6QFplgE30MQggjycBhrgDj16sLT7z2imC66fIRpmn0aMPbDylKsNfVItLsr5EQwnfQeaEj4sEnWsfx70qOLHzswVtbo+/pgplZR4P/A0fc7DGwCunRkMfXlIF/GxYFYLyxQ4e4biA5WxmV++LoyU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553683360933.5717647339491; Mon, 18 Aug 2025 14:48:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ef-0002AH-BZ; Mon, 18 Aug 2025 17:44:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eJ-0001po-V1; Mon, 18 Aug 2025 17:44:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003o0-TF; Mon, 18 Aug 2025 17:44:15 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHcs48031745; Mon, 18 Aug 2025 21:43:52 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jge3ucfm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:52 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ0xHl014790; Mon, 18 Aug 2025 21:43:51 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgp1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:51 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhoM4459282 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:50 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 22C7158057; Mon, 18 Aug 2025 21:43:50 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 21DD858059; Mon, 18 Aug 2025 21:43:49 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:49 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ni0Ed3X4Jvi4CMBLQ dRl+F9Nwqp4QzUVj1+5zs05+5o=; b=IJzFnD3gF6jjD3zYBpdOJNELaPNccHaAa 7nuqUr4j+z8INdZwgGIPwxbL8vDFGpco+L/6fE90L0vp3XIU+Ppbsz6KSXOLdUJ9 AfaEmj+IuyK7Dfd7EKsoK6iEfs7wHe6hVkZkf6Xyuttga4+TWOrdZBF+WCylDr4B umTT7QHZYnQlOroq0n0QaXpnNutZfYuM59JYmGDvBzw6kyV3YGkCANMKjUv1ur3T bzHG/kYvEE/m0Ar3sVSBDItlTIFTCa2Gdxz7/2cofLv8OoWc0sQYeKaA7AIKwCdR ilOu34J3sxEfATUSpwAQeZyxE80/BHC3Jhaam5PwMkFsciMkif3wg== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 21/29] s390x: Guest support for Secure-IPL Code Loading Attributes Facility (SCLAF) Date: Mon, 18 Aug 2025 17:43:14 -0400 Message-ID: <20250818214323.529501-22-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=FcM3xI+6 c=1 sm=1 tr=0 ts=68a39e98 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=70PmlEAx-evh_fzWiGkA:9 X-Proofpoint-GUID: EmrRI1C9qeZcKGYeZYYcVpe7BXQ0cnO0 X-Proofpoint-ORIG-GUID: EmrRI1C9qeZcKGYeZYYcVpe7BXQ0cnO0 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAxMSBTYWx0ZWRfXzU1N1RNKyV1D j1E/Fd69tuyG0rPuwVQZIRMS73hS8EUKjVhcVpJn2QeMYYwwjNy3+pWjjQYtXpIwXfAChYqbXrw tZ3b20Tc/Cb+fWS4p6XrZ9waRbgwNz3jhKWeu/Ov7VvMy06p4yeRExqba5E3KWZpu03pDSJi55e Z0ot2ijL2q0ncl4jzDeYm9BxV+BJP+6JUFnt1nfHdIMEfoujgw5Aqyo4t09nSq6eSvD/ywvgOLh 4M42WwdU6/gFcKgVUFPIfBECN6BwtKsqPViTESH+GvUCkRpbNc946g6OttNVDikk5TFEhc04Nn7 Qs/1mFnPrURh+C+VwHohUkxIvBKZUOifZ1b8CiRPlrqAvg0vQ7/uY1B+mngNwsqpASDN+G4ZGFj qQg47KsA X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 adultscore=0 phishscore=0 clxscore=1015 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160011 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553685235116600 Content-Type: text/plain; charset="utf-8" The secure-IPL-code-loading-attributes facility (SCLAF) provides additional security during IPL. Availability of SCLAF is determined by byte 136 bit 3 of the SCLP Read Info block. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 25 +++++++++++++++++++++++++ target/s390x/cpu_features.c | 2 ++ target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 3 +++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 1 + 6 files changed, 34 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 4bc330c399..72ab901014 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -83,3 +83,28 @@ operations such as: * certificate data =20 The guest kernel will inspect the IIRB and build the keyring. + + +Secure Code Loading Attributes Facility +--------------------------------- + +The Secure Code Loading Attributes Facility (SCLAF) enhances system securi= ty during the +IPL by enforcing additional verification rules. + +When SCLAF is available, its behavior depends on the IPL mode. It introduc= es verification +of both signed and unsigned components to help ensure that only authorized= code is loaded +during the IPL process. Any errors detected by SCLAF are reported in the I= IRB. + +Unsigned components are restricted to load addresses at or above absolute = storage address +``0x2000``. + +Signed components must include a Secure Code Loading Attribute Block (SCLA= B), which is +appended at the very end of the component. The SCLAB defines security attr= ibutes for +handling the signed code. Specifically, it may: + +* Provide direction on how to process the rest of the component. + +* Provide further validation of information on where to load the signed bi= nary code + from the load device. + +* Specify where to start the execution of the loaded OS code. diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 200bd8c15b..29ea3bfec2 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -120,6 +120,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * - All SIE facilities because SIE is not available * - DIAG318 * - Secure IPL Facility + * - Secure IPL Code Loading Attributes Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -152,6 +153,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC_IPL: clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_SCLAF)->bit, data); break; default: return; diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index 55eef618b8..ecfca0faef 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -142,6 +142,7 @@ DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Provide= Certificate Store functi =20 /* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") +DEF_FEAT(SCLAF, "sclaf", SCLP_FAC_IPL, 3, "Secure-IPL-code-loading-attribu= tes facility") =20 /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index f99536ef9a..7d214b5f72 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -264,6 +264,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: case S390_FEAT_SIPL: + case S390_FEAT_SCLAF: case S390_FEAT_CONFIGURATION_TOPOLOGY: return false; break; @@ -509,6 +510,8 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_SIPL }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index bd2060ab93..c3e0c6ceff 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -722,6 +722,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -924,6 +925,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 31bd574dec..2ed11fab52 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2522,6 +2522,7 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 /* Some Secure IPL facilities are emulated by QEMU */ set_bit(S390_FEAT_SIPL, model->features); + set_bit(S390_FEAT_SCLAF, model->features); =20 /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553719; cv=none; d=zohomail.com; s=zohoarc; b=ncURBDDlYQWujqwcNW03NUjeO+nH1NV7+L2uhxBlAO/ud7AV47klCnm+oBqd67HKp74/xoYls45En5ojwk36/WSTYJQfBYyWVjN/5G+uTBT7uSNVDnszAd6MD9pucL9rIy4pLS66pczidEO4zfCbDG8CNYnb2ECE0pAZTFSsk3w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553719; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mzmM7WkpyeD/lOc7ZZei/6OQ1DzAz3Yb0JN3Usq911k=; b=kWvs8Gu8++qgQnJmWPXB/5pe9TSokq5iDt45wjVjy6op6UXf85Pd4r69TdcgiO9sXnM7CzYESWMFYSCBmfQ7HS+rfBLqWQ72XawIVgX+7CYderndxr5oY4DYwDfmz13qALMhI3TSscEgYh6aejmlUWcE8YRCBeBUcKFSixlUHJw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553719075164.72947525407255; Mon, 18 Aug 2025 14:48:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eo-0002Vf-7X; Mon, 18 Aug 2025 17:44:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ec-0002AN-Lh; Mon, 18 Aug 2025 17:44:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eZ-0003oC-Lv; Mon, 18 Aug 2025 17:44:34 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IC2N1g024667; Mon, 18 Aug 2025 21:43:54 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cp9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:54 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ5GEk014724; Mon, 18 Aug 2025 21:43:52 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgp2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:52 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhpIc27722304 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:51 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B3B358057; Mon, 18 Aug 2025 21:43:51 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3AE6558058; Mon, 18 Aug 2025 21:43:50 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:50 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=mzmM7WkpyeD/lOc7Z Zei/6OQ1DzAz3Yb0JN3Usq911k=; b=spMMc7mslQyhbuUkv+Ka4qjNeB0SFLeQl ki1HzPcYilpA/tdXR9t8MYUQkk2epafwlE4RvP58jk2T09DJ6z0klHsVJL+wrQez 3w2ouaC/n3CH5fexG58og8rq4EHysO/VUgvM7vOhJAUbrOtk2cweBpoBqk3qxrYt Ms3RksowdFO1rvSlusjCjHd6xV+rG4rTYmK/18k975SZsM292VBi4umIVUEPd5wN VybkZ43TXcO1ZfLi7NEIQPSppHqwJ9LIRL3B64JiV8v+i0n92Qg5MLJHLL9iyaFn z84S3xp8LWl77lT7DXNquxkaCQA6ajGRwbexvEPSEFjKhMw1vFqqw== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 22/29] pc-bios/s390-ccw: Add additional security checks for secure boot Date: Mon, 18 Aug 2025 17:43:15 -0400 Message-ID: <20250818214323.529501-23-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 6GB7Dbu5zor4Gxbn7Z71MgfX6hZ4nbCZ X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e9a cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=-PzWCFmcDqgEtY6oAzcA:9 X-Proofpoint-GUID: 6GB7Dbu5zor4Gxbn7Z71MgfX6hZ4nbCZ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfXxYb43Qx4DQcz Oe+IXfUP3xeSnd9Mvb5zxDpKQICTTE6VPKDzwdyY6hDn5m9XSty+2nfQTIQngkD29K5bDIdkBAV Wo3YFgBOxsK2QA0Jqx7GJ2h/qqC33IcZPbQamyJ6vvM0ZB6d4LgVo/oCiQbde8d4jJHtlO3Dii9 MguSFTQjMnosTtZ589mjFMlnt52SGwl50D/D3rW++QLS1FFqtjm+3BadTe6DSya9qqJF0TBU8cG 6vPvgxxjVOJPvPt8XKfAt/6LFjAHqmutsZLxNh6B8aSfijLrE0S/0hnkxKEgmMHcbS50J4QDWyq C2+fdYXvdLudoSNWS/piKJWUb0YhIGdyX+1pmJw5u0l3dqXIpuCTPT+R/Ye25OpUZsGviOW/h70 WQ8rBNCP X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553723896124100 Content-Type: text/plain; charset="utf-8" Add additional checks to ensure that components do not overlap with signed components when loaded into memory. Add additional checks to ensure the load addresses of unsigned components are greater than or equal to 0x2000. When the secure IPL code loading attributes facility (SCLAF) is installed, all signed components must contain a secure code loading attributes block (SCLAB). The SCLAB provides further validation of information on where to load the signed binary code from the load device, and where to start the execution of the loaded OS code. When SCLAF is installed, its content must be evaluated during secure IPL. However, a missing SCLAB will not be reported in audit mode. The SCALB checking will be skipped in this case. Add IPL Information Error Indicators (IIEI) and Component Error Indicators (CEI) for IPL Information Report Block (IIRB). When SCLAF is installed, additional secure boot checks are performed during zipl and store results of verification into IIRB. Signed-off-by: Zhuoying Cai --- pc-bios/s390-ccw/iplb.h | 26 ++- pc-bios/s390-ccw/s390-ccw.h | 1 + pc-bios/s390-ccw/sclp.c | 8 + pc-bios/s390-ccw/sclp.h | 1 + pc-bios/s390-ccw/secure-ipl.c | 412 +++++++++++++++++++++++++++++++++- pc-bios/s390-ccw/secure-ipl.h | 110 +++++++++ 6 files changed, 553 insertions(+), 5 deletions(-) diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index 11302e004d..41cec91a68 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -32,11 +32,19 @@ struct IplInfoReportBlockHeader { } __attribute__ ((packed)); typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; =20 +#define S390_IPL_INFO_IIEI_NO_SIGNED_COMP 0x8000 /* bit 0 */ +#define S390_IPL_INFO_IIEI_NO_SCLAB 0x4000 /* bit 1 */ +#define S390_IPL_INFO_IIEI_NO_GLOBAL_SCLAB 0x2000 /* bit 2 */ +#define S390_IPL_INFO_IIEI_MORE_GLOBAL_SCLAB 0x1000 /* bit 3 */ +#define S390_IPL_INFO_IIEI_FOUND_UNSIGNED_COMP 0x800 /* bit 4 */ +#define S390_IPL_INFO_IIEI_MORE_SIGNED_COMP 0x400 /* bit 5 */ + struct IplInfoBlockHeader { uint32_t len; uint8_t ibt; uint8_t reserved1[3]; - uint8_t reserved2[8]; + uint16_t iiei; + uint8_t reserved2[6]; } __attribute__ ((packed)); typedef struct IplInfoBlockHeader IplInfoBlockHeader; =20 @@ -60,13 +68,27 @@ typedef struct IplSignatureCertificateList IplSignature= CertificateList; #define S390_IPL_COMPONENT_FLAG_SC 0x80 #define S390_IPL_COMPONENT_FLAG_CSV 0x40 =20 +#define S390_IPL_COMPONENT_CEI_INVALID_SCLAB 0x80000000 /* bit= 0 */ +#define S390_IPL_COMPONENT_CEI_INVALID_SCLAB_LEN 0x40000000 /* bit= 1 */ +#define S390_IPL_COMPONENT_CEI_INVALID_SCLAB_FORMAT 0x20000000 /* bit= 2 */ +#define S390_IPL_COMPONENT_CEI_UNMATCHED_SCLAB_LOAD_ADDR 0x10000000 /* bit= 3 */ +#define S390_IPL_COMPONENT_CEI_UNMATCHED_SCLAB_LOAD_PSW 0x8000000 /* bit= 4 */ +#define S390_IPL_COMPONENT_CEI_INVALID_LOAD_PSW 0x4000000 /* bit= 5 */ +#define S390_IPL_COMPONENT_CEI_NUC_NOT_IN_GLOBAL_SCLA 0x2000000 /* bit= 6 */ +#define S390_IPL_COMPONENT_CEI_SCLAB_OLA_NOT_ONE 0x1000000 /* bit= 7 */ +#define S390_IPL_COMPONENT_CEI_SC_NOT_IN_GLOBAL_SCLAB 0x800000 /* bit= 8 */ +#define S390_IPL_COMPONENT_CEI_SCLAB_LOAD_ADDR_NOT_ZERO 0x400000 /* bit= 9 */ +#define S390_IPL_COMPONENT_CEI_SCLAB_LOAD_PSW_NOT_ZERO 0x200000 /* bit= 10 */ +#define S390_IPL_COMPONENT_CEI_INVALID_UNSIGNED_ADDR 0x100000 /* bit= 11 */ + struct IplDeviceComponentEntry { uint64_t addr; uint64_t len; uint8_t flags; uint8_t reserved1[5]; uint16_t cert_index; - uint8_t reserved2[8]; + uint32_t cei; + uint8_t reserved2[4]; } __attribute__ ((packed)); typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; =20 diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index c2ba40d067..6d51d07c90 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -69,6 +69,7 @@ void sclp_setup(void); void sclp_get_loadparm_ascii(char *loadparm); bool sclp_is_diag320_on(void); bool sclp_is_sipl_on(void); +bool sclp_is_sclaf_on(void); int sclp_read(char *str, size_t count); =20 /* virtio.c */ diff --git a/pc-bios/s390-ccw/sclp.c b/pc-bios/s390-ccw/sclp.c index 0b03c3164f..16f973dde8 100644 --- a/pc-bios/s390-ccw/sclp.c +++ b/pc-bios/s390-ccw/sclp.c @@ -157,6 +157,14 @@ bool sclp_is_sipl_on(void) return fac_ipl & SCCB_FAC_IPL_SIPL_BIT; } =20 +bool sclp_is_sclaf_on(void) +{ + uint16_t fac_ipl =3D 0; + + sclp_get_fac_ipl(&fac_ipl); + return fac_ipl & SCCB_FAC_IPL_SCLAF_BIT; +} + int sclp_read(char *str, size_t count) { ReadEventData *sccb =3D (void *)_sccb; diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index cf147f4634..3441020d6b 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -52,6 +52,7 @@ typedef struct SCCBHeader { #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) #define SCCB_FAC134_DIAG320_BIT 0x4 #define SCCB_FAC_IPL_SIPL_BIT 0x4000 +#define SCCB_FAC_IPL_SCLAF_BIT 0x1000 =20 typedef struct ReadInfo { SCCBHeader h; diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index 80cbfa41a0..8c696828cd 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -188,6 +188,12 @@ static bool secure_ipl_supported(void) return false; } =20 + if (!sclp_is_sclaf_on()) { + puts("Secure IPL Code Loading Attributes Facility is not supported= by" \ + " the hypervisor!"); + return false; + } + return true; } =20 @@ -200,6 +206,393 @@ static void init_lists(IplDeviceComponentList *comps,= IplSignatureCertificateLis certs->ipl_info_header.len =3D sizeof(certs->ipl_info_header); } =20 +static bool is_comp_overlap(SecureIplCompAddrRange *comp_addr_range, int a= ddr_range_index, + uint64_t start_addr, uint64_t end_addr) +{ + /* neither a signed nor an unsigned component can overlap with a signe= d component */ + for (int i =3D 0; i < addr_range_index; i++) { + if ((comp_addr_range[i].start_addr <=3D end_addr && + start_addr <=3D comp_addr_range[i].end_addr) && + comp_addr_range[i].is_signed) { + return true; + } + } + + return false; +} + +static void comp_addr_range_add(SecureIplCompAddrRange *comp_addr_range, + int addr_range_index, bool is_signed, + uint64_t start_addr, uint64_t end_addr) +{ + if (addr_range_index > MAX_CERTIFICATES - 1) { + return; + } + + comp_addr_range[addr_range_index].is_signed =3D is_signed; + comp_addr_range[addr_range_index].start_addr =3D start_addr; + comp_addr_range[addr_range_index].end_addr =3D end_addr; +} + +static void check_unsigned_addr(uint64_t load_addr, IplDeviceComponentList= *comps, + int comp_index) +{ + uint32_t flag; + const char *msg; + bool valid; + + valid =3D validate_unsigned_addr(load_addr); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_INVALID_UNSIGNED_ADDR; + msg =3D "Load address is less than 0x2000"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static void addr_overlap_check(SecureIplCompAddrRange *comp_addr_range, + int *addr_range_index, + uint64_t start_addr, uint64_t end_addr, boo= l is_signed) +{ + bool overlap; + + overlap =3D is_comp_overlap(comp_addr_range, *addr_range_index, + start_addr, end_addr); + if (!overlap) { + comp_addr_range_add(comp_addr_range, *addr_range_index, is_signed, + start_addr, end_addr); + *addr_range_index +=3D 1; + } else { + zipl_secure_handle("Component addresses overlap"); + } +} + +static bool check_sclab_presence(uint8_t *sclab_magic, + IplDeviceComponentList *comps, int comp_i= ndex) +{ + if (!validate_sclab_magic(sclab_magic)) { + comps->device_entries[comp_index].cei |=3D S390_IPL_COMPONENT_CEI_= INVALID_SCLAB; + + /* a missing SCLAB will not be reported in audit mode */ + return false; + } + + return true; +} + +static void check_sclab_length(uint16_t sclab_len, + IplDeviceComponentList *comps, int comp_ind= ex) +{ + const char *msg; + uint32_t flag; + bool valid; + + valid =3D validate_sclab_length(sclab_len); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_INVALID_SCLAB_LEN | + S390_IPL_COMPONENT_CEI_INVALID_SCLAB; + msg =3D "Invalid SCLAB length"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static void check_sclab_format(uint8_t sclab_format, + IplDeviceComponentList *comps, int comp_ind= ex) +{ + const char *msg; + uint32_t flag; + bool valid; + + valid =3D validate_sclab_format(sclab_format); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_INVALID_SCLAB_FORMAT; + msg =3D "Format-0 SCLAB is not being use"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static void check_sclab_opsw(SecureCodeLoadingAttributesBlock *sclab, + SecureIplSclabInfo *sclab_info, + IplDeviceComponentList *comps, int comp_index) +{ + const char *msg; + uint32_t flag; + bool is_opsw_set; + bool valid; + + is_opsw_set =3D is_sclab_flag_set(sclab->flags, S390_SECURE_IPL_SCLAB_= FLAG_OPSW); + if (!is_opsw_set) { + valid =3D validate_sclab_opsw_zero(sclab->load_psw); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_SCLAB_LOAD_PSW_NOT_ZERO; + msg =3D "Load PSW is not zero when Override PSW bit is zero"; + set_cei_with_log(comps, comp_index, flag, msg); + } + } else { + /* OPSW =3D 1 indicating global SCLAB */ + valid =3D validate_sclab_opsw_one(sclab->flags); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_SCLAB_OLA_NOT_ONE; + msg =3D "Override Load Address bit is not set to one in the gl= obal SCLAB"; + set_cei_with_log(comps, comp_index, flag, msg); + } + + sclab_info->global_count +=3D 1; + if (sclab_info->global_count =3D=3D 1) { + sclab_info->load_psw =3D sclab->load_psw; + sclab_info->flags =3D sclab->flags; + } + } +} + +static void check_sclab_ola(SecureCodeLoadingAttributesBlock *sclab, + uint64_t load_addr, IplDeviceComponentList *co= mps, + int comp_index) +{ + const char *msg; + uint32_t flag; + bool is_ola_set; + bool valid; + + is_ola_set =3D is_sclab_flag_set(sclab->flags, S390_SECURE_IPL_SCLAB_F= LAG_OLA); + if (!is_ola_set) { + valid =3D validate_sclab_ola_zero(sclab->load_addr); + if (!(valid)) { + flag =3D S390_IPL_COMPONENT_CEI_SCLAB_LOAD_ADDR_NOT_ZERO; + msg =3D "Load Address is not zero when Override Load Address b= it is zero"; + set_cei_with_log(comps, comp_index, flag, msg); + } + + } else { + valid =3D validate_sclab_ola_one(sclab->load_addr, load_addr); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_UNMATCHED_SCLAB_LOAD_ADDR; + msg =3D "Load Address does not match with component load addre= ss"; + set_cei_with_log(comps, comp_index, flag, msg); + } + } +} + +static void check_sclab_nuc(uint16_t sclab_flags, IplDeviceComponentList *= comps, + int comp_index) +{ + const char *msg; + uint32_t flag; + bool is_nuc_set; + bool is_global_sclab; + + is_nuc_set =3D is_sclab_flag_set(sclab_flags, S390_SECURE_IPL_SCLAB_FL= AG_NUC); + is_global_sclab =3D is_sclab_flag_set(sclab_flags, S390_SECURE_IPL_SCL= AB_FLAG_OPSW); + if (is_nuc_set && !is_global_sclab) { + flag =3D S390_IPL_COMPONENT_CEI_NUC_NOT_IN_GLOBAL_SCLA; + msg =3D "No Unsigned Components bit is set, but not in the global = SCLAB"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static void check_sclab_sc(uint16_t sclab_flags, IplDeviceComponentList *c= omps, + int comp_index) +{ + const char *msg; + uint32_t flag; + bool is_sc_set; + bool is_global_sclab; + + is_sc_set =3D is_sclab_flag_set(sclab_flags, S390_SECURE_IPL_SCLAB_FLA= G_SC); + is_global_sclab =3D is_sclab_flag_set(sclab_flags, S390_SECURE_IPL_SCL= AB_FLAG_OPSW); + if (is_sc_set && !is_global_sclab) { + flag =3D S390_IPL_COMPONENT_CEI_SC_NOT_IN_GLOBAL_SCLAB; + msg =3D "Single Component bit is set, but not in the global SCLAB"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static bool is_psw_valid(uint64_t psw, SecureIplCompAddrRange *comp_addr_r= ange, + int range_index) +{ + uint32_t addr =3D psw & 0x3FFFFFFF; + + /* PSW points within a signed binary code component */ + for (int i =3D 0; i < range_index; i++) { + if (comp_addr_range[i].is_signed && + addr >=3D comp_addr_range[i].start_addr && + addr <=3D comp_addr_range[i].end_addr) { + return true; + } + } + + return false; +} + +static void check_load_psw(SecureIplCompAddrRange *comp_addr_range, + int addr_range_index, uint64_t sclab_load_psw, + uint64_t load_psw, IplDeviceComponentList *comp= s, + int comp_index) +{ + uint32_t flag; + const char *msg; + bool valid; + + valid =3D is_psw_valid(sclab_load_psw, comp_addr_range, addr_range_ind= ex) && + is_psw_valid(load_psw, comp_addr_range, addr_range_index); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_INVALID_LOAD_PSW; + msg =3D "Invalid PSW"; + set_cei_with_log(comps, comp_index, flag, msg); + } + + valid =3D validate_lpsw(sclab_load_psw, load_psw); + if (!valid) { + flag =3D S390_IPL_COMPONENT_CEI_UNMATCHED_SCLAB_LOAD_PSW; + msg =3D "Load PSW does not match with PSW in component"; + set_cei_with_log(comps, comp_index, flag, msg); + } +} + +static void check_nuc(uint16_t global_sclab_flags, int unsigned_count, + IplDeviceComponentList *comps) +{ + uint16_t flag; + const char *msg; + bool is_nuc_set; + + is_nuc_set =3D is_sclab_flag_set(global_sclab_flags, S390_SECURE_IPL_S= CLAB_FLAG_NUC); + if (is_nuc_set && unsigned_count > 0) { + flag =3D S390_IPL_INFO_IIEI_FOUND_UNSIGNED_COMP; + msg =3D "Unsigned components are not allowed"; + set_iiei_with_log(comps, flag, msg); + } +} + +static void check_sc(uint16_t global_sclab_flags, int signed_count, + IplDeviceComponentList *comps) +{ + uint16_t flag; + const char *msg; + bool is_sc_set; + + is_sc_set =3D is_sclab_flag_set(global_sclab_flags, S390_SECURE_IPL_SC= LAB_FLAG_SC); + if (is_sc_set && signed_count !=3D 1) { + flag =3D S390_IPL_INFO_IIEI_MORE_SIGNED_COMP; + msg =3D "Only one signed component is allowed"; + set_iiei_with_log(comps, flag, msg); + } +} + +void check_global_sclab(SecureIplSclabInfo sclab_info, + SecureIplCompAddrRange *comp_addr_range, + int addr_range_index, uint64_t load_psw, + int unsigned_count, int signed_count, + IplDeviceComponentList *comps, int comp_index) +{ + uint16_t flag; + const char *msg; + + if (sclab_info.count =3D=3D 0) { + return; + } + + if (sclab_info.global_count =3D=3D 0) { + flag =3D S390_IPL_INFO_IIEI_NO_GLOBAL_SCLAB; + msg =3D "Global SCLAB does not exists"; + set_iiei_with_log(comps, flag, msg); + return; + } + + if (sclab_info.global_count > 1) { + flag =3D S390_IPL_INFO_IIEI_MORE_GLOBAL_SCLAB; + msg =3D "More than one global SCLAB"; + set_iiei_with_log(comps, flag, msg); + return; + } + + if (sclab_info.load_psw) { + /* Verify PSW from the final component entry with PSW from the glo= bal SCLAB */ + check_load_psw(comp_addr_range, addr_range_index, + sclab_info.load_psw, load_psw, + comps, comp_index); + } + + if (sclab_info.flags) { + /* Unsigned components are not allowed if NUC flag is set in the g= lobal SCLAB */ + check_nuc(sclab_info.flags, unsigned_count, comps); + + /* Only one signed component is allowed is SC flag is set in the g= lobal SCLAB */ + check_sc(sclab_info.flags, signed_count, comps); + } +} + +static void check_signed_comp(int signed_count, IplDeviceComponentList *co= mps) +{ + uint16_t flag; + const char *msg; + + if (signed_count > 0) { + return; + } + + flag =3D S390_IPL_INFO_IIEI_NO_SIGNED_COMP; + msg =3D "Secure boot is on, but components are not signed"; + set_iiei_with_log(comps, flag, msg); +} + +static void check_sclab_count(int count, IplDeviceComponentList *comps) +{ + uint16_t flag; + const char *msg; + + if (count > 0) { + return; + } + + flag =3D S390_IPL_INFO_IIEI_NO_SCLAB; + msg =3D "No recognizable SCLAB"; + set_iiei_with_log(comps, flag, msg); +} + +static void check_unsigned_comp(uint64_t comp_addr, IplDeviceComponentList= *comps, + int comp_index, int cert_index, uint64_t c= omp_len) +{ + check_unsigned_addr(comp_addr, comps, comp_index); + + comp_list_add(comps, comp_index, cert_index, comp_addr, comp_len, 0x00= ); +} + +static void check_sclab(uint64_t comp_addr, IplDeviceComponentList *comps, + uint64_t comp_len, int comp_index, SecureIplSclabI= nfo *sclab_info) +{ + SclabOriginLocator *sclab_locator; + SecureCodeLoadingAttributesBlock *sclab; + bool exist; + bool valid; + + sclab_locator =3D (SclabOriginLocator *)(comp_addr + comp_len - 8); + + /* return early if sclab does not exist */ + exist =3D check_sclab_presence(sclab_locator->magic, comps, comp_index= ); + if (!exist) { + return; + } + + check_sclab_length(sclab_locator->len, comps, comp_index); + + /* return early if sclab is invalid */ + valid =3D (comps->device_entries[comp_index].cei & + S390_IPL_COMPONENT_CEI_INVALID_SCLAB) =3D=3D 0; + if (!valid) { + return; + } + + sclab_info->count +=3D 1; + sclab =3D (SecureCodeLoadingAttributesBlock *)(comp_addr + comp_len - + sclab_locator->len); + + check_sclab_format(sclab->format, comps, comp_index); + check_sclab_opsw(sclab, sclab_info, comps, comp_index); + check_sclab_ola(sclab, comp_addr, comps, comp_index); + check_sclab_nuc(sclab->flags, comps, comp_index); + check_sclab_sc(sclab->flags, comps, comp_index); +} + static uint32_t zipl_load_signature(ComponentEntry *entry, uint64_t sig_se= c) { uint32_t sig_len; @@ -264,7 +657,11 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_= t *tmp_sec) * cert_table value: index of cert entry in cert list that contains th= e certificate */ int cert_table[MAX_CERTIFICATES] =3D { [0 ... MAX_CERTIFICATES - 1] = =3D -1}; + SecureIplCompAddrRange comp_addr_range[MAX_CERTIFICATES]; + int addr_range_index =3D 0; int signed_count =3D 0; + int unsigned_count =3D 0; + SecureIplSclabInfo sclab_info =3D { 0 }; =20 if (!secure_ipl_supported()) { return -1; @@ -294,10 +691,17 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8= _t *tmp_sec) goto out; } =20 + addr_overlap_check(comp_addr_range, &addr_range_index, + comp_addr, comp_addr + comp_len, sig_len > = 0); + if (!sig_len) { + check_unsigned_comp(comp_addr, &comps, comp_index, cert_in= dex, comp_len); + unsigned_count +=3D 1; + comp_index++; break; } =20 + check_sclab(comp_addr, &comps, comp_len, comp_index, &sclab_in= fo); verified =3D verify_signature(comp_len, comp_addr, sig_len, (u= int64_t)sig, &cert_len, &cert_idx); =20 @@ -337,9 +741,11 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_= t *tmp_sec) } } =20 - if (signed_count =3D=3D 0) { - zipl_secure_handle("Secure boot is on, but components are not sign= ed"); - } + check_signed_comp(signed_count, &comps); + check_sclab_count(sclab_info.count, &comps); + check_global_sclab(sclab_info, comp_addr_range, addr_range_index, + entry->compdat.load_psw, unsigned_count, signed_cou= nt, + &comps, comp_index); =20 if (update_iirb(&comps, &certs)) { zipl_secure_handle("Failed to write IPL Information Report Block"); diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index 5d02f202b6..d60201bf45 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -16,6 +16,42 @@ VCStorageSizeBlock *zipl_secure_get_vcssb(void); int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t *tmp_sec); =20 +#define S390_SECURE_IPL_SCLAB_FLAG_OPSW 0x8000 +#define S390_SECURE_IPL_SCLAB_FLAG_OLA 0x4000 +#define S390_SECURE_IPL_SCLAB_FLAG_NUC 0x2000 +#define S390_SECURE_IPL_SCLAB_FLAG_SC 0x1000 + +struct SecureCodeLoadingAttributesBlock { + uint8_t format; + uint8_t reserved1; + uint16_t flags; + uint8_t reserved2[4]; + uint64_t load_psw; + uint64_t load_addr; + uint64_t reserved3[]; +} __attribute__ ((packed)); +typedef struct SecureCodeLoadingAttributesBlock SecureCodeLoadingAttribute= sBlock; + +struct SclabOriginLocator { + uint8_t reserved[2]; + uint16_t len; + uint8_t magic[4]; +} __attribute__ ((packed)); +typedef struct SclabOriginLocator SclabOriginLocator; + +typedef struct SecureIplCompAddrRange { + bool is_signed; + uint64_t start_addr; + uint64_t end_addr; +} SecureIplCompAddrRange; + +typedef struct SecureIplSclabInfo { + int count; + int global_count; + uint64_t load_psw; + uint16_t flags; +} SecureIplSclabInfo; + static inline void zipl_secure_handle(const char *message) { switch (boot_mode) { @@ -27,6 +63,80 @@ static inline void zipl_secure_handle(const char *messag= e) } } =20 +static inline bool is_sclab_flag_set(uint16_t sclab_flags, uint16_t flag) +{ + return (sclab_flags & flag) !=3D 0; +} + +static inline bool validate_unsigned_addr(uint64_t comp_load_addr) +{ + /* usigned load address must be greater than or equal to 0x2000 */ + return comp_load_addr >=3D 0x2000; +} + +static inline bool validate_sclab_magic(uint8_t *sclab_magic) +{ + /* identifies the presence of SCLAB */ + return magic_match(sclab_magic, ZIPL_MAGIC); +} + +static inline bool validate_sclab_length(uint16_t sclab_len) +{ + /* minimum SCLAB length is 32 bytes */ + return sclab_len >=3D 32; +} + +static inline bool validate_sclab_format(uint8_t sclab_format) +{ + /* SCLAB format must set to zero, indicating a format-0 SCLAB being us= ed */ + return sclab_format =3D=3D 0; +} + +static inline bool validate_sclab_ola_zero(uint64_t sclab_load_addr) +{ + /* Load address field in SCLAB must contain zeros */ + return sclab_load_addr =3D=3D 0; +} + +static inline bool validate_sclab_ola_one(uint64_t sclab_load_addr, + uint64_t comp_load_addr) +{ + /* Load address field must match storage address of the component */ + return sclab_load_addr =3D=3D comp_load_addr; +} + +static inline bool validate_sclab_opsw_zero(uint64_t sclab_load_psw) +{ + /* Load PSW field in SCLAB must contain zeros */ + return sclab_load_psw =3D=3D 0; +} + +static inline bool validate_sclab_opsw_one(uint16_t sclab_flags) +{ + /* OLA must set to one */ + return is_sclab_flag_set(sclab_flags, S390_SECURE_IPL_SCLAB_FLAG_OLA); +} + +static inline bool validate_lpsw(uint64_t sclab_load_psw, uint64_t comp_lo= ad_psw) +{ + /* compare load PSW with the PSW specified in component */ + return sclab_load_psw =3D=3D comp_load_psw; +} + +static inline void set_cei_with_log(IplDeviceComponentList *comps, int com= p_index, + uint32_t flag, const char *message) +{ + comps->device_entries[comp_index].cei |=3D flag; + zipl_secure_handle(message); +} + +static inline void set_iiei_with_log(IplDeviceComponentList *comps, uint16= _t flag, + const char *message) +{ + comps->ipl_info_header.iiei |=3D flag; + zipl_secure_handle(message); +} + static inline uint64_t diag320(void *data, unsigned long subcode) { register unsigned long addr asm("0") =3D (unsigned long)data; --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553653; cv=none; d=zohomail.com; s=zohoarc; b=gJ6BTpxeO6dl+SXjVeEuC7NRARSlnvtlyF2NWrvG5tDTLcLRzynRsv/svM7two8jsyU1Lf4vLNCCqNx8ZkPw8Xw1WX8X5SuMXi4muAA2Za0loJqOhayKFX92An+LY7f+vn39MHmSMyORwX0Ypu/452nrW0GREcvITci9OySauxk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553653; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Be2ya04rzyfZp85RE3gnjSaLtSvZyFTxlu/dewNTC/o=; b=LJS76BNnbwh3oEiYon2QPIICLVKafnWtLZM/dLMPpZvJ550rHirAZ2T9ZuKB0v7TH1YklNFmFHxEeuWQdQxe3K3EhkWZHclI54GpZaRVtbtbjZ4m62i1MJldXccqNe++QRhlugLtHPeQAeRk/opJmatYqZ4sIsWQ/JNFmvueKl4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553653776431.1834852243687; Mon, 18 Aug 2025 14:47:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eW-0001yW-9Q; Mon, 18 Aug 2025 17:44:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eI-0001pW-K0; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003oI-QN; Mon, 18 Aug 2025 17:44:14 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IAopNF030302; Mon, 18 Aug 2025 21:43:55 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhq9ugjm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:55 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIoMc3014692; Mon, 18 Aug 2025 21:43:53 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgp3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:53 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhqtA9634830 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:52 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 50B0A58057; Mon, 18 Aug 2025 21:43:52 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5471858059; Mon, 18 Aug 2025 21:43:51 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:51 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Be2ya04rzyfZp85RE 3gnjSaLtSvZyFTxlu/dewNTC/o=; b=tlxpCrkBNyq3wHpeQLMfQBjc1e9bV6Abd laY48NMKHMIf17w7vw8pAQ/HKq2mIdvDmH6i8VzUS18VSMvM+nVs0tf0coEntZQC IP4oKlXmRSrgmXrLB2Uign9qNKqSLtmz/qgoF4Y+rcqIW5yhpbb6N1lJrSg5sC2c q29CbbI0qgCIQZBm71ONlSLdWA3eac60F2Riv7sJu/GDEdTAB26kKNEPv2uNvyNL rfCHRYSDpBWWOPKkEOZOb5OSmAf1DoFNTk2XIvYi8cMxCsOdb7DrjPjMbo619um2 NwcGxzFx8YykIi1qv9JKILiei+OCrHRnDnKKNBXbGUThV2spKx56g== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 23/29] Add secure-boot to s390-ccw-virtio machine type option Date: Mon, 18 Aug 2025 17:43:16 -0400 Message-ID: <20250818214323.529501-24-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=N50pF39B c=1 sm=1 tr=0 ts=68a39e9b cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=uyvjcAWwEQu1yBn7KtoA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX05kDjmJaFlP9 um5ffEsufCkR9RiaT0xQXNQCdlegAoKbVRmBpmyZTODerHqv1GGHC3sgBeBGNSbTwgxS4B2Juni Ck2gCtbAEgnDSjvy+0gml3hAgxWpDfcstBxKkiVS3vzG7xAl90NEAHyTF6bgRZimL28qMIHIqJv QzykO47gUqOMsa5NTvG/W6c3o95ICVoEEHvs49FGgbZ2zUrXEKOowP89Gq11GaTCiKGKn//EeFx X0GNljqKnZ9ehecN5esqvYqgeiO8ghiP4YvarJOXqmzLDug8UGGBVKXJWYozm6F1qJAQyZYlKqI Zkp0Krcl6vCFJ4KC5tyGCUgoSXlwpoe/lGvd9nFHfqoIY526JFAFBIIDa6s36VSSkbCFtjCIHfO TrC8XXhb X-Proofpoint-GUID: 8AG-uLbrg_EHmohWrztcL1yzeHOlV_H4 X-Proofpoint-ORIG-GUID: 8AG-uLbrg_EHmohWrztcL1yzeHOlV_H4 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553655008124100 Content-Type: text/plain; charset="utf-8" Add secure-boot as a parameter of s390-ccw-virtio machine type option. The `secure-boot=3Don|off` parameter is implemented to enable secure IPL. By default, secure-boot is set to false if not specified in the command line. Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 20 ++++++++++++++++---- hw/s390x/s390-virtio-ccw.c | 22 ++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 1 + qemu-options.hx | 6 +++++- 4 files changed, 44 insertions(+), 5 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 40a5781c7d..0d14d0d62d 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -19,19 +19,31 @@ paths or directories on the command-line: boot-certs.0.path=3D/.../qemu/certs, \ boot-certs.1.path=3D/another/path/cert.pem = ... =20 +Enabling Secure IPL +------------------- + +Secure IPL is enabled by explicitly setting ``secure-boot=3Don``; if not s= pecified, +secure boot is considered off. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don|off + =20 IPL Modes =3D=3D=3D=3D=3D=3D=3D=3D=3D =20 The concept of IPL Modes are introduced to differentiate between the IPL c= onfigurations. -These modes are mutually exclusive and enabled based on the ``boot-certs``= option on the -QEMU command line. +These modes are mutually exclusive and enabled based on specific combinati= ons of +the ``secure-boot`` and ``boot-certs`` options on the QEMU command line. =20 Normal Mode ----------- =20 -The absence of certificates will attempt to IPL a guest without secure IPL= operations. -No checks are performed, and no warnings/errors are reported. This is the = default mode. +The absence of both certificates and the ``secure-boot`` option will attem= pt to +IPL a guest without secure IPL operations. No checks are performed, and no +warnings/errors are reported. This is the default mode, and can be explic= itly +enabled with ``secure-boot=3Doff``. =20 Configuration: =20 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 9ac425c695..1a1c905c7b 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -823,6 +823,21 @@ static void machine_set_boot_certs(Object *obj, Visito= r *v, const char *name, ms->boot_certs =3D cert_list; } =20 +static inline bool machine_get_secure_boot(Object *obj, Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + return ms->secure_boot; +} + +static inline void machine_set_secure_boot(Object *obj, bool value, + Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + ms->secure_boot =3D value; +} + static void ccw_machine_class_init(ObjectClass *oc, const void *data) { MachineClass *mc =3D MACHINE_CLASS(oc); @@ -881,6 +896,13 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); object_class_property_set_description(oc, "boot-certs", "provide paths to a directory and/or a certificate file for se= cure boot"); + + object_class_property_add_bool(oc, "secure-boot", + machine_get_secure_boot, + machine_set_secure_boot); + object_class_property_set_description(oc, "secure-boot", + "enable/disable secure boot"); + } =20 static inline void s390_machine_initfn(Object *obj) diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index b90949355c..552c936da0 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -33,6 +33,7 @@ struct S390CcwMachineState { uint64_t memory_limit; uint64_t max_pagesize; BootCertPathList *boot_certs; + bool secure_boot; =20 SCLPDevice *sclp; }; diff --git a/qemu-options.hx b/qemu-options.hx index ac497eb3a0..5d9cd0d0f1 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -45,7 +45,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " memory-backend=3D'backend-id' specifies explicitly pr= ovided backend for main RAM (default=3Dnone)\n" " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" - " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n" + " secure-boot=3Don|off enable/disable secure boot (defa= ult=3Doff) \n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -209,6 +210,9 @@ SRST =20 ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` Provide paths to a directory and/or a certificate file on the host= [s390x only]. + + ``secure-boot=3Don|off`` + Enables or disables secure boot on s390-ccw guest. The default is = off. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553719; cv=none; d=zohomail.com; s=zohoarc; b=Cg/5YrnpmUJ3FgYdyqC1+9qAnaus2XzNs8GTTXrYkoRZ9VdSwUOvA2KYJxvASzQEz+4DSR6jmgFkyK2gvFXfIkS8v2y+orojTEGts8diSr1vKKKDP4imwA86gArsRIvqlAh86y9fQeoq55MTzmSt5fPl/nuqqEcesq7/kUWMzps= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553719; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KgtadV4KyUFkHAMkRRIyGE0IJgWXf3DvcKaQ91Q10NU=; b=mBfFeheIG6ALn2Gn7QrrGmbM8Yt95Uhc0oXOFx+prvROzHJnIf9UkH+jpanccrNcryzt19VfsZ9dNEkQT1NdFO2j6yJYnz9iHH3OUPY+eYdfJ01x2coT+5GWSdlVhjZqx1iBfpyEJB3Y3BZ48VapBpzIqk0FCjU3o30M4STdR/Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553719142178.48843127830605; Mon, 18 Aug 2025 14:48:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7em-0002MS-41; Mon, 18 Aug 2025 17:44:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ee-0002DW-Jj; Mon, 18 Aug 2025 17:44:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ea-0003oS-TB; Mon, 18 Aug 2025 17:44:35 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IKJO8i016893; Mon, 18 Aug 2025 21:43:56 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cpe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:56 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIesaY028695; Mon, 18 Aug 2025 21:43:55 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5apfk08-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:55 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhrkR29753794 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:53 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6AC9A58057; Mon, 18 Aug 2025 21:43:53 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6851B58058; Mon, 18 Aug 2025 21:43:52 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:52 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=KgtadV4KyUFkHAMkR RIyGE0IJgWXf3DvcKaQ91Q10NU=; b=qtluG5zfPJyS0d+faLeXjLvD66jmyIxbE MF2/XS8o3VheRj4/ug7cHR1KpzKE9bac5HqgapTq7++gwpxmb7wCwuP4jpi2mpiu OdK/uD2pZLC3Xjz3yluC+sREaYzlpD8IfKTnTJ8jJgKkPyKd/Xn/VbcN9M8Szvwj pJIQU9AuVN/LTIOKT26jWDp5KiNklRWDUVP3e1JDtbWD65YaErSHfOsKRilMCU5Q G7rhjmGS5kMR3Edk/vv3on22+bhAkPMFt7kDiGfJ01pWpHiGaV/f9NgerjRpxc4T M1sf/3NV38VuKFS4XyjHyeXPvgmN4EKQDOis+wkMp0F0o898A4QlQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 24/29] hw/s390x/ipl: Set IPIB flags for secure IPL Date: Mon, 18 Aug 2025 17:43:17 -0400 Message-ID: <20250818214323.529501-25-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: WwosAwWbLsETfyj-mOmUBEuM_fNEojeG X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39e9c cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=MUQpW0jNMHjpGy_Q9scA:9 X-Proofpoint-GUID: WwosAwWbLsETfyj-mOmUBEuM_fNEojeG X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX6fuhU3mChO2v ywDW5BtVL+kkYnUacsK418fQG23nw5iCVEwzJRGbIdMUF+hslGPwGKDfSk1uO7UXcRLlgnXBOPx huI1SYQqrNwfw/HV9daYiyA9xIR+UJhKaA3qMV8IQGiPIbBFGRcSK19KWrcDN+Axu7Zpf98Gawu dfRieX8ZBkbTi3XQiwnQrZuzZsoKoBXh+bUyseM+SmNc6Vw+V/tqYBUA2VSzgm0ZJkuQ6G5AkCw KlZSnMlUOAziEueqE8MTUPv3X6altBVguZiegeK0lh+3jF6c/AqD0/y4A/0PwEKwVsl/ywh6YU0 LIPNQ0Q9O8gRsEpyyMtsJXspDrdNgQMcOGVH2/vRGoH56ln92TnrfObFGNm81rrDlAQbWEGWUK1 DA0E4HMB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553719742124100 Content-Type: text/plain; charset="utf-8" If `-secure-boot on` is specified on the command line option, indicating true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS. Any error that occurs during true secure IPL will cause the IPL to terminate. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d1a972ac8d..a196e1d648 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -437,6 +437,11 @@ static bool s390_has_certificate(void) return ipl->cert_store.count > 0; } =20 +static bool s390_secure_boot_enabled(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->secure_boot; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -494,6 +499,17 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + /* + * If secure-boot is enabled, then toggle the secure IPL flags to = trigger + * secure boot in the s390 BIOS. + * + * Boot process will terminate if any error occurs during secure b= oot. + * + * If SIPL is on, IPLIR must also be on. + */ + if (s390_secure_boot_enabled()) { + iplb->hdr_flags |=3D (DIAG308_IPIB_FLAGS_SIPL | DIAG308_IPIB_F= LAGS_IPLIR); + } /* * Secure boot in audit mode will perform * if certificate(s) exist in the key store. @@ -503,7 +519,7 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) * * Results of secure boot will be stored in IIRB. */ - if (s390_has_certificate()) { + else if (s390_has_certificate()) { iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; } =20 --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553686; cv=none; d=zohomail.com; s=zohoarc; b=nhE3YuKssaPCjKhAkix0jCmr5wIyq4bF1S+1izw/E2gUc9Fk9z6veMrieVSJRgRgScebv7BGRIN8UeI44oIheFcsewCYKH07rEg99A2DNhmJRmAtduyD9jb/D51Un8WmD7ExemkiMbG2C0UnQZBTEG3g0UkUHAEWeAyZ7ortrRk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553686; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pJaKCl2aGMg52Zp19ezkQh/VO9kWusZanGs0Us9ijC0=; b=TOSi6SYkekZYnc/hIfxbCQQix1DJd7D9XCrLG2IU7lfVC50IrtFQE0NuM3pNNYxUF2sM2U89qbZW2RArUrH8z/+u9fGcPVr1pjcdz1cCVWgCjaV4AXnmkOoGTl8wge5v/WoYq4YY1zIUWnjOmTtr87Dj9YiNk8SUtB6wsbcNeT4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553686523669.2248412953095; Mon, 18 Aug 2025 14:48:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ej-0002Jo-Od; Mon, 18 Aug 2025 17:44:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eN-0001qo-4H; Mon, 18 Aug 2025 17:44:20 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eG-0003oU-Se; Mon, 18 Aug 2025 17:44:17 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IBVT9M031299; Mon, 18 Aug 2025 21:43:57 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jfdrujjp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:56 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IIpcZj014735; Mon, 18 Aug 2025 21:43:56 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 48k5tmqgp8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:56 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhsoO24773244 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:54 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 85D4D58057; Mon, 18 Aug 2025 21:43:54 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8386F58058; Mon, 18 Aug 2025 21:43:53 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:53 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=pJaKCl2aGMg52Zp19 ezkQh/VO9kWusZanGs0Us9ijC0=; b=NWYvy7OnhAqahWv3dHXtEYrUoZKyl+Ljf 4yzlsHmeDpgu1higCvBwBz5g9RmHXmngx4AW5RAYYmvGtZQd+YNpFB9btE4gzxwW Ir9AMLaZOkARqM4kF+8hatEGkZa1fm6iHoLTWnKzmh6PdUBAbKI2w830rriR+iDS T1Pzhih4wLbHGWL2u8IK4lzGDB/4U8yrLlzWl1K4Rx39L1JRjHG2hPWxSb7lq4HX bQxO+0wwdOPXWPE3qYebgRuE09r7HMXM21tgKyEqSrdcVfnESSprwKcVVlNA4Sx/ x/Z5DJ3P6SsDARpMMV81SMJ/JF2a5Ad5iGmSFPnqUfv0SKQ1EsMyA== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 25/29] pc-bios/s390-ccw: Handle true secure IPL mode Date: Mon, 18 Aug 2025 17:43:18 -0400 Message-ID: <20250818214323.529501-26-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: KB_TTLf3V0tCSPnIHJ8ysvVahIPo27de X-Proofpoint-GUID: KB_TTLf3V0tCSPnIHJ8ysvVahIPo27de X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAwMSBTYWx0ZWRfXxpSej+IgRnx+ buytQzcfPcrFWCxLRrS8oPj5M60E9wrvHlUiSrejIla3jt1MLnelbCP2f0nk5H2Hx7nbDK6nEEj Ubnt+QUfGpZTjGdz8IAJxW9iBADIQEJs8XW4BMIW2ZvwlaPhrd04OWDZ8UkUivUIzhs7lCt38LT rR8M+N9unroA9oqt5Y3x4xMWTBnif3nz/CsJ2wriNOEhjx0PY07kG1JSTRKc0Nl9Jd4ehtvBEkx MFob3BohV2zcYHZPKJtZvFQlkLFNTbLD4qG1q7+sKAgn8fmqXFQFkjM9b7Hg0gCoqnDhlON/n6F 4N5Q8/FkAD5rAepukFVn3vBOzc2F8NbocluVoP2ZboHH6rqRUP9q8sRRIosJW2MAKCa1JHzH0ei 2enCTTgJ X-Authority-Analysis: v=2.4 cv=GotC+l1C c=1 sm=1 tr=0 ts=68a39e9c cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=YZg3iBzERQu5FGnwKEMA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 adultscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160001 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553688823116600 Content-Type: text/plain; charset="utf-8" When secure boot is enabled (-secure-boot on) and certificate(s) are provided, the boot operates in True Secure IPL mode. Any verification error during True Secure IPL mode will cause the entire boot process to terminate. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities. If secure boot is enabled but no certificate is provided, the boot process will also terminate, as this is not a valid secure boot configuration. Note: True Secure IPL mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 16 ++++++++++++++++ pc-bios/s390-ccw/bootmap.c | 19 ++++++++++++++++--- pc-bios/s390-ccw/main.c | 7 ++++++- pc-bios/s390-ccw/s390-ccw.h | 2 ++ pc-bios/s390-ccw/secure-ipl.c | 4 ++++ pc-bios/s390-ccw/secure-ipl.h | 3 +++ 6 files changed, 47 insertions(+), 4 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 0d14d0d62d..8ab457f1e1 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -66,3 +66,19 @@ Configuration: qemu-system-s390x -machine s390-ccw-virtio, \ boot-certs.0.path=3D/.../qemu/certs, \ boot-certs.1.path=3D/another/path/cert.pem = ... + +Secure Mode +----------- + +With *both* the presence of certificates in the store and the ``secure-boo= t=3Don`` +option, it is understood that secure boot should be performed with errors +reported and boot will abort. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio, \ + secure-boot=3Don, \ + boot-certs.0.path=3D/.../qemu/certs, \ + boot-certs.1.path=3D/another/path/cert.pem = ... diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 3922e7cdde..3ab89b91fb 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -737,6 +737,9 @@ static int zipl_run(ScsiBlockPtr *pte) entry =3D (ComponentEntry *)(&header[1]); =20 switch (boot_mode) { + case ZIPL_BOOT_MODE_INVALID: + return -1; + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: if (zipl_run_secure(&entry, tmp_sec)) { return -1; @@ -1118,9 +1121,16 @@ ZiplBootMode zipl_mode(uint8_t hdr_flags) { bool sipl_set =3D hdr_flags & DIAG308_IPIB_FLAGS_SIPL; bool iplir_set =3D hdr_flags & DIAG308_IPIB_FLAGS_IPLIR; + VCStorageSizeBlock *vcssb; =20 if (!sipl_set && iplir_set) { return ZIPL_BOOT_MODE_SECURE_AUDIT; + } else if (sipl_set && iplir_set) { + vcssb =3D zipl_secure_get_vcssb(); + if (vcssb =3D=3D NULL || vcssb->length =3D=3D VCSSB_NO_VC) { + return ZIPL_BOOT_MODE_INVALID; + } + return ZIPL_BOOT_MODE_SECURE; } =20 return ZIPL_BOOT_MODE_NORMAL; @@ -1131,7 +1141,8 @@ void zipl_load(void) VDev *vdev =3D virtio_get_device(); =20 if (vdev->is_cdrom) { - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { panic("Secure boot from ISO image is not supported!"); } ipl_iso_el_torito(); @@ -1140,7 +1151,8 @@ void zipl_load(void) } =20 if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { panic("Virtio net boot device does not support secure boot!"); } netmain(); @@ -1153,7 +1165,8 @@ void zipl_load(void) return; } =20 - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { panic("ECKD boot device does not support secure boot!"); } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 668660e64d..c5b425209a 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -277,10 +277,15 @@ static void ipl_boot_device(void) boot_mode =3D zipl_mode(iplb->hdr_flags); } =20 + if (boot_mode =3D=3D ZIPL_BOOT_MODE_INVALID) { + panic("Need at least one certificate for secure boot!"); + } + switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { panic("Passthrough (vfio) device does not support secure boot!= "); } =20 diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 6d51d07c90..389cc8ea7c 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -83,9 +83,11 @@ int virtio_read(unsigned long sector, void *load_addr); void zipl_load(void); =20 typedef enum ZiplBootMode { + ZIPL_BOOT_MODE_INVALID =3D -1, ZIPL_BOOT_MODE_UNSPECIFIED =3D 0, ZIPL_BOOT_MODE_NORMAL =3D 1, ZIPL_BOOT_MODE_SECURE_AUDIT =3D 2, + ZIPL_BOOT_MODE_SECURE =3D 3, } ZiplBootMode; =20 extern ZiplBootMode boot_mode; diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index 8c696828cd..09554a55ae 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -273,6 +273,10 @@ static bool check_sclab_presence(uint8_t *sclab_magic, comps->device_entries[comp_index].cei |=3D S390_IPL_COMPONENT_CEI_= INVALID_SCLAB; =20 /* a missing SCLAB will not be reported in audit mode */ + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { + zipl_secure_handle("Magic is not matched. SCLAB does not exist= "); + } + return false; } =20 diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index d60201bf45..9ddb5b79b7 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -58,6 +58,9 @@ static inline void zipl_secure_handle(const char *message) case ZIPL_BOOT_MODE_SECURE_AUDIT: IPL_check(false, message); break; + case ZIPL_BOOT_MODE_SECURE: + IPL_assert(false, message); + break; default: break; } --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553517; cv=none; d=zohomail.com; s=zohoarc; b=ghHHeIrH3v4Y1Kv3nRycQAYE27gyreaw1m+Hsnm39q2dmHa+T4wP+zCsOvPmC4iXmvA2rKiJd1JB80+1LFHL0fj9zxibdC/kAUd52BUTkrNQo3oTCZZTfWrBPRC60aeWQCWy2pLD/lWjVyaUlz59sHYUFQ6abF2Cw7F7+tqEJuk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553517; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4x+WT6lb7CEAsIr3qiRPURO1S0J07qNcICn0EVTg6Kk=; b=jUXwFyefOQxPz6OZ+Zz2txhlxAbem3YVTZYJ6NeLviOY+xaQA0fth8/1s72FRxL78c8l+9YD/rCEAPXB54S9d8Pw2yAF0I4x6wbd3vSsXmnaU18T97w0TOi+81fx364tL3XVe14ns7RySIr46DilB4sYt/glu6SojCS8cIQfkeQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553517332485.80917391397224; Mon, 18 Aug 2025 14:45:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ep-0002gD-0y; Mon, 18 Aug 2025 17:44:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ec-0002AO-Mz; Mon, 18 Aug 2025 17:44:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eZ-0003oi-MJ; Mon, 18 Aug 2025 17:44:34 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJpGnA029140; Mon, 18 Aug 2025 21:43:59 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhny3gfn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:58 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJo6UH003162; Mon, 18 Aug 2025 21:43:57 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cvx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:57 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhlAJ28049930 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:47 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A42B858057; Mon, 18 Aug 2025 21:43:55 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9F09458058; Mon, 18 Aug 2025 21:43:54 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:54 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=4x+WT6lb7CEAsIr3q iRPURO1S0J07qNcICn0EVTg6Kk=; b=nFHqc64iojaqXBNgQwCF/D9KDjDtat9F0 7VQBt42ZFPceDIb4kfOlcrQUGkNT2I3VTZbKXjce/ZOouqpCkwQeWFsb7z4rPX0A lFgPvTwID70aF9mxYK0l/gQUS2XqpuonMFuF+wXzJzAfrT17ljfkwJlwnCwJXwrH XR4LsTLOLQPBJPCZgnV/zmFVEaLoFo7jkL9C2eXQ5EL55bg2lUvbnAZ9bxBxMZfj 4ItCyBDDjcrTz2qskeye+0dAjv+EUJMgu6USIv4JblIUXNZsiAbJJ7kp47EqccpF KlwUpa8gm72bZ5hFAE1N7Q9AVfwUQ1f/kJiT8Wx6lID4qUGYA83MQ== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 26/29] pc-bios/s390-ccw: Handle secure boot with multiple boot devices Date: Mon, 18 Aug 2025 17:43:19 -0400 Message-ID: <20250818214323.529501-27-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XbqJzJ55 c=1 sm=1 tr=0 ts=68a39e9e cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=OWglaXZkh0GZWmb_D2oA:9 X-Proofpoint-ORIG-GUID: myyCd-pGNmzpnK-FRLBxh_u8sBNssDcD X-Proofpoint-GUID: myyCd-pGNmzpnK-FRLBxh_u8sBNssDcD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX5KQ5tX7bxWsE MEuXSzo0IM01YdkgfWTOBig4keOugyQqBB6YS9P6/Nx7q0V03FKGTAlJCeEPw6Bb5M6eVeeefKT 9d0HKXHoXf/sztl8t+ptQ5Q7kF3/HQvQA9TfwfrINXV6UzmPUegVl59VVOfC9ZSFyGsexmdaZFS 5+s1QHbWL9s5i8gMwB18/+YlvqkfTyypkT9WGwkjA2RzJHNQIVMO9Ksv+GkhVXXL0HrBEWwGjWy tvA44VmyuU90MqOZtsLc+WqFsx3QQJ42C9d/dvZdAFPrPohs0p/vSZ+YU0Dfh+Ap70IJrY77pZU 7D76360id2jPFPczEKZEJmCalRTN9B9KCSupRP9hQ9F9F2n4XF1XZRR7X6tJQrNZJt1uUZiNUJF lWusAupT X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 adultscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 malwarescore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553520249124100 Content-Type: text/plain; charset="utf-8" The current approach to enable secure boot relies on providing secure-boot and boot-certs parameters of s390-ccw-virtio machine type option, which apply to all boot devices. With the possibility of multiple boot devices, secure boot expects all provided devices to be supported and eligible (e.g., virtio-blk/virtio-scsi using the SCSI scheme). If multiple boot devices are provided and include an unsupported (e.g., ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will terminate with an error logged to the console. Signed-off-by: Zhuoying Cai --- pc-bios/s390-ccw/bootmap.c | 31 ++++++++------- pc-bios/s390-ccw/main.c | 75 ++++++++++++++++++++++++++++++++++--- pc-bios/s390-ccw/s390-ccw.h | 1 + 3 files changed, 88 insertions(+), 19 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 3ab89b91fb..8297f22c3c 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -1136,25 +1136,35 @@ ZiplBootMode zipl_mode(uint8_t hdr_flags) return ZIPL_BOOT_MODE_NORMAL; } =20 +int zipl_check_scsi_mbr_magic(void) +{ + ScsiMbr *mbr =3D (void *)sec; + + /* Grab the MBR */ + memset(sec, FREE_SPACE_FILLER, sizeof(sec)); + if (virtio_read(0, mbr)) { + puts("Cannot read block 0"); + return -EIO; + } + + if (!magic_match(mbr->magic, ZIPL_MAGIC)) { + return -1; + } + + return 0; +} + void zipl_load(void) { VDev *vdev =3D virtio_get_device(); =20 if (vdev->is_cdrom) { - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || - boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { - panic("Secure boot from ISO image is not supported!"); - } ipl_iso_el_torito(); puts("Failed to IPL this ISO image!"); return; } =20 if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || - boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { - panic("Virtio net boot device does not support secure boot!"); - } netmain(); puts("Failed to IPL from this network!"); return; @@ -1165,11 +1175,6 @@ void zipl_load(void) return; } =20 - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || - boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { - panic("ECKD boot device does not support secure boot!"); - } - switch (virtio_get_device_type()) { case VIRTIO_ID_BLOCK: zipl_load_vblk(); diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index c5b425209a..228b52a37e 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -271,8 +271,43 @@ static int virtio_setup(void) return ret; } =20 -static void ipl_boot_device(void) +static void validate_secure_boot_device(void) +{ + switch (cutype) { + case CU_TYPE_DASD_3990: + case CU_TYPE_DASD_2107: + panic("Passthrough (vfio) device does not support secure boot!"); + break; + case CU_TYPE_VIRTIO: + if (virtio_setup() =3D=3D 0) { + VDev *vdev =3D virtio_get_device(); + + if (vdev->is_cdrom) { + panic("Secure boot from ISO image is not supported!"); + } + + if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { + panic("Virtio net boot device does not support secure boot= !"); + } + + if (zipl_check_scsi_mbr_magic()) { + panic("ECKD boot device does not support secure boot!"); + } + } + break; + default: + panic("Secure boot from unexpected device type is not supported!"); + } + + printf("SCSI boot device supports secure boot.\n"); +} + +static void check_secure_boot_support(void) { + bool have_iplb_copy; + IplParameterBlock *iplb_copy; + QemuIplParameters *qipl_copy; + if (boot_mode =3D=3D ZIPL_BOOT_MODE_UNSPECIFIED) { boot_mode =3D zipl_mode(iplb->hdr_flags); } @@ -281,14 +316,40 @@ static void ipl_boot_device(void) panic("Need at least one certificate for secure boot!"); } =20 + if (boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL) { + return; + } + + /* + * Store copies of have_iplb, iplb and qipl. + * They will be updated in load_next_iplb(). + */ + have_iplb_copy =3D have_iplb; + iplb_copy =3D malloc(sizeof(IplParameterBlock)); + qipl_copy =3D malloc(sizeof(QemuIplParameters)); + + memcpy(qipl_copy, &qipl, sizeof(QemuIplParameters)); + memcpy(iplb_copy, iplb, sizeof(IplParameterBlock)); + + while (have_iplb_copy) { + if (have_iplb_copy && find_boot_device()) { + validate_secure_boot_device(); + } + have_iplb_copy =3D load_next_iplb(); + } + + memcpy(&qipl, qipl_copy, sizeof(QemuIplParameters)); + memcpy(iplb, iplb_copy, sizeof(IplParameterBlock)); + + free(qipl_copy); + free(iplb_copy); +} + +static void ipl_boot_device(void) +{ switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT || - boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE) { - panic("Passthrough (vfio) device does not support secure boot!= "); - } - dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: @@ -338,6 +399,8 @@ void main(void) probe_boot_device(); } =20 + check_secure_boot_support(); + while (have_iplb) { boot_setup(); if (have_iplb && find_boot_device()) { diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 389cc8ea7c..3009104686 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -93,6 +93,7 @@ typedef enum ZiplBootMode { extern ZiplBootMode boot_mode; =20 ZiplBootMode zipl_mode(uint8_t hdr_flags); +int zipl_check_scsi_mbr_magic(void); =20 /* jump2ipl.c */ void write_reset_psw(uint64_t psw); --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553558; cv=none; d=zohomail.com; s=zohoarc; b=CERhNenXsSWLC9VTG/lfgxSAVYboCSQPzIEqSBzcLWCCog4Lg8LWpeFZ/WiM/yQHZF5vUjtv4EKWtsWgGRW3rzJy2oy0CBKwfcKa9WbWGcOli3pQ61Jt66094xm9UB1WJh7e9ouOK7Sxzm8leHSgLuYBICfSuc4/9ib9PSv+Y6c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553558; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wwMfycF4wzNDRdtcjasvt1Q8wKCTsuFxICwCcHOIbng=; b=K1bmRIXx655Qc4DRxbwCHJFlG2ZGm3C7PckLMwZ0dZ9op8R1iAnkwyleCZePHtFQYZnVO/DM5atBP0BQsf442tQFA/UwJqKCHB+JsxGTBLcR0BC/XqRcrLRewMWCIr3RFsgbL2zb8+PwRNaheTtBzOKi6W8KP6KmoCOljDqcH38= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553558387910.3025849487215; Mon, 18 Aug 2025 14:45:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7ea-00026z-KQ; Mon, 18 Aug 2025 17:44:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eI-0001pU-BY; Mon, 18 Aug 2025 17:44:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003oe-M7; Mon, 18 Aug 2025 17:44:14 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ICKIP0022245; Mon, 18 Aug 2025 21:43:59 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jhq9ugjs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:58 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ9uPT002750; Mon, 18 Aug 2025 21:43:57 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cvy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:57 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhuqp27918920 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:56 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE9C658057; Mon, 18 Aug 2025 21:43:56 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BD0E158058; Mon, 18 Aug 2025 21:43:55 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:55 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wwMfycF4wzNDRdtcj asvt1Q8wKCTsuFxICwCcHOIbng=; b=IdfOl/qEc8kkRvJsn7F6x1Sdjf9Q8+GY8 2QWqDIRn3nWf5JN5Rn47TOODqhS6FS49Hc/LLo9j03EiL0I/N+KRswBue1Rac/wH I8QGFEb6vZ7AhcM4PKTdtYxTuchxcIiDg/QtiT7OzKhElS4qM+VWwshbkuloBGCE Ydw0HLgQwDlLkYYrL3ufEsERRnPUJVzMsbW1OGdaW5ZnqM6PS25lMo1sCZzAjJZP /w9kWJ8WXysgLfr38hR1mTmOHmY1cDGMaznf+qm8L96fEea54qIHi3gl2Df+LevN v0Oh+8yN5j1WJMt5K5nCWLzfvPGMiV0kp6/Avoth0C02ZFuYG9t4g== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 27/29] hw/s390x/ipl: Handle secure boot without specifying a boot device Date: Mon, 18 Aug 2025 17:43:20 -0400 Message-ID: <20250818214323.529501-28-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=N50pF39B c=1 sm=1 tr=0 ts=68a39e9e cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=98YBU2wH__9RKlX8yukA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAyNyBTYWx0ZWRfX1M+z20jUznCm J088twjxnpE8faKOUqVeXjfht1jfW6PmjRcv+BrFoZIIeKz6pS/gIZ+PAmJf4WcjZL3r+YPoLq+ HReNpjfpgZL2GreTew8MfUJw/eQXCxS0iFrtvIkQPKlFDm1I4ZxzqgUPlHylSvDEixScBVQvZ5y LSEke2nGD+p+zaLVVFt7F1vjj71EEhcwTgMRGdHktNigwdWUn90KAVsjU384LDfcW1sUSn9ullr /E+xd2q+funuN7Fd6eFGTYKqhIpC5rUXoAUDDxQLOd2cBnIWy89wz865qI2m461FpwowSaS60eW YYaaCki54Ye3am7juYEl91UAO0KAe6nWULIRJTTVFKBzJhWq1xMaq3BF2JHouQbfRt9aGtAcmPH m5eES/Rf X-Proofpoint-GUID: -uvhAjkVqSUPWWC1x1hJNNutqDUQmsHr X-Proofpoint-ORIG-GUID: -uvhAjkVqSUPWWC1x1hJNNutqDUQmsHr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160027 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553558790116600 Content-Type: text/plain; charset="utf-8" If secure boot in audit mode or True Secure IPL mode is enabled without specifying a boot device, the boot process will terminate with an error. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index a196e1d648..da50b52c75 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -764,6 +764,16 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) s390_ipl_create_cert_store(&ipl->cert_store); if (!ipl->iplb_valid) { ipl->iplb_valid =3D s390_init_all_iplbs(ipl); + + /* + * Secure IPL without specifying a boot device. + * IPLB is not generated if no boot device is defined. + */ + if ((s390_has_certificate() || s390_secure_boot_enabled()) && + !ipl->iplb_valid) { + error_report("No boot device defined for Secure IPL"); + exit(1); + } } else { ipl->qipl.chain_len =3D 0; } --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553496; cv=none; d=zohomail.com; s=zohoarc; b=MdHbaQekNryxDukPe15/hp6HydGxB6294i3lub79AvcR90ow8IAXW4UOskJb6KeZ7oPRaBiBrl5VoMCEfeT2GVVmniCrII+ane52nrJei7g/+NCIyclQ9G425kkeXkX+nGBJ2HghDI57BHbQ7uu68NUqbebwA73+4UuN/e9Zpbg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553496; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1lNRbqTgGXWM0kB6wwxpH8QYp6l8X3VtwcawMq1q0Sc=; b=KZ9NBiM2fMcSk8zdBpE/GR4MW/kazo98P5KTHJFbD1B1jv4Fcf6DwkAjixLlzATEDgL6buQCHsVXiy8XqK8RlV4ffacK5G9F3iHB7SOdZEUfwybfoPTF2TpTj5cKG2EUYjZtRkGSs7Q9OiiLmYHesUHgAPITbfNoSsz140y8HC8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553496261168.99456341323184; Mon, 18 Aug 2025 14:44:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7eY-000200-KL; Mon, 18 Aug 2025 17:44:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eJ-0001pn-TA; Mon, 18 Aug 2025 17:44:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7eF-0003ol-UH; Mon, 18 Aug 2025 17:44:15 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57ILM17k007399; Mon, 18 Aug 2025 21:44:00 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48jge3ucg1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:59 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ9uPV002750; Mon, 18 Aug 2025 21:43:59 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k6hm7cw1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:43:59 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhwUs32637590 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:58 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E875C58057; Mon, 18 Aug 2025 21:43:57 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E68BC58058; Mon, 18 Aug 2025 21:43:56 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:56 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=1lNRbqTgGXWM0kB6w wxpH8QYp6l8X3VtwcawMq1q0Sc=; b=dKL43wCihQ48Vos4fA+gqbyMyrr1+p2Bv 5t+hlG85+Ecob1+7KrncHfkD8X1BUoK5v5J1Hj0WyiR5LMt735SEKAoJwH74dfWf xGKfY8VsufFacW8/2rZ1vjcwtrviX93VlDqPIO4sk9/01nLHAGQsQ8ZOMASJljVw OxvFukS/E7Mylbovd/26t8q3XxqLOYFBb8Gkrrs8ORv4OAcF8f4Lfx/uiWjdVpa3 p/HrdCgV8cUW0U2GSc/pscUWLDXtcQCwPzlAD9IcmigtmoyUq9xUaCo441+Vtk3w z1alpKqPqAic9YKkv3G8VSx1BOTqWW+UhxsjfH++etfxFwWmZH+0g== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 28/29] docs/specs: Add secure IPL documentation Date: Mon, 18 Aug 2025 17:43:21 -0400 Message-ID: <20250818214323.529501-29-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=FcM3xI+6 c=1 sm=1 tr=0 ts=68a39e9f cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=pevZWc-pxkjX5tstIEcA:9 X-Proofpoint-GUID: V8ET2Sv2Xn6m7AaVQ5yvtW63Ht0Rd-D2 X-Proofpoint-ORIG-GUID: V8ET2Sv2Xn6m7AaVQ5yvtW63Ht0Rd-D2 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE2MDAxMSBTYWx0ZWRfX14/5qjjK4J6d Q5U8HM0AvgWajxp5EHNai1seqTph0NNCy0LlYtkRiZN811SyiKfWqYkZqTWfqs5R8NtlKtAg2II dS7qq+M5Ogjt+HuYfQD/iQx1YI3Hahb7tq8aWW2kSjUjRAhDFSzXjZPVjO3+zHGMCTooTLAtBEX 00x3FoALEG1zUzvNbYEHD3hMfmpXLMQlHjuzTbPhVtuX24PfDnECl//i3+LnPBrNfZ51GX9jmBX im2Nim27Kc0NY1urNejn8qe8YtwLIenGlgZY7CfMB8sdJ6pzxhvlVB4sTaf9JzZfEMLoIIDXQop RR0+FTQRcyyTTJjwrZpHzhndIKsLbOv9k7EevIds5DN0NAOtetvKSTRbXfMoDHPAnyZef5lEp2h OKCN6qL0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 adultscore=0 phishscore=0 clxscore=1015 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508160011 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553498297116600 Content-Type: text/plain; charset="utf-8" Add documentation for secure IPL Signed-off-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 53 +++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 72ab901014..dab25cb8c1 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -1,5 +1,58 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL (a.k.a. secure boot) enables s390-ccw virtual machines to +leverage qcrypto libraries and z/Architecture emulations to verify the +integrity of signed kernels. The qcrypto libraries are used to perform +certificate validation and signature-verification, whereas the +z/Architecture emulations are used to ensure secure IPL data has not +been tampered with, convey data between QEMU and userspace, and set up +the relevant secure IPL data structures with verification results. + +To find out more about using this feature, see ``docs/system/s390x/secure-= ipl.rst``. + +Note that "userspace" will refer to the s390-ccw BIOS unless stated +otherwise. + +Both QEMU and userspace work in tandem to perform secure IPL. The Secure +Loading Attributes Facility (SCLAF) is used to check the Secure Code +Loading Attribute Block (SCLAB) and ensure that secure IPL data has not +been tampered with. DIAGNOSE 'X'320' is invoked by userspace to query +the certificate store info and retrieve specific certificates from QEMU. +DIAGNOSE 'X'508' is used by userspace to leverage qcrypto libraries to +perform signature-verification in QEMU. Lastly, userspace generates and +appends an IPL Information Report Block (IIRB) at the end of the IPL +Parameter Block, which is used by the kernel to store signed and +verified entries. + +The logical steps are as follows: + +- Userspace reads data payload from disk (e.g. stage3 boot loader, kernel) +- Userspace checks the validity of the SCLAB +- Userspace invokes DIAG 508 subcode 1 and provides it the payload +- QEMU handles DIAG 508 request by reading the payload and retrieving the + certificate store +- QEMU DIAG 508 utilizes qcrypto libraries to perform signature-verificati= on on + the payload, attempting with each cert in the store (until success or ex= hausted) +- QEMU DIAG 508 returns: + + - success: index of cert used to verify payload + - failure: error code + +- Userspace responds to this operation: + + - success: retrieves cert from store via DIAG 320 using returned index + - failure: reports with warning (audit mode), aborts with error (secure = mode) + +- Userspace appends IIRB at the end of the IPLB +- Userspace kicks off IPL + +More information regarding the respective DIAGNOSE commands and IPL data +structures are outlined within this document. + + s390 Certificate Store and Functions =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 --=20 2.50.1 From nobody Sat Nov 15 05:35:27 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1755553784; cv=none; d=zohomail.com; s=zohoarc; b=YNZTmFq3BOlfyQCgRx8ukV7m7c1VvJJ+t3G9XgnGnyKPVNzGcLQJDH6stnsxcyFEh1wc0UnUYIGOI7/BpGKb1oDPjcOoroRr2RjC5JDmtUhKicYoI4OoiRIFoYgXava8HUtJn7Ei63LynASaMjkjwXSgj1pRnH4qcPN+MvbxovI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1755553784; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PHj6pdr7vDHIZx/iJ2uw9FD465VZS617qyu7K9PRWrw=; b=G9NDf2DufwULcM62YvcJQUlds2GStu6qqMIgixZz7QQcAtp7E09cvLMmeol+hi3puTggifgqWDyK0UZsrTR1sjBWT4kWTyrDa5crejGbQtTQFXnM0FqoMmahsKetWnbsAQwkjmN19T/T1MkV2ELWGc7idilZXgc+kGb3kPsLLpQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1755553784934187.29497548884; Mon, 18 Aug 2025 14:49:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uo7en-0002SK-1q; Mon, 18 Aug 2025 17:44:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ee-0002DY-K9; Mon, 18 Aug 2025 17:44:37 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uo7ea-0003ou-SN; Mon, 18 Aug 2025 17:44:35 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 57IJ2ED2027146; Mon, 18 Aug 2025 21:44:01 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 48k60g0cph-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:44:00 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 57IHBsil011695; Mon, 18 Aug 2025 21:44:00 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 48k4au7r96-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Aug 2025 21:44:00 +0000 Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 57ILhxjZ28377794 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 18 Aug 2025 21:43:59 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1161F58057; Mon, 18 Aug 2025 21:43:59 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0C49458058; Mon, 18 Aug 2025 21:43:58 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.98.172]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 18 Aug 2025 21:43:57 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=PHj6pd r7vDHIZx/iJ2uw9FD465VZS617qyu7K9PRWrw=; b=eLrqEd+3V34WJ58dSSMcNG qGLAoi9Kj6XaxsPWRGbiPKLsX2xP+47WjoOhbnHLuV7pbq6biagXF0BUXzxpghNn 9bowrG8Tw53zZ6PcA/bBQDsfR4lIdW+OmoQNIQcou9/I3bD3naGOnayATC2oFyiM 94odcs/cGVjtGeAJkTNyn7IFJuQzHy6MHalySAENNFNJZs+wJ4QUEJsTNdsBrHdX ECh6fp40U4qWpZ94mLTa4Q3E9MckuDEnq+lOb/zoxr3k60MAFjfMbtLLJo++aml4 ihXsOBYgnrpiFzJ0ZzVE3UH+waNAP5mduo3yUMZCIqf8Fehpx5QCA2L+gml6JR3w == From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@redhat.com, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, zycai@linux.ibm.com Subject: [PATCH v5 29/29] docs/system/s390x: Add secure IPL documentation Date: Mon, 18 Aug 2025 17:43:22 -0400 Message-ID: <20250818214323.529501-30-zycai@linux.ibm.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250818214323.529501-1-zycai@linux.ibm.com> References: <20250818214323.529501-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: rZPEBvQZjNfo98Clc3ZeWKLsppqViN8_ X-Authority-Analysis: v=2.4 cv=coObk04i c=1 sm=1 tr=0 ts=68a39ea1 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=2OwXVqhp2XgA:10 a=VnNF1IyMAAAA:8 a=q5T4S90kAAAA:8 a=pLVlpZFyWxzbV8Ps1vQA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=LnBBZQxPVJ0Z7KJyRdxh:22 X-Proofpoint-GUID: rZPEBvQZjNfo98Clc3ZeWKLsppqViN8_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODE3MDAxNiBTYWx0ZWRfX86hKElNyd7V+ F+a/Mz7PX0hkvF4DBPYi4vjk1hg5mrwU2YRfa0X4fchItWbAzVKSaqbygaC1gzCydgVNVDlkNt4 yF0YssVATqsYwKKWIHm+EdWFwbNqBbZ8SquFFTftgazSNYseqxAxewzfpV8OnbePicihK1wXyoW pjpp3cGr9ljY23KdrgW82Z/z8amf6XZclpXkeWLWDM0Pb9Ys91VS26rc2G1ePwPlgvoGuhdL63u kekFZSX7ZL/5HdvsKRFn0RtPVGoPCzq7h3wMudJu2CqmpvIN3dT9s4lZGW39Vy1apOP6fYZRJGW Lk83v6YI1xWzcrpGLWmfkLK3z2fXsm59Y4iXOSjZ2Ux7IhsiL2DrOv5l/eHiKxfTHLCRstghTjy W0dlPzKW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-18_06,2025-08-14_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 suspectscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508170016 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1755553786494124100 Add documentation for secure IPL Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 96 ++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 8ab457f1e1..5842ed83d0 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -1,5 +1,21 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL, also known as secure boot, enables s390-ccw virtual machines to +verify the integrity of guest kernels. + +For technical details of this feature, see ``docs/specs/s390x-secure-ipl.r= st``. + +This document explains how to use secure IPL with s390x in QEMU. It covers +new command line options for providing certificates and enabling secure IP= L, +the different IPL modes (Normal, Audit, and Secure), and system requiremen= ts. + +A quickstart guide is provided to demonstrate how to generate certificates, +sign images, and start a guest in Secure Mode. + + Secure IPL Command Line Options =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D =20 @@ -82,3 +98,83 @@ Configuration: secure-boot=3Don, \ boot-certs.0.path=3D/.../qemu/certs, \ boot-certs.1.path=3D/another/path/cert.pem = ... + + +Constraints +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +The following constraints apply when attempting to secure IPL an s390 gues= t: + +- z16 CPU model +- certificates must be in X.509 PEM format +- only support for SCSI scheme of virtio-blk/virtio-scsi devices +- a boot device must be specified +- any unsupported devices (e.g., ECKD and VFIO) or non-eligible devices (e= .g., + Net) will cause the entire boot process terminating early with an error + logged to the console. + + +Secure IPL Quickstart +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Build QEMU with gnutls enabled +------------------------------- + +.. code-block:: shell + + ./configure =E2=80=A6 --enable-gnutls + +Generate certificate (e.g. via certtool) +---------------------------------------- + +A private key is required before generating a certificate. This key must b= e kept secure +and confidential. + +Use an RSA private key for signing. + +.. code-block:: shell + + certtool --generate-privkey > key.pem + +A self-signed certificate requires the organization name. Use the ``cert.i= nfo`` template +to pre-fill values and avoid interactive prompts from certtool. + +.. code-block:: shell + + cat > cert.info <