From nobody Sun Apr 12 06:08:38 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1770929132; cv=none; d=zohomail.com; s=zohoarc; b=Ioh5mloSu8ikCTZcpVbMhugdWC9sDFAvf9n38w7CevbvQ+03ZTZxbFC1zS1uUq2MLtQB3+x1Uw2ylgLK4bU7VgntsTztVkCCQ8BVMDNlG9CzdQOZud7tEtQMcioEQ/B0SKEIDKlr7PZ0/nXZA2JGwLUGn1xKGuH8EV/EUFQe3Gc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1770929132; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lqV14i4OXx37CwbJbYaajgUk0kzYUn8dpFUr9K3xZ34=; b=LzPmM0+cFgbdzthDQmwUfpDaVh7rvyVUhQi/DPpebyl9YA7VkaeQ8muZp6BVumQBV6VcOcNTxj3KARGY+ftfcOC4umQTKiHZWWDoQYfgOWulF5TkfkzDhfLiXQi3D/9NXqnLfC9agfWUZkRm1MH1H6DQxcLRXmLfp7R85VKTC+8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1770929132883355.42346108542824; Thu, 12 Feb 2026 12:45:32 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vqdY6-0000m2-Kn; Thu, 12 Feb 2026 15:44:30 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vqdY4-0000ko-Id; Thu, 12 Feb 2026 15:44:28 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vqdY2-0007cu-RN; Thu, 12 Feb 2026 15:44:28 -0500 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61CD9ntL2606743; Thu, 12 Feb 2026 20:44:23 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4c696ur7x0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Feb 2026 20:44:22 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 61CGjI8p008390; Thu, 12 Feb 2026 20:44:21 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4c6g3ym7ur-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Feb 2026 20:44:21 +0000 Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 61CKiKJk50397492 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 12 Feb 2026 20:44:20 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 60AFC58055; Thu, 12 Feb 2026 20:44:20 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A3D2158054; Thu, 12 Feb 2026 20:44:18 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.112.15]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 12 Feb 2026 20:44:18 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=lqV14i4OXx37CwbJb YaajgUk0kzYUn8dpFUr9K3xZ34=; b=HTQywdEBtDMAwdwCzqMEPQVRv5Yrll3Dd qew0rn4ftzDNxbl7VTHOJwS/lwQyafnddZo42e6uU06abVPOwmEfZuk75+wfGZ4L +CiYvN+2RPk+QseM+i7LYcjnNbCZzBLYNGm5KOogVroKtcXXatdkW/KUXWzqkiu4 NEzInO1VBSTfygGYfCXsK4BX4imnagwiMgPMMOu/frww1UeqBx9Jc6gJ81jB0Tn9 tebp2+igxUSV8FpMsQx/hPAM5sTKAsY0Y/hmA0bJ9SCsU++zqzq1FKWpA8MyN/Ox pBuZo8jhz6t0sxBjiaEc8urGC5bll9Bu+TYvmuakKfvhw0jflthDA== From: Zhuoying Cai To: thuth@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com Subject: [PATCH v8 13/30] s390x/ipl: Introduce IPL Information Report Block (IIRB) Date: Thu, 12 Feb 2026 15:43:34 -0500 Message-ID: <20260212204352.1044699-14-zycai@linux.ibm.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260212204352.1044699-1-zycai@linux.ibm.com> References: <20260212204352.1044699-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=KZnfcAYD c=1 sm=1 tr=0 ts=698e3ba6 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=HzLeVaNsDn8A:10 a=VkNPw1HP01LnGYTKEx00:22 a=Mpw57Om8IfrbqaoTuvik:22 a=GgsMoib0sEa3-_RKJdDe:22 a=VnNF1IyMAAAA:8 a=1JLT7A-2tSAM-sJnsQYA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjEyMDE1NyBTYWx0ZWRfX44m/NkW7Nlgp pdYaKlVnkZjhRF5/fVwVmxXDZeHqlQt1SuwsLyEnPIPRijT7kLEitfbzr3LiBfPRa9E4PMNDWTE N0s7mpq2fQ7caqF9sOLvgJKKHWngIJME01BXgqCggh1jEiSNSq0Kb7bt+W0CSeP/pfsY5anjG24 toXMbdhwF2MIhvQ+Z0myg9iUYzUM0kKptvzghWLbtb/K+FgTmpRooqIFC83HQhOwTtKyd7EuKDs 6KC2iGiVhtLa708jUj9qLNxEG7of1z90fvun7DP1+zkRtsJJNwB6qNAs3gsPJRjO1y0HrS17DV1 s62Q3zjn3QFCOcuVFzy6r/aw9fn60OejhxjQzzZwO+jSIDpC5DgyhzvGWIlBYNcmkdvVMhuOkaC yZJV7meYUTRqHzXAS9TmtvAH7M7pGaDT8lCLV245AGwDx+/dtenlHRzqqFSHRn/JuNgeq9dHfeq xS/oiLKuvJyARmbEVrQ== X-Proofpoint-ORIG-GUID: artyuK00BKafEVP_wPWZz_OnZDaOZ58l X-Proofpoint-GUID: artyuK00BKafEVP_wPWZz_OnZDaOZ58l X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-12_05,2026-02-12_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 bulkscore=0 priorityscore=1501 adultscore=0 clxscore=1015 suspectscore=0 phishscore=0 malwarescore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000 definitions=main-2602120157 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1770929134836154100 Content-Type: text/plain; charset="utf-8" The IPL information report block (IIRB) contains information used to locate IPL records and to report the results of signature verification of one or more secure components of the load device. IIRB is stored immediately following the IPL Parameter Block. Results on component verification in any case (failure or success) are stored. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali --- docs/specs/s390x-secure-ipl.rst | 14 ++++++++ include/hw/s390x/ipl/qipl.h | 59 +++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 6e5a86fcf4..82dd8b847a 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -95,3 +95,17 @@ Subcode 1 - perform signature verification * ``0x0302``: PKCS#7 format signature is invalid * ``0x0402``: signature-verification failed * ``0x0502``: length of Diag508SigVerifBlock is invalid + +IPL Information Report Block +---------------------------- + +The IPL Parameter Block (IPLPB), utilized for IPL operation, is extended w= ith an +IPL Information Report Block (IIRB), which contains the results from secur= e IPL +operations such as: + +* component data +* verification results +* certificate data + +The guest's kernel inspects the IIRB and uses the certificate data it cont= ains +to build the keyring. diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index e505f44020..0f1f55c428 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -126,4 +126,63 @@ union IplParameterBlock { } QEMU_PACKED; typedef union IplParameterBlock IplParameterBlock; =20 +struct IplInfoReportBlockHeader { + uint32_t len; + uint8_t flags; + uint8_t reserved1[11]; +}; +typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; + +struct IplInfoBlockHeader { + uint32_t len; + uint8_t type; + uint8_t reserved1[11]; +}; +typedef struct IplInfoBlockHeader IplInfoBlockHeader; + +enum IplInfoBlockType { + IPL_INFO_BLOCK_TYPE_CERTIFICATES =3D 1, + IPL_INFO_BLOCK_TYPE_COMPONENTS =3D 2, +}; + +struct IplSignatureCertificateEntry { + uint64_t addr; + uint64_t len; +}; +typedef struct IplSignatureCertificateEntry IplSignatureCertificateEntry; + +struct IplSignatureCertificateList { + IplInfoBlockHeader ipl_info_header; + IplSignatureCertificateEntry cert_entries[MAX_CERTIFICATES]; +}; +typedef struct IplSignatureCertificateList IplSignatureCertificateList; + +#define S390_IPL_DEV_COMP_FLAG_SC 0x80 +#define S390_IPL_DEV_COMP_FLAG_CSV 0x40 + +struct IplDeviceComponentEntry { + uint64_t addr; + uint64_t len; + uint8_t flags; + uint8_t reserved1[5]; + uint16_t cert_index; + uint8_t reserved2[8]; +}; +typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; + +struct IplDeviceComponentList { + IplInfoBlockHeader ipl_info_header; + IplDeviceComponentEntry device_entries[MAX_CERTIFICATES]; +}; +typedef struct IplDeviceComponentList IplDeviceComponentList; + +#define COMP_LIST_MAX sizeof(IplDeviceComponentList) +#define CERT_LIST_MAX sizeof(IplSignatureCertificateList) + +struct IplInfoReportBlock { + IplInfoReportBlockHeader hdr; + uint8_t info_blks[COMP_LIST_MAX + CERT_LIST_MAX]; +}; +typedef struct IplInfoReportBlock IplInfoReportBlock; + #endif --=20 2.52.0