From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939035; cv=none; d=zohomail.com; s=zohoarc; b=nAxyql9FZcrt/cDfVTtov8C5VgPms3rCMwvqJ1w8iSxDiZSHWFJiKs52jcItL6JQs3ZvnnyvD8h666ZKWjqIl+PVYU3kVLEPS8gDd4oGWYw7Ngtvq3M6pWVlfCVxSqngdnCVnxp45UThTqjWr2wf0jCB36+f9wWW5nHE2cTVadE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939035; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZQBMveVz3zrHCUv4OhXugWlZu+8BB0BQPD62b5QP9po=; b=dn000cH2HFhDweEqM9tDBqVLP1A8/55r5j0SJbyj81OTJC4d2EmraUBc8Y5drmkimwLq0PMpwFVQpVE9DcU2sNzLe7jHbMq9/6khBLr2o7x+8wFSP1hIeW0+7gY+EbQq6g2ADebwKq/mReV0lPADAm9vVZAuBCtqqyufbtLn7Sg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939035695193.99715874971525; Wed, 1 Jul 2026 13:50:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sJ-00037z-VC; Wed, 01 Jul 2026 16:49:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sI-00037g-Fu; Wed, 01 Jul 2026 16:49:38 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sG-0003oP-IC; Wed, 01 Jul 2026 16:49:38 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmqo31339841; Wed, 1 Jul 2026 20:49:32 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa69ue-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:32 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KYhwo010662; Wed, 1 Jul 2026 20:49:31 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9f2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:31 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KnUZc29360836 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:30 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0B9B25803F; Wed, 1 Jul 2026 20:49:30 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0A7F858054; Wed, 1 Jul 2026 20:49:27 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:26 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ZQBMveVz3zrHCUv4O hXugWlZu+8BB0BQPD62b5QP9po=; b=fascamW4ktKuP7YqE9X7AH4HN8FMy3cNu 3rKz7ZRyhp+sx9mL+cgsO4w21PtSBB2HPsXo+uIBfXtikmDwUzoHShydzBObi790 gY2kcvuTeQ7k1c9a+Sr4xIm77Lqai+ztuCK8XvdaHPIvoKSdM/3q/RbnBXkRY/LA BkEHPmQPpW1mr/Q8l0Q/Dk1XkETUq0JLyydHaCZ24JAEEbt9oNM+BASjFl2rcy5s /ya2XfDD1SwnxmWMPYrnG6zLBOwvgZflKvK1ouOqDToud+poXo3RHQvol0yjwdj/ jD3usJoC2kXykoaoF3q/lNspRlx78C1C+kXJp4UA8G9DGFKHp07dg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 01/35] Add boot-certs to s390-ccw-virtio machine type option Date: Wed, 1 Jul 2026 16:48:47 -0400 Message-ID: <20260701204922.1320349-2-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX+rfcVoMrqDxW fn5YBHQQuoCznPBBkDuCgW3jBEuOhBKQj5kODftkfhdOnlCrOh7lv7DYxrnhADzMmA42i7dOk+r d5XUqSKyKxSHutArPXAjlDYHHlBcEEGJvv2pFI/8P97aR/wBH4cdFXRuqwpkCs/F6i4XiWNUT2f bbSevwj1tpDcRNgH+DU439es5litjbBEcvBcPCAgDbI5TqiUZaT2pNs7mWaJTdgdj6kIH1xpmPv ZyUEOdtgXw5yaI/gOWAtm9EZjl23ufrfntzK2cFhhF5r6x7M3Zuw+kfqGaJiJ/2qNXbr8f1gDjS Ts1CIjGV7gGQcbB5VGu3P0q0kA+vBryqKMe3vYOrifiTjHNdCo0iBDY6m/IBkJdiNWuafhRHu/O oFvoOwa2nrOLSjKU0LofakspwTRo/Bwy1+cWG5JZR1UBOjhIgVthXzaXZ2Z2sVpwpqbjrSj/b3C xNQ8OtaZL1yZFwq9V9Q== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX9hp4mvaeFJYh dfIuVsw6zHWOXFEwPQJaPWke5ahJbQ9mlXMO1isK14P/CSWp6r8/TsLdf2d122IsO1eRkP+3OwT xhRRWgUZzyhq8OQxwbWTS2BCCsKQTbI= X-Proofpoint-GUID: 6fpMI9Y6AIy97-6Psa2sZlEv7MRLz9YJ X-Proofpoint-ORIG-GUID: 6fpMI9Y6AIy97-6Psa2sZlEv7MRLz9YJ X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457d5c cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=pOjPfhpiL-oY2_FcObYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939037427158500 Content-Type: text/plain; charset="utf-8" Introduce a new `boot-certs` machine type option for the s390-ccw-virtio machine. This allows users to specify one or more certificate file paths or directories to be used during secure boot. Each entry is specified using the syntax: boot-certs..path=3D/path/to/cert.pem Multiple paths can be specify using array properties: boot-certs.0.path=3D/path/to/cert.pem, boot-certs.1.path=3D/path/to/cert-dir, boot-certs.2.path=3D/path/to/another-dir... Signed-off-by: Zhuoying Cai Acked-by: Markus Armbruster Reviewed-by: Matthew Rosato --- docs/system/s390x/secure-ipl.rst | 20 ++++++++++++++++++++ docs/system/target-s390x.rst | 1 + hw/s390x/s390-virtio-ccw.c | 30 ++++++++++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 2 ++ qapi/machine-s390x.json | 23 +++++++++++++++++++++++ qapi/pragma.json | 1 + qemu-options.hx | 6 +++++- 7 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 docs/system/s390x/secure-ipl.rst diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst new file mode 100644 index 0000000000..88df52ce2f --- /dev/null +++ b/docs/system/s390x/secure-ipl.rst @@ -0,0 +1,20 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +Secure IPL Command Line Options +------------------------------- + +The s390-ccw-virtio machine type supports secure IPL. These parameters all= ow +users to provide certificates and enable secure IPL directly via the comma= nd +line. + +Providing Certificates +^^^^^^^^^^^^^^^^^^^^^^ + +The certificate store can be populated by supplying a list of X.509 certif= icate +file paths or directories containing certificate files on the command-line: + +Note: certificate files must have a .pem extension. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/docs/system/target-s390x.rst b/docs/system/target-s390x.rst index 94c981e732..8938a13d10 100644 --- a/docs/system/target-s390x.rst +++ b/docs/system/target-s390x.rst @@ -35,3 +35,4 @@ Architectural features s390x/bootdevices s390x/protvirt s390x/cpu-topology + s390x/secure-ipl diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 25a9fa4955..b3c96ba35b 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -44,6 +44,7 @@ #include "target/s390x/kvm/pv.h" #include "migration/blocker.h" #include "qapi/visitor.h" +#include "qapi/qapi-visit-machine-s390x.h" #include "hw/s390x/cpu-topology.h" #include "kvm/kvm_s390x.h" #include "hw/virtio/virtio-md-pci.h" @@ -788,6 +789,30 @@ static void machine_set_loadparm(Object *obj, Visitor = *v, g_free(val); } =20 +static void machine_get_boot_certs(Object *obj, Visitor *v, + const char *name, void *opaque, + Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertificatesList **certs =3D &ms->boot_certs; + + visit_type_BootCertificatesList(v, name, certs, errp); +} + +static void machine_set_boot_certs(Object *obj, Visitor *v, const char *na= me, + void *opaque, Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertificatesList *cert_list =3D NULL; + + visit_type_BootCertificatesList(v, name, &cert_list, errp); + if (!cert_list) { + return; + } + + ms->boot_certs =3D cert_list; +} + /* * S390x-specific global compatibility properties. * @@ -856,6 +881,11 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars conve= rted" " to upper case) to pass to machine loader, boot manager," " and guest kernel"); + + object_class_property_add(oc, "boot-certs", "BootCertificatesList", + machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); + object_class_property_set_description(oc, "boot-certs", + "provide paths to a directory and/or a certificate file for se= cure boot"); } =20 static inline void s390_machine_initfn(Object *obj) diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index f1f06119d6..5ad1ea2f24 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -14,6 +14,7 @@ #include "hw/core/boards.h" #include "qom/object.h" #include "hw/s390x/sclp.h" +#include "qapi/qapi-types-machine-s390x.h" =20 #define TYPE_S390_CCW_MACHINE "s390-ccw-machine" =20 @@ -31,6 +32,7 @@ struct S390CcwMachineState { uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; + BootCertificatesList *boot_certs; =20 SCLPDevice *sclp; }; diff --git a/qapi/machine-s390x.json b/qapi/machine-s390x.json index ea430e1b88..bbe3646e91 100644 --- a/qapi/machine-s390x.json +++ b/qapi/machine-s390x.json @@ -140,3 +140,26 @@ { 'event': 'SCLP_CPI_INFO_AVAILABLE', 'features': [ 'unstable' ] } + +## +# @BootCertificates: +# +# Boot certificates for secure IPL. +# +# @path: path to an X.509 certificate file or a directory containing +# certificate files. +# +# Since: 11.1 +## +{ 'struct': 'BootCertificates', + 'data': {'path': 'str'} } + +## +# @DummyBootCertificates: +# +# Not used by QMP; hack to let us use BootCertificatesList internally. +# +# Since: 11.1 +## +{ 'struct': 'DummyBootCertificates', + 'data': {'unused-boot-certs': ['BootCertificates'] } } diff --git a/qapi/pragma.json b/qapi/pragma.json index 24aebbe8f5..342cedc42e 100644 --- a/qapi/pragma.json +++ b/qapi/pragma.json @@ -49,6 +49,7 @@ 'DisplayProtocol', 'DriveBackupWrapper', 'DummyBlockCoreForceArrays', + 'DummyBootCertificates', 'DummyForceArrays', 'DummyVirtioForceArrays', 'HotKeyMod', diff --git a/qemu-options.hx b/qemu-options.hx index e44b47de68..83915bd7ef 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -46,7 +46,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " memory-backend=3D'backend-id' specifies explicitly pr= ovided backend for main RAM (default=3Dnone)\n" " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" " sgx-epc.0.memdev=3Dmemid,sgx-epc.0.node=3Dnumaid\n" - " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n", + " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -214,6 +215,9 @@ SRST :: =20 -machine smp-cache.0.cache=3Dl1d,smp-cache.0.topology=3Dcore,s= mp-cache.1.cache=3Dl1i,smp-cache.1.topology=3Dcore + + ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` + Provide paths to a directory and/or a certificate file on the host= [s390x only]. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939068; cv=none; d=zohomail.com; s=zohoarc; b=JO9THbBFqE68JF1qTHiBgZAwFBdbgjnEBqGwLpDC7c4UbBcvA3tEqloqLBuq7LNfVDcN8MCxdzLLRhvwe3+lbsgc7wEW6FRVkMWDtzmHebQStKiAEXWovSj78YbL6BZeY4JOiFczCxRAMk/SpCmNgJCEa6OrD95T69yyrTcgcVs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939068; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SRItF3Rpj3r/qWUSqrHn8Lr/8FzyN807OwVIui3tyWE=; b=VF8agTwcZmzhiPTv5lzUP7faPri0WGSMjIU7HGoDkOw8Z5wlyollU20ORMdPUDMnWVTfR7RRydvo3fDroBz1md5buf9qn2xKzgDvoGsyGHDM4oX8etw360HGDKhW3m2QKc2XCRAATwv/aGcQtJNDohTU3E3EjYAXrbc3ZCVcorU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939068354199.6977058318306; Wed, 1 Jul 2026 13:51:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sN-0003AB-IQ; Wed, 01 Jul 2026 16:49:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sL-00038q-JH; Wed, 01 Jul 2026 16:49:41 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sJ-0003p9-Gh; Wed, 01 Jul 2026 16:49:41 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmfKu1339697; Wed, 1 Jul 2026 20:49:36 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa69uu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:36 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnZPG030786; Wed, 1 Jul 2026 20:49:35 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxpu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:34 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KnXZP34472464 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:33 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 154DF5804E; Wed, 1 Jul 2026 20:49:33 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3EA625803F; Wed, 1 Jul 2026 20:49:30 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:30 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=SRItF3 Rpj3r/qWUSqrHn8Lr/8FzyN807OwVIui3tyWE=; b=UA6q+s54xAqvpkHLjauk5f 8v8bQ+v3I1M4HKZwrnBfk2jqfgh+M6ZyrW5qeNO8ycQOaCDuUbuyNQrzTODZo8Jv iK0/J2HWgJA+HgKTGcq7dZtBMvhgUeKCE93oowc7VfRlqNhV6FNGklSByAqj0mIv kxfrnHN12CAKL38MAlufw5yiDqD6MU5DJtmw1n8VstqCug0yUfVNOrWzuwYXRjkb vbUq27Cnk0kqk9tA7IsHzv15sHMpudnbnNIzq+3QOOAMXB1RM04JuayaPnznSK67 idbmoIVP68R1ItyxY0t8lVOlGCszQgS814wEQx74bWciRzX52c9xCB0y/kR74AyQ == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 02/35] crypto/x509-utils: Refactor with GNUTLS fallback Date: Wed, 1 Jul 2026 16:48:48 -0400 Message-ID: <20260701204922.1320349-3-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzW1dYjU+pZDb bm6WfulOr2dc63oToCJgnsAQCe0u/pvqSBBPgiiS4Vbm7qoIJf0ZR98Wp3mT099FKuzQbkoT80g Di8qyjJjL/sisuu/SDR6c8BE4UdVur4RyliL2KjPNEGcjVy25nvvKBu6vTBE1db9kUfQiBE9JWG NDMLRj6C+y5x8axeqduViOXne5pUd/PmK+stgyNdg0TNffnFPBIO+KYuKryI95WMkzgvfxqi+2z YXfqxOn4klTt/sAONPHf4gzYyKB4+2KXK2qBNInHB4ReAtEw/gcwRJL7M9w7jjCWoqV6dWunddt bMdLn4U8n3//t8VefqsarSgmCssbbEjAdG8/t3ROGjBdtP15haXF2CXPtu9pVz16kLwQ+Ya9MYH QOOplg75s/f7CpEu+LtMRlIYk7jPMTVZdSZrXLbk0TQ1O+CzxHAVOWl4hlB3ItJvHaScyUxvYg4 t1FmZ3wG/IytNxvTRxw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX9hSGRnhoaO7x O41rpU3NpUpVKMoiG5iydXS+A4swC/4PzU7sBonaUl4VEXrLul4BS3D97U42LznWqs8s7ocVFgK g0XEV1jVunVuYPGcgwhygyDQfhDcA4w= X-Proofpoint-GUID: GbHSSUZAxfnD2tV0Zd-Ph0bigKrFQrfG X-Proofpoint-ORIG-GUID: GbHSSUZAxfnD2tV0Zd-Ph0bigKrFQrfG X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457d60 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=FUyA0-9y5A7gcD0mOlIA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939071019158500 Always compile x509-utils.c and add a fallback when GNUTLS is unavailable. These functions will be needed in the s390x code regardless of whether GNUTLS is available. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/meson.build | 2 +- crypto/x509-utils.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/crypto/meson.build b/crypto/meson.build index b51597a879..fda85543de 100644 --- a/crypto/meson.build +++ b/crypto/meson.build @@ -22,12 +22,12 @@ crypto_ss.add(files( 'tlscredsx509.c', 'tlssession.c', 'rsakey.c', + 'x509-utils.c', )) =20 if gnutls.found() crypto_ss.add(files( 'tlscredsbox.c', - 'x509-utils.c', )) endif =20 diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 39bb6d4d8c..6176a88653 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -11,6 +11,8 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "crypto/x509-utils.h" + +#ifdef CONFIG_GNUTLS #include #include #include @@ -78,3 +80,17 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, gnutls_x509_crt_deinit(crt); return ret; } + +#else /* ! CONFIG_GNUTLS */ + +int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, + QCryptoHashAlgo hash, + uint8_t *result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get fingerprint"); + return -1; +} + +#endif /* ! CONFIG_GNUTLS */ --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939081; cv=none; d=zohomail.com; s=zohoarc; b=k/evOCNmRMQkwVcI7AAwvgnDc2HHqdzjkP+K746aH9mI9CD+NhuzrjGyk/gIR0m7+tG2LUE9YuRnPrB0J79TdJ1HllP10xk4h9cXVfjoDqQ8wH6wv05mAcu2VUoe7xXqplPMtw2Xx5xgF9sNXNG/ns23erTFp5gv79sfz64VnWg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939081; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/3eqHNbv4aXfd+u4AnT0IFpGYmbYJdEcHut8ZRCL9ww=; b=XuOT2+zC83MGH9e2RfmkjXzsIhlCa2OklJBV9kZ3rxwjm8eho4PHzIN4/Y/CBuYZ2Qmvz3F/DbuumH6niJTGq/OyT1o9jagR+1CE6mydr5hwZHhTSfb0JqFSSWkp8EB9/jF2ATfQ1bzNbHw3RSZyUNGy4PHjgjfajmMgoFcQpz8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939081722274.6838025043161; Wed, 1 Jul 2026 13:51:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sQ-0003BJ-6P; Wed, 01 Jul 2026 16:49:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sO-0003Af-BJ; Wed, 01 Jul 2026 16:49:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sM-0003sy-Gs; Wed, 01 Jul 2026 16:49:44 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmlOO1455730; Wed, 1 Jul 2026 20:49:39 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6pys-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:38 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnbRt006913; Wed, 1 Jul 2026 20:49:37 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhh0pm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:37 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KnaXQ4063898 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:36 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 05A9358054; Wed, 1 Jul 2026 20:49:36 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4E5CA5803F; Wed, 1 Jul 2026 20:49:33 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=/3eqHN bv4aXfd+u4AnT0IFpGYmbYJdEcHut8ZRCL9ww=; b=j9RPGbfSwVucKK0S41Y9Zx Lgh9M8GG6HQY9/XXj2hb/fZdJU8+tJ5GKVz9WVXNDw+HYoCrh6K27FOgYjAov2tq YDKa7hVbaeRvSPkM+bwdmKGuso+JDlUjBjqQJsDD5WqLOl5n/aTQ5aqshv0dG6Oo vClqxf2s0D46gWL3mmgfWZZ7FWN9E7ltRzGat4q88nNcEMNb+0SydZ1/5LH6XMsN jAzm8gy2077QpRERs+561wz0ILXtus9XN/+PCzLSw/fqAWYgiGyZ5zm1i8NHFG1S LNFYj/uYE0iN/vXVN3d71JLNmu4YvUi5LWonfIVxQZaEMaehkfIMxenTBf3wRkZw == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 03/35] crypto/x509-utils: Add helper functions for certificate store Date: Wed, 1 Jul 2026 16:48:49 -0400 Message-ID: <20260701204922.1320349-4-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: JTvVEOqaNmBOwnvDVzTbh86igaZulrS2 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX+1JD8KRJuOQC WGN4I3kLDmK9uKT6x5QMk6dW1KQErxP56zhC3WmV5mNFI+C4kJpJxUtMFbzE2Yxe8jWEaOCv/8m kJA/2h+SDYcNCigHGt64YyBE2e8ajVA= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d62 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=GX81FK21qHpjiM7aGUoA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXz3M4k3C7Cu1y z1V++cOn9/CDohtVqFnLlHOtIKiaBpSPuNjNkgZQQ+edSq2Ky3sBg1+mZfwX77/3qDyucJdZR/z wr8R8Qwf649V7WyRliqid1zPjs4Eao4hft3NEY4MvoZODdT6uUa1g4XtOV/ks+yPnxzoOb7/OLe 3YUDbJkXVLL1fzwgfwBydMHrGUoB2h8uPafd+IhmcjnVoJQOeSfTWh7Yc1UjDkPf6VCIak2kUeW rs2yIxvs3PDhcNrURRzhFKBmPW4MztR1nLm+3kR6RrkIqQyNk7f4jvp5d6y9hcL3duzZpwbxiLf 8ACue+RilhuP5vWdSNF83lGFvZArlxrKRqX/L4CXjRfo1L8DvYsAJ5nZKe8mySrpfwkPZDaME9+ +5jSH1iu6Hyi2GE79y+rHZg3MVqQJDW0C3KiGIKiB6DJtfzWPRWRfsLxu4Nu0ikMjOjxwkYdoQU hzK1/DQVd8/EdeyqMZw== X-Proofpoint-ORIG-GUID: JTvVEOqaNmBOwnvDVzTbh86igaZulrS2 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939082922158500 Introduce new helper functions for x509 certificate, which will be used by the certificate store: qcrypto_x509_convert_cert_der() - converts a certificate from PEM to DER fo= rmat These functions provide support for certificate format conversion. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/x509-utils.c | 49 +++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 21 ++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 6176a88653..68cf008938 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -81,6 +81,46 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, return ret; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + gnutls_datum_t datum_der =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_export2(crt, GNUTLS_X509_FMT_DER, &datum_der); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert certificate to DER format: %s", + gnutls_strerror(rc)); + goto cleanup; + } + + *resultlen =3D datum_der.size; + *result =3D g_memdup2(datum_der.data, datum_der.size); + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + g_free(datum_der.data); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -93,4 +133,13 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, si= ze_t size, return -1; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export X.509 certificate"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 1e99661a71..91ae79fb03 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -19,4 +19,25 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_convert_cert_der + * @cert: pointer to the raw certificate data in PEM format + * @size: size of the certificate + * @result: output location for the allocated buffer for the certificate + * in DER format + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer (will be updated with the + * actual size of the DER-encoded certificate) + * @errp: error pointer + * + * Convert the given @cert from PEM to DER format. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp); + #endif --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939178; cv=none; d=zohomail.com; s=zohoarc; b=CqARura93v1csZel1nEePKfvbbEcQVnuJwHU/9MhbaRHFhf5dgqqnLyfkaLZUTn21EaHANiy1nfcPcSVvei/56t4+Ps1kLbJeQucCr8Wusceso8pzorCoIL3VeK/dRhJnrAefvyUs2xethO4MhXmG76SrSJ9nhoioJOMKYtDYec= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939178; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PDyPcSH1/ZNAXNQkfkvtaNVU4Ceo1LiLXG/FR+hMVfs=; b=DQWBDrz4ZGCwfI0Ky1Ihvyu5QaDHchsWy9ksERjiCpv+KSbNdLfNLnstCpUkTdk2T6XAfcPlgoiyWJIQ/+2HozuONwaperw3PfeZG/aoybZRm4OZMNUGL66GZf/JujnGVTbSBd36pH82nDhoA5qdo/rg+yKA9Z75yfVWiJVpwBs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939178434128.4834758887696; Wed, 1 Jul 2026 13:52:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sT-0003C5-R7; Wed, 01 Jul 2026 16:49:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sR-0003Bh-FE; Wed, 01 Jul 2026 16:49:47 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sP-0003vw-5M; Wed, 01 Jul 2026 16:49:47 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn8vV1456768; Wed, 1 Jul 2026 20:49:41 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q04-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:41 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Kne1X030818; Wed, 1 Jul 2026 20:49:40 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxq5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:40 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KndSm24248872 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:39 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0693158054; Wed, 1 Jul 2026 20:49:39 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3A56458056; Wed, 1 Jul 2026 20:49:36 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:36 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=PDyPcSH1/ZNAXNQkf kvtaNVU4Ceo1LiLXG/FR+hMVfs=; b=J2aP+waOQFu4LVzQhhwsqH6ZJqLinu1rW bvJby/U66nWPEdZ7ahSjLLPrlOiJVsRrqiIBiZ2sg0K3kLiosViZTg9u8LUScznh wRkVWDAJ5Zqwbe8H3Wj1Yozee8H1AoqZve7rJATFbgaW3Xv5c3NI638zYu7Ril/G oOn7IMnLk5M+LjAHZtVMLfwunLXP9Smvp+21aC9T6cAm+WFyBM1vRQoyfGFGJrD5 2Br7dmhEBFCiKAwuEBkgRn6s2TSipVGRgt8GhAnggBIrXXVDBGN1KrIOQyVYDAjV EQYwjiUhGnFt2u3VUMHEvybq1ZNcFRAqd9IB8UTUl9ZXx5h5kOi6g== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 04/35] hw/s390x/ipl: Create certificate store Date: Wed, 1 Jul 2026 16:48:50 -0400 Message-ID: <20260701204922.1320349-5-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: LnRUHsyhkzibcNMO6yi4CDyhEdTohVAh X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX8ombwAJ+4TDf 8aEFR3ttnYRYIfP5qcO2PGNma6DO8LZTFq5QUZcAkA+8/jCU2OM4vFj1/SOOxhOgJL2ou4zi4GZ Ls+hSUT11lglOQOoG9UYLYzmk2/ct2E= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d65 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=U0tahsH2YktMir8Gk2YA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX8zYn0nwqJeS5 2n9e1XqBC6xti80xF0Cw+FHAEz4x11L3zEQiDOs/MhAq9VflalK92jnHAWH4pHuPX8u0bHzPVp7 Zwzq/5BS5OkAvEtMtNenvCg/il7vkKWujG0L5KDJIwXaviiS1QXjxJI5c/BE4kjE1i1SHECJz2t wLMjk8su6/rvle842gFJhm+XRKJeTdvrSm3On8wrxDSRocHFd85TEc/ll5b7yqvKExIYphGuWT7 7qvJGcq8fZcX8TvMtxhoykRUlo6XglYkMEHfKOmn5hC6FB+jXgxHzvBS+A8WcqXPwEZnZEJsYJp 8o0S+agm42w2ZNsTKWEyRcN+lFjE+DfwdJnISmlPCcS0310D6VjaAvojspHJZt2uht+SCpDmyZO YVFA9UzpfknQ6SpkrEW3xzk4JW2CQ4Trex0Zt1mrrvVAU6MGdi0Evr6cPTNS35GXnGac7JHedY8 3JwTSP27+JfAU5kKYDw== X-Proofpoint-ORIG-GUID: LnRUHsyhkzibcNMO6yi4CDyhEdTohVAh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939179514158500 Content-Type: text/plain; charset="utf-8" Create a certificate store for boot certificates used for secure IPL. Load certificates from the `boot-certs` parameter of s390-ccw-virtio machine type option into the cert store. Currently, only X.509 certificates in PEM format are supported, as the QEMU command line accepts certificates in PEM format only. The raw Base64 data is stored, as well as the certificate's size. The binary (DER) size is stored as well, which may later be utilized for secure boot (signature verification). Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali --- docs/specs/index.rst | 1 + docs/specs/s390x-secure-ipl.rst | 20 +++ hw/s390x/cert-store.c | 228 ++++++++++++++++++++++++++++++++ hw/s390x/cert-store.h | 39 ++++++ hw/s390x/ipl.c | 10 ++ hw/s390x/ipl.h | 3 + hw/s390x/meson.build | 1 + include/hw/s390x/ipl/qipl.h | 2 + 8 files changed, 304 insertions(+) create mode 100644 docs/specs/s390x-secure-ipl.rst create mode 100644 hw/s390x/cert-store.c create mode 100644 hw/s390x/cert-store.h diff --git a/docs/specs/index.rst b/docs/specs/index.rst index b7909a108a..76d439782c 100644 --- a/docs/specs/index.rst +++ b/docs/specs/index.rst @@ -40,3 +40,4 @@ guest hardware that is specific to QEMU. riscv-aia aspeed-intc iommu-testdev + s390x-secure-ipl diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst new file mode 100644 index 0000000000..d7c0d4eaac --- /dev/null +++ b/docs/specs/s390x-secure-ipl.rst @@ -0,0 +1,20 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +s390 Certificate Store and Functions +------------------------------------ + +s390 Certificate Store +^^^^^^^^^^^^^^^^^^^^^^ + +A certificate store is implemented for s390-ccw guests to retain within +memory all certificates provided by the user via the command-line, which +are expected to be stored somewhere on the host's file system. The store +will keep track of the number of certificates, their respective size, +and a summation of the sizes. + +Each certificate is stroed in an S390IPLCertificate struct, which has a +name (converted to EBCDIC), size fields of PEM and DER data, and the raw +PEM Base64 data. + +Note: A maximum of 64 certificates are allowed to be stored in the certifi= cate +store. diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c new file mode 100644 index 0000000000..ab3abf414b --- /dev/null +++ b/hw/s390x/cert-store.c @@ -0,0 +1,228 @@ +/* + * S390 certificate store implementation + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "cert-store.h" +#include "qapi/error.h" +#include "qemu/error-report.h" +#include "qemu/option.h" +#include "qemu/config-file.h" +#include "hw/s390x/ebcdic.h" +#include "hw/s390x/s390-virtio-ccw.h" +#include "qemu/cutils.h" +#include "crypto/x509-utils.h" +#include "qapi/qapi-types-machine-s390x.h" + +static BootCertificatesList *s390_get_boot_certs(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->boot_certs; +} + +static S390IPLCertificate *init_cert(char *path, Error **errp) +{ + int rc; + size_t size; + size_t der_len; + char name[CERT_NAME_MAX_LEN]; + g_autofree char *buf =3D NULL; + g_autofree gchar *filename =3D NULL; + S390IPLCertificate *cert =3D NULL; + g_autofree uint8_t *cert_der =3D NULL; + Error *local_err =3D NULL; + + filename =3D g_path_get_basename(path); + + if (!g_file_get_contents(path, &buf, &size, NULL)) { + error_setg(errp, "Failed to load certificate: %s", path); + return NULL; + } + + rc =3D qcrypto_x509_convert_cert_der((uint8_t *)buf, size, + &cert_der, &der_len, &local_err); + if (rc !=3D 0) { + error_propagate_prepend(errp, local_err, + "Failed to initialize certificate: %s: ", = path); + return NULL; + } + + cert =3D g_new0(S390IPLCertificate, 1); + cert->size =3D size; + /* + * Store DER length only - reused for size calculation. + * cert_der is discarded because DER certificate data will be used once + * and can be regenerated from cert->raw. + */ + cert->der_size =3D der_len; + /* store raw pointer - ownership transfers to cert */ + cert->raw =3D (uint8_t *)g_steal_pointer(&buf); + + /* + * Left justified certificate name with padding on the right with blan= ks. + * Convert certificate name to EBCDIC. + */ + strpadcpy(name, CERT_NAME_MAX_LEN, filename, ' '); + ebcdic_put(cert->name, name, CERT_NAME_MAX_LEN); + + return cert; +} + +static int update_cert_store(S390IPLCertificateStore *cert_store, + S390IPLCertificate *cert) +{ + size_t data_buf_size; + size_t keyid_buf_size; + size_t hash_buf_size; + size_t cert_buf_size; + + /* length field is word aligned for later DIAG use */ + keyid_buf_size =3D ROUND_UP(CERT_KEY_ID_LEN, 4); + hash_buf_size =3D ROUND_UP(CERT_HASH_LEN, 4); + cert_buf_size =3D ROUND_UP(cert->der_size, 4); + data_buf_size =3D keyid_buf_size + hash_buf_size + cert_buf_size; + + if (cert_store->largest_cert_size < data_buf_size) { + cert_store->largest_cert_size =3D data_buf_size; + } + + if (cert_store->count >=3D MAX_CERTIFICATES) { + error_report("Cert store is full"); + return -1; + } + + cert_store->certs[cert_store->count] =3D *cert; + cert_store->total_bytes +=3D data_buf_size; + cert_store->count++; + + return 0; +} + +static GPtrArray *get_cert_paths(Error **errp) +{ + struct stat st; + BootCertificatesList *path_list =3D NULL; + BootCertificatesList *list =3D NULL; + gchar *cert_path; + GDir *dir =3D NULL; + const gchar *filename; + bool is_empty; + g_autoptr(GError) err =3D NULL; + g_autoptr(GPtrArray) cert_path_builder =3D g_ptr_array_new_full(0, g_f= ree); + + path_list =3D s390_get_boot_certs(); + + for (list =3D path_list; list; list =3D list->next) { + cert_path =3D list->value->path; + + if (g_strcmp0(cert_path, "") =3D=3D 0) { + error_setg(errp, "Empty path in certificate path list is not a= llowed"); + goto fail; + } + + if (stat(cert_path, &st) !=3D 0) { + error_setg(errp, "Failed to stat path '%s': %s", + cert_path, g_strerror(errno)); + goto fail; + } + + if (S_ISREG(st.st_mode)) { + if (!g_str_has_suffix(cert_path, ".pem")) { + error_setg(errp, "Certificate file '%s' must have a .pem e= xtension", + cert_path); + goto fail; + } + + g_ptr_array_add(cert_path_builder, g_strdup(cert_path)); + } else if (S_ISDIR(st.st_mode)) { + dir =3D g_dir_open(cert_path, 0, &err); + if (dir =3D=3D NULL) { + error_setg(errp, "Failed to open directory '%s': %s", + cert_path, err->message); + + goto fail; + } + + is_empty =3D true; + while ((filename =3D g_dir_read_name(dir))) { + is_empty =3D false; + + if (g_str_has_suffix(filename, ".pem")) { + g_ptr_array_add(cert_path_builder, + g_build_filename(cert_path, filename, = NULL)); + } else { + warn_report("skipping '%s': not a .pem file", filename= ); + } + } + + if (is_empty) { + warn_report("'%s' directory is empty", cert_path); + } + + g_dir_close(dir); + } else { + error_setg(errp, "Path '%s' is neither a file nor a directory"= , cert_path); + goto fail; + } + } + + qapi_free_BootCertificatesList(path_list); + return g_steal_pointer(&cert_path_builder); + +fail: + qapi_free_BootCertificatesList(path_list); + return NULL; +} + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store) +{ + GPtrArray *cert_path_builder; + Error *err =3D NULL; + + /* If cert store is already populated, then no work to do */ + if (cert_store->count) { + return; + } + + cert_path_builder =3D get_cert_paths(&err); + if (cert_path_builder =3D=3D NULL) { + error_report_err(err); + exit(1); + } + + if (cert_path_builder->len =3D=3D 0) { + g_ptr_array_free(cert_path_builder, TRUE); + return; + } + + if (cert_path_builder->len > MAX_CERTIFICATES) { + error_report("Cert store exceeds maximum of %d certificates", MAX_= CERTIFICATES); + g_ptr_array_free(cert_path_builder, TRUE); + exit(1); + } + + cert_store->largest_cert_size =3D 0; + cert_store->total_bytes =3D 0; + + for (int i =3D 0; i < cert_path_builder->len; i++) { + g_autofree S390IPLCertificate *cert =3D + init_cert((char *) cert_path_builder->pdata[i], + &err); + if (!cert) { + error_report_err(err); + g_ptr_array_free(cert_path_builder, TRUE); + exit(1); + } + + if (update_cert_store(cert_store, cert)) { + g_ptr_array_free(cert_path_builder, TRUE); + exit(1); + } + } + + g_ptr_array_free(cert_path_builder, TRUE); +} diff --git a/hw/s390x/cert-store.h b/hw/s390x/cert-store.h new file mode 100644 index 0000000000..7fc9503cb9 --- /dev/null +++ b/hw/s390x/cert-store.h @@ -0,0 +1,39 @@ +/* + * S390 certificate store + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HW_S390_CERT_STORE_H +#define HW_S390_CERT_STORE_H + +#include "hw/s390x/ipl/qipl.h" +#include "crypto/x509-utils.h" + +#define CERT_NAME_MAX_LEN 64 + +#define CERT_KEY_ID_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 +#define CERT_HASH_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 + +struct S390IPLCertificate { + uint8_t name[CERT_NAME_MAX_LEN]; + size_t size; + size_t der_size; + uint8_t *raw; +}; +typedef struct S390IPLCertificate S390IPLCertificate; + +struct S390IPLCertificateStore { + uint16_t count; + size_t largest_cert_size; + size_t total_bytes; + S390IPLCertificate certs[MAX_CERTIFICATES]; +}; +typedef struct S390IPLCertificateStore S390IPLCertificateStore; + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store); + +#endif diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 4cca21c621..09c24203c7 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -38,6 +38,7 @@ #include "qemu/option.h" #include "qemu/ctype.h" #include "standard-headers/linux/virtio_ids.h" +#include "cert-store.h" =20 #define KERN_IMAGE_START 0x010000UL #define LINUX_MAGIC_ADDR 0x010008UL @@ -453,6 +454,13 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t= *ebcdic_lp) } } =20 +S390IPLCertificateStore *s390_ipl_get_certificate_store(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return &ipl->cert_store; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -767,6 +775,8 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) cpu->env.psw.addr =3D ipl->start_addr; cpu->env.psw.mask =3D IPL_PSW_MASK; =20 + s390_ipl_create_cert_store(&ipl->cert_store); + if (!ipl->kernel || ipl->iplb_valid) { cpu->env.psw.addr =3D ipl->bios_start_addr; if (!ipl->iplb_valid) { diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index fac30763df..f5a49a4431 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -13,6 +13,7 @@ #ifndef HW_S390_IPL_H #define HW_S390_IPL_H =20 +#include "cert-store.h" #include "target/s390x/cpu.h" #include "exec/target_page.h" #include "system/address-spaces.h" @@ -35,6 +36,7 @@ int s390_ipl_pv_unpack(struct S390PVResponse *pv_resp); void s390_ipl_prepare_cpu(S390CPU *cpu); IplParameterBlock *s390_ipl_get_iplb(void); IplParameterBlock *s390_ipl_get_iplb_pv(void); +S390IPLCertificateStore *s390_ipl_get_certificate_store(void); =20 enum s390_reset { /* default is a reset not triggered by a CPU e.g. issued by QMP */ @@ -63,6 +65,7 @@ struct S390IPLState { IplParameterBlock iplb; IplParameterBlock iplb_pv; QemuIplParameters qipl; + S390IPLCertificateStore cert_store; uint64_t start_addr; uint64_t compat_start_addr; uint64_t bios_start_addr; diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build index 57cc2a6be3..6b39ad012f 100644 --- a/hw/s390x/meson.build +++ b/hw/s390x/meson.build @@ -17,6 +17,7 @@ s390x_ss.add(files( 'sclpcpu.c', 'sclpquiesce.c', 'tod.c', + 'cert-store.c', )) s390x_ss.add(when: 'CONFIG_KVM', if_true: files( 'tod-kvm.c', diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 8d3c83a80b..ed1a91182a 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -31,6 +31,8 @@ typedef enum S390IplType S390IplType; =20 #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 +#define MAX_CERTIFICATES 64 + /* * The QEMU IPL Parameters will be stored at absolute address * 204 (0xcc) which means it is 32-bit word aligned but not --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939036; cv=none; d=zohomail.com; s=zohoarc; b=AdB5WNzrWT6+PTmYZBaHljEg+qLhAEsOIE1s0W6i6vn9czvoWGHvLkg2d+WmOcjjdgax+lPIDHI3KeTwSjvb7349E0rBoMOxihaUKreXxA8vgDJsWYhXxfsRjUQW27I+HrRUHkhS+bLgXNwyuV4fAeB8afOriBUe03pt5V4Ezt4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939036; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MDQ+yUUIZECwheS015R6J/LbJHk8pwKujTNxZzwylTI=; b=Z65zMq6ngQu0adbbQzTn2xCajfGjLIDbI2S+Ky0QaElcnpHClm1NjA2gGzvMftOq0Y6Tv2O9b/NHih2Qxiz++q6fcD0ePmU6aRKAQZNre5xpW0sG/OJowCpNFTxG0PXN31ZQHpyP/Yxt7kowh8zHdBBx//dcIYMC28j5kMqlVQc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939036023539.7635504335108; Wed, 1 Jul 2026 13:50:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sW-0003Cs-C1; Wed, 01 Jul 2026 16:49:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sU-0003Ca-PX; Wed, 01 Jul 2026 16:49:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sS-0003yG-GI; Wed, 01 Jul 2026 16:49:50 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmvrM1456449; Wed, 1 Jul 2026 20:49:45 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q0b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:44 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnhdM026073; Wed, 1 Jul 2026 20:49:43 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9fg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:43 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kngmw57213382 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:42 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1DD8D58054; Wed, 1 Jul 2026 20:49:42 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4E0705804E; Wed, 1 Jul 2026 20:49:39 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:39 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=MDQ+yUUIZECwheS01 5R6J/LbJHk8pwKujTNxZzwylTI=; b=rRayFTkxfreSGLE6+x/ARcS/dusROznW6 +qGE0TLbwfIKcUIJmRYMRCBxaw2X+k7pqBTciF9+pO4EAJZ4+DxkuJNbxc8O/6fn HwVJRu2pXZto0Jw9pkbq/ZLoxbDCq94GbwYGuWML2Zsyp6ooKSbITlDNIthRslqR ytIBi/mD3Zsny43K0zg0h1tpBJnuO875F7qJoV8rJ7aF+VVuQBUBZPc4ncfTvDky AXFZvMKY2DoDPEi/C0axuCM5FwmPKT9K59xLRE2sNvyqev18RYsAJ2f8Vlq9aLTb qOho/mtkkmhigXycvxSMJ+TsmeVaC0ua9hyMS77OKezcl7FHjT6hw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 05/35] s390x/diag: Introduce DIAG 320 for Certificate Store Facility Date: Wed, 1 Jul 2026 16:48:51 -0400 Message-ID: <20260701204922.1320349-6-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: WBKjqtG8r5XoWgztZ95qgs2JfSDPFmFB X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzMsQK5gN9TT5 2bwneb2CKxJzhRs/GQCn0UozXQAfg87bjPBxinCp7ek9uUw3wGV1HB/uthtKAsT7pPkAVFtRXws BWXmXJ2KDZ7h+Ab9+BNzcxLnEMZfEZ0= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d68 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=mM8oulnVqnlOJU-pfAMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXxUwMH+zBgaVy VFGa3699r337N8sNCRoX8gvOspzHoOz4ZHFO4DNIlffCEQfRj57DfUuMGvreqHV20J4aUot9RKb 8aZTWOQfcTxXsvUeGevKbF2z0JgXrq/3djhcqPyyY7TUq+T8LcGvZQbsfhJrRZkNsU8XciRCyYX ouZOF0EwHDCcXxS9aYWhW7uD5xd1hqV5P09SChbJ75n4eP8QSiGLmECCCfXaIX04YndQubhZYyi YEg0QfZz8kpE0cctvws600pvgf9e2UJsuqUQUkDueZ39OA0zz6cDaY8S+e61QN9/jVY2s3xsxrp b1TaRX+FMF3lAEAQykj7xKlBWzrcuvSW0ZDnA2AOW2OFE5lwDmUnFuukEReoL55rzvQay39cKyd 7aE3Dfngxsc0J7RfeAIMmWd187brbviNhiXtPRKDYRe1QItd5ufX4rzrZnD/3SQC1lZpMcpODH7 Dx/0XLXsmKqNIDLiX2w== X-Proofpoint-ORIG-GUID: WBKjqtG8r5XoWgztZ95qgs2JfSDPFmFB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939038821158500 Content-Type: text/plain; charset="utf-8" DIAGNOSE 320 is introduced to support Certificate Store (CS) Facility, which includes operations such as query certificate storage information and provide certificates in the certificate store. Currently, only subcode 0 is supported with this patch, which is used to query the Installed Subcodes Mask (ISM). This subcode is only supported when the CS facility is enabled. Availability of CS facility is determined by byte 134 bit 5 of the SCLP Read Info block. Byte 134's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Note: secure IPL is not available for Secure Execution (SE) guests, as their images are already integrity protected, and an additional protection of the kernel by secure IPL is not necessary. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- docs/specs/s390x-secure-ipl.rst | 12 +++++++++ include/hw/s390x/ipl/diag320.h | 20 ++++++++++++++ target/s390x/cpu_features.c | 1 + target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 2 ++ target/s390x/diag.c | 42 +++++++++++++++++++++++++++++ target/s390x/gen-features.c | 3 +++ target/s390x/kvm/kvm.c | 16 +++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++ 10 files changed, 106 insertions(+) create mode 100644 include/hw/s390x/ipl/diag320.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index d7c0d4eaac..331d793008 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -18,3 +18,15 @@ PEM Base64 data. =20 Note: A maximum of 64 certificates are allowed to be stored in the certifi= cate store. + +DIAGNOSE function code 'X'320' - Certificate Store Facility +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +DIAGNOSE 'X'320' is used to provide support for guest code to directly +query the s390 certificate store. Guest code may be the s390-ccw BIOS or +the guest kernel. + +Subcode 0 - query installed subcodes + Returns a 256-bit installed subcodes mask (ISM) stored in the installed + subcodes block (ISB). This mask indicates which subcodes are currently + installed and available for use. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h new file mode 100644 index 0000000000..aa04b699c6 --- /dev/null +++ b/include/hw/s390x/ipl/diag320.h @@ -0,0 +1,20 @@ +/* + * S/390 DIAGNOSE 320 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG320_H +#define S390X_DIAG320_H + +#define DIAG_320_SUBC_QUERY_ISM 0 + +#define DIAG_320_RC_OK 0x0001 +#define DIAG_320_RC_NOT_SUPPORTED 0x0102 + +#define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 + +#endif diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 4b5be6798e..436471f4b4 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -147,6 +147,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC134: clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; default: return; diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index c017bffcdc..2976ecd0ee 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -138,6 +138,7 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s =20 /* Features exposed via SCLP SCCB Facilities byte 134 (bit numbers relativ= e to byte-134) */ DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") +DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certificate Store function= s") =20 /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 0b88868289..962f135f42 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -248,6 +248,7 @@ bool s390_has_feat(S390Feat feat) if (s390_is_pv()) { switch (feat) { case S390_FEAT_DIAG_318: + case S390_FEAT_CERT_STORE: case S390_FEAT_HPMA2: case S390_FEAT_SIE_F2: case S390_FEAT_SIE_SKEY: @@ -505,6 +506,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_PTFF_STOUE, S390_FEAT_MULTIPLE_EPOCH }, { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 80f0958478..9131e8b1c9 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -18,6 +18,7 @@ #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" #include "hw/s390x/ipl.h" +#include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -199,3 +200,44 @@ out: return false; } } + +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + S390CPU *cpu =3D env_archcpu(env); + uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if (!s390_has_feat(S390_FEAT_CERT_STORE) || + (subcode & ~0x000ffULL) || + (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + + switch (subcode) { + case DIAG_320_SUBC_QUERY_ISM: + /* + * The Installed Subcode Block (ISB) can be up 8 words in size, + * but the current set of subcodes can fit within a single word + * for now. + */ + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + + if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return; + } + + env->regs[r1 + 1] =3D DIAG_320_RC_OK; + break; + default: + env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; + break; + } +} diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index 8218e6470e..6c20c3a862 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -720,6 +720,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_PAIE, S390_FEAT_UV_FEAT_AP, S390_FEAT_UV_FEAT_AP_INTR, + S390_FEAT_CERT_STORE, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -919,6 +920,8 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_KIMD_SHA_512, S390_FEAT_KLMD_SHA_512, S390_FEAT_PRNO_TRNG, + S390_FEAT_EXTENDED_LENGTH_SCCB, + S390_FEAT_CERT_STORE, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index fdef8f9e8a..138b5b9c67 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -99,6 +99,7 @@ #define DIAG_TIMEREVENT 0x288 #define DIAG_IPL 0x308 #define DIAG_SET_CONTROL_PROGRAM_CODES 0x318 +#define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 =20 @@ -1531,6 +1532,16 @@ static void handle_diag_318(S390CPU *cpu, struct kvm= _run *run) } } =20 +static void kvm_handle_diag_320(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1561,6 +1572,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_KVM_BREAKPOINT: r =3D handle_sw_breakpoint(cpu, run); break; + case DIAG_CERT_STORE: + kvm_handle_diag_320(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); @@ -2471,6 +2485,8 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) set_bit(S390_FEAT_DIAG_318, model->features); } =20 + set_bit(S390_FEAT_CERT_STORE, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index 35d1e34ef4..1945bdf40c 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -388,6 +388,8 @@ int handle_diag_288(CPUS390XState *env, uint64_t r1, ui= nt64_t r3); /* Return whether a CPU reset is pending */ bool handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index 09a45e58a5..403388145e 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -147,6 +147,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) /* time bomb (watchdog) */ r =3D handle_diag_288(env, r1, r3); break; + case 0x320: + /* cert store */ + bql_lock(); + handle_diag_320(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939050; cv=none; d=zohomail.com; s=zohoarc; b=VNwwVrNX4II1jRsKYNTIheA98ZeUfoIDisNAqSmKr5cwoSzKr5CwFYJvZGZ+btjsbegzaPRbdwF+TSudkHJfzDLou41x+2PkP0t0JndXqtnLskXRlX5KMDaRvPaRL0S5OsOWoUKW3BwHStZPU6wl0RNX0lHMb6BGs2lUIA5WEFo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939050; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=k8tvPzrQo6/t7WcdVeAWkNdKQiKyShsjewFS2iwPC9A=; b=OlRwPe1dYWIghCA0aPuEUYM4Dss2e52SqDdhMVIpYbuqSmj1G5vfXgGaX92rIBfc5ilmWQoIxITYnmqTIRlKfXHGPQ70aUz99Dy8ASHavBsPyavsmgGzckNEEN9cNLXGAUP7MRMq1JNHbqJjiZr0PxQflFmT1qjSGksAScjc8+s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939050311923.1452054318485; Wed, 1 Jul 2026 13:50:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sY-0003E8-UB; Wed, 01 Jul 2026 16:49:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sW-0003Ct-E2; Wed, 01 Jul 2026 16:49:52 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sU-0003yb-Sl; Wed, 01 Jul 2026 16:49:52 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmx4N1456533; Wed, 1 Jul 2026 20:49:47 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q0j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:47 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knakw030801; Wed, 1 Jul 2026 20:49:46 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxqc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:46 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Knj2U13763180 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:45 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 111205804E; Wed, 1 Jul 2026 20:49:45 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5809D5803F; Wed, 1 Jul 2026 20:49:42 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=k8tvPzrQo6/t7WcdV eAWkNdKQiKyShsjewFS2iwPC9A=; b=TKn0vIqS7aYzJT2bDlliW8U82Xwhr7NNO ZTDNAkDQfHxJYtKVk58ixh2d5F2ThImTQmGxorwTJlh1L0naMqR0S8bT5iMjIIR3 SBd/mRIuZbWXkx5IRzOkc2pi9XRAc9NEf95hw3+2+k1j3lmj354FT7/NIbTb5Du0 LkrVCmxYMsF+IZcwf2WJd126yGAesWtzXi+/zzUgr63Ofh6FOpw/nEKlwlEYfHXX zWudkNQLZNrkvTChvHdyloi/QRLzvaa5HfS0UQimJXI/ZfYTWV5UZ6HsjoOz8Z/1 IFH96lHgHaofglLutN3ThvfpByOsz4V0cbG+1I+TqBt1QlPeLw64w== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 06/35] s390x/diag: Refactor address validation check from diag308_parm_check Date: Wed, 1 Jul 2026 16:48:52 -0400 Message-ID: <20260701204922.1320349-7-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: rCqUSbGtnx-FfMu4BYKGtDT3rCtRRQSq X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX+rFjDt6Jjv95 DjSypHgRGZCH/C1xepoi4+4Mz+M0iq7t9wydhhQmJKOIZNY/LK98CencnWjjqtw8i5C8t0UPuII QiRVeSVO33O+mWmPWLV2ikxH+0s0MkI= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d6b cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=130TwiEZxdn8fhqcL5YA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2+GXixHUvfAd 0oAOv0rqiL9jLPYsliqeftRvPo2XC+rddGZhCVmpPzLQZ7fFYM7BLrtORSM9jROqH3j+EfUHNOZ DX7EM1fwzOn3Dp8vFKxd4CTJnt3tsc0u07JN9ETwmrggUCponhnK/UwwoXKfU4NfutDlt5C9E8Z cJOoJGq3wVlEW8CZ4mctRlSSRAlpZwdxoCf0qJVkme2r9PG0r0dfcswekjLdxRoZ0u/ste8TtDe LLifAZZWBtaqSwttygwgCCbdCiapvSg+EFrpGM+EzVm+tfCmccN956QAzItZ2+DWnQI0I0sPSg6 uaGB4hyqxameW/UJ2rVb+Xst8t5RDvKlxUfo/8oRLusdGEIp30EW0ZHv/AYguqszi80NDVTg9/k cTVWGspdqv+nbsjDQgXG0PywukgxnquLWX28ZBxi1nTqnPVkWSXwgIQR+0Ym8i8fWaVuz2eds/1 xeYFsN421XILjtKbqZA== X-Proofpoint-ORIG-GUID: rCqUSbGtnx-FfMu4BYKGtDT3rCtRRQSq X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939050756158500 Content-Type: text/plain; charset="utf-8" Create a function to validate the address parameter of DIAGNOSE. Refactor the function for reuse in the next patch, which allows address validation in read or write operation of DIAGNOSE. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling Reviewed-by: Hendrik Brueckner Reviewed-by: Thomas Huth --- target/s390x/diag.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 9131e8b1c9..9f98e4b677 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -26,6 +26,12 @@ #include "qemu/error-report.h" =20 =20 +static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) +{ + return address_space_access_valid(&address_space_memory, addr, + size, write, MEMTXATTRS_UNSPECIFIED); +} + int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3) { uint64_t func =3D env->regs[r1]; @@ -65,9 +71,7 @@ static int diag308_parm_check(CPUS390XState *env, uint64_= t r1, uint64_t addr, s390_program_interrupt(env, PGM_SPECIFICATION, ra); return -1; } - if (!address_space_access_valid(&address_space_memory, addr, - sizeof(IplParameterBlock), write, - MEMTXATTRS_UNSPECIFIED)) { + if (!diag_parm_addr_valid(addr, sizeof(IplParameterBlock), write)) { s390_program_interrupt(env, PGM_ADDRESSING, ra); return -1; } --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939231; cv=none; d=zohomail.com; s=zohoarc; b=VQE+nhN9RbagDAAMan8fxX19rNHdkzRbCUjLxHAlVxA+A+uKg0mBB0UUBW1arK/KX8HRBEFdjttOld63FOiUi5l1O41chqQyfUwiwYFZYNzaZ52a7b2OsouUMQsVYk4H6OOvh/XEeASTSIie7Y4CSQ1E6RpoTOM1aqFVlycTQ2M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939231; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bC6DKN5g34NGe5h+UGHCkNmnpyjF3+fg2UJxte6jMko=; b=C6Jh/CDr9O7G3COgzsrTGzEvSMWzzEq7CoEdhdg0ZqjQF0deJUE8PWmDH1H3R1BGKqHKQrUu7cwRMO0qXOTprYJI1Yb676zJcglPxCUT0TuwaYnmkkycqVey6xCj8ik0WhtK9cAQ1yYBzZStdB2q81C2z3f6rUXTPWWEXLL/RI4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939231572258.22989968288925; Wed, 1 Jul 2026 13:53:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sb-0003Fn-Ui; Wed, 01 Jul 2026 16:49:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sa-0003Ez-Jk; Wed, 01 Jul 2026 16:49:56 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sY-0003zM-27; Wed, 01 Jul 2026 16:49:56 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn6Ht1594552; Wed, 1 Jul 2026 20:49:50 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6m5k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:50 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knjbw001789; Wed, 1 Jul 2026 20:49:49 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7w95vq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:49 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KnmBp17433140 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:48 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 278E55803F; Wed, 1 Jul 2026 20:49:48 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4E5355804E; Wed, 1 Jul 2026 20:49:45 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=bC6DKN5g34NGe5h+U GHCkNmnpyjF3+fg2UJxte6jMko=; b=hFJIvvbd21sguXqu9GWM9rqqS/KxvHamz BqsWZB/UUoq5m1wFFuYqmQhwaeBMsKboeesyvn4PPBM/PsfHnwN6rMNxXZcuxUtV leRQJenEGjIZnNMUrGmiSUpD2FB4KmqBy++KwlCrpm9UgAoCN11PrdwJISF4AwnI o3GN3ilc3yG+keX8MBubeBPUBTWnJxpeZjLSnfzJrvATH/DfFCR+XiWcJQczR6sb erQ6zfsItaHxXvjidqw5an9b4My5UN4MueLrmyaVqa1SqPui9Biz1exsq4dOkIFx GLqBDShra2Tqc7i6CJ05uKFEOMjF+ZPo8QmVEdwKRTakemoCwts+g== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 07/35] s390x/diag: Implement DIAG 320 subcode 1 Date: Wed, 1 Jul 2026 16:48:53 -0400 Message-ID: <20260701204922.1320349-8-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457d6e cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=MguaJt8dR91BFOVN_IAA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX0UyWrpO4yAJA v+NCFkXR6CZWI7g3O+zDHofERNKqhnjLNRAl7V0K6qe/4fk7APMG9AQMdJfjmFLly3XopwtBYFx 75BCb1Je8RaQEqUCMdkDIYhspJg64yQ= X-Proofpoint-GUID: qkGZW5lSjULlgstnF30LjDbX2EGg3qWn X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX/i/C0rowjmxI TTnpC1esUK6vliKPLQZT/+IjwlRN3VzEpuYSUhl+2ByN2RnQQMxTNGXStlEhyKgJfceM52E/myQ j0TgAF08JQX1BLrmeg8sQEPgb5jCVgpKFP1AVo8DCRRTcgiHe4lSPXI6sz6ens3gkPS9SYYjuCN fkNuwZAp4Z+aa9BpoaNa68iW0XYvZzMfexy4Uk3+p7uQZkZnLk02fQD4xIKMucghhA94E5AAq1g Gk/JbZCMAgP5Or4e/0XQZQqFVDkBgnblau+G7/Pj75eh+8KtslWvopgSNzAaxsx2qEXml/2vLe8 ZsDOMMiAv/u2bEXxk4af/Rm4iDF5VahPmA0Clap9c4x+6IuKPdohTa2Z0Rzb2F8KksRa9mslMdg VqmoOjDSzkxdCMNFHbk0Z+LfrDlKSrL4lcP3eKNUziYB6n24cO69eS1gEa3sp1QqLoqK9avffy+ sasouE6RJs7zmQ2gD6A== X-Proofpoint-ORIG-GUID: qkGZW5lSjULlgstnF30LjDbX2EGg3qWn X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939231797158500 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 1 provides information needed to determine the amount of storage to store one or more certificates from the certificate store. Upon successful completion, this subcode returns information of the current cert store, such as the number of certificates stored and allowed in the ce= rt store, amount of space may need to be allocate to store a certificate, etc for verification-certificate blocks (VCBs). The subcode value is denoted by setting the left-most bit of an 8-byte field. The verification-certificate-storage-size block (VCSSB) contains the output data when the operation completes successfully. A VCSSB length of 4 indicates that no certificate are available in the cert store. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling Reviewed-by: Eric Farman --- docs/specs/s390x-secure-ipl.rst | 12 ++++++ hw/s390x/cert-store.h | 3 +- include/hw/s390x/ipl/diag320.h | 57 +++++++++++++++++++++++++++++ target/s390x/diag.c | 65 ++++++++++++++++++++++++++++++++- 4 files changed, 134 insertions(+), 3 deletions(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 331d793008..d5d4c3a24d 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -30,3 +30,15 @@ Subcode 0 - query installed subcodes Returns a 256-bit installed subcodes mask (ISM) stored in the installed subcodes block (ISB). This mask indicates which subcodes are currently installed and available for use. + +Subcode 1 - query verification certificate storage information + Provides the information required to determine the amount of memory ne= eded + to store one or more verification-certificates (VCs) from the certific= ate + store (CS). + + Upon successful completion, this subcode returns various storage size = values + for verification-certificate blocks (VCBs). + + The output is returned in the verification-certificate-storage-size bl= ock + (VCSSB). A VCSSB length of 4 indicates that no certificates are availa= ble + in the CS. diff --git a/hw/s390x/cert-store.h b/hw/s390x/cert-store.h index 7fc9503cb9..6f5ee63177 100644 --- a/hw/s390x/cert-store.h +++ b/hw/s390x/cert-store.h @@ -11,10 +11,9 @@ #define HW_S390_CERT_STORE_H =20 #include "hw/s390x/ipl/qipl.h" +#include "hw/s390x/ipl/diag320.h" #include "crypto/x509-utils.h" =20 -#define CERT_NAME_MAX_LEN 64 - #define CERT_KEY_ID_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 #define CERT_HASH_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 =20 diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index aa04b699c6..d37d8eaa86 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -11,10 +11,67 @@ #define S390X_DIAG320_H =20 #define DIAG_320_SUBC_QUERY_ISM 0 +#define DIAG_320_SUBC_QUERY_VCSI 1 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 +#define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 +#define DIAG_320_ISM_QUERY_VCSI 0x40000000 + +#define VCSSB_NO_VC 4 +#define VCSSB_LEN_VALID 128 + +#define CERT_NAME_MAX_LEN 64 + +struct VCStorageSizeBlock { + uint32_t length; + uint8_t reserved0[3]; + uint8_t version; + uint32_t reserved1[6]; + uint16_t total_vc_ct; + uint16_t max_vc_ct; + uint32_t reserved3[11]; + uint32_t max_single_vcb_len; + uint32_t total_vcb_len; + uint32_t reserved4[10]; +}; +typedef struct VCStorageSizeBlock VCStorageSizeBlock; + +struct VCEntryHeader { + uint32_t len; + uint8_t flags; + uint8_t key_type; + uint16_t cert_idx; + uint8_t name[CERT_NAME_MAX_LEN]; + uint8_t format; + uint8_t reserved0; + uint16_t keyid_len; + uint8_t reserved1; + uint8_t hash_type; + uint16_t hash_len; + uint32_t reserved2; + uint32_t cert_len; + uint32_t reserved3[2]; + uint16_t hash_offset; + uint16_t cert_offset; + uint32_t reserved4[7]; +}; +typedef struct VCEntryHeader VCEntryHeader; + +struct VCBlockHeader { + uint32_t in_len; + uint32_t reserved0; + uint16_t first_vc_index; + uint16_t last_vc_index; + uint32_t reserved1[5]; + uint32_t out_len; + uint8_t reserved2[4]; + uint16_t stored_ct; + uint16_t remain_ct; + uint32_t reserved3[5]; +}; +typedef struct VCBlockHeader VCBlockHeader; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 9f98e4b677..2336732c9f 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -205,11 +205,56 @@ out: } } =20 +static int handle_diag320_query_vcsi(S390CPU *cpu, uint64_t addr, uint64_t= r1, + uintptr_t ra, S390IPLCertificateStore= *cs) +{ + g_autofree VCStorageSizeBlock *vcssb =3D NULL; + + vcssb =3D g_new0(VCStorageSizeBlock, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcssb, sizeof(*vcssb))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + if (be32_to_cpu(vcssb->length) > sizeof(*vcssb)) { + return DIAG_320_RC_INVAL_VCSSB_LEN; + } + + if (be32_to_cpu(vcssb->length) < VCSSB_LEN_VALID) { + return DIAG_320_RC_INVAL_VCSSB_LEN; + } + + if (!cs->count) { + vcssb->length =3D cpu_to_be32(VCSSB_NO_VC); + } else { + vcssb->version =3D 0; + vcssb->total_vc_ct =3D cpu_to_be16(cs->count); + vcssb->max_vc_ct =3D cpu_to_be16(MAX_CERTIFICATES); + vcssb->max_single_vcb_len =3D cpu_to_be32(sizeof(VCBlockHeader) + + sizeof(VCEntryHeader) + + cs->largest_cert_size); + vcssb->total_vcb_len =3D cpu_to_be32(sizeof(VCBlockHeader) + + cs->count * sizeof(VCEntryHeade= r) + + cs->total_bytes); + } + + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcssb, be32_to_cpu(vcssb->l= ength))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + return DIAG_320_RC_OK; +} + +QEMU_BUILD_BUG_MSG(sizeof(VCStorageSizeBlock) !=3D VCSSB_LEN_VALID, + "size of VCStorageSizeBlock is wrong"); + void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { S390CPU *cpu =3D env_archcpu(env); + S390IPLCertificateStore *cs =3D s390_ipl_get_certificate_store(); uint64_t subcode =3D env->regs[r3]; uint64_t addr =3D env->regs[r1]; + int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { s390_program_interrupt(env, PGM_PRIVILEGED, ra); @@ -231,7 +276,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * but the current set of subcodes can fit within a single word * for now. */ - uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | + DIAG_320_ISM_QUERY_VCSI); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -240,6 +286,23 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 env->regs[r1 + 1] =3D DIAG_320_RC_OK; break; + case DIAG_320_SUBC_QUERY_VCSI: + if (addr & 0x7) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + if (!diag_parm_addr_valid(addr, sizeof(VCStorageSizeBlock), true))= { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag320_query_vcsi(cpu, addr, r1, ra, cs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939126; cv=none; d=zohomail.com; s=zohoarc; b=gKRmWz2URpvbgU45vuuzNvdVOtmIIPRYyfuo1vk85fbVIdUX8Vx5ssso+gbjVOGDdk1mrWF/CDArhucFQ+psFmUqvWl8kPVubhAiMCD8g4EI29B0B+Klhv2/ESuQ42I4I7d5pIIP9cCMAbixsDUfkR0nVWBUU+jAwL7kfU34ZC0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939126; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wQ+il+s9Xg/o08k/00pPOPcbrUnAgwjkgTF3VysbxK4=; b=Zb4TlGSWu6y1moeM/xc5Re5DvJ87WfyFJnWzE/dqQh4OxsxhI8KSJb46qBTCCh8BKegl4+qAjY/6yZyy7umjjv6Zhr+kL8Gs6LSBEdn8cSlrEXVNjbKv/Cl+5jmE/DcEtPYYGwnGdKAk9bUmzb8Rhlklv+ybXHlLKDolm2RFrUg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939126447278.0966519834891; Wed, 1 Jul 2026 13:52:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1se-0003Ic-2U; Wed, 01 Jul 2026 16:50:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sd-0003HI-5F; Wed, 01 Jul 2026 16:49:59 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sa-0003zz-Ux; Wed, 01 Jul 2026 16:49:58 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmjJ81398864; Wed, 1 Jul 2026 20:49:53 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26n5xnnf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:53 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KncPY006282; Wed, 1 Jul 2026 20:49:52 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu2p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:52 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Knp2b43385198 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:51 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 32D6458054; Wed, 1 Jul 2026 20:49:51 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 61C485803F; Wed, 1 Jul 2026 20:49:48 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:48 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=wQ+il+ s9Xg/o08k/00pPOPcbrUnAgwjkgTF3VysbxK4=; b=ZFl/VH5wlpu+vX2xW74ya8 Bkknn3a9cUEOlcj2F8xXkQBF2XdehvB5hDc3solipXmNvKXeo3bzh6x6Arly+9PA 4DKSFudmYRy3ysXIYtHViukbtOIghM9rTiCw6NNZnzIb9OIhmQ6HBe2fynIv4NDK Re+5FcmhSTMMG84qaADfuqfWsT3/SjO7l++YNuZIhHb2f9LzhRlDQf3RJBp0qf/J oDKS0ssD4aMsLF6Bo9AZEOySsiSyZq43zqa4h84v+e+5/VFIeozE8COw0B4uE0Jm hyC3Olrx1Owa1R3DZQi8I+8sZvIiMz7qXF8ylicid69hGL4tgkdwGM8tpmL16Lsg == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 08/35] crypto/x509-utils: Add helper functions for DIAG 320 subcode 2 Date: Wed, 1 Jul 2026 16:48:54 -0400 Message-ID: <20260701204922.1320349-9-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX0SKa89ix5Z9d BHVdUxu965q0x0ibKSva5iIUixrT1PWwooH4mmKpZo/BwSjPFNyAxQQ2Hg7ENJKgPptjmke9OQn Np0ATp+3lCsBKoQYRZEwFGeQeTRzng/SrxWhMbEayQ5U+Xcfxf1TUOiJGhJlvwQrSMb5BzHVu7r KxKTpMlHSPvVV7g5IjxNRAZYMp9ogWLx8Eg7bHeafKrRmCgqmhEr+gp80VKqGSM5uAKgqTaG03x 6nKm9fv6dcxvvM3gUlHwwFM/MS9RI9KPeXR/cQWzAcvBi2lUMEuq4IbPb3Mbg6SpxzL0idbcB+9 782sNu1Dtfyt+aJryGMDypy2eMjJMPCerD0ibULNCmPX469WPYnjSqWoMN+7Ok9eOtJOx1nT8oj 6DS1Rkmf9oyAx1C4b0kpvYSIfDOFclR//JmfVox4Xqyl9LHBXpNM4HC1a6voCkPRUv3gc0886dU x+O6UaqvhybHOfjNpdA== X-Authority-Analysis: v=2.4 cv=V45NF+ni c=1 sm=1 tr=0 ts=6a457d71 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=cx8EP_J7U0ANkHmDKVUA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: Q-DKjiayV4lY_uztOnJjcgyfNcC4juqs X-Proofpoint-GUID: Q-DKjiayV4lY_uztOnJjcgyfNcC4juqs X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX91sn8xc2OMK/ CNYXYjEb5F8P0wZh8d8rliZlQqUSJvl8VAM5WVMJoShUgTfNkTyzhih2JeeAEVtt7OS3nQ8dkAP GJa0e3JSFS6BhSvDQDdCwbptWumUACE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 clxscore=1015 impostorscore=0 malwarescore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939127208158500 Introduce new helper functions to extract certificate metadata: qcrypto_x509_check_cert_times() - validates the certificate's validity peri= od against the current time qcrypto_x509_get_cert_key_id() - extracts the key ID from the certificate qcrypto_x509_check_ecc_curve_p521() - determines the ECC public key algorit= hm uses P-521 curve These functions provide support for metadata extraction and validity checki= ng for X.509 certificates. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali --- crypto/x509-utils.c | 236 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 51 ++++++++ 2 files changed, 287 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 68cf008938..d0e0384e9c 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -27,6 +27,16 @@ static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_= HASH_ALGO__MAX] =3D { [QCRYPTO_HASH_ALGO_RIPEMD160] =3D GNUTLS_DIG_RMD160, }; =20 +static const int qcrypto_to_gnutls_keyid_flags_map[] =3D { + [QCRYPTO_HASH_ALGO_MD5] =3D -1, + [QCRYPTO_HASH_ALGO_SHA1] =3D GNUTLS_KEYID_USE_SHA1, + [QCRYPTO_HASH_ALGO_SHA224] =3D -1, + [QCRYPTO_HASH_ALGO_SHA256] =3D GNUTLS_KEYID_USE_SHA256, + [QCRYPTO_HASH_ALGO_SHA384] =3D -1, + [QCRYPTO_HASH_ALGO_SHA512] =3D GNUTLS_KEYID_USE_SHA512, + [QCRYPTO_HASH_ALGO_RIPEMD160] =3D -1, +}; + int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, QCryptoHashAlgo alg, uint8_t *result, @@ -121,6 +131,210 @@ cleanup: return ret; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + time_t now =3D time(NULL); + time_t exp_time; + time_t act_time; + + if (now =3D=3D ((time_t)-1)) { + error_setg_errno(errp, errno, "Cannot get current time"); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + exp_time =3D gnutls_x509_crt_get_expiration_time(crt); + if (exp_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate expiration time"); + goto cleanup; + } + if (exp_time < now) { + error_setg(errp, "The certificate has expired"); + goto cleanup; + } + + act_time =3D gnutls_x509_crt_get_activation_time(crt); + if (act_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate activation time"); + goto cleanup; + } + if (act_time > now) { + error_setg(errp, "The certificate is not yet active"); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +static int qcrypto_x509_get_pk_algorithm(uint8_t *cert, size_t size, Error= **errp) +{ + int rc; + int ret =3D -1; + unsigned int bits; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_get_pk_algorithm(crt, &bits); + if (rc < 0) { + error_setg(errp, "Unknown public key algorithm %d", rc); + goto cleanup; + } + + ret =3D rc; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + if (hash_alg >=3D G_N_ELEMENTS(qcrypto_to_gnutls_hash_alg_map)) { + error_setg(errp, "Unknown hash algorithm %d", hash_alg); + return ret; + } + + if (hash_alg >=3D G_N_ELEMENTS(qcrypto_to_gnutls_keyid_flags_map) || + qcrypto_to_gnutls_keyid_flags_map[hash_alg] =3D=3D -1) { + error_setg(errp, "Unsupported key id flag %d", hash_alg); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + *resultlen =3D gnutls_hash_get_len(qcrypto_to_gnutls_hash_alg_map[hash= _alg]); + if (*resultlen =3D=3D 0) { + error_setg(errp, "Failed to get hash algorithm length: %s", gnutls= _strerror(rc)); + goto cleanup; + } + + *result =3D g_malloc0(*resultlen); + if (gnutls_x509_crt_get_key_id(crt, + qcrypto_to_gnutls_keyid_flags_map[hash_= alg], + *result, resultlen) !=3D 0) { + error_setg(errp, "Failed to get key ID from certificate"); + g_clear_pointer(result, g_free); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +static int qcrypto_x509_get_ecc_curve(uint8_t *cert, size_t size, Error **= errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + gnutls_ecc_curve_t curve_id; + gnutls_datum_t x =3D {.data =3D NULL, .size =3D 0}; + gnutls_datum_t y =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_get_pk_ecc_raw(crt, &curve_id, &x, &y); + if (rc !=3D 0) { + error_setg(errp, "Failed to get ECC public key curve: %s", gnutls_= strerror(rc)); + goto cleanup; + } + + ret =3D curve_id; + +cleanup: + gnutls_x509_crt_deinit(crt); + g_free(x.data); + g_free(y.data); + return ret; +} + +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp) +{ + int algo; + int curve_id; + + algo =3D qcrypto_x509_get_pk_algorithm(cert, size, errp); + if (algo !=3D GNUTLS_PK_ECDSA) { + return 0; + } + + curve_id =3D qcrypto_x509_get_ecc_curve(cert, size, errp); + if (curve_id =3D=3D -1) { + error_setg(errp, "Failed to get ECC curve"); + return -1; + } + + if (curve_id =3D=3D GNUTLS_ECC_CURVE_INVALID) { + error_setg(errp, "Invalid ECC curve"); + return -1; + } + + return curve_id =3D=3D GNUTLS_ECC_CURVE_SECP521R1; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -142,4 +356,26 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_= t size, return -1; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + error_setg(errp, "GNUTLS is required to get certificate times"); + return -1; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get key ID"); + return -1; +} + +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp) +{ + error_setg(errp, "GNUTLS is required to determine ecc curve"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 91ae79fb03..fcace73c49 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -40,4 +40,55 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t = size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_check_cert_times + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Check whether the activation and expiration times of @cert + * are valid at the current time. + * + * Returns: 0 if the certificate times are valid, + * -1 on error. + */ +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp= ); + +/** + * qcrypto_x509_get_cert_key_id + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @hash_alg: the hash algorithm flag + * @result: output location for the allocated buffer for key ID + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + * (will be updated with the actual size of key id) + * @errp: error pointer + * + * Retrieve the key ID from the @cert based on the specified @hash_alg. + * + * Returns: 0 if key ID was successfully stored in @result, + * -1 on error. + */ +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp); + +/** + * qcrypto_x509_check_ecc_curve_p521 + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Determine whether the ECC public key in the given certificate uses the = P-521 + * curve. + * + * Returns: 0 if ECC public key does not use P521 curve. + * 1 if ECC public key uses P521 curve. + * -1 on error. + */ +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp); + #endif --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939044; cv=none; d=zohomail.com; s=zohoarc; b=SeH0IcdYfbPfHSxKWluuGOiT1BFan1XmQj9ncGuFExfTnYo9WuueukxX0mfJxcoAB9CVsEwr0aOHjT7JUHo6xzdd3U/ItZXRqdd+zxZccQP0u7Wvs28p2IEJtXBlf/oHBYisDX78s1/UiBL2WIxXqtOkzo3zHurkUM2z/9+2eHw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939044; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6ZeBTdcHgot+WzOGlUOiZxxE86Vry47f3XiSNIbnO+A=; b=ALK4vpRkzCjEphPICaIxP+ZGLYA1PVeBiafz3xTVA1oVq04HlV3vFFiUjOHAKJMwb3RKGy7FTkc6kcgyC6ffa/J37sM8LdWDXiqYRgJeNjgoPCgEnmF3pvfFNXM20UNHxJBYzGoCamUqajqK4l+yZ4eM471LUca+1qQqRcBaLeo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939044746643.4309667803767; Wed, 1 Jul 2026 13:50:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1si-0003KX-Kq; Wed, 01 Jul 2026 16:50:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sh-0003K3-3b; Wed, 01 Jul 2026 16:50:03 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1se-00040s-DR; Wed, 01 Jul 2026 16:50:02 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmn7G1340848; Wed, 1 Jul 2026 20:49:57 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26rf66br-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:56 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnkU9007578; Wed, 1 Jul 2026 20:49:56 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhh0qk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:56 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Knsvo1573526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:54 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 59A355803F; Wed, 1 Jul 2026 20:49:54 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6B8E25804E; Wed, 1 Jul 2026 20:49:51 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:51 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=6ZeBTdcHgot+WzOGl UOiZxxE86Vry47f3XiSNIbnO+A=; b=VYAlwHszyJO5E7SDDb67v5VS8xw3Kp78E zUl+5U3rtpeMFtlyEwhOJYJzPLSQk6WQj1GsQjpuNDdNUr03/xCxMD1m0aMTuz59 I1JRtDxZ1IvFUs4NNzEGW4eKEq7EEgKgaAP6sW1WtLzb8EKprDiWGViVnKM3Voe4 kaqjc5UrQluz5CVca5bkCotStWNtDOzVwYO+QkL1e9WY1qzudXeoZZERl9DcaFdL nj8r+kJC6oN4Afe8xGIZnrpgRCqDb0FvHI/KYlSb3AMJeMCSP+aFJmLvznRAO1L1 7dcbNF3EEMt/WHnQKczwgSfN21LC4v+67WcOwp5g0rb23ZnFjES+Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 09/35] s390x/diag: Implement DIAG 320 subcode 2 Date: Wed, 1 Jul 2026 16:48:55 -0400 Message-ID: <20260701204922.1320349-10-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=a4kAM0SF c=1 sm=1 tr=0 ts=6a457d74 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=yb4F8fGd1MjoyQfLk7gA:9 X-Proofpoint-ORIG-GUID: ZCfvhzziK9YOEgrV-6yB-qJZ-6pfjN5B X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX5WGBfOQhRLB8 R9FHAx6nQB5i8KuL89cFIEDDdATmSiYuBsAvafgvil7bWIVmYqemM1oISibPIwC9NTVNLKP3WF0 UgnRKWbDy/+VMQKHCa/l36Gdv9e37RUnntYk8QfJMMCqX5DKmmKSEQH7kRc3k62f2Vrq2VERk4d tpnPRT5hhYI8wY8c4zu9zOMVsUq2Vh0U/eqe8sDereZ8CHopFwMPn4ZDq3ZJCXlHI8qkAtP5yDl Irfxhco/IEcTEvziZY9eY69gxiaUVl0mlMRFAV1+GnP/+tiZDTWjUnvOCX0ctb8hJpuSUeJ0aeO gTCV5T67Z8orAwTxIky+49Z5Ajp582uktmOdmjMP2wArnTpvyFQwdNKVPYlAFbtnhpl8uYpLiY+ 3qpZz0ydWT2+Xt7TGzEwR7SuMPGl214MLJ0ikwpUSnVx/EoYl57C7FupT+Svtw26Du0Wl0RaPxY q4dGAF8M+rvNOkbThvQ== X-Proofpoint-GUID: ZCfvhzziK9YOEgrV-6yB-qJZ-6pfjN5B X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX5pMNZVU07Nvb PxEpsSqbrf6ho5S5rShTe3hnasaCcmld41EVnj79mqjur34Z+VJx2x6SfuaQ06AXvhszEZtqPJe kDTSa99O2IiS1+UzmftfpzDP6xA9iDg= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 priorityscore=1501 adultscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939046984158500 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 2 provides verification-certificates (VCs) that are in the certificate store. Only X509 certificates in DER format and SHA-256 hash type are recognized. The subcode value is denoted by setting the second-left-most bit of an 8-byte field. The Verification Certificate Block (VCB) contains the output data when the operation completes successfully. It includes a common header followed by zero or more Verification Certificate Entries (VCEs), depending on the VCB input length and the VC range (from the first VC index to the last VC index) in the certificate store. Each VCE contains information about a certificate retrieved from the S390IPLCertificateStore, such as the certificate name, key type, key ID length, hash length, and the raw certificate data. The key ID and hash are extracted from the raw certificate by the crypto AP= I. Note: SHA2-256 VC hash type is required for retrieving the hash (fingerprint) of the certificate. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman --- docs/specs/s390x-secure-ipl.rst | 24 +++ include/hw/s390x/ipl/diag320.h | 38 ++++ target/s390x/diag.c | 317 +++++++++++++++++++++++++++++++- 3 files changed, 378 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index d5d4c3a24d..a17bb0ab55 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -42,3 +42,27 @@ Subcode 1 - query verification certificate storage infor= mation The output is returned in the verification-certificate-storage-size bl= ock (VCSSB). A VCSSB length of 4 indicates that no certificates are availa= ble in the CS. + +Subcode 2 - store verification certificates + Provides VCs that are in the certificate store. + + The output is provided in a VCB, which includes a common header follow= ed by + zero or more verification-certificate entries (VCEs). + + The instruction expects the cert store to maintain an origin of 1 for = the + index (i.e. a retrieval of the first certificate in the store should be + denoted by setting first-VC to 1). + + The first-VC and last-VC fields of the VCB specify the index range of + VCs to be stored in the VCB. Certs are stored sequentially, starting + with first-VC index. As each cert is stored, a "stored count" is + incremented. If there is not enough space to store all certs requested + by the index range, a "remaining count" will be recorded and no more + certificates will be stored. + + Each VCE contains a header followed by information extracted from a + certificate within the certificate store. The information includes: + key-id, hash, and certificate data. This information is stored + contiguously in a VCE (with zero-padding). Following the header, the + key-id is immediately stored. The hash and certificate data follow and + may be accessed via the respective offset fields stored in the VCE. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index d37d8eaa86..7fda2d44fd 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -12,19 +12,45 @@ =20 #define DIAG_320_SUBC_QUERY_ISM 0 #define DIAG_320_SUBC_QUERY_VCSI 1 +#define DIAG_320_SUBC_STORE_VC 2 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 #define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 +#define DIAG_320_RC_INVAL_VCB_LEN 0x0204 +#define DIAG_320_RC_BAD_RANGE 0x0302 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 #define DIAG_320_ISM_QUERY_VCSI 0x40000000 +#define DIAG_320_ISM_STORE_VC 0x20000000 =20 #define VCSSB_NO_VC 4 #define VCSSB_LEN_VALID 128 =20 #define CERT_NAME_MAX_LEN 64 =20 +/* + * If the VCE flags indicate an invalid certificate, + * the VCE length is set to 72, containing only the + * first five fields of VCEntry. + */ +#define VCE_INVALID_LEN 72 + +#define DIAG_320_VCE_FLAGS_VALID 0x80 + +typedef enum Diag320VceKeyType { + DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING =3D 0, + DIAG_320_VCE_KEYTYPE_ECDSA_P521 =3D 1, +} Diag320VceKeyType; + +typedef enum Diag320VceFormat { + DIAG_320_VCE_FORMAT_X509_DER =3D 1, +} Diag320VceFormat; + +typedef enum Diag320VceHashType { + DIAG_320_VCE_HASHTYPE_SHA2_256 =3D 1, +} Diag320VceHashType; + struct VCStorageSizeBlock { uint32_t length; uint8_t reserved0[3]; @@ -60,6 +86,12 @@ struct VCEntryHeader { }; typedef struct VCEntryHeader VCEntryHeader; =20 +struct VCEntry { + VCEntryHeader vce_hdr; + uint8_t cert_buf[]; +}; +typedef struct VCEntry VCEntry; + struct VCBlockHeader { uint32_t in_len; uint32_t reserved0; @@ -74,4 +106,10 @@ struct VCBlockHeader { }; typedef struct VCBlockHeader VCBlockHeader; =20 +struct VCBlock { + VCBlockHeader vcb_hdr; + uint8_t vce_buf[]; +}; +typedef struct VCBlock VCBlock; + #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 2336732c9f..42e3f20067 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -17,13 +17,16 @@ #include "s390x-internal.h" #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" +#include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" #include "target/s390x/kvm/pv.h" +#include "qapi/error.h" #include "qemu/error-report.h" +#include "crypto/x509-utils.h" =20 =20 static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) @@ -245,8 +248,307 @@ static int handle_diag320_query_vcsi(S390CPU *cpu, ui= nt64_t addr, uint64_t r1, return DIAG_320_RC_OK; } =20 +static bool is_cert_valid(const S390IPLCertificate *cert) +{ + int rc; + Error *err =3D NULL; + + rc =3D qcrypto_x509_check_cert_times(cert->raw, cert->size, &err); + if (rc !=3D 0) { + error_report_err(err); + return false; + } + + return true; +} + +static int handle_key_id(VCEntry *vce, const S390IPLCertificate *cert) +{ + int rc; + g_autofree unsigned char *key_id_data =3D NULL; + size_t key_id_len; + Error *err =3D NULL; + + rc =3D qcrypto_x509_get_cert_key_id(cert->raw, cert->size, + QCRYPTO_HASH_ALGO_SHA256, + &key_id_data, &key_id_len, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + if (sizeof(VCEntryHeader) + key_id_len > be32_to_cpu(vce->vce_hdr.len)= ) { + error_report("Unable to write key ID: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.keyid_len =3D cpu_to_be16(key_id_len); + + memcpy(vce->cert_buf, key_id_data, key_id_len); + + return ROUND_UP(key_id_len, 4); +} + +static int handle_hash(VCEntry *vce, const S390IPLCertificate *cert, + uint16_t keyid_field_len) +{ + int rc; + uint16_t hash_offset; + g_autofree void *hash_data =3D NULL; + size_t hash_len; + Error *err =3D NULL; + + hash_len =3D CERT_HASH_LEN; + hash_data =3D g_malloc0(hash_len); + rc =3D qcrypto_get_x509_cert_fingerprint(cert->raw, cert->size, + QCRYPTO_HASH_ALGO_SHA256, + hash_data, &hash_len, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + hash_offset =3D sizeof(VCEntryHeader) + keyid_field_len; + if (hash_offset + hash_len > be32_to_cpu(vce->vce_hdr.len)) { + error_report("Unable to write hash: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.hash_len =3D cpu_to_be16(hash_len); + vce->vce_hdr.hash_type =3D DIAG_320_VCE_HASHTYPE_SHA2_256; + vce->vce_hdr.hash_offset =3D cpu_to_be16(hash_offset); + + memcpy((uint8_t *)vce + hash_offset, hash_data, hash_len); + + return ROUND_UP(hash_len, 4); +} + +static int handle_cert(VCEntry *vce, const S390IPLCertificate *cert, + uint16_t hash_field_len) +{ + int rc; + uint16_t cert_offset; + g_autofree uint8_t *cert_der =3D NULL; + size_t der_size; + Error *err =3D NULL; + + rc =3D qcrypto_x509_convert_cert_der(cert->raw, cert->size, + &cert_der, &der_size, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + cert_offset =3D be16_to_cpu(vce->vce_hdr.hash_offset) + hash_field_len; + if (cert_offset + der_size > be32_to_cpu(vce->vce_hdr.len)) { + error_report("Unable to write certificate: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.format =3D DIAG_320_VCE_FORMAT_X509_DER; + vce->vce_hdr.cert_len =3D cpu_to_be32(der_size); + vce->vce_hdr.cert_offset =3D cpu_to_be16(cert_offset); + + memcpy((uint8_t *)vce + cert_offset, cert_der, der_size); + + return ROUND_UP(der_size, 4); +} + +static int get_key_type(const S390IPLCertificate *cert) +{ + int rc; + Error *err =3D NULL; + + rc =3D qcrypto_x509_check_ecc_curve_p521(cert->raw, cert->size, &err); + if (rc =3D=3D -1) { + error_report_err(err); + return -1; + } + + return (rc =3D=3D 1) ? DIAG_320_VCE_KEYTYPE_ECDSA_P521 : + DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING; +} + +static int build_vce_header(VCEntry *vce, const S390IPLCertificate *cert, = int idx) +{ + int key_type; + + vce->vce_hdr.len =3D cpu_to_be32(sizeof(VCEntryHeader)); + vce->vce_hdr.cert_idx =3D cpu_to_be16(idx + 1); + memcpy(vce->vce_hdr.name, cert->name, CERT_NAME_MAX_LEN); + + if (!is_cert_valid(cert)) { + return -1; + } + + key_type =3D get_key_type(cert); + if (key_type =3D=3D -1) { + return -1; + } + vce->vce_hdr.key_type =3D key_type; + + return 0; +} + +static int build_vce_data(VCEntry *vce, const S390IPLCertificate *cert, + uint32_t vce_max_len) +{ + uint16_t keyid_field_len; + uint16_t hash_field_len; + uint32_t cert_field_len; + uint32_t vce_len; + + vce->vce_hdr.len =3D cpu_to_be32(vce_max_len); + + keyid_field_len =3D handle_key_id(vce, cert); + if (!keyid_field_len) { + return -1; + } + + hash_field_len =3D handle_hash(vce, cert, keyid_field_len); + if (!hash_field_len) { + return -1; + } + + cert_field_len =3D handle_cert(vce, cert, hash_field_len); + if (!cert_field_len) { + return -1; + } + + vce_len =3D sizeof(VCEntryHeader) + keyid_field_len + hash_field_len += cert_field_len; + if (vce_len > vce_max_len) { + return -1; + } + + vce->vce_hdr.flags |=3D DIAG_320_VCE_FLAGS_VALID; + + /* Update vce length to reflect the actual size used by vce */ + vce->vce_hdr.len =3D cpu_to_be32(vce_len); + + return 0; +} + +static int handle_diag320_store_vc(S390CPU *cpu, uint64_t addr, uint64_t r= 1, uintptr_t ra, + S390IPLCertificateStore *cs) +{ + g_autofree VCBlockHeader *vcb_hdr =3D NULL; + size_t remaining_space; + uint16_t first_vc_index; + uint16_t last_vc_index; + int cs_start_index; + int cs_end_index; + uint32_t vce_max_len; + uint32_t vce_len; + uint32_t in_len; + + vcb_hdr =3D g_new0(VCBlockHeader, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcb_hdr, sizeof(*vcb_hdr))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + in_len =3D be32_to_cpu(vcb_hdr->in_len); + first_vc_index =3D be16_to_cpu(vcb_hdr->first_vc_index); + last_vc_index =3D be16_to_cpu(vcb_hdr->last_vc_index); + + if (in_len % TARGET_PAGE_SIZE !=3D 0) { + return DIAG_320_RC_INVAL_VCB_LEN; + } + + if (first_vc_index > last_vc_index) { + return DIAG_320_RC_BAD_RANGE; + } + + vcb_hdr->out_len =3D sizeof(VCBlockHeader); + + /* + * DIAG 320 subcode 2 expects to query a certificate store that + * maintains an index origin of 1. However, the S390IPLCertificateStore + * maintains an index origin of 0. Thus, the indices must be adjusted + * for correct access into the cert store. A couple of special cases + * must also be accounted for. + */ + + /* Both indices are 0; return header with no certs */ + if (first_vc_index =3D=3D 0 && last_vc_index =3D=3D 0) { + goto out; + } + + /* Normalize indices */ + cs_start_index =3D (first_vc_index =3D=3D 0) ? 0 : first_vc_index - 1; + cs_end_index =3D last_vc_index - 1; + + /* Requested range is outside the cert store; return header with no ce= rts */ + if (cs_start_index >=3D cs->count || cs_end_index >=3D cs->count) { + goto out; + } + + remaining_space =3D in_len - sizeof(VCBlockHeader); + + for (int i =3D cs_start_index; i <=3D cs_end_index; i++) { + const S390IPLCertificate *cert =3D &cs->certs[i]; + /* + * Each field of the VCE is word-aligned. + * Allocate enough space for the largest possible size for this VC= E. + * As the certificate fields (key-id, hash, data) are parsed, the + * VCE's length field will be updated accordingly. + */ + vce_max_len =3D sizeof(VCEntryHeader) + ROUND_UP(CERT_KEY_ID_LEN, = 4) + + ROUND_UP(CERT_HASH_LEN, 4) + ROUND_UP(cert->der_size= , 4); + g_autofree VCEntry *vce =3D g_malloc0(vce_max_len); + + /* + * Bit 0 of the VCE flags indicates whether the certificate is val= id. + * The caller of DIAG320 subcode 2 is responsible for verifying th= at + * the VCE contains a valid certificate. + */ + if (build_vce_header(vce, cert, i) || build_vce_data(vce, cert, vc= e_max_len)) { + /* + * Error occurs - VCE does not contain a valid certificate. + * Bit 0 of the VCE flags is 0 and the VCE length is set. + */ + vce->vce_hdr.len =3D cpu_to_be32(VCE_INVALID_LEN); + } + vce_len =3D be32_to_cpu(vce->vce_hdr.len); + + /* + * If there is no more space to store the cert, + * set the remaining verification cert count and + * break early. + */ + if (remaining_space < vce_len) { + vcb_hdr->remain_ct =3D cpu_to_be16(last_vc_index - i); + break; + } + + /* Write VCE */ + if (s390_cpu_virt_mem_write(cpu, addr + vcb_hdr->out_len, r1, vce,= vce_len)) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + g_free(vce); + return -1; + } + + vcb_hdr->out_len +=3D vce_len; + remaining_space -=3D vce_len; + vcb_hdr->stored_ct++; + } + vcb_hdr->stored_ct =3D cpu_to_be16(vcb_hdr->stored_ct); + +out: + vcb_hdr->out_len =3D cpu_to_be32(vcb_hdr->out_len); + + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcb_hdr, sizeof(VCBlockHead= er))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + return DIAG_320_RC_OK; +} + QEMU_BUILD_BUG_MSG(sizeof(VCStorageSizeBlock) !=3D VCSSB_LEN_VALID, "size of VCStorageSizeBlock is wrong"); +QEMU_BUILD_BUG_MSG(sizeof(VCBlock) !=3D 64, "size of VCBlock is wrong"); +QEMU_BUILD_BUG_MSG(sizeof(VCEntry) !=3D 128, "size of VCEntry is wrong"); =20 void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { @@ -277,7 +579,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * for now. */ uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | - DIAG_320_ISM_QUERY_VCSI); + DIAG_320_ISM_QUERY_VCSI | + DIAG_320_ISM_STORE_VC); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -303,6 +606,18 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) } env->regs[r1 + 1] =3D rc; break; + case DIAG_320_SUBC_STORE_VC: + if (addr & ~TARGET_PAGE_MASK) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + rc =3D handle_diag320_store_vc(cpu, addr, r1, ra, cs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939107; cv=none; d=zohomail.com; s=zohoarc; b=VNYpGzrDPRcMJy/hfWlPauJPTD4FmUkSkEAImfxi7XKIX2BiQodU7Rf1JTshDT6HHvAytcB4TG7oSHlbmz4RNu2A1yL5z7mDS/NvEdlpTVsQ4/keMIS5NJsvB2uj/OFyYWyepHJkufnZVl7d1IvaHZbV9hMD+CJBL4sxlhPnmrQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939107; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=cDboDYYOBdrA20kFboU7CGyqbQd4Dx5N0FyV5yQsLaY=; b=Zv2CuZrn3TJgIlebtJnamWDDlzEdGrYqtfAOoih0ZbWs2se/mB5G8eZYWSA7WMOw6w7LbGC5VVih8G9s77NQoVy2MFqHokhhOdadHvsF+NkmeuhL//Uf0bpCEUgI8udER8bYfcgJs7E+XLIovOmWeeI1Ji8d1VxxaABSOydZmTQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939107050543.0538834043365; Wed, 1 Jul 2026 13:51:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sk-0003L5-4O; Wed, 01 Jul 2026 16:50:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1si-0003Kc-UT; Wed, 01 Jul 2026 16:50:04 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sh-00042f-A7; Wed, 01 Jul 2026 16:50:04 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GnPwn1296338; Wed, 1 Jul 2026 20:50:00 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26mjxabg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:59 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnfVU030844; Wed, 1 Jul 2026 20:49:58 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxrd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:49:58 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KnOHt45416886 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:49:24 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 346ED58056; Wed, 1 Jul 2026 20:49:57 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9B2885804E; Wed, 1 Jul 2026 20:49:54 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:54 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cDboDYYOBdrA20kFb oU7CGyqbQd4Dx5N0FyV5yQsLaY=; b=NCuJEG8J9dhq2oSV5n9AMzbdUZe3zlULb 22FTPF1rGtQ7Ky3eQKAM+LzSUHKVnt6sNSq2qElHQClRJFnWgrfhk3UL9MxG0fCH bVg0sdvewMyqq2eIRSM2prlm7pWzR2+gGD6qyO8Wf4xJrg87Blty9gAZ5+Ko8B+P 2AXIU4ZnXmTzG/PTaayhV1oIsoj9brU7ycIT2S513D5ewctMg8xbNAJEiMRsIQyP V2tH1HbrVRUToyBpXdICZpc2QOQ4uxsv012HcrdGUten30uLa0QmVcq6SsgA967u R0CahgqWFH6sV7jQnIVzLvSr4ZOPu3vB8KovhlolDJBjG37vZ2QiA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 10/35] hw/s390x: Define finite size for single entry VCEntry Date: Wed, 1 Jul 2026 16:48:56 -0400 Message-ID: <20260701204922.1320349-11-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX3AfY1LIPaeL+ F4UakzQpUnOZbBs0Syxbe2kZvYHAZVjvv08xFf2S/C78fFOTE30I8l5ExVFkGlizeNkmjubCSDq RZUBVfETQaGVlqHoon03UplGdg5FbtJhBvVqmbcGkXJFCSV2fnW4GvTm4jy1mWqM1nQYx/orpWT gv7iScvYYpiDSwxZ+z+3szFQazZx/pDZ2hPRazLrzGSnrU+0MfuDgMsvpA8VjKux4x9A0vhPqQf t6sU2rRqG966EjWrrtI1xf+W3DBPyzp7sH3GqBoQFxQ7JE6GCboVkxjU0GQmf5Cuzb0PEcPYee8 33pbbVRsXPd73CVmYAAenZ0JG5Uc6ueRwFo+ir48nZFlbsOFbd4VU0i8I0Oz996sxRkSo8NUI7K nlXjX9HKYLDIx4+O4haGnef23OLlaWlN3/hEAkd8PDgMSejvxTpHfst+rFUvoIP3JJbh0+7GIGO R093fk8qGYHopIaJAKg== X-Proofpoint-GUID: X31luhQMCj8bI8k8M12NEVI7bkbffGtx X-Authority-Analysis: v=2.4 cv=Z8bc2nRA c=1 sm=1 tr=0 ts=6a457d77 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=HeWPiYe96b1ufxwsDYQA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX0W12YORn2tuR lVxa48kG8NmZoE3HruJJuoxc2oJQKLcubvKJnzhDIfoHj7105Ka54uknM+c8/voqyda4yRqE4Qe GxwdYfSDHchyVcUbiG1LHB2AM83E+YY= X-Proofpoint-ORIG-GUID: X31luhQMCj8bI8k8M12NEVI7bkbffGtx X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939109134158500 Content-Type: text/plain; charset="utf-8" Define MAX_VCENTRY_SIZE(8KB) and CERT_BUF_MAX_LEN to establish a finite size for a single entry VCEntry. Add validation in update_cert_store() to ensure certificate data does not exceed this limit. This finite size definition is needed for proper memory allocation and will be used in a later commit to handle VCEntry structures with known size constraints. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- hw/s390x/cert-store.c | 6 ++++++ include/hw/s390x/ipl/diag320.h | 3 +++ 2 files changed, 9 insertions(+) diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c index ab3abf414b..08c38d18df 100644 --- a/hw/s390x/cert-store.c +++ b/hw/s390x/cert-store.c @@ -86,6 +86,12 @@ static int update_cert_store(S390IPLCertificateStore *ce= rt_store, cert_buf_size =3D ROUND_UP(cert->der_size, 4); data_buf_size =3D keyid_buf_size + hash_buf_size + cert_buf_size; =20 + if (data_buf_size > CERT_BUF_MAX_LEN) { + error_report("Certificate data size %zu exceeds maximum buffer siz= e %ld", + data_buf_size, CERT_BUF_MAX_LEN); + return -1; + } + if (cert_store->largest_cert_size < data_buf_size) { cert_store->largest_cert_size =3D data_buf_size; } diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index 7fda2d44fd..f3c23a3176 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -92,6 +92,9 @@ struct VCEntry { }; typedef struct VCEntry VCEntry; =20 +#define MAX_VCENTRY_SIZE (8 * 1024) +#define CERT_BUF_MAX_LEN (MAX_VCENTRY_SIZE - sizeof(VCEntryHeader)) + struct VCBlockHeader { uint32_t in_len; uint32_t reserved0; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939052; cv=none; d=zohomail.com; s=zohoarc; b=azJlch7aD2jvR7PPYGVefw6vpOH5RQGJBekp9x6061EbFHlbS6EopJ6nZhqjkKY0X/XLVMXsu2HIVH4gguoCw/tLFSP1Esbioaus9igm4v8kzIps9nqpUJDUH5em6nUiF7L9O/rmHQ/hO0xvEB+b6hrPqZeB24G0gBPSKPwdUqU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939052; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hqi3m1oj7QdWayUVr72salraRaDr70UUbZ8oP1TcoHE=; b=Gw3GMqz7mPuHdZRNYydkWEA6cwsJ+m2GM149789vSmZ0LTr3ysckhURx8rkGOUFEkAUIz7ALXqQ/DbHvM8yYk06e4Na+IzVBOBA/uRuZDJwJn2M6xIvmin2grxx5jvQKvi9uK1WFisK7KfJ9pwRCZxq/tNT/gcb5nRfNwmbMOjA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939052028224.99151207976604; Wed, 1 Jul 2026 13:50:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1so-0003Mg-PZ; Wed, 01 Jul 2026 16:50:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sm-0003Ly-Mg; Wed, 01 Jul 2026 16:50:08 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sk-0004Ea-D5; Wed, 01 Jul 2026 16:50:08 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmjNA1594141; Wed, 1 Jul 2026 20:50:02 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6m7d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:02 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Kngdf026063; Wed, 1 Jul 2026 20:50:01 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9hj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:01 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Ko0bb4719328 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:00 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F6D65803F; Wed, 1 Jul 2026 20:50:00 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 752C358054; Wed, 1 Jul 2026 20:49:57 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:49:57 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=hqi3m1oj7QdWayUVr 72salraRaDr70UUbZ8oP1TcoHE=; b=Sc84jE4NkHoGb5T2t4p0DjKHw4Ke9MWQC lHHkzVa8pNtcDVBTU8Yk7VnCwRBFSw8OTrB1LMJ8judqtjugx60i+P+IJ3KhcqgX S6f52zwg8tvD4u0bxH+ruvATIvMXBnp7lyI7gZUMEmiDvqx05ANTJVQWBIeN8nci JxZAQuWbufYVgEO+6zsr4IBkPFnfUqGQZvcl6BQbtUoBQBIuhwLziPZzFQF/z1DQ D6ZDrMcqyBGnOYbTroPKn3ssAMaaOB3D5HIBgcdpEh/1BopU7wJzpIf7DYqe2svw SZlnNStkFNN1CKFdVv2nS/Yr9Vg6gJ6iSueOK9uVq/04zqz4KoRFw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 11/35] s390x/diag: Introduce DIAG 508 for secure IPL operations Date: Wed, 1 Jul 2026 16:48:57 -0400 Message-ID: <20260701204922.1320349-12-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457d7a cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=hXQcL9AfcS-IPDpH2m0A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX1m2RJY2sdamg t/FcXMqHbPxLiOv9dTuH3eLtyx6TxinS5273AqthzNaOwqCzM2rd0EWAnWchy47uivbbvyHZB4t R+jFfLxWH3wVoewphK6Z3gV6D6t/2sA= X-Proofpoint-GUID: sNW07nGHTep8IQ1PAQTsMyloYRLHrpDm X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXyjkmR1SRMXMR JeZZM61viqMQ7R4aCYJwPXc/T6DmtrRxsTAFjc3oXH7HU3QBoZvDVyc51xcLXDJZGc6RUsLfHw4 OT8Ipu70TQg8L8/XegAZfPUITJHPpPKSp88Z28gHYAE9YS3aysmieQeo5Ejkbaz/AHYkFxOQN+8 1q5W9P87ohahFojqRZ2uqnLkX60DrsPT4PdhQFzP/7FFaglblysr+IAE4I5q9g54vBSndBRi06G ZjmFzueZo0xL/xSNTI09b/X+EuXb+loURrcj9Iv1lOFwKRu4925TpDYTPjywonUwwIlb8ESE6fj SX3hAhSC+OZH89YWy+ClsfUD4l4813hHMT1zc6pWiNjI/fuOkTyr/tckKKJDIry4mPpyERa2+lG fiG2Mj/+g/fs7WG6zeV/3uuu3p8DE9hv1WdoLkXSjHa4djnPawHuV8lRKer0BI0zAowRP1Wid65 kj7qWwUBJLYtuMMVz4Q== X-Proofpoint-ORIG-GUID: sNW07nGHTep8IQ1PAQTsMyloYRLHrpDm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939052795158500 Content-Type: text/plain; charset="utf-8" From: Collin Walling In order to support secure IPL (aka secure boot) for the s390-ccw BIOS, a new s390 DIAGNOSE instruction is introduced to leverage QEMU for handling operations such as signature verification and certificate retrieval. Currently, only subcode 0 is supported with this patch, which is used to query a bitmap of which subcodes are supported. Signed-off-by: Collin Walling Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- docs/specs/s390x-secure-ipl.rst | 18 ++++++++++++++++++ include/hw/s390x/ipl/diag508.h | 15 +++++++++++++++ target/s390x/diag.c | 27 +++++++++++++++++++++++++++ target/s390x/kvm/kvm.c | 14 ++++++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++++ 6 files changed, 83 insertions(+) create mode 100644 include/hw/s390x/ipl/diag508.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index a17bb0ab55..2198805b47 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -66,3 +66,21 @@ Subcode 2 - store verification certificates contiguously in a VCE (with zero-padding). Following the header, the key-id is immediately stored. The hash and certificate data follow and may be accessed via the respective offset fields stored in the VCE. + + +Secure IPL Data Structures, Facilities, and Functions +----------------------------------------------------- + +DIAGNOSE function code 'X'508' - IPL extensions +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +DIAGNOSE 'X'508' is reserved for guest use in order to facilitate communic= ation +of additional IPL operations that cannot be handled by guest code, such as +signature verification for secure IPL. + +If the function code specifies 0x508, IPL extension functions are performe= d. +These functions are meant to provide extended functionality for s390 guest= boot +that requires assistance from QEMU. + +Subcode 0 - query installed subcodes + Returns a 64-bit mask indicating which subcodes are supported. diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h new file mode 100644 index 0000000000..6281ad8299 --- /dev/null +++ b/include/hw/s390x/ipl/diag508.h @@ -0,0 +1,15 @@ +/* + * S/390 DIAGNOSE 508 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Collin Walling + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG508_H +#define S390X_DIAG508_H + +#define DIAG_508_SUBC_QUERY_SUBC 0x0000 + +#endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 42e3f20067..f07d39ab07 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -20,6 +20,7 @@ #include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" +#include "hw/s390x/ipl/diag508.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -623,3 +624,29 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) break; } } + +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + uint64_t subcode =3D env->regs[r3]; + int rc; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if ((subcode & ~0x0ffffULL) || (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + switch (subcode) { + case DIAG_508_SUBC_QUERY_SUBC: + rc =3D 0; + break; + default: + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + env->regs[r1 + 1] =3D rc; +} diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 138b5b9c67..56795837f5 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -102,6 +102,7 @@ #define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 +#define DIAG_SECURE_IPL 0x508 =20 #define ICPT_INSTRUCTION 0x04 #define ICPT_PROGRAM 0x08 @@ -1542,6 +1543,16 @@ static void kvm_handle_diag_320(S390CPU *cpu, struct= kvm_run *run) handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); } =20 +static void kvm_handle_diag_508(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_508(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1575,6 +1586,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_CERT_STORE: kvm_handle_diag_320(cpu, run); break; + case DIAG_SECURE_IPL: + kvm_handle_diag_508(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index 1945bdf40c..81da207a5f 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -390,6 +390,8 @@ bool handle_diag_308(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra); void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index 403388145e..f1c8563af0 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -154,6 +154,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) bql_unlock(); r =3D 0; break; + case 0x508: + /* secure ipl operations */ + bql_lock(); + handle_diag_508(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939035; cv=none; d=zohomail.com; s=zohoarc; b=hb5IHkwaR/etS+ZWVk0IqSF1NEYXT7JD32AIhucWpQvx2MXaVoR/pdtSR2tQdomfnADySTOo4QX5eJ+FMumI6ckAPGZqbCMA3u2jsZbRbTrndPKlvsF/bFWfV0417jb0ktDrhu+XBImYofzHpqgh88tkqJtfhEJam1fGu6+2bP8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939035; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mXU26Fu2/R8eROgDuf/6BQoFcSLeWh1d8e0Fq3O8M8A=; b=PyJTqSfuIJ/Crd15PB8eI48zlS86HARUG7YVZp9MqpD/hRfe2tE+fVQqpeQ298pVuBiaKu+LEWZPIDCjZAvGyKe/gbp0q2evkuAcUWAL85BtXOsCNayEaQ7moffRAzVOp+rITln4qhVpt7D54NFgVi0mlTBODord7X/z4JpO+I0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939035676756.0614509981652; Wed, 1 Jul 2026 13:50:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sq-0003OB-VZ; Wed, 01 Jul 2026 16:50:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1so-0003Mc-MJ; Wed, 01 Jul 2026 16:50:10 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sm-0004FS-K7; Wed, 01 Jul 2026 16:50:10 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmlY11455741; Wed, 1 Jul 2026 20:50:05 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q31-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:05 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnZB2025906; Wed, 1 Jul 2026 20:50:04 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9hr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:04 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Ko3r063832348 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:03 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 119DF5803F; Wed, 1 Jul 2026 20:50:03 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 58B6158055; Wed, 1 Jul 2026 20:50:00 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:00 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=mXU26F u2/R8eROgDuf/6BQoFcSLeWh1d8e0Fq3O8M8A=; b=Nu0E7urldKZOhVrNI4M5IC u5XGmCT3gioT24cJ1zeKRkfBBFLFzmZlZk6TO9gVAClAucalNJC5Idv3QoAc9LNo w14ZyWcFjCckwHcJD5zFLXBy9Fe83laBKAS93hMaHP6nRvDzCNAmggV9MWsIFu41 ay/MSCaoLmJ6liDOF53PCNzqqEcx3VDA7zPK5LJOp41odkunDL0YPi40llJTsucm 2l3CTnS+LDpk8S7SNwoOpRZM4B8BbBFtmAZ7IEYpQ9+hRbG2xjAw1+waDWVPy1pI UOIisk0KFNaFnMcMAnwbwMMWzbO/MBHaDOwzSSgXYAxT5gVDbZInm36HMabVpN3g == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 12/35] crypto/x509-utils: Add helper functions for DIAG 508 subcode 1 Date: Wed, 1 Jul 2026 16:48:58 -0400 Message-ID: <20260701204922.1320349-13-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: YCwq1CHlncXoXYfK7RSdl4lEI6XUzsRo X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXyoNVfQKmLFTo 28y7P477zRmLlF5y7q5CDl0YQud4xNbq/Ju7EHSQPrS2ShA9c7srNqujnMPcjQs2K3rgwFP4+1I AtytGOVyUcrVHYOixLEetoStn/7y14c= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d7d cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=Ehcw9bocbOASTidboh8A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXxoJVNSwJncQ4 D3A2KLoYhe8vxdxHn6dsdIQ33eV4g0OfwJGyviuMFImK9IBJ/6DfBtzyS/TnHQE1n7jViAxsDKf ETroeREqwK6a+nWXo87iAzh68lq56zlpdU5AqfCDEI2TV6bNSprZY7zGH4A/Oxpe9tLDo9b8NcY AfDFEiYQfZ2ycOsQ1Bv26qCn3bsbfL6RhmPa16VWdENN/2X869ai/gk9iHFDaGCwmsYFpTDOQHx TRPzGi9wQbXTYImtXJlO6B9RdRZQ/pLBN3Xp2kE0ngFL1V5OzKW5BXljYRNrjrjWVsEj4VIYOcH IPXmHLEQBBvegm9ll2VR6rfRsj/Jlux/sNHim9dtyyQByxLhzF6qHDrgPHRw/bYARf75aPbeCzG PjgbXIS3ft/L/1XHykU8n0PoUVhLFfvCVKlo5jzi2/UuIPuaazIyoFPygSWvgc+JBJTDgvgcxRq b2RLZhKFiwMKzc8nc2w== X-Proofpoint-ORIG-GUID: YCwq1CHlncXoXYfK7RSdl4lEI6XUzsRo X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939037093158500 Introduce helper functions to support signature verification required by DIAG 508 subcode 1: qcrypto_pkcs7_convert_sig_pem() =E2=80=93 converts a signature from DER to = PEM format qcrypto_x509_verify_sig() =E2=80=93 verifies the provided data against the = given signature These functions enable basic signature verification support. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/x509-utils.c | 108 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 41 ++++++++++++++ 2 files changed, 149 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index d0e0384e9c..b23a5f0979 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -16,6 +16,7 @@ #include #include #include +#include =20 static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_HASH_ALGO__MAX] = =3D { [QCRYPTO_HASH_ALGO_MD5] =3D GNUTLS_DIG_MD5, @@ -335,6 +336,96 @@ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, s= ize_t size, Error **errp) return curve_id =3D=3D GNUTLS_ECC_CURVE_SECP521R1; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_pkcs7_t signature; + gnutls_datum_t sig_datum_der =3D {.data =3D sig, .size =3D sig_size}; + gnutls_datum_t sig_datum_pem =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initialize pkcs7 data: %s", gnutls_str= error(rc)); + return ret; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum_der, GNUTLS_X509_FMT_= DER); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_export2(signature, GNUTLS_X509_FMT_PEM, &sig_datum= _pem); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert signature to PEM format: %s", + gnutls_strerror(rc)); + goto cleanup; + } + + *resultlen =3D sig_datum_pem.size; + *result =3D g_memdup2(sig_datum_pem.data, sig_datum_pem.size); + + ret =3D 0; + +cleanup: + gnutls_pkcs7_deinit(signature); + g_free(sig_datum_pem.data); + return ret; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt =3D NULL; + gnutls_pkcs7_t signature =3D NULL; + gnutls_datum_t cert_datum =3D {.data =3D cert, .size =3D cert_size}; + gnutls_datum_t data_datum =3D {.data =3D comp, .size =3D comp_size}; + gnutls_datum_t sig_datum =3D {.data =3D sig, .size =3D sig_size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_import(crt, &cert_datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initialize pkcs7 data: %s", gnutls_str= error(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum , GNUTLS_X509_FMT_PEM= ); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_verify_direct(signature, crt, 0, &data_datum, 0); + if (rc !=3D 0) { + error_setg(errp, "Failed to verify signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + gnutls_pkcs7_deinit(signature); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -378,4 +469,21 @@ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, s= ize_t size, Error **errp) return -1; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export pkcs7 signature"); + return -1; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + error_setg(errp, "GNUTLS is required for signature-verification suppor= t"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index fcace73c49..c256d7bfad 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -91,4 +91,45 @@ int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t s= ize, */ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp); =20 +/** + * qcrypto_pkcs7_convert_sig_pem + * @sig: pointer to the PKCS#7 signature in DER format + * @sig_size: size of the signature + * @result: output location for the allocated buffer for the signature in + * PEM format + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + * (will be updated with the actual size of the PEM-encoded + * signature) + * @errp: error pointer + * + * Convert given PKCS#7 @sig from DER to PEM format. + * + * Returns: 0 if PEM-encoded signature was successfully stored in @result, + * -1 on error. + */ +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp); + +/** + * qcrypto_x509_verify_sig + * @cert: pointer to the raw certificate data + * @cert_size: size of the certificate + * @comp: pointer to the component to be verified + * @comp_size: size of the component + * @sig: pointer to the signature + * @sig_size: size of the signature + * @errp: error pointer + * + * Verify the provided @comp against the @sig and @cert. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp); + #endif --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939039; cv=none; d=zohomail.com; s=zohoarc; b=RjTxs4pkJc3Bgk/hyQfIfcYRti611euGxe3lm5I+CbGEF4SzcJ/O+bNZqJ/sp6gQZyqoska8YCdlNWyy6qGG+5LKwqtQhueN7A3tWdJWz3gmlMfVTeiK+WO8FK47OV78Lit7YxzdaIs7iBLYAjY9zqzFGFoLmZyEOVM7wwPTgXw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939039; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CYUEM7/UgXery6rxSLXF936SWXcMNRsBNxD0cjMNUaw=; b=jTSvNYxJuBkoQLRqUCkD62oISo9fR3bB5zLbxW/0mvOtuA1BBeDp0PVusA4y8bn4D9UUnvXlipsOJA7XXQBzVNkdwBR90GfG2z4O1L9rmSF543WYYAsMZHDiGWdaKD2o505AdAsvymWy62VwdxSRxnZlI69EMKAxbrg9v4ixDok= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939039409550.800194670087; Wed, 1 Jul 2026 13:50:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1st-0003Ot-Ts; Wed, 01 Jul 2026 16:50:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sr-0003OD-1w; Wed, 01 Jul 2026 16:50:13 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sp-0004GR-D3; Wed, 01 Jul 2026 16:50:12 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn6d51296063; Wed, 1 Jul 2026 20:50:08 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26mjxacb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:08 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnrVk032095; Wed, 1 Jul 2026 20:50:07 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxs2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:07 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Ko6v321103324 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:06 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F43658064; Wed, 1 Jul 2026 20:50:06 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4E54C58054; Wed, 1 Jul 2026 20:50:03 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:03 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=CYUEM7/UgXery6rxS LXF936SWXcMNRsBNxD0cjMNUaw=; b=I/ZcZDxMcdTTuyODs/UptS8YASgNyuEcv LFR6UwSqRhTpWQKl0fCYHPYjXNVGQciAZ2IAaMvDAx51Mj31gMhXet0v1jbVYQj8 ixWVLQAuBSjZ4XwMIdB/5yKISuTZyzWN1hMevOKl7mVnWlrPhbyhe6iFYciqin9D IGj1lW2M0binVjt6uusnIlpItxn/xVPBG/28okbaj3PLujZ1fcr9LYqBGSc1wcic /9KvTisk9TL+ujcfYy/fpvHBG0Esvyp3VCagSdT1mJ7hzRD5o5CsQSrUKLg2bk2D xA6er0oI++iR5I+WTS5tTM+DkHJ3Q+p/F69w+fsVi/sN0DO6p+K9g== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 13/35] s390x/diag: generalize s390_ipl_read/write to accept void * Date: Wed, 1 Jul 2026 16:48:59 -0400 Message-ID: <20260701204922.1320349-14-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzpcKO+YYGhLx GEkrxc2uPR3x7Z77OCQ0EUBszi5fp2GcUP8nqNkZxZqxW91YheSC2SpHMUfYSTf0i9O7e0CD1Ue jVBVRYw7IayosRS4rpDqxQXt2tnLLdY9jYn/DyRkB0J1e9MpIHKUNzEjm6IWyeMhPgkj9ajl8+7 WCcgt/6+nKkmLjmn+hjwKDWqJhXqXplayZQxsy8d2fCpvubXnLBLi6cT58r7IGiMpzn4NkXcd/G Xn7y/GNvDM6/uK/l4tKyJ4QgYK0ibgN1UOBdHYXr4C/nCqtHQP2w0polc3O4FpaIQ3WaIrudxFh 2GQybRSPyQIFf6yJqi04eU3Dwxoj/H6TnzbitXoiKGyXFBfnt3/pEAMmxH5Ok8PEzKOPjIwqv4O 3L0Ry14yy0dyWvU6naMWe48yBf7SNjlWAIJYdk5eJSkj938ujT2/9wJ6mGjfownzsjoLIW23u0O 7au+xTU6wvDSrDpjlUg== X-Proofpoint-GUID: t74eeY9WMzrJREO5ZU6DDeq2zPHydZ-H X-Authority-Analysis: v=2.4 cv=Z8bc2nRA c=1 sm=1 tr=0 ts=6a457d80 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=CkZHjoNxVx3BTC6vW7wA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX4za9BmDKeucP tIwkMCeJBPTOhaNf/3g3K4D1iyEM5hgOwqy6XjyDJZ7LvgKBA2j24CGcmMGfCaQSif9Dh9Lwrwd +EX1olKf6N45JLVdBen/QtU1l0e7bvE= X-Proofpoint-ORIG-GUID: t74eeY9WMzrJREO5ZU6DDeq2zPHydZ-H X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939040634158500 Content-Type: text/plain; charset="utf-8" Change the data parameter of s390_ipl_read() and s390_ipl_write() from IplParameterBlock * to void *, so the helpers can be reused beyond DIAG 308. Signed-off-by: Zhuoying Cai Reviewed-by: Jared Rossi --- target/s390x/diag.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/target/s390x/diag.c b/target/s390x/diag.c index f07d39ab07..aad2e8c6bc 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -83,24 +83,24 @@ static int diag308_parm_check(CPUS390XState *env, uint6= 4_t r1, uint64_t addr, } =20 static void s390_ipl_read(CPUS390XState *env, uint64_t addr, - IplParameterBlock *iplb, size_t size) + void *data, size_t size) { if (s390_is_pv()) { - s390_cpu_pv_mem_read(env_archcpu(env), 0, iplb, size); + s390_cpu_pv_mem_read(env_archcpu(env), 0, data, size); } else { address_space_read(cpu_get_address_space(env_cpu(env), 0), addr, - MEMTXATTRS_UNSPECIFIED, iplb, size); + MEMTXATTRS_UNSPECIFIED, data, size); } } =20 static void s390_ipl_write(CPUS390XState *env, uint64_t addr, - IplParameterBlock *iplb, size_t size) + void *data, size_t size) { if (s390_is_pv()) { - s390_cpu_pv_mem_write(env_archcpu(env), 0, iplb, size); + s390_cpu_pv_mem_write(env_archcpu(env), 0, data, size); } else { address_space_write(cpu_get_address_space(env_cpu(env), 0), addr, - MEMTXATTRS_UNSPECIFIED, iplb, size); + MEMTXATTRS_UNSPECIFIED, data, size); } } =20 --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939316; cv=none; d=zohomail.com; s=zohoarc; b=S4/jZpYBLk+6ZnLljhYBbWXO1i084yNBAG2iveSK5BN2mMQhYK3GpGwaS0cFhkxALcWKC8rTUd8x9reQDJUnPG4cY3Qz8i0U/HyovHu4jbCp/zPvDunVxAnVs6MR29XU2ud4IecO1lfbR7Hwb7MGepsG2e3tz4804p+tSqHG7Qk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939316; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LRcwx1NeaioI9AxpSRp8SmKm+re9uvEmIcemKuLd2Uw=; b=Kf8935q2AkM/dWYw/SfOW4MY0rk0xy6mUDvP2eQT8kljQO5MP+xwLYBlm1H6LhiAY8RIPgx+1+lMSB7Mna749vq4qj5SSOD+hmk4HJVJlwzOZ6un2DdLF9b31+IfEQrDpJC5GbiBVETB7AFLJ8hXwoW99QkpBXMhEDW8Ib5M/O4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17829393165211023.4052332949957; Wed, 1 Jul 2026 13:55:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1sx-0003Pp-BG; Wed, 01 Jul 2026 16:50:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sv-0003PS-TR; Wed, 01 Jul 2026 16:50:17 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1st-0004IB-HT; Wed, 01 Jul 2026 16:50:17 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GnGwR1457115; Wed, 1 Jul 2026 20:50:11 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q3q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:11 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnZB6025906; Wed, 1 Jul 2026 20:50:10 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9jj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:10 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Ko98956492434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:09 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E37F758054; Wed, 1 Jul 2026 20:50:08 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4460A5803F; Wed, 1 Jul 2026 20:50:06 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:06 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=LRcwx1NeaioI9AxpS Rp8SmKm+re9uvEmIcemKuLd2Uw=; b=Y6QXt79tOs/qcm2XqNz+SnCC2t+j/XwR/ n4frKZEyN7Mxjs6moRDcR8rjxeNGmq+rh0LZJldH/LeuzrL4Rosz5fFD4Rjhr3HX HlR0HtUm5rAN3aiWL2yMKzB7UmNDnyNTFOAlI+CGgyjNpBN9ZrAGgolbwZgaTQ9t iTaKyGLpR82NHXJkyp8VExbpIrm24QM4+XSF8ybWPrVvVQUE1yMrqYFJ/up1Vy6h oCW0/jSMXjKqEBMeh20DDgVVMPNseGzhRqzXsSZOKGltpB94U4LTOqrc/tW1w2tq rhfzEMM6R6bVNORbiFATr9fQEcqYfYIpJGkSVCa4iRkMsjIUYJyrg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 14/35] s390x/diag: Implement DIAG 508 subcode 1 for signature verification Date: Wed, 1 Jul 2026 16:49:00 -0400 Message-ID: <20260701204922.1320349-15-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: jNcGUr0zQTO7cDXOEccmWGBQbWAAfi_m X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXwnRZdpVOTkOz kMRk/eXSKyV0TXcqpyAJdflCDRZ4wL/7z5QE2+p7T1fFUZDTM0Knir1ykTb3x1v48slaLDnXaJr CzDL4O3woKWoLeuigZ9KN67/p3xkjng= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d83 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=K66z3tz1c1WH2lCF3KIA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX0k9OvcTSBZJR +CJZHuUv0txpO+DqY1CQAupdwo/LB5b81Oepqi7xvzKNVRe0cjw0iu2EODS2nZKRhQg0jzcCNHQ hIxij3H6pZ/FSoWuxHStEOIra4tJHB610L0ijMhHOzAMI+CbTr9dudYD4PpIQJulx463H173ueu boS75wH/GiEAi+/W8gz93FUqOfL9jE68HgKWQ/WkJcsVJGVc2Wc3XS+V3lNQtHUA/EsxsKeKXzW jIf5FkKqKcHh7N8WkBEiucPy/b2D6XnvvtU13/mL6WN/JrdSWCEciRcIFA8Q/f7hdIh+n5HYp9d jU3BE1GyHYlr9fZKS7kKbOKXpJswcjc21r9YMGAjCCT/HiQq2PWA+3q+OPDZNQbpHD3LzpE79uc P200TOUhbguXOeAAIQzXPCtSdRqlFWJi60ht5hbF8gT7B5rSmGqql4oXHSqXC6r2NkDzeOLeHZ9 Y6vt1cHY3q+BUpA3xgA== X-Proofpoint-ORIG-GUID: jNcGUr0zQTO7cDXOEccmWGBQbWAAfi_m X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939318259158500 Content-Type: text/plain; charset="utf-8" From: Collin Walling DIAG 508 subcode 1 performs signature-verification on signed components. A signed component may be a Linux kernel image, or any other signed binary. **Verification of initrd is not supported.** The instruction call expects two item-pairs: an address of a device component, an address of the analogous signature file (in PKCS#7 DER format= ), and their respective lengths. All of this data should be encapsulated within a Diag508SigVerifBlock. The DIAG handler will read from the provided addresses to retrieve the necessary data, parse the signature file, then perform the signature-verification. Because there is no way to correlate a specific certificate to a component, each certificate in the store is tried until either verification succeeds, or all certs have been exhausted. A return code of 1 indicates success, and the index and length of the corresponding certificate will be set in the Diag508SigVerifBlock. The following values indicate failure: 0x0102: no certificates are available in the store 0x0202: component data is invalid 0x0302: PKCS#7 format signature is invalid 0x0402: signature-verification failed 0x0502: length of Diag508SigVerifBlock is invalid Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Farhan Ali --- docs/specs/s390x-secure-ipl.rst | 17 +++++ include/hw/s390x/ipl/diag508.h | 30 +++++++++ target/s390x/diag.c | 111 +++++++++++++++++++++++++++++++- 3 files changed, 157 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 2198805b47..a8be863548 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -84,3 +84,20 @@ that requires assistance from QEMU. =20 Subcode 0 - query installed subcodes Returns a 64-bit mask indicating which subcodes are supported. + +Subcode 1 - perform signature verification + Perform signature-verification on a signed component, using certificat= es + from the certificate store and leveraging qcrypto libraries to perform + this operation. + + Note: verification of initrd is not supported. + + A return code of 1 indicates success, and the index and length of the + corresponding certificate will be set in the Diag508SigVerifBlock. + The following values indicate failure: + + * ``0x0102``: no certificates are available in the store + * ``0x0202``: component data is invalid + * ``0x0302``: PKCS#7 format signature is invalid + * ``0x0402``: signature-verification failed + * ``0x0502``: length of Diag508SigVerifBlock is invalid diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h index 6281ad8299..8a147f32a0 100644 --- a/include/hw/s390x/ipl/diag508.h +++ b/include/hw/s390x/ipl/diag508.h @@ -11,5 +11,35 @@ #define S390X_DIAG508_H =20 #define DIAG_508_SUBC_QUERY_SUBC 0x0000 +#define DIAG_508_SUBC_SIG_VERIF 0x8000 + +#define DIAG_508_RC_OK 0x0001 +#define DIAG_508_RC_NO_CERTS 0x0102 +#define DIAG_508_RC_INVAL_COMP_DATA 0x0202 +#define DIAG_508_RC_INVAL_PKCS7_SIG 0x0302 +#define DIAG_508_RC_FAIL_VERIF 0x0402 +#define DIAG_508_RC_INVAL_LEN 0x0502 + +/* + * Maximum componenet and signature sizes for current secure boot implemen= tation + * Not architecturally defined and may need to revisit if increased + */ +#define DIAG_508_MAX_COMP_LEN 0x10000000 +#define DIAG_508_MAX_SIG_LEN 4096 + +struct Diag508SigVerifBlock { + uint32_t length; + uint8_t reserved0[3]; + uint8_t version; + uint32_t reserved[2]; + uint8_t cert_store_index; + uint8_t reserved1[7]; + uint64_t cert_len; + uint64_t comp_len; + uint64_t comp_addr; + uint64_t sig_len; + uint64_t sig_addr; +}; +typedef struct Diag508SigVerifBlock Diag508SigVerifBlock; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index aad2e8c6bc..6c855db783 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -625,9 +625,110 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1,= uint64_t r3, uintptr_t ra) } } =20 +static bool diag_508_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size) +{ + g_autofree uint8_t *sig_pem =3D NULL; + size_t sig_size_pem; + int rc; + + /* + * PKCS#7 signature with DER format + * Convert to PEM format for signature verification + * + * Ignore errors during qcrypto signature format conversion and verifi= cation + * Return false on any error, treating it as a verification failure + */ + rc =3D qcrypto_pkcs7_convert_sig_pem(sig, sig_size, &sig_pem, &sig_siz= e_pem, NULL); + if (rc < 0) { + return false; + } + + rc =3D qcrypto_x509_verify_sig(cert, cert_size, + comp, comp_size, + sig_pem, sig_size_pem, NULL); + if (rc < 0) { + return false; + } + + return true; +} + +static int handle_diag508_sig_verif(CPUS390XState *env, uint64_t addr) +{ + int verified; + uint32_t svb_len; + uint64_t comp_len, comp_addr; + uint64_t sig_len, sig_addr; + g_autofree uint8_t *comp =3D NULL; + g_autofree uint8_t *sig =3D NULL; + g_autofree Diag508SigVerifBlock *svb =3D NULL; + size_t svb_size =3D sizeof(Diag508SigVerifBlock); + S390IPLCertificateStore *cs =3D s390_ipl_get_certificate_store(); + + if (!cs->count) { + return DIAG_508_RC_NO_CERTS; + } + + svb =3D g_new0(Diag508SigVerifBlock, 1); + s390_ipl_read(env, addr, svb, svb_size); + + svb_len =3D be32_to_cpu(svb->length); + if (svb_len !=3D svb_size) { + return DIAG_508_RC_INVAL_LEN; + } + + comp_len =3D be64_to_cpu(svb->comp_len); + comp_addr =3D be64_to_cpu(svb->comp_addr); + sig_len =3D be64_to_cpu(svb->sig_len); + sig_addr =3D be64_to_cpu(svb->sig_addr); + + if (!comp_len || !comp_addr || comp_len > DIAG_508_MAX_COMP_LEN) { + if (comp_len > DIAG_508_MAX_COMP_LEN) { + warn_report("DIAG 0x508: component length %lu exceeds current = maximum %u", + comp_len, DIAG_508_MAX_COMP_LEN); + } + return DIAG_508_RC_INVAL_COMP_DATA; + } + + if (!sig_len || !sig_addr || sig_len > DIAG_508_MAX_SIG_LEN) { + if (sig_len > DIAG_508_MAX_SIG_LEN) { + warn_report("DIAG 0x508: signature length %lu exceeds current = maximum %u", + sig_len, DIAG_508_MAX_SIG_LEN); + } + return DIAG_508_RC_INVAL_PKCS7_SIG; + } + + comp =3D g_malloc0(comp_len); + s390_ipl_read(env, comp_addr, comp, comp_len); + + sig =3D g_malloc0(sig_len); + s390_ipl_read(env, sig_addr, sig, sig_len); + + for (int i =3D 0; i < cs->count; i++) { + verified =3D diag_508_verify_sig(cs->certs[i].raw, + cs->certs[i].size, + comp, comp_len, + sig, sig_len); + if (verified) { + svb->cert_store_index =3D i; + svb->cert_len =3D cpu_to_be64(cs->certs[i].der_size); + s390_ipl_write(env, addr, svb, svb_size); + return DIAG_508_RC_OK; + } + } + + return DIAG_508_RC_FAIL_VERIF; +} + +QEMU_BUILD_BUG_MSG(sizeof(Diag508SigVerifBlock) !=3D 64, + "size of Diag508SigVerifBlock is wrong"); + void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { @@ -642,7 +743,15 @@ void handle_diag_508(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 switch (subcode) { case DIAG_508_SUBC_QUERY_SUBC: - rc =3D 0; + rc =3D DIAG_508_SUBC_SIG_VERIF; + break; + case DIAG_508_SUBC_SIG_VERIF: + if (!diag_parm_addr_valid(addr, sizeof(Diag508SigVerifBlock), true= )) { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag508_sig_verif(env, addr); break; default: s390_program_interrupt(env, PGM_SPECIFICATION, ra); --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939143; cv=none; d=zohomail.com; s=zohoarc; b=P/WXMCCIIp1oyywIdyCU448kKQbTQZZqiRsQkxFYYQZQB/ZM5RxFLa+Dhc+o4wuY1Vcn3vIiC8onPd5ZKIjG2k7HWO5xCWC7ZUDOdgYmdVtslQ9XwT32Yc6Llrr0h/dM6clY8NbzkelbJryW70zLhgpKeAbWYXX4RafvtqNY9CY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939143; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MvtpAfu5C748zVsbMtvrjWIeeo4XUR8oSKVohioaAWw=; b=KpWA6/1VV8wj/n9J+IBhqG4bZpGXkf5Othxwr4wEAcyHwospy5o0CXpxqDqTEgvUYKeAyDkI9Kv2kulP5y62GUglr+/rTqvVhaCO5g7SEqLJqdQV/XufGiwt96yew2CIgXr/lqnokGE8r0cEOE8bgLOR4YXb2kQJDlU/z+8vo60= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939143645607.9268995647398; Wed, 1 Jul 2026 13:52:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1t0-0003Se-SV; Wed, 01 Jul 2026 16:50:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sx-0003Pu-DO; Wed, 01 Jul 2026 16:50:19 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sv-0004Ix-Hk; Wed, 01 Jul 2026 16:50:19 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn7iX1341374; Wed, 1 Jul 2026 20:50:14 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26rf66cw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:14 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knak1027027; Wed, 1 Jul 2026 20:50:13 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2suk92um-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:13 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoCSB25428502 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:12 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4FD5458060; Wed, 1 Jul 2026 20:50:12 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5802D58055; Wed, 1 Jul 2026 20:50:09 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:09 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=MvtpAf u5C748zVsbMtvrjWIeeo4XUR8oSKVohioaAWw=; b=ceY42pV2rFTF5QtoMBNfLQ cV8XFaGTGTL2X3+6dMGZzoq/57KEo4jpVyGggDMjK/YR4I7ccdB8yR+emBjzxizT ckH/2QyzOo8/bwtH7f5KPqY033cEs0QfjiyRxFzDgna4XHt2grBLjQJuq/hhRC8d XxFSokH42mY49O8UggHm+u1u7kX2DxmVvEA0RnRGj3D4dgFgcNrUuA2dnSQyz5nE uVrT9f4p5CeIjwaSSdbnV1tQL2+3U4jgep/lqgkcAQZv+ynKsIV9CD+1pfCnEPi3 2OV9TMvJECSZdb9Jjv1dJZZI9eCnlzrtiaT4YA4XED3qtYfHOXvs7wZwje7B0dSw == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 15/35] s390x/ipl: Introduce IPL Information Report Block (IIRB) Date: Wed, 1 Jul 2026 16:49:01 -0400 Message-ID: <20260701204922.1320349-16-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=a4kAM0SF c=1 sm=1 tr=0 ts=6a457d86 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=1NTGDykL02WXTEG3Jz0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: z-0P8U5lseekXeNdCVHj-xyfBUvVqDHH X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXxqD87xEUZIKo r3o2oo7g3DT2vrFGiFfWOUHb3LKfvAQJcfLMbEFrFRHN8lUcXdRjk4xr8X+IlOBGMRTj+QePpnP OH39tg4/8oaTwM2wlh9KouFT4AEYi40bU4vBIliVeO6Zefdni32MAhoKxVgstnXmsVkA1Cq8ZTM PUsNMdUUWwTDgfbQUYcf3jwxC6J4TwtS1QoyZizZYfwDxBzmtSpaj3VuIKAlzSqeCJdUhRZreWx o+ZMuKcdE/M3wFFT/a4tI/7s5otYE+ujMYaJgdoRAdbzoMEvj6BB4IeafhAWY5MTHGI2lotxrIc SNoClLgkLqX1LoO5Mk47HVgtIn+CVagnqnfX/tbRGV9Qdn39JDzzVbdyvx5RJ1mSiw2Js1dh3PT 7qaghoLmgzRF6txx4O4O7NQY6oTo85QCRG+O0ebd9TQ/UDO3aFgjnuD7yCXscbHToVSmkpti/c4 SHDkrRQiKkkSRmJF5UA== X-Proofpoint-GUID: z-0P8U5lseekXeNdCVHj-xyfBUvVqDHH X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX5+Q5QEOul2qP S437D9CVC41q5iFFk3X+nuFVQIsOw6cR1P+RlvC3rnwgh7MZflcL76Ey79pPVSqCQHfJF57sPgL 8VZlre87uOya48fmM1/fMBOU0AwNYBE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 priorityscore=1501 adultscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939145270158500 The IPL information report block (IIRB) contains information used to locate IPL records and to report the results of signature verification of one or more secure components of the load device. IIRB is stored immediately following the IPL Parameter Block. Results on component verification in any case (failure or success) are stored. The IIRB data is reserved and protected by the guest kernel during early boot to prevent it from being overwritten before the certificate data is permanently saved. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- docs/specs/s390x-secure-ipl.rst | 21 +++++++++++ include/hw/s390x/ipl/qipl.h | 62 +++++++++++++++++++++++++++++++++ 2 files changed, 83 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index a8be863548..a183d46b61 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -101,3 +101,24 @@ Subcode 1 - perform signature verification * ``0x0302``: PKCS#7 format signature is invalid * ``0x0402``: signature-verification failed * ``0x0502``: length of Diag508SigVerifBlock is invalid + +IPL Information Report Block +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The IPL Parameter Block (IPLPB), utilized for IPL operation, is extended w= ith an +IPL Information Report Block (IIRB), which contains the results from secur= e IPL +operations such as: + +* component data +* verification results +* certificate data + +During early boot, the guest kernel reserves the memory region +containing the IIRB. This preserves the data while the guest kernel is +operating and during re-IPL. + +The guest kernel uses the contents in the IIRB for: + +* Boot logging: reports which components were loaded and verified. +* kexec operations: builds the next kernel=E2=80=99s IPL report from the e= xisting one. +* Keying: installs IPL certificates into the platform trusted keyring. diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index ed1a91182a..45d25264f4 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -32,6 +32,9 @@ typedef enum S390IplType S390IplType; #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 #define MAX_CERTIFICATES 64 +/* largest supported block size - same as VIRTIO_DASD_DEFAULT_BLOCK_SIZE */ +#define VIRTIO_MAX_BLOCK_SIZE 4096 +#define MAX_COMP_ENTRIES ((VIRTIO_MAX_BLOCK_SIZE - 32) / 32) =20 /* * The QEMU IPL Parameters will be stored at absolute address @@ -146,4 +149,63 @@ union IplParameterBlock { } QEMU_PACKED; typedef union IplParameterBlock IplParameterBlock; =20 +struct IplInfoReportBlockHeader { + uint32_t len; + uint8_t flags; + uint8_t reserved1[11]; +}; +typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; + +struct IplInfoBlockHeader { + uint32_t len; + uint8_t type; + uint8_t reserved1[11]; +}; +typedef struct IplInfoBlockHeader IplInfoBlockHeader; + +enum IplInfoBlockType { + IPL_INFO_BLOCK_TYPE_CERTIFICATES =3D 1, + IPL_INFO_BLOCK_TYPE_COMPONENTS =3D 2, +}; + +struct IplSignatureCertificateEntry { + uint64_t addr; + uint64_t len; +}; +typedef struct IplSignatureCertificateEntry IplSignatureCertificateEntry; + +struct IplSignatureCertificateList { + IplInfoBlockHeader ipl_info_header; + IplSignatureCertificateEntry cert_entries[MAX_CERTIFICATES]; +}; +typedef struct IplSignatureCertificateList IplSignatureCertificateList; + +#define S390_IPL_DEV_COMP_FLAG_SC 0x80 +#define S390_IPL_DEV_COMP_FLAG_CSV 0x40 + +struct IplDeviceComponentEntry { + uint64_t addr; + uint64_t len; + uint8_t flags; + uint8_t reserved1[5]; + uint16_t cert_index; + uint8_t reserved2[8]; +}; +typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; + +struct IplDeviceComponentList { + IplInfoBlockHeader ipl_info_header; + IplDeviceComponentEntry device_entries[MAX_COMP_ENTRIES]; +}; +typedef struct IplDeviceComponentList IplDeviceComponentList; + +#define COMP_LIST_MAX sizeof(IplDeviceComponentList) +#define CERT_LIST_MAX sizeof(IplSignatureCertificateList) + +struct IplInfoReportBlock { + IplInfoReportBlockHeader hdr; + uint8_t info_blks[COMP_LIST_MAX + CERT_LIST_MAX]; +}; +typedef struct IplInfoReportBlock IplInfoReportBlock; + #endif --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939105; cv=none; d=zohomail.com; s=zohoarc; b=dP6ZV96m3UkENZnfKaT9SILVoS9q0BIo7DF9Xe4TUGBYOYGMNGLdRXynm6wo/xoe1tZmrRnn8XsJWoYWIvBn3MAU8lJ3N0ee+hhtHs/Fy9o0MvW5QgHArx/yYY/IUqAdz0AWxNl/CS4QFmdngTmuxataSp1gVTKcvhG5CKbdEtY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939105; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=rHIhs21YxKUUf7jApc7uBL0KiGOWi/SidEL+PlvIWag=; b=g1UVS7nTppy0kl4luzaxLntw9a5EBJc84lBcZJ7XuzhFwxuP0MMd8rUGEIjjbp11tPP9KyXh5tt7nuLnS9X78ILnBph5tUfRfd8iFqtg3yUjuNeIaFkQgIjA7qGVIMytI6RoUuSHEdHN0VaQO3burIpz116eA1Vht7Txr5D3avo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939105369338.67884596516376; Wed, 1 Jul 2026 13:51:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1t8-0003bl-Sy; Wed, 01 Jul 2026 16:50:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t2-0003TS-Ap; Wed, 01 Jul 2026 16:50:24 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1sz-0004KJ-Dk; Wed, 01 Jul 2026 16:50:24 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmlMu1455752; Wed, 1 Jul 2026 20:50:17 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q40-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:17 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KndWI006294; Wed, 1 Jul 2026 20:50:16 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu54-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:16 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoFjq16515732 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:15 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 543C25804E; Wed, 1 Jul 2026 20:50:15 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8537C5803F; Wed, 1 Jul 2026 20:50:12 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:12 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rHIhs21YxKUUf7jAp c7uBL0KiGOWi/SidEL+PlvIWag=; b=AxlgtwiNfQa3KON8PWEDBBCv31QhzxvrB fjD8GdCo+NwRs4dLLHkji1BHJFedjK9C2YufgZxcJ6DDNEvvCM4b6hgM9xqvaGSQ 2oQILvzV7wCnKGQX+p0arKkiui61ck9bzbeA5RA6c9fJVoIW24zCLf1odep6cDRd rpfBCl3h1Z/eaT0vL+cMH+QC2n6FnpO6EEfsuY2MPa2v7xcC3ALafAxqa0T8PEcM zdQ6sMQzhBGB0XdeOk0xav7WJT9vk9ogm8ybU+woOl83+wv2eq1QtLqD1G50oAe5 7PUMX9crOOvSKd04Bu4Ftwf6hanJXygaxNV1McdbTu0WzMrTGxEEw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 16/35] pc-bios/s390-ccw: Define memory for IPLB and convert IPLB to pointers Date: Wed, 1 Jul 2026 16:49:02 -0400 Message-ID: <20260701204922.1320349-17-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: TtqdfzsEB55kAVG2D0palmx-GfiSFCI9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX4NQFkGNFpz2I Z0v07PwhG9VBDpd6sprscJw5tmFK9MOnai8uM0dN4x6E4fnENeFE8PxOyCzS/CTrLTMGNWxrUQA iG0ENbpuzryZeu1CvuOPCEz3fCpVnEw= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d89 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=_GZQR2ZoBes7ElOevS0A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXx8XPwBwJ3MOH yeOSS3u1rcpfAzwVTcotpylMilSF6irXMHpxJXgQ0JJHQ34eVVVaGEGCXg3v0TBojI1V33znBUA WiRAPT9Z1myWqvp8uxC0LTR5Q7j50x82nCBYX75QbOsx3T7bXK4o1rZ8+50r1LzQp9C62CusNcO F3QaGWU4cgacm3FycYzrk3jPjstdxjCoOKYZzYnv6PJRbUgNcNcRT9ofsY8/ZWADhYzTjVF7taB MIjfXQV52jsiSGNNKe8cZghwZCoC6UtNf7hxDqSW4gnJhszh+MD92I92xO1TeXXGN7lGbewgPkV kUoSHLBLTPEq8FkoaCpWRlyeei6bJg2zBrGvtee/uE/K0uGE4jFpNLCRv6A2++Mdv+c9uFCgtio 9LKSU4Beg9SBvbtQXBNFd/vjR4G/Oo84qUfWachheObZ3RJM88TjIFgiA3Cv9D8eTBXe2qASMGy tfQMBztgG0myv0G+nIw== X-Proofpoint-ORIG-GUID: TtqdfzsEB55kAVG2D0palmx-GfiSFCI9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939107088158500 Content-Type: text/plain; charset="utf-8" Define a memory space for both IPL Parameter Block (IPLB) and IPL Information Report Block (IIRB) since IIRB is stored immediately following IPLB. Convert IPLB to pointer and it points to the start of the defined memory sp= ace. IIRB points to the end of IPLB. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Farhan Ali Reviewed-by: Jared Rossi --- include/hw/s390x/ipl/qipl.h | 6 ++++++ pc-bios/s390-ccw/iplb.h | 5 +++-- pc-bios/s390-ccw/jump2ipl.c | 6 +++--- pc-bios/s390-ccw/main.c | 34 +++++++++++++++++++--------------- pc-bios/s390-ccw/netmain.c | 8 ++++---- 5 files changed, 35 insertions(+), 24 deletions(-) diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 45d25264f4..9940f1457c 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -208,4 +208,10 @@ struct IplInfoReportBlock { }; typedef struct IplInfoReportBlock IplInfoReportBlock; =20 +struct IplBlocks { + IplParameterBlock iplb; + IplInfoReportBlock iirb; +}; +typedef struct IplBlocks IplBlocks; + #endif diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index 926e8eed5d..c92a3d0f0c 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -20,8 +20,9 @@ #include =20 extern QemuIplParameters qipl; -extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +extern IplParameterBlock *iplb; extern bool have_iplb; +extern IplBlocks ipl_blocks; =20 static inline bool manage_iplb(IplParameterBlock *iplb, bool store) { @@ -61,7 +62,7 @@ static inline bool load_next_iplb(void) =20 qipl.index++; next_iplb =3D (IplParameterBlock *) qipl.next_iplb; - memcpy(&iplb, next_iplb, sizeof(IplParameterBlock)); + memcpy(iplb, next_iplb, sizeof(IplParameterBlock)); =20 qipl.chain_len--; qipl.next_iplb =3D qipl.next_iplb + sizeof(IplParameterBlock); diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c index 86321d0f46..fa2ca5cbe1 100644 --- a/pc-bios/s390-ccw/jump2ipl.c +++ b/pc-bios/s390-ccw/jump2ipl.c @@ -43,11 +43,11 @@ int jump_to_IPL_code(uint64_t address) * The IPLB for QEMU SCSI type devices must be rebuilt during re-ipl. = The * iplb.devno is set to the boot position of the target SCSI device. */ - if (iplb.pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { - iplb.devno =3D qipl.index; + if (iplb->pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { + iplb->devno =3D qipl.index; } =20 - if (have_iplb && !set_iplb(&iplb)) { + if (have_iplb && !set_iplb(iplb)) { panic("Failed to set IPLB"); } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 26287cfd81..b8f836c682 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -24,7 +24,9 @@ static SubChannelId blk_schid =3D { .one =3D 1 }; static char loadparm_str[LOADPARM_LEN + 1]; QemuIplParameters qipl; -IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +/* Ensure that IPLB and IIRB are page aligned and sequential in memory */ +IplBlocks ipl_blocks __attribute__((__aligned__(PAGE_SIZE))); +IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ @@ -53,7 +55,7 @@ void write_subsystem_identification(void) void write_iplb_location(void) { if (cutype =3D=3D CU_TYPE_VIRTIO && virtio_get_device_type() !=3D VIRT= IO_ID_NET) { - lowcore->ptr_iplb =3D ptr2u32(&iplb); + lowcore->ptr_iplb =3D ptr2u32(iplb); } } =20 @@ -213,14 +215,14 @@ static void boot_setup(void) char lpmsg[] =3D "LOADPARM=3D[________]\n"; VDev *vdev =3D virtio_get_device(); =20 - if (have_iplb && memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) !=3D= 0) { - ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN= ); + if (have_iplb && memcmp(iplb->loadparm, NO_LOADPARM, LOADPARM_LEN) != =3D 0) { + ebcdic_to_ascii((char *) iplb->loadparm, loadparm_str, LOADPARM_LE= N); } else { sclp_get_loadparm_ascii(loadparm_str); } =20 if (have_iplb) { - vdev->ipl_type =3D iplb.pbt; + vdev->ipl_type =3D iplb->pbt; menu_setup(vdev); } else { vdev->ipl_type =3D QEMU_DEFAULT_IPL; @@ -244,21 +246,21 @@ static bool find_boot_device(void) switch (vdev->ipl_type) { case S390_IPL_TYPE_CCW: vdev->scsi_device_selected =3D false; - debug_print_int("device no. ", iplb.ccw.devno); - blk_schid.ssid =3D iplb.ccw.ssid & 0x3; + debug_print_int("device no. ", iplb->ccw.devno); + blk_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", blk_schid.ssid); - found =3D find_subch(iplb.ccw.devno); + found =3D find_subch(iplb->ccw.devno); break; case S390_IPL_TYPE_QEMU_SCSI: vdev->scsi_device_selected =3D true; - vdev->selected_scsi_device.channel =3D iplb.scsi.channel; - vdev->selected_scsi_device.target =3D iplb.scsi.target; - vdev->selected_scsi_device.lun =3D iplb.scsi.lun; - blk_schid.ssid =3D iplb.scsi.ssid & 0x3; - found =3D find_subch(iplb.scsi.devno); + vdev->selected_scsi_device.channel =3D iplb->scsi.channel; + vdev->selected_scsi_device.target =3D iplb->scsi.target; + vdev->selected_scsi_device.lun =3D iplb->scsi.lun; + blk_schid.ssid =3D iplb->scsi.ssid & 0x3; + found =3D find_subch(iplb->scsi.devno); break; case S390_IPL_TYPE_PCI: - found =3D find_fid(iplb.pci.fid); + found =3D find_fid(iplb->pci.fid); break; default: puts("Unsupported IPLB"); @@ -377,10 +379,12 @@ static void probe_boot_device(void) =20 void main(void) { + iplb =3D &ipl_blocks.iplb; + copy_qipl(); sclp_setup(); css_setup(); - have_iplb =3D store_iplb(&iplb); + have_iplb =3D store_iplb(iplb); if (!have_iplb) { boot_setup(); probe_boot_device(); diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c index 651cedf6ef..9b4dfd4638 100644 --- a/pc-bios/s390-ccw/netmain.c +++ b/pc-bios/s390-ccw/netmain.c @@ -528,11 +528,11 @@ static bool virtio_setup(void) */ enable_mss_facility(); =20 - if (have_iplb || store_iplb(&iplb)) { - IPL_assert(iplb.pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expect= ed"); - dev_no =3D iplb.ccw.devno; + if (have_iplb || store_iplb(iplb)) { + IPL_assert(iplb->pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expec= ted"); + dev_no =3D iplb->ccw.devno; debug_print_int("device no. ", dev_no); - net_schid.ssid =3D iplb.ccw.ssid & 0x3; + net_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", net_schid.ssid); found =3D find_net_dev(&schib, dev_no); } else { --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939313; cv=none; d=zohomail.com; s=zohoarc; b=Pg9naYuc2cyWOWSvwY1shNoUQec2ltIgP+REnOAfCHqYgc8exqv7vhhSPWZl0vwSkh1JcT1A7rm+6CBLUzGaBpOsj1EpSMOidLNnIOm1CIAOZeRg+ddX8qSaSQ5qETOlL1+KvG7DUyXp3qOfAMVfMJJbw7nzz0gMlw8THLLeHxA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939313; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=U9dL+5K6DINaHwUbJdaXZTIm6epN4kvYWhy/Wp+D4lE=; b=BM9WL4UWI4QKnwbXQCKjPg0H3RV4zbTWCrvQtzoP+JYaABIPzHSbAJX73P8mMk9aRcxuV+4ODHzhOVFTzRh7Jc2uo+xrdVhGlpNSUokrjHDYLx+QghdSWKJzWdSbzTImhGZDMvCop9ky/l3OfLga+LaWVAaHOmlPpJFSFUs6Z5M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939313547998.1412561090265; Wed, 1 Jul 2026 13:55:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tA-0003dm-F0; Wed, 01 Jul 2026 16:50:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t4-0003XL-TS; Wed, 01 Jul 2026 16:50:28 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t2-0004Lh-Gm; Wed, 01 Jul 2026 16:50:26 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmuAU1456439; Wed, 1 Jul 2026 20:50:21 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q49-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:20 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Kngg1027075; Wed, 1 Jul 2026 20:50:19 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2suk92v2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:19 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoIBq17629712 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:18 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2A8F95804E; Wed, 1 Jul 2026 20:50:18 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 864525803F; Wed, 1 Jul 2026 20:50:15 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:15 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=U9dL+5K6DINaHwUbJ daXZTIm6epN4kvYWhy/Wp+D4lE=; b=o0mn2hYzohLtEqy/zaZA+zlKusWAp0FKw 9/Nlp+iS5pa08ecHsdgIOhuUO8Tn/dhecCIvqJ4rfAAnxUpM8AG8PoBIJi2Z2ae/ JGEbnAHw1WIADTeXBX1YTmNcbnyRl2icYRRYbQyl2Fo5krm+tzrEDlzZOQpE/0FW tR0ke7J24RxOYyh9EafGOk0HkiZrXkm7W2TTp68xaTzdyFeHkqGYUZACq2T4/mhz nrFMv0peu0SR8z3NF6H/1rv2jbN7KECHrK+/1sA5x6pN7GJEICJBMuuH7o3ttgn4 uk8zz4qIayaCN+am9Be08K5lACgMDGHoHA81uSCpP1lBk3lzeOHEg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 17/35] hw/s390x/ipl: Add IPIB flags to IPL Parameter Block Date: Wed, 1 Jul 2026 16:49:03 -0400 Message-ID: <20260701204922.1320349-18-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: QN6pNaNfjesTmT4LaGn5a3kgrpjnWU-t X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2NR1d5nN2wUu RU4M3lo6A+Zqkhe/AHPFCV2tGisKMeDd5i3JIzMrz98mnD+BsR+47lKJrJPmln4HuqgRE68MUp6 KH7mZifLu54o1r5jECrOXB22eB6Js5g= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d8c cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=ZDXLRS20C3ackK2NFGcA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX3GOsLwDCxGYk Py+pyF62PZKWq6VGIkKraM352KiWMNeeu0owiI67TKW+u8xc9Ex625bzvBpcwf8IahaPZrZ02Fz MwTO4ykkBGT+a4j4DXyhsMKHOJWiwNJwS7YSyWzvYALbVqZwusSBoP5m5rYJxiw9kps4CHe86IQ fEEvsbV4L2rMFGhhLlXZ+7V7zPGxTsdehHbGPOp8xrpDHXrN85bOzf239KILFxtBts0p08uMA9Q oTokxg1TdhKrr/T1VsPm1LRGHO9yzjjWF7p0JGNIARp+yqKA8+B8T0Ixir57CJoNGVpnLlGGeJb k7di7BPvUwzNJBSmSmVjObnd9zejGXpimSAsq4j54N1eMNJT1gXaaVIhG9qZeMEWtv9hreR4+6q 5ElpfyJMTTmq5K2uTlhhZs1UAIP8QviUslA75Fm0kMOUkoskyL3fClLoh7JKo+/JKxFfHtNKU2X JPiu7gO0BdNLk7S3omw== X-Proofpoint-ORIG-GUID: QN6pNaNfjesTmT4LaGn5a3kgrpjnWU-t X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939314221158500 Content-Type: text/plain; charset="utf-8" Add IPIB flags to IPL Parameter Block to determine if IPL needs to perform securely and if IPL Information Report Block (IIRB) exists. Move DIAG308 flags to a separated header file and add flags for secure IPL. Move IPLB length related definitions to include/hw/s390x/ipl/qipl.h and add a maximum length constant to support secure IPL. Secure boot in audit mode will perform if certificate(s) exist in the key store. IIRB will exist and results of verification will be stored in IIRB. To ensure proper alignment of the IIRB and prevent overlap, set iplb->len to the maximum length of the IPLB, allowing alignment constraints to be determined based on its size. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- hw/s390x/ipl.c | 21 +++++++++++++++++++++ hw/s390x/ipl.h | 24 ------------------------ include/hw/s390x/ipl/diag308.h | 34 ++++++++++++++++++++++++++++++++++ include/hw/s390x/ipl/qipl.h | 13 ++++++++++++- 4 files changed, 67 insertions(+), 25 deletions(-) create mode 100644 include/hw/s390x/ipl/diag308.h diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 09c24203c7..9cb41511e8 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -461,6 +461,13 @@ S390IPLCertificateStore *s390_ipl_get_certificate_stor= e(void) return &ipl->cert_store; } =20 +static bool s390_has_certificate(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return ipl->cert_store.count > 0; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -517,6 +524,20 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + /* + * Secure boot in audit mode will perform + * if certificate(s) exist in the key store. + * + * IPL Information Report Block (IIRB) will exist + * for secure boot in audit mode. + * + * Results of secure boot will be stored in IIRB. + */ + if (s390_has_certificate()) { + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); + } + return true; } =20 diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index f5a49a4431..9807ef18f2 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -23,7 +23,6 @@ #include "qom/object.h" #include "target/s390x/kvm/pv.h" =20 -#define DIAG308_FLAGS_LP_VALID 0x80 #define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex= */ =20 void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp); @@ -90,29 +89,6 @@ struct S390IPLState { }; QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wr= ong"); =20 -#define DIAG_308_RC_OK 0x0001 -#define DIAG_308_RC_NO_CONF 0x0102 -#define DIAG_308_RC_INVALID 0x0402 -#define DIAG_308_RC_NO_PV_CONF 0x0902 -#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 - -#define DIAG308_RESET_MOD_CLR 0 -#define DIAG308_RESET_LOAD_NORM 1 -#define DIAG308_LOAD_CLEAR 3 -#define DIAG308_LOAD_NORMAL_DUMP 4 -#define DIAG308_SET 5 -#define DIAG308_STORE 6 -#define DIAG308_PV_SET 8 -#define DIAG308_PV_STORE 9 -#define DIAG308_PV_START 10 - -#define S390_IPLB_HEADER_LEN 8 -#define S390_IPLB_MIN_PV_LEN 148 -#define S390_IPLB_MIN_CCW_LEN 200 -#define S390_IPLB_MIN_FCP_LEN 384 -#define S390_IPLB_MIN_PCI_LEN 376 -#define S390_IPLB_MIN_QEMU_SCSI_LEN 200 - static inline bool iplb_valid_len(IplParameterBlock *iplb) { return be32_to_cpu(iplb->len) <=3D sizeof(IplParameterBlock); diff --git a/include/hw/s390x/ipl/diag308.h b/include/hw/s390x/ipl/diag308.h new file mode 100644 index 0000000000..6e62f29215 --- /dev/null +++ b/include/hw/s390x/ipl/diag308.h @@ -0,0 +1,34 @@ +/* + * S/390 DIAGNOSE 308 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG308_H +#define S390X_DIAG308_H + +#define DIAG_308_RC_OK 0x0001 +#define DIAG_308_RC_NO_CONF 0x0102 +#define DIAG_308_RC_INVALID 0x0402 +#define DIAG_308_RC_NO_PV_CONF 0x0902 +#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 + +#define DIAG308_RESET_MOD_CLR 0 +#define DIAG308_RESET_LOAD_NORM 1 +#define DIAG308_LOAD_CLEAR 3 +#define DIAG308_LOAD_NORMAL_DUMP 4 +#define DIAG308_SET 5 +#define DIAG308_STORE 6 +#define DIAG308_PV_SET 8 +#define DIAG308_PV_STORE 9 +#define DIAG308_PV_START 10 + +#define DIAG308_FLAGS_LP_VALID 0x80 + +#define DIAG308_IPIB_FLAGS_SIPL 0x40 +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 + +#endif diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 9940f1457c..a2180719b1 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -12,6 +12,8 @@ #ifndef S390X_QIPL_H #define S390X_QIPL_H =20 +#include "diag308.h" + /* Boot Menu flags */ #define QIPL_FLAG_BM_OPTS_CMD 0x80 #define QIPL_FLAG_BM_OPTS_ZIPL 0x40 @@ -31,6 +33,14 @@ typedef enum S390IplType S390IplType; =20 #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 +#define S390_IPLB_HEADER_LEN 8 +#define S390_IPLB_MIN_PV_LEN 148 +#define S390_IPLB_MIN_CCW_LEN 200 +#define S390_IPLB_MIN_FCP_LEN 384 +#define S390_IPLB_MIN_PCI_LEN 376 +#define S390_IPLB_MIN_QEMU_SCSI_LEN 200 +#define S390_IPLB_MAX_LEN 4096 + #define MAX_CERTIFICATES 64 /* largest supported block size - same as VIRTIO_DASD_DEFAULT_BLOCK_SIZE */ #define VIRTIO_MAX_BLOCK_SIZE 4096 @@ -125,7 +135,8 @@ typedef struct IplBlockPci IplBlockPci; union IplParameterBlock { struct { uint32_t len; - uint8_t reserved0[3]; + uint8_t hdr_flags; + uint8_t reserved0[2]; uint8_t version; uint32_t blk0_len; uint8_t pbt; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939324; cv=none; d=zohomail.com; s=zohoarc; b=GTqYTSBvigdZ22bZEykhHx5JzlyPqrZKgUoHWin//WMiofRDuPdgy/qDEJ5XQ0lnqgahaQjOjDa8188YXsMHSKLIfD7agxbgUmzCHGU6xrafjvvS/W5Cwz6h1+f8jOgkiW6jVnlZ4HXLj5DQDGiSIm8o282nOgJpLcsjCRgjN7A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939324; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/5VeWfYK0Mfp0id+YYxGwHSgH49IgdJXxZd+a2zOPy8=; b=HNEfqNOgF7ySgUVhOa1j8eWIV7HzLEvXd+2Zz80VXTclTuOFd0KgvhQxPT7NudbTM3aNb7pDDF4XsaGIHRVfju4dEW+sNA+r6w7ix2CgqwM2+FHKduhev69lkAoYkh+3dyJo4oz8YOPC9RqYaCjeQBTlQ7/e3Mz307jsLFB5HI8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939324726380.76544109315694; Wed, 1 Jul 2026 13:55:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tA-0003eB-Su; Wed, 01 Jul 2026 16:50:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t7-0003bL-Et; Wed, 01 Jul 2026 16:50:30 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t5-0004Mg-6n; Wed, 01 Jul 2026 16:50:29 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmh3a1594131; Wed, 1 Jul 2026 20:50:23 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6m98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:23 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Kndvi006289; Wed, 1 Jul 2026 20:50:22 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu5n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:22 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoLeD61538608 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:21 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0CCA85804E; Wed, 1 Jul 2026 20:50:21 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 643815803F; Wed, 1 Jul 2026 20:50:18 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:18 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=/5VeWfYK0Mfp0id+Y YxGwHSgH49IgdJXxZd+a2zOPy8=; b=LHNHZBWMzSZUxiUSHdikMnnRzupyeeOY+ QkEEW4bAsljicL0ObOtJm7RweEbO6qlbWB8s164bjBpoaz3doht6HadvJ9zhSd28 8aPpiXaKvXHd9mp/EBUAwD/bBe7rfrfzHzX4FCab1ZXJZGmRz0Qry52I3UxBp//0 yW/2OJhEDuABL4QbXYB96GrVnIPpQ1reJD50KkAcXqYseYoWBp0PUfuIiMSq8xDk FbEPL9th8q5qjBui345oc9cI5exO39HDomFcc4GSxC0q8LHug5n7lWE5r2fqkB7F RloCgGWAdayp1LpuGz21rJfFWOtb2jdrUqOJow1NJbm2PY6pY8qgw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 18/35] hw/s390x/ipl: Rework s390_ipl_map_iplb_chain for certificate storage Date: Wed, 1 Jul 2026 16:49:04 -0400 Message-ID: <20260701204922.1320349-19-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457d8f cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=xj6Z2pgGhtYFzPFpXM4A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX1a9vuriILmqS iRasp5mAiaVWPwFmt5f9fgrxlSFFIMYRKh80uzWuJhdddod5B9RsO7fJjq5SwrMDmCKhvKXULw8 qv3p4+R2eetBQUw0XVr9FuQRwEVen0k= X-Proofpoint-GUID: pSUaGdaAZYYuyefh12FQX6h8WJOddPsD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXwRiwNEfyZOSy 0pqUTjq736iUDarhuxYvw+kfKUPfRiP+osUIdUgGoTpOSVO+kn/wg7tUWcaIoqfGdZmPd5d9Tnd th65NhnLwotRtP+oheIfNurddHzc2lLTcSy6wwjCpNdnJ4HmmcVdYh7qydARhmALYxJjBHPuqef uInXO0l89DjQ3jBCANTwVg9s7JYNKYWUojSJnTHNPj0YTET9xCvtt57Y1nGYqAFYHJnU2Hk+E0n fFK0EgVzNQSc/U8J1qvySnkDKOG2XabSIpwA5ZZxh3UvtOynm3GcA6DnAWVGZaAO7NfunJfTLT1 uMZXjZcnOvmL3jiQpi1T4IaQlq/nxcePUvIZQQ3LtJV4hqVNw5n3/dlKeA2g+6qFlVKmJZQdw0O HwzhawD6DMobqB56O0NxchnYzwQ98ahPACe59INTfB5IIBBvQfy2+/TUrDd7gM9j2YyzP8ldXOw t5GXhjvPdzqOuAfObXA== X-Proofpoint-ORIG-GUID: pSUaGdaAZYYuyefh12FQX6h8WJOddPsD X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939326257158500 Content-Type: text/plain; charset="utf-8" Rework s390_ipl_map_iplb_chain to always allocate maximum memory for the IPLB chain, regardless of the number of boot devices. This space is also used to store certificates during secure boot, providing a safe location for certificates until the kernel reads them during boot. Rename next_iplb to ipl_data to better reflect its multiple purposes: storing both IPLB chains and certificate data. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 13 ++++++++++--- include/hw/s390x/ipl/qipl.h | 2 +- pc-bios/s390-ccw/iplb.h | 4 ++-- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 9cb41511e8..7734b6edc7 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -425,10 +425,9 @@ static S390PCIBusDevice *s390_get_pci_device(DeviceSta= te *dev_st, int *devtype) return pbdev; } =20 -static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain) +static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain, uin= t16_t count) { S390IPLState *ipl =3D get_ipl_device(); - uint16_t count =3D be16_to_cpu(ipl->qipl.chain_len); uint64_t len =3D sizeof(IplParameterBlock) * count; uint64_t chain_addr =3D find_iplb_chain_addr(ipl->bios_start_addr, cou= nt); =20 @@ -629,8 +628,16 @@ static bool s390_init_all_iplbs(S390IPLState *ipl) dev_st =3D get_boot_device(i); s390_build_iplb(dev_st, &iplb_chain[i - 1]); } + } =20 - ipl->qipl.next_iplb =3D cpu_to_be64(s390_ipl_map_iplb_chain(iplb_c= hain)); + /* + * Allocate maximum space for IPLB chain and/or certificate storage. + * Once a valid boot device is found, this space will be used to store + * certificates if secure boot is enabled. + */ + if (iplb_num > 1 || s390_has_certificate()) { + ipl->qipl.ipl_data =3D cpu_to_be64(s390_ipl_map_iplb_chain(iplb_ch= ain, + MAX_BOOT_= DEVS - 1)); } =20 return iplb_num; diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index a2180719b1..2b29dfa8c5 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -61,7 +61,7 @@ struct QemuIplParameters { uint32_t boot_menu_timeout; uint8_t reserved3[2]; uint16_t chain_len; - uint64_t next_iplb; + uint64_t ipl_data; } QEMU_PACKED; typedef struct QemuIplParameters QemuIplParameters; =20 diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index c92a3d0f0c..c807e7f49b 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -61,11 +61,11 @@ static inline bool load_next_iplb(void) } =20 qipl.index++; - next_iplb =3D (IplParameterBlock *) qipl.next_iplb; + next_iplb =3D (IplParameterBlock *) qipl.ipl_data; memcpy(iplb, next_iplb, sizeof(IplParameterBlock)); =20 qipl.chain_len--; - qipl.next_iplb =3D qipl.next_iplb + sizeof(IplParameterBlock); + qipl.ipl_data =3D qipl.ipl_data + sizeof(IplParameterBlock); =20 return true; } --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939088; cv=none; d=zohomail.com; s=zohoarc; b=BF3qhMApUieVHPloIv0qPTOweEZFCzjI4tNBoxtNJHBZM1VCX4AbytgbMAgL/cEXML1hvHBMCtZTVyR/5hBhtkJdNyXmN9H67Q4VhW5mgoMi7Ab36OqEgBCYRdhTAH5K4yGLmfUgsaw7voiEdoa7n3bflJ7U59gRnSa7Om/xn5Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939088; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NAicq5uOLykXnygWzmTg96eZ5hFzE9v0Y9FC2UsYLCY=; b=e2iE66fs7nuK1479ZU48xgjplCzxXUaLA8EgS3gVpVU3kUUxIFVz+2tXgWj4qwIst0x/wdUk2YFR9XU1/gNMqmVzVrfWfUCyOtRSwuOP5cn/3bheAupX3XcSqbqNldrQA88hVYEAm4ua5X9ePJvjCuEqNQtztpKNrFByIz9jYoY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939088081153.6524067832279; Wed, 1 Jul 2026 13:51:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tD-0003nT-L3; Wed, 01 Jul 2026 16:50:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t9-0003cX-DF; Wed, 01 Jul 2026 16:50:31 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1t7-0004NG-If; Wed, 01 Jul 2026 16:50:31 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmoim1339798; Wed, 1 Jul 2026 20:50:26 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa69ya-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:26 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnZBE025906; Wed, 1 Jul 2026 20:50:25 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9kt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:25 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoOuT39387898 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:24 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 005695803F; Wed, 1 Jul 2026 20:50:24 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 580C65804E; Wed, 1 Jul 2026 20:50:21 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:21 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=NAicq5uOLykXnygWz mTg96eZ5hFzE9v0Y9FC2UsYLCY=; b=L5MAJ2HNBuJZaVAEMX7WKgtzdV1lwDDdQ 2KZ24DQ+qdbitt/kRDBwRDRwA51/RoAwXnu6HescbCziIkEyJJRqllDAXvPt3UeY XUdCvsdwcBEmndnV2hkoFU0duq0DXuba+ulEZgsB5k/6N1ZCh7TxOCmP7EBosVan PLqUtlvyIWWkr0yrasT/bTz9GmWZgVML37rgr1hZx5vxUFymT0ktCWv9oq1zAM7v NC13BL/tQx/cSQUiuAYImN5d9uDt48lUoSdd9i9zlVDXiBjLx1UmPBOsKSFD1buX G0igYdnoiUBzqzpOkZJ9v1sJ5KJM4Ys1Hu7ycWNSxURPG9px4x1Uw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 19/35] s390x: Guest support for Secure-IPL Facility Date: Wed, 1 Jul 2026 16:49:05 -0400 Message-ID: <20260701204922.1320349-20-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2L/lUGLQEgOB poWYhHKI+Ymj9NHKt5EMHpLY91ztHfXGY/scbYfkXa4iWQJkCyxUi1ihf1wPnlFpPwDCgxj3cvO 4SBEyCZVLi9Q9iW9RL5Pdi2HHKVyFB5fUI4cP08PGwevaW+bAscZ+nVOahYLSqLtPMojAOYZtDl AkFI5GZbUIq5qmTWYjnj18p3w2uybkEPhumX3O4zKe0g9fDb8W8+Hsazvx7L1K0gZN+nCbnqhZK 9S6quTFMEN+ix8pgWrTKHKM9cShKlEfiSmErVMp4TLYsCS1sGHVJCNOPcspMZM/mp1GycYqnjCF 78QP04RNoByUNk6c6bFNVy8RqbID4knVUOimp70DENjJ74ZuDc43USX6owym1D6SSd9f713gGqs 8jad6ZOpiyktMmYyEtkrEv1P3H38tWsT8SfwDBRlrsLK8g9BNxoP5x65HX8xMRuyDaqsJOOUXRd QZfeFZ+IqCMVeBgTZXQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXx3KscIhUBRRw W+zXfAXmm0jtTX0yaaN8grJxftfvFgX+o+dPV4MZDqgc99OUqmdTUxHJf3ons1JnbI6rDKpThYe II882mcMIQpcBbEGzqIMEZcelhrRn0k= X-Proofpoint-GUID: 0txjtNyXfuFvKQIR0MES1DW3qLWm2GRc X-Proofpoint-ORIG-GUID: 0txjtNyXfuFvKQIR0MES1DW3qLWm2GRc X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457d92 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=Bichc5AjJS213ZhIJUEA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939089024158500 Content-Type: text/plain; charset="utf-8" Introduce Secure-IPL (SIPL) facility. Use fac_ipl to represent bytes 136 and 137 for IPL device facilities of the SCLP Read Info block. Availability of SIPL facility is determined by byte 136 bit 1 of the SCLP Read Info block. Byte 136's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Secure IPL is not available for guests under protected virtualization. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Thomas Huth --- hw/s390x/sclp.c | 2 ++ include/hw/s390x/sclp.h | 4 +++- target/s390x/cpu_features.c | 4 ++++ target/s390x/cpu_features.h | 1 + target/s390x/cpu_features_def.h.inc | 3 +++ target/s390x/cpu_models.c | 2 ++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 3 +++ 8 files changed, 20 insertions(+), 1 deletion(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index b9c3983df1..666bae33f0 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -146,6 +146,8 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb) if (s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB)) { s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC134, &read_info->fac134); + s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC_IPL, + read_info->fac_ipl); } =20 read_info->facilities =3D cpu_to_be64(SCLP_HAS_CPU_INFO | diff --git a/include/hw/s390x/sclp.h b/include/hw/s390x/sclp.h index ddc61f1c21..a9595d8007 100644 --- a/include/hw/s390x/sclp.h +++ b/include/hw/s390x/sclp.h @@ -136,7 +136,9 @@ typedef struct ReadInfo { uint32_t hmfai; uint8_t _reserved7[134 - 128]; /* 128-133 */ uint8_t fac134; - uint8_t _reserved8[144 - 135]; /* 135-143 */ + uint8_t _reserved8; + uint8_t fac_ipl[2]; /* 136-137 */ + uint8_t _reserved9[144 - 138]; /* 138-143 */ struct CPUEntry entries[]; /* * When the Extended-Length SCCB (ELS) feature is enabled the diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 436471f4b4..200bd8c15b 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -119,6 +119,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * Some facilities are not available for CPUs in protected mode: * - All SIE facilities because SIE is not available * - DIAG318 + * - Secure IPL Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -149,6 +150,9 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; + case S390_FEAT_TYPE_SCLP_FAC_IPL: + clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + break; default: return; } diff --git a/target/s390x/cpu_features.h b/target/s390x/cpu_features.h index 5635839d03..b038198555 100644 --- a/target/s390x/cpu_features.h +++ b/target/s390x/cpu_features.h @@ -24,6 +24,7 @@ typedef enum { S390_FEAT_TYPE_SCLP_CONF_CHAR, S390_FEAT_TYPE_SCLP_CONF_CHAR_EXT, S390_FEAT_TYPE_SCLP_FAC134, + S390_FEAT_TYPE_SCLP_FAC_IPL, S390_FEAT_TYPE_SCLP_CPU, S390_FEAT_TYPE_MISC, S390_FEAT_TYPE_PLO, diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index 2976ecd0ee..bcf8a666e4 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -140,6 +140,9 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certificate Store function= s") =20 +/* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ +DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") + /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") DEF_FEAT(SIE_SKEY, "skey", SCLP_CPU, 5, "SIE: Storage-key facility") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 962f135f42..a52e34aa95 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -263,6 +263,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_CMMA: case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: + case S390_FEAT_SIPL: case S390_FEAT_CONFIGURATION_TOPOLOGY: return false; break; @@ -507,6 +508,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index 6c20c3a862..bd2060ab93 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -721,6 +721,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP, S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -922,6 +923,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_PRNO_TRNG, S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 56795837f5..61ac6c84a0 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2501,6 +2501,9 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 set_bit(S390_FEAT_CERT_STORE, model->features); =20 + /* Some Secure IPL facilities are emulated by QEMU */ + set_bit(S390_FEAT_SIPL, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939095; cv=none; d=zohomail.com; s=zohoarc; b=HyFIEpQ1ybm2tLrUPhSHapmZXipioE4FZtE33MWe4r4UZfgcKlvti2+vncHIsAU5ckqqx2ok79zXXxHVwtpViwIsMbC3FAkS9ehyIpPgFG7J/h3vhvMdgbENmuYLQ5N2Dh6h23k1rqps8h07o8KapAT4EP9hEUAP+Hg4waAfzHE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939095; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uufRKRXPnebR+lmJi9MWwmsULNyfXmR+saxaraiCqSE=; b=QMMleKrk4/rqY3pgO4TN+SBMJ/hN/c4cLF7oIBOfzpX36EWsnUr7zDAV2eoTy9NmiXdbEiN7LbcahJYC3xugEaGc4iFKrKlyu8chomD62/sg8fQbY4e6g+2sy3DId2uS83KmAxswe4LLTrUbBvHJpcx9jom0l7w0AitiznIshsU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939095703780.3958865619161; Wed, 1 Jul 2026 13:51:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tF-0003rV-3p; Wed, 01 Jul 2026 16:50:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tC-0003lG-S5; Wed, 01 Jul 2026 16:50:35 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tB-0004Ol-1r; Wed, 01 Jul 2026 16:50:34 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmmhd1594169; Wed, 1 Jul 2026 20:50:29 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6m9t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:29 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnotG006698; Wed, 1 Jul 2026 20:50:28 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu69-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:28 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoRJ032047666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:27 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2773C58060; Wed, 1 Jul 2026 20:50:27 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3A9895803F; Wed, 1 Jul 2026 20:50:24 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:24 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=uufRKRXPnebR+lmJi 9MWwmsULNyfXmR+saxaraiCqSE=; b=pbD8Lvl0ViRC+xviPeyq0aHCWmOREwLzn N1krdZXkYd5Ffh/kUonyenro3phkL9Pk7FPPUs5l2lp6YakAryvgdhA0xpp66c0o xsZ0LfF026IyrnnBqgTBnQZf/KRcTru/a8aEJkiMDTQBy/hvsZuSfPiC+e0e+8a/ 9QGipjaoxgalKpQTxUPUKOR9aSgM6uzLJ5y2SDbzCXrBgF4p+ZHiEuTbzqMYw1pG pqEhJhzES36ToOlfQhMT5Lho0XYNSKtuBOnfcsAHdrEcsq3x9Q43hhWtCoFg+avd JddUHaQfiSuSifvQWaNzvCn7XBt+PRFhvziH90SmJyHpA6h/DtBsw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 20/35] pc-bios/s390-ccw: Refactor zipl_run() Date: Wed, 1 Jul 2026 16:49:06 -0400 Message-ID: <20260701204922.1320349-21-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457d95 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=se3WwofzMRKbtILPOyIA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2ts8VCqnptbU sYbTONlSkuqFw7i8GMv/fOXT7T21au1GxnULb2FtIvzaHk+/xDOuAxcQmg7+YxsQ7GVAAFVzczV sHDGLHW8/BSBwnlQUvFtbJjfgHpyLnw= X-Proofpoint-GUID: kJmBLOCzrLgNVqqYx38u2paihB80vvPb X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX+ew8AzuNABCo kMgfSzyF25vMxez134rKmPYqEh3ctnKoH8s9rxnI3S4jp5SwGdoDQ8UlV+gctT/2cadoBQQsibX 1Ut4KMEmMXaAGAjXQMe44swaUwJ0gToUrq1dZFokeAdBrxNEkAbh7kO7jux/FDYTHo0ExpPzIOL nhnTvcPv78Iay5gHQMo51t+aswYYXMP5aJg+w0aj0hRKYs1nr6kDMYpUhuxe/GXmKFtmZnslx9A OdKQc45d4x93UayEeEAu+qKofJec4se41w+VSwmX/z5EvwMpx2IGirqGp2q7hJ8JWeJC8bzdZXL LiKhNW//B/zEhGWKGl94jOr2IOxGZfFZ643MqjTIcNS+cUUAO+N9fvz3ckaml8kwutpgCPt30mt 0ch9xylJQwTfoAJW2xGX+3E/hUC3BNAFfiCzfJWLb2avh0p2qBMq6F8ymoPfVU2ptHnavs/MmGR c2EuPnCN9BBB4S8OEQA== X-Proofpoint-ORIG-GUID: kJmBLOCzrLgNVqqYx38u2paihB80vvPb X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939097041158500 Content-Type: text/plain; charset="utf-8" Refactor to enhance readability before enabling secure IPL in later patches. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Jared Rossi Reviewed-by: Collin Walling --- pc-bios/s390-ccw/bootmap.c | 51 ++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 420ee32eff..b9ba004cfc 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -674,12 +674,42 @@ static int zipl_load_segment(ComponentEntry *entry) return 0; } =20 +static int zipl_run_normal(ComponentEntry **entry_ptr, uint8_t *tmp_sec) +{ + ComponentEntry *entry =3D *entry_ptr; + + while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || + entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + + /* Secure boot is off, so we skip signature entries */ + if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + entry++; + continue; + } + + if (zipl_load_segment(entry)) { + return -1; + } + + entry++; + + if ((uint8_t *)&entry[1] > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + return -EINVAL; + } + } + + *entry_ptr =3D entry; + return 0; +} + /* Run a zipl program */ static int zipl_run(ScsiBlockPtr *pte) { ComponentHeader *header; ComponentEntry *entry; uint8_t tmp_sec[MAX_SECTOR_SIZE]; + int rc; =20 if (virtio_read(pte->blockno, tmp_sec)) { puts("Cannot read header"); @@ -700,25 +730,10 @@ static int zipl_run(ScsiBlockPtr *pte) =20 /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); - while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || - entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - - /* We don't support secure boot yet, so we skip signature entries = */ - if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - entry++; - continue; - } - - if (zipl_load_segment(entry)) { - return -1; - } =20 - entry++; - - if ((uint8_t *)(&entry[1]) > (tmp_sec + MAX_SECTOR_SIZE)) { - puts("Wrong entry value"); - return -EINVAL; - } + rc =3D zipl_run_normal(&entry, tmp_sec); + if (rc) { + return rc; } =20 if (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939142; cv=none; d=zohomail.com; s=zohoarc; b=SoW9Xm3FbiJLPZKxuRngjBeUYkoLs7HANSx/PZa5oAlYCH+xuoZyHVRMDeWGozroGU+yjQA8yYh2BK+VjCvJZ4PATAr2MOAij660f3gujYEa1H2GO2JXesBX5GOyTfNyGuu67wyEl8ZTDC9ApV20kujFn/lrN6FsoAEpQ+o3t1Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939142; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OqlrodHPUlapgVnGa3tsxgVu7CCkob4jaYlnWD+C2lo=; b=PcnTXGZ0dfirsf/5BrlW+wMfnbLPUlnn50VybjXdkS/h8DTB4ox2ZIyB4Ni5N1p0KcmavoHfwCzzAFFFFAvwVET+CNNAGB23w+paOF9sUmGHcd6mk3e4kF8Eh+7qjb0zSFHWidQn3JXbyaUKd5HtpU1VsHYmUyG7LJgHYNNp0Wg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939142420161.68593603179124; Wed, 1 Jul 2026 13:52:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tH-0003uq-Bi; Wed, 01 Jul 2026 16:50:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tF-0003s4-FL; Wed, 01 Jul 2026 16:50:37 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tD-0004Q7-Ua; Wed, 01 Jul 2026 16:50:37 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmxCf1341052; Wed, 1 Jul 2026 20:50:32 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26rf66e0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:32 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnapW001585; Wed, 1 Jul 2026 20:50:31 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7w960e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:31 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoULC27001502 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:30 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 59EAA5803F; Wed, 1 Jul 2026 20:50:30 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5E1FB5804E; Wed, 1 Jul 2026 20:50:27 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:27 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=OqlrodHPUlapgVnGa 3tsxgVu7CCkob4jaYlnWD+C2lo=; b=ZMU7isb7qKrflaNy8glmq6b0yL/9EVQgD lm7ogWAFTP5vTuVju18A9pj0Fhe1HUAYDbxoEYQ109KqM5LomEyyvLSmiwd5Z/jK nEEnke/xG7BGA2lYaO+et0f8VDK5N0VjHb6k736hxqnOVUfHPwOJQLuFOnhmrACT fasKrCT0YxAH5VM+19v45ryofcG66CwlJIDo/W9knKFoRB8mqsNskgDGLkOmjP6T bSyjPi7Sr8rtcXWTgL6QAgTGC6vEy4hMGfwj4r/AJcLE/k44GcM9DXT3kdMm25xt kVZr8fG55NjhJI25lURJMnUT3fzspetEvuxMRVhOGbo0zhcp3eJZA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 21/35] pc-bios/s390-ccw: Rework zipl_load_segment function Date: Wed, 1 Jul 2026 16:49:07 -0400 Message-ID: <20260701204922.1320349-22-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=a4kAM0SF c=1 sm=1 tr=0 ts=6a457d98 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=uL_FI9FW9AP7juJAwn4A:9 X-Proofpoint-ORIG-GUID: OEgu8W-IHtSsSKYCbYDY705cdfSqe74e X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2F0YHhAqEuA4 kilc799HZ5gMqoDfqZm83+32sf3aSuov0mOgs6MkYRy6bNwSmra+lvHqpsFDLCuXmethMCtCL5E 7l5spyBb2WmKTo+vlt7ukRHz1v4k+CYVB2DDLfGtkxM2hbj+6nyIPIhRJdglghcKZ+9PX1bLUql E+WGur/g1VPiIlM9cXUeMHQe4SqVLGmhmKQ4mKINqlwe2JH38XJG0n7RXZD9rR02vuv0gnCtAtI 9UjDZk38nxy0DBcUQY7833zyWtWvF9lLLbeUTmTGFk1azLBVs3NOqMfeUiVuRFfc+hQQT4wSr3p rYd7rm1UA54VfNX0bZdo6NLMT01zcoWJBBtN8g9bvspIYIglFTAO7D6bWUFz8iULGhvyPoQLr5e 5HMFi0QkKoU1iDKB54BN69+Cze85IENadXJh+SuhLTjO1ME9S2S4RuojDcFGrSjPyOEisAVdPX/ 2KGQ0t1RxvD72+tx4mA== X-Proofpoint-GUID: OEgu8W-IHtSsSKYCbYDY705cdfSqe74e X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX8X9DEuWK6nGz SbPmBrEajfh94G+AmcdCT+jeY51h7tpYf+abBVx/ao1Jn9Psk7ffSjusA9Lf30YFEif8ZtR4SB5 hyDfow72+madLFeaJ5eKhFS7dTagQBg= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 priorityscore=1501 adultscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939143290158500 Content-Type: text/plain; charset="utf-8" Change zipl_load_segment() to accept explicit blockno and address parameters instead of ComponentEntry pointer and return segment length. Modify this function to allow the caller to specify a memory address where segment data should be loaded into. seg_len variable is necessary to store the calculated segment length and is used during signature verification. Return the length on success, or a negative return code on failure. Remove static qualifier and add function declaration to bootmap.h to make it accessible to other modules. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- pc-bios/s390-ccw/bootmap.c | 18 ++++++++++-------- pc-bios/s390-ccw/bootmap.h | 2 ++ 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index b9ba004cfc..b19981feb1 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -613,19 +613,19 @@ static int ipl_eckd(void) * IPL a SCSI disk */ =20 -static int zipl_load_segment(ComponentEntry *entry) +/* + * Returns: length of the segment on success, + * negative value on error. + */ +int zipl_load_segment(block_number_t blockno, uint64_t address) { const int max_entries =3D (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr)); ScsiBlockPtr *bprs =3D (void *)sec; const int bprs_size =3D sizeof(sec); - block_number_t blockno; - uint64_t address; int i; char err_msg[] =3D "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ"; char *blk_no =3D &err_msg[30]; /* where to print blockno in (those ZZs= ) */ - - blockno =3D entry->data.blockno; - address =3D entry->compdat.load_addr; + int seg_len =3D 0; =20 debug_print_int("loading segment at block", blockno); debug_print_int("addr", address); @@ -668,10 +668,12 @@ static int zipl_load_segment(ComponentEntry *entry) puts("zIPL load segment failed"); return -EIO; } + + seg_len +=3D bprs->size * (bprs[i].blockct + 1); } } while (blockno); =20 - return 0; + return seg_len; } =20 static int zipl_run_normal(ComponentEntry **entry_ptr, uint8_t *tmp_sec) @@ -687,7 +689,7 @@ static int zipl_run_normal(ComponentEntry **entry_ptr, = uint8_t *tmp_sec) continue; } =20 - if (zipl_load_segment(entry)) { + if (zipl_load_segment(entry->data.blockno, entry->compdat.load_add= r) < 0) { return -1; } =20 diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h index 95943441d3..8d61ac383c 100644 --- a/pc-bios/s390-ccw/bootmap.h +++ b/pc-bios/s390-ccw/bootmap.h @@ -113,6 +113,8 @@ typedef struct ScsiMbr { ScsiBlockPtr pt; /* block pointer to program table */ } __attribute__ ((packed)) ScsiMbr; =20 +int zipl_load_segment(block_number_t blockno, uint64_t address); + #define ZIPL_MAGIC "zIPL" #define ZIPL_MAGIC_EBCDIC "\xa9\xc9\xd7\xd3" #define IPL1_MAGIC "\xc9\xd7\xd3\xf1" /* =3D=3D "IPL1" in EBCDIC */ --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939324; cv=none; d=zohomail.com; s=zohoarc; b=QKqh6FjGdvmXPl3XjNqjZqpcpgoXF7C8q7OupkQvjV5SxCQYThD7P+7kUiXIHuQ6tqWLIlQbEnrwFi3/amFUoMWR1i0rTrMGhkWFuualV02LC4ZzpBl1YmE0oyMVg4x08mhvuIWtsE1w+2gqRcfsEN9tErlowNSuYzVQDddmz9I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939324; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8yCO8HXepI8L6Mfc1F1ks6KgBp51E/YNG/ZXlsH6+xY=; b=GDZ4Q1IPRrL9idCc6hZ2FX9UjWGV0nLUnwRgWTPDQBMrBuqRWX/P0i5oBgkYOGB1LdmqcNKKYc4KuMaq/xloT8cl2jj47FCapT6jNwW1cFDD68yB434KmyzLp/XVXPLLVMVO98E1fFp6gb6gKcEdOGwCP0QyFPI4/wwydlBy6Ds= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939324954186.1833904013173; Wed, 1 Jul 2026 13:55:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tW-0004m8-Aw; Wed, 01 Jul 2026 16:50:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tS-0004au-Bx; Wed, 01 Jul 2026 16:50:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tQ-0004Qt-27; Wed, 01 Jul 2026 16:50:50 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmvrP1456449; Wed, 1 Jul 2026 20:50:35 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q5e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:35 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KneuT006304; Wed, 1 Jul 2026 20:50:34 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu6q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:34 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoXYb24969972 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:33 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 511B45803F; Wed, 1 Jul 2026 20:50:33 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 92A6F5804E; Wed, 1 Jul 2026 20:50:30 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:30 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8yCO8HXepI8L6Mfc1 F1ks6KgBp51E/YNG/ZXlsH6+xY=; b=eFcgEhDNj8tey5ILsIpBxEUE+7JuLXKyV 5XVJQ5Yf0Hk2fzBvn53Ciy5M/MntPX1pnhMs/PLubCCZiRVaSFuB81//cpB/n/kH yC3ZpbX/lPmankvfnSq9lBaUK4yFP4wloxnbI20Fs4kqPD9eTFINF7ZhOUn+cGw/ hxpdDdJsT2pmpGOSVNVAW1NNl1SABu7qJIt0bGdhYnfEXxNlZM37S0SI6Wp59UQV gGsFBBUMbnVzlraFIthyx4YItHZ8exWKCnEWcMFFs3yoDVQo7Qp857/tNWD7EjNI tx8RJ9oJyGNe660F8GEFbe1uU9HwqpMIHe19ME8ZuDdXsbjD6ISCw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 22/35] pc-bios/s390-ccw: Introduce ZiplBootMode enum for IPL mode selection Date: Wed, 1 Jul 2026 16:49:08 -0400 Message-ID: <20260701204922.1320349-23-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: vVNH0qcm9es8rMnDKUJ0evZ1LtMhmTDI X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzcOd1X+V6SqA j7+nwPmuXtR2tlhb/Om9S8WaGutxKuSBtlCMnRBJ7m41kEngyqbw6Lf0U5h2y1TC2ATupUIxlZv LI3iI4PacTGc7MrW7GiO6XM2k/9/81Y= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d9b cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=OEmD_Q5Wy55prwwHBkMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX8A3MX3/YDWph mP5tG/vep0Ij4zxG7HUcHYQJKZvKPknK7GhbSXYX/z5ZedQyp3TKlSsJJhTQObwI9ucCnLYpkRN DwIHok/jQ7Bo/TcxYwRjBpsrcjyxbFK7jSnU3l5MGCRaSPyTBd6mjrVLWzFnasl0nYlzxCryMUT W0NpcPOkaRceIdkeYgzwI8NsSd4JAnKrGke21GVH7gACll5di0egGX5oKL0Mj9s1KUrzuIollE3 WcwaLLmIBZ5Eo47gNVm18wSHwD0WIPhUYtuZftuydYs2nCtHrVhB/eZR10AigmuvyfJofLyOUzs fczExqdpSG6Q14DoaG4tlHzFQhkJYbosccCCFotVdd5bihEzxIaKo3ZIbSBLoxYop4c0MZyp1KI E7fWW3maL6LSn2TXID/fhHliDceljWdWzWwMJcsmpmQSBoYExASQdd9UpNi1F//+UOPhtL5q2Ah Gde8dOmOYEPdrd/dvsQ== X-Proofpoint-ORIG-GUID: vVNH0qcm9es8rMnDKUJ0evZ1LtMhmTDI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939326281158500 Content-Type: text/plain; charset="utf-8" Add ZiplBootMode enumeration to support multiple IPL boot configurations. Boot modes differentiate between normal boot and secure IPL operations, enabled based on boot certificates specified via the boot-certs option. Normal Mode: IPL when no certificates are provided. No signature verification is performed. This prepares for future secure IPL modes requiring signature verification. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- docs/system/s390x/secure-ipl.rst | 21 +++++++++++++++++++++ pc-bios/s390-ccw/bootmap.c | 16 +++++++++++++++- pc-bios/s390-ccw/main.c | 6 ++++++ pc-bios/s390-ccw/s390-ccw.h | 6 ++++++ 4 files changed, 48 insertions(+), 1 deletion(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 88df52ce2f..9d7d33f5ed 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -18,3 +18,24 @@ Note: certificate files must have a .pem extension. .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + + +IPL Modes +--------- + +Multiple IPL modes are available to differentiate between the various IPL +configurations. These modes are mutually exclusive and enabled based on the +``boot-certs`` option on the QEMU command line. + +Normal Mode +^^^^^^^^^^^ + +The absence of certificates will attempt to IPL a guest without secure IPL +operations. No checks are performed, and no warnings/errors are reported. +This is the default mode. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio ... diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index b19981feb1..667a69f80d 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -733,7 +733,14 @@ static int zipl_run(ScsiBlockPtr *pte) /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); =20 - rc =3D zipl_run_normal(&entry, tmp_sec); + switch (boot_mode) { + case ZIPL_BOOT_MODE_NORMAL: + rc =3D zipl_run_normal(&entry, tmp_sec); + break; + default: + panic("Unknown boot mode"); + } + if (rc) { return rc; } @@ -1105,12 +1112,16 @@ void zipl_load(void) VDev *vdev =3D virtio_get_device(); =20 if (vdev->is_cdrom) { + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Secure boot from ISO image is not supported!"); ipl_iso_el_torito(); puts("Failed to IPL this ISO image!"); return; } =20 if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Virtio net boot device does not support secure boot!"= ); netmain(); puts("Failed to IPL from this network!"); return; @@ -1121,6 +1132,9 @@ void zipl_load(void) return; } =20 + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Secure boot with the ECKD scheme is not supported!"); + switch (virtio_get_device_type()) { case VIRTIO_ID_BLOCK: zipl_load_vblk(); diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index b8f836c682..cd3d0776b0 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -30,6 +30,7 @@ IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ +ZiplBootMode boot_mode; =20 #define LOADPARM_PROMPT "PROMPT " #define LOADPARM_EMPTY " " @@ -303,6 +304,9 @@ static void ipl_ccw_device(void) switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Passthrough (vfio) CCW device does not support secure= boot!"); + dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: @@ -390,6 +394,8 @@ void main(void) probe_boot_device(); } =20 + boot_mode =3D ZIPL_BOOT_MODE_NORMAL; + while (have_iplb) { boot_setup(); if (have_iplb && find_boot_device()) { diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 1e1f71775e..5420443ad2 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -69,6 +69,12 @@ int sclp_read(char *str, size_t count); /* bootmap.c */ void zipl_load(void); =20 +typedef enum ZiplBootMode { + ZIPL_BOOT_MODE_NORMAL =3D 0, +} ZiplBootMode; + +extern ZiplBootMode boot_mode; + /* jump2ipl.c */ void write_reset_psw(uint64_t psw); int jump_to_IPL_code(uint64_t address); --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939234; cv=none; d=zohomail.com; s=zohoarc; b=VEDOMfejcLJwsH23LLJnYE6BWCQbnQrw5LInYU0ScvBe0rZSycJElBCSSVppEL48PzwCkb6qpTK4VlZuNizqgQ+DNmLsSo34wGNYsbxMFjUhmfo0iMAusbkGhUV+EuRe4xfClsa+i6FNITw8T6aiK6MmNvDJzgFD+7gn/NW4kKI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939234; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uddd2HeZvsF/rtnIa7crqSumOURBXxgTmLwKvIdwEUo=; b=QF1rPvED9tE3eJMH7aIwW2dmwyi+3CwUacfFdEsSEokNxsobL8I7LNQYuEC8pW3woKW6Dw680skwUktvz68qBi1kwC+eeLc0M959nYlj+//SzitBrM16Ah+4flt6OGrh9zV941jv6ztjTXS0o5cHyzrhsqtnNCCJlQtv3C0P4Ao= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939234463759.5149934054929; Wed, 1 Jul 2026 13:53:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1ts-00065h-9E; Wed, 01 Jul 2026 16:51:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tV-0004mB-GR; Wed, 01 Jul 2026 16:50:54 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tQ-0004RE-Qg; Wed, 01 Jul 2026 16:50:53 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gml391455738; Wed, 1 Jul 2026 20:50:39 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q5j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:38 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnotI006698; Wed, 1 Jul 2026 20:50:38 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu6r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:38 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Ko3Pa16843500 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:03 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 65C895803F; Wed, 1 Jul 2026 20:50:36 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 88E095804E; Wed, 1 Jul 2026 20:50:33 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=uddd2HeZvsF/rtnIa 7crqSumOURBXxgTmLwKvIdwEUo=; b=NBwR2RAnt45yxcrWQ2JQx5ifEBJQQUxyE YzGZcMPz/jgdjBJ/boRpWAMbYud7zLq+G6017FN4ZS7lYLXPY2OUcN6uq576GxpM 8nOKfjXsPx97v6r5/UXqYwKt0/r6Ls4lVR4bzhhsS5Xdn+ywOSqggOm+IEDimnQa iG5ZWAF505H18R4FU9/Cs3zlbAjO3YHisyJ5oXGPelGq1CNcxBLTrqWQu+QvEQSl hlY5N0xUSYgTMf1PqhPMj0RQgVAbGtVyL9RagRV2F55/p3q0yAz+3m22yvtCedsa jMpqpmWTovc2C7T03cVpfrLHZaANlmwWXhgGZiJfFZTp04JMnj2rg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 23/35] pc-bios/s390-ccw: Add signature verification for secure IPL in audit mode Date: Wed, 1 Jul 2026 16:49:09 -0400 Message-ID: <20260701204922.1320349-24-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8aTkZa51ky4ur6PDLfW6gO64tNH1sJFr X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX6v5JUq1AFGnt AtAMpdBBIIaF1PEKY4Mpw+DCbOxPrfVfFVJwfhMu7Zmr8WPb61BL2FcbnmoNMSMTMdi0X10Kb0B 0jO1MCT+ONeE8zaMK0aoClvwY//dD8A= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457d9f cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=3FNzS69ekdRN-UcNs_EA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX3wfPjSHTpjw4 Qr3FOdccmT+H5puwQR+a4Hvju3J4FjMQeCyBiyLKbX9hQyaovVfl3RrB7ApaR3/75FOOgmY9hXF Loeu0JFgpymlN5HqqJf568R+CxNKKE5jQnZM+mQZ1RtIRk3GoYP4DJtWtQEKKDT92cIDsL/QxIX ua9aqngCrnOizrrVfv9XqHACeHYykpTaKXksHJJ+rD8G1H+P6tDwzwWs/wmHKLLdH6mDAx4uYFo URID7jrbx27abIpExVcliFvTAlS8DRYgqGecyW04T7tTpuR+/FzS8Aa+uXfQH8iLladW8sOFY/f qf4EwFuELloNyoybFOxPH+c3zmvV+teYayrW6535k1dfwKs3TdBKfTEqrxWKNzAxrwfBoCJ55W/ /OzeSjjGASBLdCQzQKId2ADpG1ewWhH/qbi0XYgGsNGFHkc7sitoWom/Wi1fOrM1dfDvV6qZZL0 X1K5/yVHTfwH1AZrbTw== X-Proofpoint-ORIG-GUID: 8aTkZa51ky4ur6PDLfW6gO64tNH1sJFr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939235915158500 Content-Type: text/plain; charset="utf-8" Enable secure IPL in audit mode, which performs signature verification, but any error does not terminate the boot process. Only warnings will be logged to the console instead. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities (Secure IPL Facility, Certificate Store Facility and secure IPL extension support). Note: Secure IPL in audit mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai --- docs/system/s390x/secure-ipl.rst | 15 ++ pc-bios/s390-ccw/Makefile | 2 +- pc-bios/s390-ccw/bootmap.c | 27 +++ pc-bios/s390-ccw/bootmap.h | 9 + pc-bios/s390-ccw/jump2ipl.c | 7 + pc-bios/s390-ccw/main.c | 18 +- pc-bios/s390-ccw/s390-ccw.h | 20 ++ pc-bios/s390-ccw/sclp.c | 27 +++ pc-bios/s390-ccw/sclp.h | 6 + pc-bios/s390-ccw/secure-ipl.c | 362 +++++++++++++++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 116 ++++++++++ 11 files changed, 607 insertions(+), 2 deletions(-) create mode 100644 pc-bios/s390-ccw/secure-ipl.c create mode 100644 pc-bios/s390-ccw/secure-ipl.h diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 9d7d33f5ed..cf6ccf5d57 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -39,3 +39,18 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio ... + +Audit Mode +^^^^^^^^^^ + +When the certificate store is populated with at least one certificate +and no additional secure IPL parameters are provided on the command +line, then secure IPL will proceed in "audit mode". All secure IPL +operations will be performed with signature verification errors reported +as non-disruptive warnings. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile index 3e5dfb64d5..2109d16781 100644 --- a/pc-bios/s390-ccw/Makefile +++ b/pc-bios/s390-ccw/Makefile @@ -35,7 +35,7 @@ QEMU_DGFLAGS =3D -MMD -MP -MT $@ -MF $(@D)/$(*F).d =20 OBJECTS =3D start.o main.o bootmap.o jump2ipl.o sclp.o menu.o netmain.o \ virtio.o virtio-net.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o \ - virtio-ccw.o clp.o pci.o virtio-pci.o + virtio-ccw.o clp.o pci.o virtio-pci.o secure-ipl.o =20 SLOF_DIR :=3D $(SRC_PATH)/../../roms/SLOF =20 diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 667a69f80d..1147124bd7 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -10,11 +10,13 @@ =20 #include #include +#include #include "s390-ccw.h" #include "s390-arch.h" #include "bootmap.h" #include "virtio.h" #include "bswap.h" +#include "secure-ipl.h" =20 #ifdef DEBUG /* #define DEBUG_FALLBACK */ @@ -711,6 +713,9 @@ static int zipl_run(ScsiBlockPtr *pte) ComponentHeader *header; ComponentEntry *entry; uint8_t tmp_sec[MAX_SECTOR_SIZE]; + IplDeviceComponentList comp_list =3D { 0 }; + IplSignatureCertificateList cert_list =3D { 0 }; + uint8_t *tmp_cert_buf =3D NULL; int rc; =20 if (virtio_read(pte->blockno, tmp_sec)) { @@ -737,6 +742,9 @@ static int zipl_run(ScsiBlockPtr *pte) case ZIPL_BOOT_MODE_NORMAL: rc =3D zipl_run_normal(&entry, tmp_sec); break; + case ZIPL_BOOT_MODE_SECURE_AUDIT: + rc =3D zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &t= mp_cert_buf); + break; default: panic("Unknown boot mode"); } @@ -752,6 +760,13 @@ static int zipl_run(ScsiBlockPtr *pte) =20 /* should not return */ write_reset_psw(entry->compdat.load_psw); + + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + update_cert_list(&cert_list); + update_iirb(&comp_list, &cert_list); + free(tmp_cert_buf); + } + jump_to_IPL_code(0); return -1; } @@ -1107,6 +1122,18 @@ static int zipl_load_vscsi(void) * IPL starts here */ =20 +ZiplBootMode get_boot_mode(uint8_t hdr_flags) +{ + bool sipl_set =3D hdr_flags & DIAG308_IPIB_FLAGS_SIPL; + bool iplir_set =3D hdr_flags & DIAG308_IPIB_FLAGS_IPLIR; + + if (!sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE_AUDIT; + } + + return ZIPL_BOOT_MODE_NORMAL; +} + void zipl_load(void) { VDev *vdev =3D virtio_get_device(); diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h index 8d61ac383c..1e00454a1f 100644 --- a/pc-bios/s390-ccw/bootmap.h +++ b/pc-bios/s390-ccw/bootmap.h @@ -88,9 +88,18 @@ typedef struct BootMapTable { BootMapPointer entry[]; } __attribute__ ((packed)) BootMapTable; =20 +#define DER_SIGNATURE_FORMAT 1 + +typedef struct SignatureInformation { + uint8_t format; + uint8_t reserved[3]; + uint32_t sig_len; +} SignatureInformation; + typedef union ComponentEntryData { uint64_t load_psw; uint64_t load_addr; + SignatureInformation sig_info; } ComponentEntryData; =20 typedef struct ComponentEntry { diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c index fa2ca5cbe1..8e87c566f9 100644 --- a/pc-bios/s390-ccw/jump2ipl.c +++ b/pc-bios/s390-ccw/jump2ipl.c @@ -75,6 +75,13 @@ int jump_to_IPL_code(uint64_t address) "diag %%r1,%%r1,0x308\n\t" : : : "1", "memory"); puts("IPL code jump failed"); + + /* + * A failed jump only occurs in extreme conditions, so abort the IPL e= ntirely. + * This also prevents attempts to boot from the chain area if it has b= een + * overwritten with component data. + */ + qipl.chain_len =3D 0; return -1; } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index cd3d0776b0..7484429c9a 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -20,6 +20,7 @@ #include "dasd-ipl.h" #include "clp.h" #include "virtio-pci.h" +#include "secure-ipl.h" =20 static SubChannelId blk_schid =3D { .one =3D 1 }; static char loadparm_str[LOADPARM_LEN + 1]; @@ -383,6 +384,8 @@ static void probe_boot_device(void) =20 void main(void) { + int vcssb_len; + iplb =3D &ipl_blocks.iplb; =20 copy_qipl(); @@ -394,7 +397,20 @@ void main(void) probe_boot_device(); } =20 - boot_mode =3D ZIPL_BOOT_MODE_NORMAL; + boot_mode =3D get_boot_mode(iplb->hdr_flags); + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + if (!secure_ipl_supported()) { + panic("Unable to boot in audit mode"); + } + + vcssb_len =3D zipl_secure_get_vcssb(); + if (vcssb_len =3D=3D 0) { + panic("Failed to query certificate storage information!"); + } + default: + break; + } =20 while (have_iplb) { boot_setup(); diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 5420443ad2..ca2737054d 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -40,6 +40,22 @@ typedef unsigned long long u64; ((b) =3D=3D 0 ? (a) : (MIN(a, b)))) #endif =20 +/* + * Round number down to multiple. Requires that d be a power of 2. + * Works even if d is a smaller type than n. + */ +#ifndef ROUND_DOWN +#define ROUND_DOWN(n, d) ((n) & -(0 ? (n) : (d))) +#endif + +/* + * Round number up to multiple. Requires that d be a power of 2. + * Works even if d is a smaller type than n. + */ +#ifndef ROUND_UP +#define ROUND_UP(n, d) ROUND_DOWN((n) + (d) - 1, (d)) +#endif + #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0])) =20 #include "cio.h" @@ -64,6 +80,8 @@ void sclp_print(const char *string); void sclp_set_write_mask(uint32_t receive_mask, uint32_t send_mask); void sclp_setup(void); void sclp_get_loadparm_ascii(char *loadparm); +bool sclp_is_diag320_on(void); +bool sclp_is_fac_ipl_flag_on(uint16_t fac_ipl_flag); int sclp_read(char *str, size_t count); =20 /* bootmap.c */ @@ -71,9 +89,11 @@ void zipl_load(void); =20 typedef enum ZiplBootMode { ZIPL_BOOT_MODE_NORMAL =3D 0, + ZIPL_BOOT_MODE_SECURE_AUDIT =3D 1, } ZiplBootMode; =20 extern ZiplBootMode boot_mode; +ZiplBootMode get_boot_mode(uint8_t hdr_flags); =20 /* jump2ipl.c */ void write_reset_psw(uint64_t psw); diff --git a/pc-bios/s390-ccw/sclp.c b/pc-bios/s390-ccw/sclp.c index 4a07de018d..48bdfedf1f 100644 --- a/pc-bios/s390-ccw/sclp.c +++ b/pc-bios/s390-ccw/sclp.c @@ -113,6 +113,33 @@ void sclp_get_loadparm_ascii(char *loadparm) } } =20 +bool sclp_is_diag320_on(void) +{ + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + return sccb->fac134 & SCCB_FAC134_DIAG320_BIT; + } + + return 0; +} + +/* check if specified IPL facility flag is enabled */ +bool sclp_is_fac_ipl_flag_on(uint16_t fac_ipl_flag) +{ + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + return sccb->fac_ipl & fac_ipl_flag; + } + + return 0; +} + int sclp_read(char *str, size_t count) { ReadEventData *sccb =3D (void *)_sccb; diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index 64b53cad29..a8a41cd004 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -50,6 +50,8 @@ typedef struct SCCBHeader { } __attribute__((packed)) SCCBHeader; =20 #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) +#define SCCB_FAC134_DIAG320_BIT 0x4 +#define SCCB_FAC_IPL_SIPL_BIT 0x4000 =20 typedef struct ReadInfo { SCCBHeader h; @@ -57,6 +59,10 @@ typedef struct ReadInfo { uint8_t rnsize; uint8_t reserved[13]; uint8_t loadparm[LOADPARM_LEN]; + uint8_t reserved1[102]; + uint8_t fac134; + uint8_t reserved2; + uint16_t fac_ipl; } __attribute__((packed)) ReadInfo; =20 typedef struct SCCB { diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c new file mode 100644 index 0000000000..2d9a4cbc02 --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -0,0 +1,362 @@ +/* + * S/390 Secure IPL + * + * Functions to support IPL in secure boot mode (DIAG 320, DIAG 508, + * signature verification, and certificate handling). + * + * For secure IPL overview: docs/system/s390x/secure-ipl.rst + * For secure IPL technical: docs/specs/s390x-secure-ipl.rst + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include +#include +#include "s390-ccw.h" +#include "sclp.h" +#include "secure-ipl.h" + +static VCStorageSizeBlock vcssb __attribute__((__aligned__(8))); + +#define for_each_rb_entry(entry, list) \ + for (entry =3D (void *)(list) + sizeof((list)->ipl_info_header); \ + (void *)(entry) + sizeof(*(entry)) <=3D \ + (void *)(list) + (list)->ipl_info_header.len; \ + entry++) + +int zipl_secure_get_vcssb(void) +{ + /* avoid retrieving vcssb multiple times */ + if (vcssb.length =3D=3D VCSSB_LEN_VALID) { + goto out; + } + + vcssb.length =3D VCSSB_LEN_VALID; + if (_diag320(&vcssb, DIAG_320_SUBC_QUERY_VCSI) !=3D DIAG_320_RC_OK) { + vcssb.length =3D 0; + } + +out: + return vcssb.length; +} + +static uint32_t request_certificate(uint8_t *cert_buf, uint8_t index) +{ + VCEntryHeader *vce_hdr; + struct vcb { + VCBlockHeader vcb_hdr; + struct vce { + VCEntryHeader vce_hdr; + uint8_t cert_buf[CERT_BUF_MAX_LEN]; + } vce; + } __attribute__((__aligned__(PAGE_SIZE))) vcb =3D { 0 }; + + /* + * Request single entry + * Fill input fields of single-entry VCB + * + * First and last index must be equal because only one + * VCE per VCB is currently supported + */ + vcb.vcb_hdr.in_len =3D ROUND_UP(vcssb.max_single_vcb_len, PAGE_SIZE); + vcb.vcb_hdr.first_vc_index =3D index; + vcb.vcb_hdr.last_vc_index =3D index; + + if (_diag320(&vcb, DIAG_320_SUBC_STORE_VC) !=3D DIAG_320_RC_OK) { + puts("Could not get certificate"); + return 0; + } + + if (vcb.vcb_hdr.out_len =3D=3D sizeof(VCBlockHeader)) { + puts("No certificate entry"); + return 0; + } + + if (vcb.vcb_hdr.remain_ct !=3D 0) { + panic("Not enough memory to store requested certificate"); + } + + vce_hdr =3D &vcb.vce.vce_hdr; + if (!(vce_hdr->flags & DIAG_320_VCE_FLAGS_VALID)) { + puts("Invalid certificate"); + return 0; + } + + memcpy(cert_buf, (uint8_t *)&vcb.vce + vce_hdr->cert_offset, vce_hdr->= cert_len); + + return vce_hdr->cert_len; +} + +static int cert_list_add(IplSignatureCertificateList *cert_list, + IplSignatureCertificateEntry cert_entry) +{ + int cert_entry_idx; + + cert_entry_idx =3D (cert_list->ipl_info_header.len - sizeof(IplInfoBlo= ckHeader)) / + sizeof(IplSignatureCertificateEntry); + + cert_list->cert_entries[cert_entry_idx] =3D cert_entry; + cert_list->ipl_info_header.len +=3D sizeof(IplSignatureCertificateEntr= y); + + return cert_entry_idx; +} + +static void comp_list_add(IplDeviceComponentList *comp_list, + IplDeviceComponentEntry comp_entry) +{ + int comp_entry_idx; + + comp_entry_idx =3D (comp_list->ipl_info_header.len - sizeof(IplInfoBlo= ckHeader)) / + sizeof(IplDeviceComponentEntry); + if (comp_entry_idx > MAX_COMP_ENTRIES - 1) { + printf("Warning: only %d component entries are supported\n", + MAX_COMP_ENTRIES); + panic("The device component list has reached its maximum capacity"= ); + } + + comp_list->device_entries[comp_entry_idx] =3D comp_entry; + comp_list->ipl_info_header.len +=3D sizeof(IplDeviceComponentEntry); +} + +void update_iirb(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list) +{ + IplInfoReportBlock *iirb; + IplDeviceComponentList *iirb_comps; + IplSignatureCertificateList *iirb_certs; + uint32_t iirb_hdr_len; + uint32_t comps_len; + uint32_t certs_len; + + if (iplb->len % 8 !=3D 0) { + panic("IPL parameter block length field value is not multiple of 8= bytes"); + } + + iirb_hdr_len =3D sizeof(IplInfoReportBlockHeader); + comps_len =3D comp_list->ipl_info_header.len; + certs_len =3D cert_list->ipl_info_header.len; + if ((comps_len + certs_len + iirb_hdr_len) > sizeof(IplInfoReportBlock= )) { + panic("Not enough space to hold all components and certificates in= IIRB"); + } + + /* IIRB immediately follows IPLB */ + iirb =3D &ipl_blocks.iirb; + iirb->hdr.len =3D iirb_hdr_len; + + /* Copy IPL device component list after IIRB Header */ + iirb_comps =3D (IplDeviceComponentList *) iirb->info_blks; + memcpy(iirb_comps, comp_list, comps_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D comps_len; + + /* Copy IPL sig cert list after IPL device component list */ + iirb_certs =3D (IplSignatureCertificateList *) (iirb->info_blks + + iirb_comps->ipl_info_hea= der.len); + memcpy(iirb_certs, cert_list, certs_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D certs_len; +} + +bool secure_ipl_supported(void) +{ + if (!sclp_is_fac_ipl_flag_on(SCCB_FAC_IPL_SIPL_BIT)) { + puts("Secure IPL Facility is not supported by the hypervisor!"); + return false; + } + + if (!is_signature_verif_supported()) { + puts("Secure IPL extensions are not supported by the hypervisor!"); + return false; + } + + if (!is_cert_store_facility_supported()) { + puts("Certificate Store Facility is not supported by the hyperviso= r!"); + return false; + } + + return true; +} + +static void init_lists(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list) +{ + comp_list->ipl_info_header.type =3D IPL_INFO_BLOCK_TYPE_COMPONENTS; + comp_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); + + cert_list->ipl_info_header.type =3D IPL_INFO_BLOCK_TYPE_CERTIFICATES; + cert_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); +} + +static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) +{ + if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { + puts("Signature is not in DER format"); + return -1; + } + + if (zipl_load_segment(entry->data.blockno, sig) < 0) { + return -1; + } + + return entry->compdat.sig_info.sig_len; +} + +void update_cert_list(IplSignatureCertificateList *cert_list) +{ + IplSignatureCertificateEntry *cert_entry; + uint8_t *cert_buf; + + cert_buf =3D (uint8_t *)qipl.ipl_data; + + for_each_rb_entry(cert_entry, cert_list) { + memcpy(cert_buf, (uint8_t *)cert_entry->addr, cert_entry->len); + cert_entry->addr =3D (uint64_t)cert_buf; + cert_buf +=3D cert_entry->len; + } +} + +int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t *tmp_sec, + IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list, + uint8_t **tmp_cert_buf) +{ + /* + * Keep track of which certificate store indices correspond to the + * certificate data entries within the IplSignatureCertificateList to + * prevent allocating space for the same certificate multiple times. + * + * The array index corresponds to the certificate's cert-store index. + * + * The array value corresponds to the certificate's entry within the + * IplSignatureCertificateList (with a value of -1 denoting no entry + * exists for the certificate). + */ + int cert_list_table[vcssb.total_vc_ct + 1]; + IplSignatureCertificateEntry sig_entry =3D { 0 }; + IplSignatureCertificateEntry cert_entry; + IplDeviceComponentEntry comp_entry; + ComponentEntry *entry =3D *entry_ptr; + int rc =3D -1; + int sig_len =3D 0; + int comp_len; + int cert_entry_idx; + uint64_t comp_addr; + uint8_t cert_table_idx; + uint8_t *tmp_buf; + bool verified; + bool signed_found =3D false; + + if ((MAX_SIGNED_COMP * CERT_BUF_MAX_LEN) > (CERT_BUF_SIZE)) { + panic("Not enough memory to store certificates"); + } + *tmp_cert_buf =3D malloc(CERT_BUF_SIZE); + tmp_buf =3D *tmp_cert_buf; + + init_lists(comp_list, cert_list); + sig_entry.addr =3D (uint64_t)malloc(MAX_SECTOR_SIZE); + memset(cert_list_table, -1, sizeof(cert_list_table)); + + while (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { + switch (entry->component_type) { + case ZIPL_COMP_ENTRY_SIGNATURE: + if (sig_entry.len) { + goto error; + } + + sig_len =3D zipl_load_signature(entry, sig_entry.addr); + if (sig_len < 0) { + goto error; + } + + sig_entry.len =3D sig_len; + break; + case ZIPL_COMP_ENTRY_LOAD: + comp_addr =3D entry->compdat.load_addr; + comp_len =3D zipl_load_segment(entry->data.blockno, comp_addr); + if (comp_len < 0) { + goto error; + } + + comp_entry =3D (IplDeviceComponentEntry){ 0 }; + comp_entry.addr =3D comp_addr; + comp_entry.len =3D (uint64_t)comp_len; + + /* no signature present (unsigned component) */ + if (!sig_entry.len) { + comp_list_add(comp_list, comp_entry); + break; + } + + /* + * Initialize with SC flag (signed component) + * CSV flag set upon successful verification + */ + comp_entry.flags =3D S390_IPL_DEV_COMP_FLAG_SC; + signed_found =3D true; + + cert_entry =3D (IplSignatureCertificateEntry) { 0 }; + verified =3D verify_signature(comp_entry, sig_entry, + &cert_entry.len, &cert_table_idx); + + if (verified) { + if (cert_list_table[cert_table_idx] =3D=3D -1) { + if (!request_certificate(tmp_buf, cert_table_idx)) { + puts("Could not get certificate"); + goto error; + } + + cert_entry.addr =3D (uint64_t)tmp_buf; + cert_entry_idx =3D cert_list_add(cert_list, cert_entry= ); + /* map cert-store index to cert-list entry index */ + cert_list_table[cert_table_idx] =3D cert_entry_idx; + /* increment for the next certificate */ + tmp_buf +=3D cert_entry.len; + } + + comp_entry.cert_index =3D cert_list_table[cert_table_idx]; + comp_entry.flags |=3D S390_IPL_DEV_COMP_FLAG_CSV; + puts("Verified component"); + } else { + zipl_secure_error("Could not verify component"); + } + + comp_list_add(comp_list, comp_entry); + + /* After a signature is used another new one can be accepted */ + sig_entry.len =3D 0; + break; + default: + puts("Unknown component entry type"); + goto error; + } + + entry++; + + if ((uint8_t *)(&entry[1]) > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + rc =3D -EINVAL; + goto error; + } + } + + if (!signed_found) { + zipl_secure_error("Secure boot is on, but components are not signe= d"); + } + + *entry_ptr =3D entry; + free((void *)sig_entry.addr); + + return 0; +error: + free(*tmp_cert_buf); + *tmp_cert_buf =3D NULL; + free((void *)sig_entry.addr); + + return rc; +} diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h new file mode 100644 index 0000000000..d5d6d6f7ac --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -0,0 +1,116 @@ +/* + * S/390 Secure IPL + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef _PC_BIOS_S390_CCW_SECURE_IPL_H +#define _PC_BIOS_S390_CCW_SECURE_IPL_H + +#include "bootmap.h" +#include +#include + +#define MAX_SIGNED_COMP 3 +#define CERT_BUF_SIZE (7 * PAGE_SIZE) + +int zipl_secure_get_vcssb(void); +bool secure_ipl_supported(void); +void update_iirb(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list); +void update_cert_list(IplSignatureCertificateList *cert_list); +int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t *tmp_sec, + IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list, + uint8_t **tmp_cert_buf); + +static inline void zipl_secure_error(const char *message) +{ + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + printf("AUDIT MODE WARNING: %s\n", message); + break; + default: + break; + } +} + +static inline uint64_t _diag320(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x320\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_cert_store_facility_supported(void) +{ + uint32_t d320_ism; + + if (!sclp_is_diag320_on()) { + return false; + } + + if (_diag320(&d320_ism, DIAG_320_SUBC_QUERY_ISM) !=3D DIAG_320_RC_OK) { + return false; + } + + return d320_ism & (DIAG_320_ISM_QUERY_VCSI | DIAG_320_ISM_STORE_VC); +} + +static inline uint64_t _diag508(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x508\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_signature_verif_supported(void) +{ + uint64_t d508_subcodes; + + d508_subcodes =3D _diag508(NULL, DIAG_508_SUBC_QUERY_SUBC); + return d508_subcodes & DIAG_508_SUBC_SIG_VERIF; +} + +static inline bool verify_signature(IplDeviceComponentEntry comp_entry, + IplSignatureCertificateEntry sig_entry, + uint64_t *cert_len, uint8_t *cert_idx) +{ + Diag508SigVerifBlock svb; + + svb.length =3D sizeof(Diag508SigVerifBlock); + svb.version =3D 0; + svb.comp_len =3D comp_entry.len; + svb.comp_addr =3D comp_entry.addr; + svb.sig_len =3D sig_entry.len; + svb.sig_addr =3D sig_entry.addr; + + if (_diag508(&svb, DIAG_508_SUBC_SIG_VERIF) =3D=3D DIAG_508_RC_OK) { + *cert_len =3D svb.cert_len; + /* + * DIAG 508 utilizes an index origin of 0 when indexing the cert s= tore. + * The cert_idx will be used for DIAG 320 data structures, which e= xpects + * an index origin of 1. Account for the offset here so it's easie= r to + * manage later. + */ + *cert_idx =3D svb.cert_store_index + 1; + return true; + } + + return false; +} + +#endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */ --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939315; cv=none; d=zohomail.com; s=zohoarc; b=EWf+vwPLyBEKgbFLQgRSsgFwOsuCjytN2VOeymqqDhdMwdO2FUpyraEr+ORl7ZUpt2gwl3RPs3LViJEpUJAwta5dSi8nGCXz4XIVNlwPy8iQXeHd3SPviTC4HUR6rwMVEMpEcnE0YRSb8/TW+B8icEKlQGGPxWkvdAPcFDCNebQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939315; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=E4b5bfHOQyFhTmYYtysCz81a9z7yS3ZdV6/IvgNVOmA=; b=fGtkYnrAG2bWzVYuYZS8/a6w4rxNuxogdu2CBfailuTzqW6MnK8sn8BQapXamTaiUCLNVvc9jF+Zf+0WUolPVwpLYm5vlyy9+WIYQjg9aLL+pgZ86Nehh01jkBYF6sonCTaGPWCXNuK1U6uLOShVGFC14oZ6SmbMIxJ+8R13IGI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939315305606.0675218014195; Wed, 1 Jul 2026 13:55:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tn-0005Rb-1Y; Wed, 01 Jul 2026 16:51:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tT-0004ie-RU; Wed, 01 Jul 2026 16:50:52 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tQ-0004R4-RE; Wed, 01 Jul 2026 16:50:51 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmfKx1339697; Wed, 1 Jul 2026 20:50:41 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa69yx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:41 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knbjv001596; Wed, 1 Jul 2026 20:50:40 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7w9611-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:40 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KodOs17957518 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:39 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3285258060; Wed, 1 Jul 2026 20:50:39 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D7695803F; Wed, 1 Jul 2026 20:50:36 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:36 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=E4b5bfHOQyFhTmYYt ysCz81a9z7yS3ZdV6/IvgNVOmA=; b=qxQIKqU6IKXQ2ljtKQXy9gMrvyxLHaf0V QdYQS/bVT332frLhmRkb6YH8cial3HuSvXAOTD2WBe46KcWQmslPnTFakrLbKuXQ Ft+75R0B1AwuFBP2anb9jPzDJJhQkWR3mDrjnfPnI0vPe26iAX2NCmwU+0OuRLsP P78YpgNBX5cXP2/tsLkiEWcZEGV6KdMKza9HjuSndyR4nzjX0VEH8yY03pRRt4TI V/O4DMF9gk+c0pyTn1grKrMOJbl+1N6s8I2Hfp09j9+iQD1Qlw2gegfhFeuy6suP QijXpCdvFWtoLBJqHT8Ax68UyfaPECUuHvTQHyOaUCs1/TR/b4z1Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 24/35] pc-bios/s390-ccw: Add signed component address overlap checks Date: Wed, 1 Jul 2026 16:49:10 -0400 Message-ID: <20260701204922.1320349-25-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX322mlSKm7lwq ooUCUxV1z8Xm/5TVNl0q8yfd7XJygwrV8yNuPrspR8a6NDxuys7ipsxVdIWkRXJUrFPXD3EiLJo Ud9WxsTghZ6+Pe5blabyrvFWZbjgzphCVwgsPf1DO1VPCKgQA+OVQeD3AVKRw6TBBDYtMZxqsbh NZjpwq50QKe8uADUNWYc01N5bgeeImUcMt0M0IobnfVIo+K2ORmod0fzt4o/S+gixY/YSc7t5if 1e+q2mJkg5ob+znMXwMNOA+jjho+ORmKvTH8lK3s0iB765uXG1CCeyVvCMujX2pxj81GVXotv0A lXYoZ+I3An6LIV5p52U3eOvu8VYYgv/xhHjtoxUslQgqNup69hHRf6q7mtRqrxCJrmFa/A/D82L OVCqXxavbXal3fUJ1f/Bw8FhtTRm1YceVATJyzhlCFzN4OWKd12pKjf3xpz/CK3G28HbxvTNhDn LTcu31qL4AxL4F1f0jQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXyU7wRlNmADot FCHmBGhfuRIiQIql3DjM4TLaT+pK9ZvtF3uslwZKTt5D6bv0HUxKSZmx2M6OnnH9v+kQAsIZKlC CXedtdON0Lh9y1wdXlTZbgjkEo8lwiw= X-Proofpoint-GUID: Skm8YSYOAMnHbvDj36wpObo25jMvkUsq X-Proofpoint-ORIG-GUID: Skm8YSYOAMnHbvDj36wpObo25jMvkUsq X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457da1 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=G58Pgg4fZqxeurqYNSYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939316164158500 Content-Type: text/plain; charset="utf-8" Add address range tracking and overlap checks to ensure that no component overlaps with a signed component during secure IPL. Signed-off-by: Zhuoying Cai Reviewed-by: Jared Rossi --- pc-bios/s390-ccw/secure-ipl.c | 19 +++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 6 ++++++ 2 files changed, 25 insertions(+) diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index 2d9a4cbc02..af98881aa5 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -193,6 +193,23 @@ static void init_lists(IplDeviceComponentList *comp_li= st, cert_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); } =20 +static void check_comp_overlap(IplDeviceComponentList *comp_list, + IplDeviceComponentEntry comp_entry) +{ + IplDeviceComponentEntry *comp; + + /* + * Check component's address range does not overlap with any + * signed component's address range. + */ + for_each_rb_entry(comp, comp_list) { + if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC && + intersects(comp->addr, comp->len, comp_entry.addr, comp_entry.= len)) { + zipl_secure_error("Component addresses overlap"); + } + } +} + static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) { if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { @@ -287,6 +304,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t= *tmp_sec, comp_entry.addr =3D comp_addr; comp_entry.len =3D (uint64_t)comp_len; =20 + check_comp_overlap(comp_list, comp_entry); + /* no signature present (unsigned component) */ if (!sig_entry.len) { comp_list_add(comp_list, comp_entry); diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index d5d6d6f7ac..1b1287858b 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -113,4 +113,10 @@ static inline bool verify_signature(IplDeviceComponent= Entry comp_entry, return false; } =20 +static inline bool intersects(uint64_t addr0, uint64_t size0, + uint64_t addr1, uint64_t size1) +{ + return addr0 + size0 > addr1 && addr1 + size1 > addr0; +} + #endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */ --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939288; cv=none; d=zohomail.com; s=zohoarc; b=jJ/wyhH1D0jeUW56NIGoc3PCjp7ALrW14YujIvcFVnnlRMHeEEmG3/d0gYeaw5eUbyYbcSfNLFlA5Bxv/0KhaXX1MamQKBDoy8WcFQyFCRO9bCvpYsQMWfeZEU0cu5KZRxJkbM2i0mRhSrtNCXcpL9vjkFLENoJWtqeg3zjkPCc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939288; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8UYnyA29wNyVPG7g+kerkYgaYEwPFa6KUIjEUfOFgk8=; b=kosfX778QUQ0qYr1E0dVbbZlxibOzJnpxjzh1oa1FSKY/z4dJfI1Z654GEII5qRll7ncQSRrR+RadUkjHe1OyLFuowRUEzImnxBbghCLZA7ynzZAqfrYV+WWz8cbJyR5RsWNjABTrgl7EQWvxe0zAccoQOg1ZK7kXpAl91AhKlM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17829392878080.02231577773989102; Wed, 1 Jul 2026 13:54:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tl-0005DZ-GG; Wed, 01 Jul 2026 16:51:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tU-0004m9-Sf; Wed, 01 Jul 2026 16:50:54 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tS-0004Rz-5Y; Wed, 01 Jul 2026 16:50:52 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmmhe1594169; Wed, 1 Jul 2026 20:50:44 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6maf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:44 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnrVt032095; Wed, 1 Jul 2026 20:50:43 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxv9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:43 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kogc15898822 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:42 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 327F058062; Wed, 1 Jul 2026 20:50:42 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 68EED5803F; Wed, 1 Jul 2026 20:50:39 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:39 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=8UYnyA 29wNyVPG7g+kerkYgaYEwPFa6KUIjEUfOFgk8=; b=To2BYgzqI2KMxS7qbFvtkX ahk9ckZg4mjUW6yMN8gTeAf8CWWGiGQmz8rlTsSs4CY1XOgzQA7Stq7a74CK9D3m 0xaXtBeBGgsqy0fhVlMoPAfq/i63xhnv1cioQpb4ZpoYBGaEikFBLqi+ZH/nZOx9 pCxz5S9JmmNSD/wyDvlVAjPzWUTYNr3CeVRhcKat5Y7Zc2vggEghf86ASi5dUwH9 e0ppWv1CZjIM5+CEB6Bch/RFpOKulQnpC9fKpUXTEHVfU2PKmJRVJ5vFjAaap+AF c1F3kp0OwxvzzJyvDWlQFXlhqSROpMgo9QZKuOZ92bj80KG+H/wfMN1pFVhBt6jg == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 25/35] s390x: Guest support for Secure-IPL Code Loading Attributes Facility (SCLAF) Date: Wed, 1 Jul 2026 16:49:11 -0400 Message-ID: <20260701204922.1320349-26-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457da4 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=s2GHSiDfQs-ooOV4uGMA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX/mKuF+2QIgPE eiEzFa1uSiVCKy4LpG0f642mBwZfXeLon0Nrx3L8PW+jx0KXNSb0yX7CStNHdqjLAdSNmnPceRh kCcb7WqjtUKDDtI7ViIhikEq2EXGZDQ= X-Proofpoint-GUID: wNOnSYsrHdENH1L5cSymeDJy6NxVBFmt X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX/w8VENyR1nyp gSHQN05HmxADq+MPcedD8OFq6hJq6EJGKOxzZLOI8f2GiUpoQpqodpg66+bsEvuV3AKRMzWghCu 8A5CukbRsQMhznGJlsH+uj9jy0/YF9yKe5fCTZZBC40VeZXnNzPaKj01JMg7Jn9mbCRRCYoM+ws 9pj16RgYn4T5mZRyA+ZyHlSm5kCqrCqm/53r19rKhlPXkyXxyiIEte46WhlK2aantTl6+2zGd/6 m/+eOvOyqGNN366zkso6s1vb+65vml7j+UtLR1XAcCZCHh7gXEyU4dxWYyS9086f6Jph5mTgs4y RgVFFk7ORUd4jiHN5CV/L62Fw6XhaDXdUsxsb/zQd9FH9B0DR91Ufz/+gQfbGy+Soxug9iIeDqx ewamMXt5x75VU6L95F+JaaNBAQbDJY5bFFzAxS70g+XY8wleUh9mKTnZpYu3B0YtsovImuk8gGI jEEHg0N+iMOBwLpUqVw== X-Proofpoint-ORIG-GUID: wNOnSYsrHdENH1L5cSymeDJy6NxVBFmt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939290095158500 The secure-IPL-code-loading-attributes facility (SCLAF) provides additional security during secure IPL. Availability of SCLAF is determined by byte 136 bit 3 of the SCLP Read Info block. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 18 ++++++++++++++++++ target/s390x/cpu_features.c | 2 ++ target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 3 +++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 1 + 6 files changed, 27 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index a183d46b61..0f92ff96b9 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -122,3 +122,21 @@ The guest kernel uses the contents in the IIRB for: * Boot logging: reports which components were loaded and verified. * kexec operations: builds the next kernel=E2=80=99s IPL report from the e= xisting one. * Keying: installs IPL certificates into the platform trusted keyring. + +Secure Code Loading Attributes Facility +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The Secure Code Loading Attributes Facility (SCLAF) enhances system securi= ty +during the IPL by enforcing additional verification rules. + +When SCLAF is available, its behavior depends on the IPL mode. It introduc= es +verification of both signed and unsigned components to help ensure that on= ly +authorized code is loaded during the IPL process. Any errors detected by S= CLAF +are reported in the IIRB. + +Unsigned components are restricted to load addresses at or above absolute +storage address ``0x2000``. + +Signed components must include a Secure Code Loading Attribute Block (SCLA= B), +which is appended at the very end of the component. The SCLAB defines secu= rity +attributes for handling the signed code. diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 200bd8c15b..29ea3bfec2 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -120,6 +120,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * - All SIE facilities because SIE is not available * - DIAG318 * - Secure IPL Facility + * - Secure IPL Code Loading Attributes Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -152,6 +153,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC_IPL: clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_SCLAF)->bit, data); break; default: return; diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index bcf8a666e4..f6ba9e87e1 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -142,6 +142,7 @@ DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certifi= cate Store functions") =20 /* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") +DEF_FEAT(SCLAF, "sclaf", SCLP_FAC_IPL, 3, "Secure-IPL-code-loading-attribu= tes facility") =20 /* Features exposed via SCLP CPU info. */ DEF_FEAT(SIE_F2, "sief2", SCLP_CPU, 4, "SIE: interception format 2 (Virtua= l SIE)") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index a52e34aa95..7de727a256 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -264,6 +264,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: case S390_FEAT_SIPL: + case S390_FEAT_SCLAF: case S390_FEAT_CONFIGURATION_TOPOLOGY: return false; break; @@ -509,6 +510,8 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_SIPL }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index bd2060ab93..c3e0c6ceff 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -722,6 +722,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -924,6 +925,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 61ac6c84a0..52bbd560bd 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2503,6 +2503,7 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 /* Some Secure IPL facilities are emulated by QEMU */ set_bit(S390_FEAT_SIPL, model->features); + set_bit(S390_FEAT_SCLAF, model->features); =20 /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939285; cv=none; d=zohomail.com; s=zohoarc; b=bCVl3JZgzudkhNSPCxupc1l4QnYP8xoFEIwgcDsLyv6wJLGzPEcNNoc8xGOrJfwz5gCJqyy+E+JphZ5ZSn6tNUJbrHHlYWV+MBHbmBCUIAh9524p302xpYPsuUW4DA203yWi1/HkcSUIV1UcDjAR1KVfBuJowoNx7RcPhHlwvnA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939285; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zWVlNlAKEneWmso/KUidL1i1XHNd+hhM7am7u104RtE=; b=jHX7BoOKCegUNZkcFj7uX8t79qqzyHpUAIg3n1yYZkeZwVtpEvgRkBYTBzd1KEvFmJn9DoejxsbV6sl+/kckuajkEwU+r8JnHrdmrfyTZqDoMpxXMOwasoAwHPSf5LevGGq8B2/k0RQl16d/5JM9+2G54O8zk0cGQOgyGqn7Jl4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17829392857701019.3965745060733; Wed, 1 Jul 2026 13:54:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tm-0005JX-0u; Wed, 01 Jul 2026 16:51:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tV-0004mA-Db; Wed, 01 Jul 2026 16:50:54 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tS-0004SM-Qs; Wed, 01 Jul 2026 16:50:53 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmiqG1295214; Wed, 1 Jul 2026 20:50:47 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26mjxaec-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:47 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KneKJ027063; Wed, 1 Jul 2026 20:50:46 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2suk92x6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:46 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KojF525363020 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:45 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 28BF45803F; Wed, 1 Jul 2026 20:50:45 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6CCCA5804E; Wed, 1 Jul 2026 20:50:42 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zWVlNlAKEneWmso/K UidL1i1XHNd+hhM7am7u104RtE=; b=mtSXMZrCi6ygoX5846Lh838maIMl+1VNJ KJ7iwRbe0Cc1zWc5p7QHd+B7hj7f68hNt+wwOL74yn+NOPZnPrXCFDimQJ3c9FCk i/mY7YW2uDTklmEUntGRXs1gkhRoDCt9UmEM7JJJHVxdj7nd3tC1EFqx/l2bwVUz VHFb10YqVXMuKo3I7WO/X+1AHNB5AjCLcUcnA8EdICRV67OmEg5LSF9PoDYgmz5L fdTeHUcDC2X3mCCYBGYNlacDGdMVcmFb4C0t/qcon5ipJkaHmyqZhSgk19+BHrQV Kg3ZMrLzVDuBukZMgSJrDNYPIUzXVamonAxL8VyPUrJGCHf19AsNw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 26/35] pc-bios/s390-ccw: Add additional security checks for secure boot Date: Wed, 1 Jul 2026 16:49:12 -0400 Message-ID: <20260701204922.1320349-27-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXyraayuSQnfXu DVKclobzbDkFgGCRv1CmSEMEGoRd1jg1PavABTVlE1wNnWXtDS28Al1flNy3GSn4XteqZkOrtJJ Kk3SWG7bK4wfIyshLg0aMHfD6mQ2v3LACTqvycTdJPAQcjcCOeFC7EC5U8V0tBRPpJDdJY/Peh9 uHYxRrwxS7L9T0ZJ+vDPBJ07xUDIc7pfpyg2WLBYoj6fI5NTCioUo00cJuluI4nezx1AtrQ0IgA wvgMzPmJ/on/z6G+wKMN/ocrYnsh5lVPeLqop3yWzCbqsT/6FCbvy5JgEGEUSUGYbCgmkRxYd4Z gIHjPYRvFqOWev+yRe4XVz6QgKdYVP0iQaApDkmSuE+1nmnpmR6Rx0MpZrMrNqWX+6ORWmVNZpA wcsnBSf5j4YBmuURjdZxCCYoDaUR2glwe34FI4zdd6l+h+/FLuJFkKPxPqCl5LCp5vhztq0eVjO ANS4DnX3Qcai+Pu2beA== X-Proofpoint-GUID: FkMu5DelKXLlFTbIkN1Dpgyo3HIP49Ed X-Authority-Analysis: v=2.4 cv=Z8bc2nRA c=1 sm=1 tr=0 ts=6a457da7 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=s9pCXNYtFNHZQuK5kQYA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzwFqwjxEvCPT dcUALs7cbxtn5Y3fNooQQvvD3A0/vEjOYU9Z8zGWMKqUs5RDk8BT6dqaxxQQ1svMG+S7noYZ6EY 4Ze+jHrlK4IYQmToO6luh16Wk7cORDk= X-Proofpoint-ORIG-GUID: FkMu5DelKXLlFTbIkN1Dpgyo3HIP49Ed X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939286093158500 Content-Type: text/plain; charset="utf-8" Add additional checks to ensure that components do not overlap with signed components when loaded into memory. Add additional checks to ensure the load addresses of unsigned components are greater than or equal to 0x2000. When the secure IPL code loading attributes facility (SCLAF) is installed, all signed components must contain a secure code loading attributes block (SCLAB). The SCLAB provides further validation of information on where to load the signed binary code from the load device, and where to start the execution of the loaded OS code. When SCLAF is installed, its content must be evaluated during secure IPL. Add IPL Information Error Indicators (IIEI) and Component Error Indicators (CEI) for IPL Information Report Block (IIRB). When SCLAF is installed, additional secure boot checks are performed during zipl and store results of verification into IIRB. Signed-off-by: Zhuoying Cai --- include/hw/s390x/ipl/qipl.h | 29 +++++- pc-bios/s390-ccw/sclp.h | 1 + pc-bios/s390-ccw/secure-ipl.c | 170 +++++++++++++++++++++++++++++++++- pc-bios/s390-ccw/secure-ipl.h | 51 ++++++++++ 4 files changed, 246 insertions(+), 5 deletions(-) diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 2b29dfa8c5..f05c4a7206 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -167,10 +167,20 @@ struct IplInfoReportBlockHeader { }; typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; =20 +/* IPL Info Error Indicators */ +#define S390_IIEI_NO_SIGNED_COMP 0x8000 /* bit 0 */ +#define S390_IIEI_NO_SCLAB 0x4000 /* bit 1 */ +#define S390_IIEI_NO_GLOBAL_SCLAB 0x2000 /* bit 2 */ +#define S390_IIEI_MORE_GLOBAL_SCLAB 0x1000 /* bit 3 */ +#define S390_IIEI_FOUND_UNSIGNED_COMP 0x800 /* bit 4 */ +#define S390_IIEI_MORE_SIGNED_COMP 0x400 /* bit 5 */ + struct IplInfoBlockHeader { uint32_t len; uint8_t type; - uint8_t reserved1[11]; + uint8_t reserved1[3]; + uint16_t iiei; + uint8_t reserved2[6]; }; typedef struct IplInfoBlockHeader IplInfoBlockHeader; =20 @@ -194,13 +204,28 @@ typedef struct IplSignatureCertificateList IplSignatu= reCertificateList; #define S390_IPL_DEV_COMP_FLAG_SC 0x80 #define S390_IPL_DEV_COMP_FLAG_CSV 0x40 =20 +/* IPL Device Component Error Indicators */ +#define S390_CEI_INVALID_SCLAB 0x80000000 /* bit 0 */ +#define S390_CEI_INVALID_SCLAB_LEN 0x40000000 /* bit 1 */ +#define S390_CEI_INVALID_SCLAB_FORMAT 0x20000000 /* bit 2 */ +#define S390_CEI_UNMATCHED_SCLAB_LOAD_ADDR 0x10000000 /* bit 3 */ +#define S390_CEI_UNMATCHED_SCLAB_LOAD_PSW 0x8000000 /* bit 4 */ +#define S390_CEI_INVALID_LOAD_PSW 0x4000000 /* bit 5 */ +#define S390_CEI_NUC_NOT_IN_GLOBAL_SCLAB 0x2000000 /* bit 6 */ +#define S390_CEI_SCLAB_OLA_NOT_ONE 0x1000000 /* bit 7 */ +#define S390_CEI_SC_NOT_IN_GLOBAL_SCLAB 0x800000 /* bit 8 */ +#define S390_CEI_SCLAB_LOAD_ADDR_NOT_ZERO 0x400000 /* bit 9 */ +#define S390_CEI_SCLAB_LOAD_PSW_NOT_ZERO 0x200000 /* bit 10 */ +#define S390_CEI_INVALID_UNSIGNED_ADDR 0x100000 /* bit 11 */ + struct IplDeviceComponentEntry { uint64_t addr; uint64_t len; uint8_t flags; uint8_t reserved1[5]; uint16_t cert_index; - uint8_t reserved2[8]; + uint32_t cei; + uint8_t reserved2[4]; }; typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; =20 diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index a8a41cd004..cae65b29b5 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -52,6 +52,7 @@ typedef struct SCCBHeader { #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) #define SCCB_FAC134_DIAG320_BIT 0x4 #define SCCB_FAC_IPL_SIPL_BIT 0x4000 +#define SCCB_FAC_IPL_SCLAF_BIT 0x1000 =20 typedef struct ReadInfo { SCCBHeader h; diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index af98881aa5..c92d8e2aff 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -180,6 +180,12 @@ bool secure_ipl_supported(void) return false; } =20 + if (!sclp_is_fac_ipl_flag_on(SCCB_FAC_IPL_SCLAF_BIT)) { + puts("Secure IPL Code Loading Attributes Facility is not supported= by" + " the hypervisor!"); + return false; + } + return true; } =20 @@ -210,6 +216,147 @@ static void check_comp_overlap(IplDeviceComponentList= *comp_list, } } =20 +static bool is_psw_valid(uint64_t psw, IplDeviceComponentEntry *comp) +{ + uint32_t addr =3D psw & 0x7fffffff; + + /* + * PSW points within a signed binary code component + * + * Check addr falls within [comp->addr, comp->addr + comp->len - 2], + * ensuring at least 2 bytes (minimum instruction length) remain. + */ + return intersects(addr, 1, comp->addr, comp->len - 1); +} + +void check_global_sclab(const SclaBlock *global_sclab, + IplDeviceComponentEntry *comp_entry, + IplDeviceComponentList *comp_list) +{ + bool psw_valid =3D false; + bool global_psw_valid =3D false; + int signed_count =3D 0; + int unsigned_count =3D 0; + IplDeviceComponentEntry *comp; + + if (!global_sclab) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_NO_GLOBAL_SCLAB; + zipl_secure_error("Global SCLAB does not exist"); + return; + } + + for_each_rb_entry(comp, comp_list) { + if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC) { + psw_valid |=3D is_psw_valid(comp_entry->addr, comp); + global_psw_valid |=3D is_psw_valid(global_sclab->load_psw, com= p); + signed_count +=3D 1; + } else { + unsigned_count +=3D 1; + } + } + + /* validate load PSW with PSW specified in the final entry */ + zipl_secure_validate(psw_valid && global_psw_valid, &comp_entry->cei, + S390_CEI_INVALID_LOAD_PSW, "Invalid PSW"); + + /* compare load PSW with the PSW specified in component */ + zipl_secure_validate(global_sclab->load_psw =3D=3D comp_entry->addr, + &comp_entry->cei, S390_CEI_UNMATCHED_SCLAB_LOAD_P= SW, + "Load PSW does not match with PSW in component"); + + /* Unsigned components are not allowed if NUC flag is set in the globa= l SCLAB */ + if ((global_sclab->flags & S390_SCLAB_NUC) && unsigned_count > 0) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_FOUND_UNSIGNED_COMP; + zipl_secure_error("Unsigned components are not allowed"); + } + + /* + * Only one signed component is allowed if SC flag is set in the globa= l SCLAB + * More than one component in the component table is not allowed + */ + if ((global_sclab->flags & S390_SCLAB_SC) && + (signed_count !=3D 1 || unsigned_count !=3D 0)) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_MORE_SIGNED_COMP; + zipl_secure_error("Only one signed component is allowed"); + } +} + +static void check_sclab(SclaBlock **global_sclab, + IplDeviceComponentEntry *comp_entry, + IplInfoBlockHeader *comp_list_hdr) +{ + SclabOriginLocator *sclab_locator; + SclaBlock *sclab; + + /* sclab locator is located at the last 8 bytes of the signed comp */ + sclab_locator =3D (SclabOriginLocator *)(comp_entry->addr + + comp_entry->len - 8); + + /* return early if sclab does not exist */ + zipl_secure_validate(magic_match(sclab_locator->magic, ZIPL_MAGIC), + &comp_entry->cei, S390_CEI_INVALID_SCLAB, + "Magic does not match. SCLAB does not exist"); + + if (comp_entry->cei & S390_CEI_INVALID_SCLAB) { + return; + } + + zipl_secure_validate(sclab_locator->len >=3D S390_SCLAB_MIN_LEN, &comp= _entry->cei, + S390_CEI_INVALID_SCLAB_LEN | S390_CEI_INVALID_SCL= AB, + "Invalid SCLAB length"); + + /* return early if sclab is invalid */ + if (comp_entry->cei & S390_CEI_INVALID_SCLAB) { + return; + } + + sclab =3D (SclaBlock *)(comp_entry->addr + comp_entry->len - + sclab_locator->len); + + zipl_secure_validate(sclab->format =3D=3D 0, &comp_entry->cei, + S390_CEI_INVALID_SCLAB_FORMAT, + "Format-0 SCLAB is not being used"); + + if (!(sclab->flags & S390_SCLAB_OPSW)) { + /* OPSW =3D 0 - Load PSW field in SCLAB must contain zeros */ + zipl_secure_validate(sclab->load_psw =3D=3D 0, &comp_entry->cei, + S390_CEI_SCLAB_LOAD_PSW_NOT_ZERO, + "Load PSW is not zero when Override PSW bit i= s zero"); + } else { + /* OPSW =3D 1 indicating global SCLAB */ + if (*global_sclab) { + comp_list_hdr->iiei |=3D S390_IIEI_MORE_GLOBAL_SCLAB; + zipl_secure_error("More than one global SCLAB"); + } + *global_sclab =3D sclab; + + /* override load address flag must set to one */ + zipl_secure_validate(sclab->flags & S390_SCLAB_OLA, &comp_entry->c= ei, + S390_CEI_SCLAB_OLA_NOT_ONE, + "OLA flag is not set to one in the global SCL= AB"); + } + + if (!(sclab->flags & S390_SCLAB_OLA)) { + /* OLA =3D 0 - Load address field in SCLAB must contain zeros */ + zipl_secure_validate(sclab->load_addr =3D=3D 0, &comp_entry->cei, + S390_CEI_SCLAB_LOAD_ADDR_NOT_ZERO, + "Load Address is not zero when OLA flag is ze= ro"); + } else { + /* OLA =3D 1 - Load address field must match storage address of th= e component */ + zipl_secure_validate(sclab->load_addr =3D=3D comp_entry->addr, &co= mp_entry->cei, + S390_CEI_UNMATCHED_SCLAB_LOAD_ADDR, + "Load Address does not match with component l= oad address"); + } + + zipl_secure_validate(~sclab->flags & S390_SCLAB_NUC || sclab->flags & = S390_SCLAB_OPSW, + &comp_entry->cei, S390_CEI_NUC_NOT_IN_GLOBAL_SCLA= B, + "NUC bit is set, but not in the global SCLAB"); + + zipl_secure_validate(~sclab->flags & S390_SCLAB_SC || sclab->flags & S= 390_SCLAB_OPSW, + &comp_entry->cei, S390_CEI_SC_NOT_IN_GLOBAL_SCLAB, + "SC bit is set, but not in the global SCLAB"); +} + static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) { if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { @@ -268,6 +415,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t= *tmp_sec, uint8_t *tmp_buf; bool verified; bool signed_found =3D false; + bool sclab_found =3D false; + SclaBlock *global_sclab =3D NULL; =20 if ((MAX_SIGNED_COMP * CERT_BUF_MAX_LEN) > (CERT_BUF_SIZE)) { panic("Not enough memory to store certificates"); @@ -308,6 +457,10 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_= t *tmp_sec, =20 /* no signature present (unsigned component) */ if (!sig_entry.len) { + zipl_secure_validate(comp_entry.addr >=3D S390_UNSIGNED_MI= N_ADDR, + &comp_entry.cei, S390_CEI_INVALID_UNSIGNED_ADD= R, + "Load address for unsigned component is less t= han 0x2000"); + comp_list_add(comp_list, comp_entry); break; } @@ -319,6 +472,9 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t= *tmp_sec, comp_entry.flags =3D S390_IPL_DEV_COMP_FLAG_SC; signed_found =3D true; =20 + check_sclab(&global_sclab, &comp_entry, &comp_list->ipl_info_h= eader); + sclab_found |=3D !(comp_entry.cei & S390_CEI_INVALID_SCLAB); + cert_entry =3D (IplSignatureCertificateEntry) { 0 }; verified =3D verify_signature(comp_entry, sig_entry, &cert_entry.len, &cert_table_idx); @@ -364,9 +520,17 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_= t *tmp_sec, } } =20 - if (!signed_found) { - zipl_secure_error("Secure boot is on, but components are not signe= d"); - } + zipl_secure_validate(signed_found, &comp_list->ipl_info_header.iiei, + S390_IIEI_NO_SIGNED_COMP, + "Secure boot is on, but components are not signed= "); + + zipl_secure_validate(sclab_found, &comp_list->ipl_info_header.iiei, + S390_IIEI_NO_SCLAB, "No recognizable SCLAB"); + + comp_entry =3D (IplDeviceComponentEntry){ 0 }; + comp_entry.addr =3D entry->compdat.load_psw; + check_global_sclab(global_sclab, &comp_entry, comp_list); + comp_list_add(comp_list, comp_entry); =20 *entry_ptr =3D entry; free((void *)sig_entry.addr); diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index 1b1287858b..1bacb4987a 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -27,6 +27,33 @@ int zipl_run_secure(ComponentEntry **entry_ptr, uint8_t = *tmp_sec, IplSignatureCertificateList *cert_list, uint8_t **tmp_cert_buf); =20 +#define S390_SCLAB_OPSW 0x8000 /* override PSW flag */ +#define S390_SCLAB_OLA 0x4000 /* override load address flag */ +#define S390_SCLAB_NUC 0x2000 /* no unsigned components flag */ +#define S390_SCLAB_SC 0x1000 /* single component flag */ + +#define S390_SCLAB_MIN_LEN 32 +#define S390_UNSIGNED_MIN_ADDR 0x2000 + +/* Secure Code Loading Attributes Block */ +struct SclaBlock { + uint8_t format; + uint8_t reserved1; + uint16_t flags; + uint8_t reserved2[4]; + uint64_t load_psw; + uint64_t load_addr; + uint64_t reserved3[]; +} __attribute__ ((packed)); +typedef struct SclaBlock SclaBlock; + +struct SclabOriginLocator { + uint8_t reserved[2]; + uint16_t len; + uint8_t magic[4]; +} __attribute__ ((packed)); +typedef struct SclabOriginLocator SclabOriginLocator; + static inline void zipl_secure_error(const char *message) { switch (boot_mode) { @@ -38,6 +65,30 @@ static inline void zipl_secure_error(const char *message) } } =20 +static inline void zipl_secure_validate_u16(bool condition, uint16_t *flag= s, + uint16_t flag, const char *mes= sage) +{ + if (!condition) { + *flags |=3D flag; + zipl_secure_error(message); + } +} + +static inline void zipl_secure_validate_u32(bool condition, uint32_t *flag= s, + uint32_t flag, const char *mes= sage) +{ + if (!condition) { + *flags |=3D flag; + zipl_secure_error(message); + } +} + +#define zipl_secure_validate(condition, flags, flag, message) \ + _Generic((flags), \ + uint16_t * : zipl_secure_validate_u16, \ + uint32_t * : zipl_secure_validate_u32 \ + )(condition, flags, flag, message) + static inline uint64_t _diag320(void *data, unsigned long subcode) { register unsigned long addr asm("0") =3D (unsigned long)data; --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939277; cv=none; d=zohomail.com; s=zohoarc; b=B/XgeqU1Gm01HnJo2ySc89KqvWrntfmDaEYNfEAVnE1pVZ0ht7uji2CPUCUQyqN1BrQ6ASV4QYLnkRKSxOcx0nHXgVBTsDiE8/dH7IYkggjOMw2T+N9zcsMVwyW00IvW6z+fPdwCjCB5cCWNr7uR/QgTbSxQf8HW0MBFXcvhRaI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939277; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PKFcHPOpJSe/GnJ1TqpjMI9ExOCvbM2YG7a/GSmrYbc=; b=CBjsHNJk1+kPiCsJ7TIox72ZAj56iVyqOzuBcQ+wyxcaG2q/mqpmwbv9m/yPdLBRS7hE3Omne18HDUZ0U6IiJ+6m43G63qeaITUvLDe/cCXncokz39MQbch5LzBUF2LzTgyul5qe+UxB3R2nhrqaDqeLPgpefXOSBtxGlcXr3Yc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939276991516.6418236500297; Wed, 1 Jul 2026 13:54:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tm-0005Pd-PQ; Wed, 01 Jul 2026 16:51:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tY-0004sq-JM; Wed, 01 Jul 2026 16:50:57 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tW-0004TS-R1; Wed, 01 Jul 2026 16:50:56 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmmfa1455758; Wed, 1 Jul 2026 20:50:51 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26pe6q61-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:50 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knan3030792; Wed, 1 Jul 2026 20:50:49 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxvr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:49 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Komtt26804918 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:48 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B2BE5803F; Wed, 1 Jul 2026 20:50:48 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 61C6F5804E; Wed, 1 Jul 2026 20:50:45 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=PKFcHPOpJSe/GnJ1T qpjMI9ExOCvbM2YG7a/GSmrYbc=; b=g/DS2ZiDXMOOEWm58y0Fwo0u+X8Wez+xP aMtPpaDh75iZdsz82HoeoKWnIF1SHkPA0zclE64u2e52ZFdlqR22iJnLQ6XbK+pB 6H0yf8Z3eqNrrGi75XFrGJ6hjA68Hyv9rwrR8u9cm2jzRGf69s/woPi741ZWCS1t b2Ewf3F9IUGma5f7V/Ya6xpya8dcvWILJWVFaLw13xpMgPPrdqslyOKqM+E7k95Z 0AJ+WTc3b9DBQxthZVVXLPT+x4JHJN1Z+2rnzGX3wWrn3kvLOhjvvVjt3pCRlQ1V C8xO3q+FwQO5WOPCIa9HvmMYiaYSMLigfhIr7O6UTI74rdZHQu2RA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 27/35] Add secure-boot to s390-ccw-virtio machine type option Date: Wed, 1 Jul 2026 16:49:13 -0400 Message-ID: <20260701204922.1320349-28-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: VQuSZJOxTV63yD9fFpKSskKBmOtXITfl X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXwnxc4ZcWREZi QN1IOjxBxQ337RqrR8qV4f1leW4GhY25tR880u6LF4YoJDHM3k4Quu+uPkVJRvdxQoynnju5iYG pofIAGOxucAGaDfHNwXDAed0gmaFmu4= X-Authority-Analysis: v=2.4 cv=edsNubEH c=1 sm=1 tr=0 ts=6a457daa cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=uyvjcAWwEQu1yBn7KtoA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX1LvJXGtR8HWw +Xa7prfGm0Gnh+jisznaD81WOUE/uKWwquHPLFDSJoimrb/Bp9Y4jn0Oh7wfCloAarOwGECVk9R TWyVG3zymzgSkIQ5lvRYFKMWOhuYd5Zb4jjFPATm6x9cX2dvdx5rfeEdxUEy85iewDkBld5xp/h 2h0bl2Sw4J7m4ZrmjF5+/iDXRrUTCJm1qzQZdTyn2kbs/G8NS79HGz6I1FrIPuXOenyIvqEIaC6 6SwnNuF6hQd9CJX1qC3yaPTGoZ/2Mbw1zkOJ4f9sBoUTzbI2xRPeMOSEoXOuxdQmcjhWYsmz7yo mMWIkPyso2IuPbWNdxgNn1VKBiCb55wJIBLn79KY1Db/51YHzQn+hfiJL/gwmxB9oGRLa1zOa+2 7C61AdT9lb26YOEg4KADT13dF6xlvSCI5ZN22GF13WLmwVfp5UviSlLMD4MC3sJmjeRhQEOHQ1a kO/DdZHkj8AshhuPFKA== X-Proofpoint-ORIG-GUID: VQuSZJOxTV63yD9fFpKSskKBmOtXITfl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 bulkscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939278022158500 Content-Type: text/plain; charset="utf-8" Add secure-boot as a parameter of s390-ccw-virtio machine type option. The `secure-boot=3Don|off` parameter is implemented to enable secure IPL. By default, secure-boot is set to false if not specified in the command line. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling --- docs/system/s390x/secure-ipl.rst | 22 +++++++++++++++++----- hw/s390x/s390-virtio-ccw.c | 22 ++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 1 + qemu-options.hx | 6 +++++- 4 files changed, 45 insertions(+), 6 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index cf6ccf5d57..9e3955f8fc 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension. =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... =20 +Enabling Secure IPL +^^^^^^^^^^^^^^^^^^^ + +Secure IPL is enabled by explicitly setting ``secure-boot=3Don``; if not +specified, secure boot is considered off. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don|off + =20 IPL Modes --------- =20 Multiple IPL modes are available to differentiate between the various IPL -configurations. These modes are mutually exclusive and enabled based on the -``boot-certs`` option on the QEMU command line. +configurations. These modes are mutually exclusive and enabled based on sp= ecific +combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU +command line. =20 Normal Mode ^^^^^^^^^^^ =20 -The absence of certificates will attempt to IPL a guest without secure IPL -operations. No checks are performed, and no warnings/errors are reported. -This is the default mode. +The absence of both certificates and the ``secure-boot`` option will attem= pt to +IPL a guest without secure IPL operations. No checks are performed, and no +warnings/errors are reported. This is the default mode, and can be explic= itly +enabled with ``secure-boot=3Doff``. =20 Configuration: =20 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index b3c96ba35b..6d2e45c1a7 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -813,6 +813,21 @@ static void machine_set_boot_certs(Object *obj, Visito= r *v, const char *name, ms->boot_certs =3D cert_list; } =20 +static inline bool machine_get_secure_boot(Object *obj, Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + return ms->secure_boot; +} + +static inline void machine_set_secure_boot(Object *obj, bool value, + Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + ms->secure_boot =3D value; +} + /* * S390x-specific global compatibility properties. * @@ -886,6 +901,13 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); object_class_property_set_description(oc, "boot-certs", "provide paths to a directory and/or a certificate file for se= cure boot"); + + object_class_property_add_bool(oc, "secure-boot", + machine_get_secure_boot, + machine_set_secure_boot); + object_class_property_set_description(oc, "secure-boot", + "enable/disable secure boot"); + } =20 static inline void s390_machine_initfn(Object *obj) diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index 5ad1ea2f24..93a4c0ccad 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -29,6 +29,7 @@ struct S390CcwMachineState { bool aes_key_wrap; bool dea_key_wrap; bool pv; + bool secure_boot; uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; diff --git a/qemu-options.hx b/qemu-options.hx index 83915bd7ef..d37fd8595c 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -47,7 +47,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" " sgx-epc.0.memdev=3Dmemid,sgx-epc.0.node=3Dnumaid\n" " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" - " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n" + " secure-boot=3Don|off enable/disable secure boot (defa= ult=3Doff) \n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -218,6 +219,9 @@ SRST =20 ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` Provide paths to a directory and/or a certificate file on the host= [s390x only]. + + ``secure-boot=3Don|off`` + Enables or disables secure boot on s390-ccw guest. The default is = off. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939209; cv=none; d=zohomail.com; s=zohoarc; b=DG6Iq3UqRH+phdgh7oG31VEAoO1zBHmuRRaESblBE4Z/X72Hc+3xO8NSBEjVZqdwjssj6dNPHRy6EJZXmBl+Sp7IHvaTFXxMn7bLfx/+UCqV4mDHcP0a4uMARMQyN7bfxUa2sHK5/OZlco1e2jfWHXxPga6eQnczQ0vfqHC89IA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939209; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=eFNX3F9rh1ONhQuS1e8YFG0Ky24tgVq6X5uGW6jky6U=; b=Dm6hINWUstND1GkRrfS0i8I+tuL9N7+S1jPIMlRkHFUHj1DC873qFyzbvnS0IWURG2qiDMfPH01jDNTWgBX1Ys0Lp2iimGblmVFUkSVGH5gn2VeFr+BPddLIQ8u06nwVNNVFuwg4fNLDLI+rAoo9IRhOI7w9midqhFWCDbH1E1c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939209775243.02084057526736; Wed, 1 Jul 2026 13:53:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tn-0005Xs-T1; Wed, 01 Jul 2026 16:51:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1ta-0004v3-UZ; Wed, 01 Jul 2026 16:51:00 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tZ-0004Ui-AA; Wed, 01 Jul 2026 16:50:58 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn4tm1400653; Wed, 1 Jul 2026 20:50:53 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26n5xnt8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:53 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnfTh006947; Wed, 1 Jul 2026 20:50:52 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhh0vj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:52 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KoptI30868058 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:51 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 461955804E; Wed, 1 Jul 2026 20:50:51 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6B7A55803F; Wed, 1 Jul 2026 20:50:48 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:48 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=eFNX3F9rh1ONhQuS1 e8YFG0Ky24tgVq6X5uGW6jky6U=; b=a/nxBXzTvrrTTIeRaJqTK+so3Z2hFqomI VXY1rLmTjsFs7h94x3f9FQx7GW3fjRi9QYvRGDImyRlppHBIISRW4hJtBxLRL8I7 TrGBWKY36FvJ6wZgXom4EjGZhKUF4HX0oJDLeZsqVuUOKfj7beeUCnJwHzcF+18X 4LTv4u0+GsNEvSOX5Io1+2y5wSVeaawEKksVZhbGhLb7TqvVRyldkRx7hRnm74ck pI43qP8OGS6wz5RRurljENXIOMySO9igx3D0ihCmDH3yvAXJu+SRS6Vob6HLJmKV 9MRimvXSzUIjinheq9dON7Mg+LsMZR4SQGWvxlGDTLu+HaGp7WMlg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 28/35] hw/s390x/ipl: Set IPIB flags for secure IPL Date: Wed, 1 Jul 2026 16:49:14 -0400 Message-ID: <20260701204922.1320349-29-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzTcLcaEoivgt ienccOnSdAkjF/t65uRjPTFJmzDQrnRD0Gh/lDE98RBcQ2UxXpj0/4/tcJbVxT5k7thTR0S6ocG IkAT4ffI5dJLC0eLW5+i9y9Ou9qE+jYBDIe7+6GMqqJrLk8LeEOGzUvyg5Ki8lz3mCueL97W5Az riiXkMvhJeqi7KAe8VGeZb95Un1DgezvUdPyFqVT8YrbroKl0RSu5KxxyNskmO9icM/TUfgkQqj RapPUJbQvniHGaGBFfz+0Z1jz9b5reEXjuarsHoxu19rADsVCtfHvHNuwcg9i3fRCTjzqJGePCX pGLp2hdHzWVeZ7/PSzFRhL7IVTrA/Ntzm18KW59/OqRSuWrqrkH3p321HDCnvvYcBAk9bdGpMEf JTxfkQk6kIMdAguJlrA8Ziz0gnAEfg0mZbf1DKQJs+ban2QK3lBGSZW+3EyKD2FIdoBYH7CvyYl D08YQkFGMhB3F5YZg7w== X-Authority-Analysis: v=2.4 cv=V45NF+ni c=1 sm=1 tr=0 ts=6a457dad cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=MUQpW0jNMHjpGy_Q9scA:9 X-Proofpoint-ORIG-GUID: bv11lScrDfgfwJRKqe2Rlwmaen61ihVi X-Proofpoint-GUID: bv11lScrDfgfwJRKqe2Rlwmaen61ihVi X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX9Do/mNf5/vNm sTuiHzEhnQHfUD154rEPvUer22Tvm45zINOf8GcsaumyLPF2+wDfxDBVYX1NCLuFBHIlpnHjR0C iDOn0fmUW6tFKpzpGTg5oZl33iOQlNQ= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 clxscore=1015 impostorscore=0 malwarescore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939211716158500 Content-Type: text/plain; charset="utf-8" If `-M secure-boot=3Don` is specified on the command line option, indicating true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS. Any error that occurs during true secure IPL will cause the IPL to terminate. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- hw/s390x/ipl.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 7734b6edc7..da826908c1 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -467,6 +467,11 @@ static bool s390_has_certificate(void) return ipl->cert_store.count > 0; } =20 +static bool s390_secure_boot_enabled(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->secure_boot; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -523,6 +528,18 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + /* + * If secure-boot is enabled, then toggle the secure IPL flags to + * trigger secure boot in the s390 BIOS. + * + * Boot process will terminate if any error occurs during secure b= oot. + * + * If SIPL is on, IPLIR must also be on. + */ + if (s390_secure_boot_enabled()) { + iplb->hdr_flags |=3D (DIAG308_IPIB_FLAGS_SIPL | DIAG308_IPIB_F= LAGS_IPLIR); + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); + } /* * Secure boot in audit mode will perform * if certificate(s) exist in the key store. @@ -532,7 +549,7 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) * * Results of secure boot will be stored in IIRB. */ - if (s390_has_certificate()) { + else if (s390_has_certificate()) { iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); } --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939102; cv=none; d=zohomail.com; s=zohoarc; b=N8HN0aRvOi12414MdU/yp4Zb9G7+dC5PVMrOYjpQI9aHVYptpkI6FbDrzJGnZrU4NjH/Cn9KiarIrQ311P2NSS++Y/uJgqS+sk/Zv3hIDCPRVb/DpuLyMv3xEiku+YAjMX1J/s8UjdHSs4DtCZx1LTcRFWppdwbSu8M3ZKovM+E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939102; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JDUqcBm9SbBu1IQ0QVgtEHIzFbo/ae6DTp3QVtYW4Wg=; b=kH8j8PJkDVAqz1Y1Es8L9Wky5D8GK97k4sSsy14LB5E27XyJY2FGY4Y0+R+E7EQg5m9bGrpk6YnsovuSB2GbmItxS6xPJjAd+HUZfu7iXgrPbKt7Xml/EX1sfb6WtgSr+4PYP9kP8J0zGp60Q2anbSGtDQRt0R+sUx06g/3i/GI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939102118404.53970145699066; Wed, 1 Jul 2026 13:51:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1u2-0007B3-S5; Wed, 01 Jul 2026 16:51:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1ty-0006lY-Vm; Wed, 01 Jul 2026 16:51:23 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tw-0004VO-14; Wed, 01 Jul 2026 16:51:22 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmZoV1398494; Wed, 1 Jul 2026 20:50:56 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26n5xntd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:56 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnahO030797; Wed, 1 Jul 2026 20:50:55 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxw8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:55 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kosrk29229776 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:54 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4F8F158056; Wed, 1 Jul 2026 20:50:54 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7EF7F5803F; Wed, 1 Jul 2026 20:50:51 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:51 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=JDUqcBm9SbBu1IQ0Q VgtEHIzFbo/ae6DTp3QVtYW4Wg=; b=CZNSlSRWS5+YrbLxq41S2Wsw+cXi49dJ7 V/QvG4EUjoCxes3F+xCpPHLWUV7nrfXiqY+8+TUxwArSRur6h0hVAeG6dYgSzhRe ANwlO7kvn7+L4CM8/HBXQQOZPCBU6uePkrV26HGWce7EkYK5OlIY5mJ5iZoXMhxI fZ+6ly4rpwh0khsLjB045lrIPms2LEOJxgejNfK9/Tq29xPYfmkUTbmbqtYo4VHh WgCFURC45qfn55K4p7IJ2ZZR1l/XjK/kJPoZsiFSsx3m5ASjgcbNXdZNSGxiyI9i cEgxD5V6lKeUPdxcVRDdNjOBUEAuwPEcbd1pQWEoBJTDDYf8Aml9A== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 29/35] pc-bios/s390-ccw: Handle true secure IPL mode Date: Wed, 1 Jul 2026 16:49:15 -0400 Message-ID: <20260701204922.1320349-30-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXwhNDzhX/uCfZ d0jw4IwbsawjYz28FEjP/s40Eb4FBHZZI84lMidayFsbx98XlAg3EV5l8cLYdUzL2ntmjQo17Rl so9nR9hYpugYmakqgvAe/Nqm+Sa9peRB9ZNknpZt/y7JKdhKqJ5M4ybzjTr/jmXxpqzdiG3qMR1 gPuFrtGi/I+71npRI7f4YE8RA4djw5gGGLWKAeC7GE0BOayAL7eD/1OlDO9kkbcO/47RrxmI24T dHiYxQEm2fUgKWt261DyIPwXTJFrIQoSllMNdmuGj4a47vqDpqR46Hv89kOyYaS/vKA8tBYmHsL tj1CQruxZyedkyUaSFMDp/6IYievKawTO//80chmow6NBQ953WyHaZzLkidaL6+Uyc3ZHoClIt+ 50QDWlbyzwCPoeUHU4p8qkx2jNy4+1QmFKWXdN3318zcwtMeG1N4WLywgz2lrlVhj18dvbZW/df ELly6+0zPmX9kNZtKMw== X-Authority-Analysis: v=2.4 cv=V45NF+ni c=1 sm=1 tr=0 ts=6a457db0 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=D03tI8-wM19WNX2duQ4A:9 X-Proofpoint-ORIG-GUID: 0Ddhp7sZCGF0WhW9H2NSZ4FuMTcdrJuD X-Proofpoint-GUID: 0Ddhp7sZCGF0WhW9H2NSZ4FuMTcdrJuD X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2r50eMsGWFaM dGxG/2Uy8PIMmqSykc2WuvlletvSHaDLR1WCn5mstsC7qx4U1VZGDF345UN1dEXKvbMkDq+g3w+ o4ntkQQxOW0I94b7/fLQLo0v+22gfM8= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 clxscore=1015 impostorscore=0 malwarescore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939103086158500 Content-Type: text/plain; charset="utf-8" When secure boot is enabled (-secure-boot on) and certificate(s) are provided, the boot operates in True Secure IPL mode. Any verification error during True Secure IPL mode will cause the entire boot process to terminate. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities. If secure boot is enabled but no certificate is provided, the boot process will also terminate, as this is not a valid secure boot configuration. Note: True Secure IPL mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- docs/system/s390x/secure-ipl.rst | 13 +++++++++++++ pc-bios/s390-ccw/bootmap.c | 6 +++++- pc-bios/s390-ccw/main.c | 7 ++++++- pc-bios/s390-ccw/s390-ccw.h | 1 + pc-bios/s390-ccw/secure-ipl.h | 3 +++ 5 files changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 9e3955f8fc..c8fb887ac0 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -66,3 +66,16 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + +Secure Mode +^^^^^^^^^^^ + +When the ``secure-boot=3Don`` option is set and certificates are provided, +a secure boot is performed with error reporting enabled. The boot process = aborts +if any error occurs. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don,boot-certs= .0.path=3D/.../qemu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 1147124bd7..cbfbbfe35c 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -742,6 +742,7 @@ static int zipl_run(ScsiBlockPtr *pte) case ZIPL_BOOT_MODE_NORMAL: rc =3D zipl_run_normal(&entry, tmp_sec); break; + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: rc =3D zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &t= mp_cert_buf); break; @@ -761,7 +762,8 @@ static int zipl_run(ScsiBlockPtr *pte) /* should not return */ write_reset_psw(entry->compdat.load_psw); =20 - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { update_cert_list(&cert_list); update_iirb(&comp_list, &cert_list); free(tmp_cert_buf); @@ -1129,6 +1131,8 @@ ZiplBootMode get_boot_mode(uint8_t hdr_flags) =20 if (!sipl_set && iplir_set) { return ZIPL_BOOT_MODE_SECURE_AUDIT; + } else if (sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE; } =20 return ZIPL_BOOT_MODE_NORMAL; diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 7484429c9a..687946c471 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -399,15 +399,20 @@ void main(void) =20 boot_mode =3D get_boot_mode(iplb->hdr_flags); switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: if (!secure_ipl_supported()) { - panic("Unable to boot in audit mode"); + panic("Unable to boot in secure/audit mode"); } =20 vcssb_len =3D zipl_secure_get_vcssb(); if (vcssb_len =3D=3D 0) { panic("Failed to query certificate storage information!"); } + + if (vcssb_len =3D=3D VCSSB_NO_VC) { + panic("Need at least one certificate for secure boot!"); + } default: break; } diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index ca2737054d..0ea4810f1f 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -90,6 +90,7 @@ void zipl_load(void); typedef enum ZiplBootMode { ZIPL_BOOT_MODE_NORMAL =3D 0, ZIPL_BOOT_MODE_SECURE_AUDIT =3D 1, + ZIPL_BOOT_MODE_SECURE =3D 2, } ZiplBootMode; =20 extern ZiplBootMode boot_mode; diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index 1bacb4987a..da2e379ff3 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -60,6 +60,9 @@ static inline void zipl_secure_error(const char *message) case ZIPL_BOOT_MODE_SECURE_AUDIT: printf("AUDIT MODE WARNING: %s\n", message); break; + case ZIPL_BOOT_MODE_SECURE: + panic(message); + break; default: break; } --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939163; cv=none; d=zohomail.com; s=zohoarc; b=RC4TDy/1TehZMy72reEPfW9yM/Hvfl1xJYi0xxNOylGhcdZe0msMGdrw12hPEXO3nj9f0WR67+b1YV8B8wSt74DGCMf6GqI5yp5d8qwkbP6MSdhFs9L8EG0dF+TnO9BoZmk30dAyEoS4T7TzrBeC2Mp2HEuebcm8cQCKIYLNO28= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939163; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wpTUN/g422QkWVrgoYIQSi7D3hcIhUr4WflTKyKfC40=; b=kdwNFcxS0eaats3vnhCrvID+v7ybUwu8vZfT27RyVle+Ykob9DZ1QkHhzDVJM8TOXFQnO7cO7Npfr18XOWx/W+ATRUOoCW2D876qbZ6zvnSIBV6OxVT/tfE1OKivr4k+HX+P/JlWbLHr6dtwkRqjy1DlPAj89selosyyRZwYWm8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939163392735.5540594101924; Wed, 1 Jul 2026 13:52:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1u4-0007Ng-J4; Wed, 01 Jul 2026 16:51:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1u2-00077N-3n; Wed, 01 Jul 2026 16:51:26 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tz-0004VZ-UG; Wed, 01 Jul 2026 16:51:25 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gmtxv1594405; Wed, 1 Jul 2026 20:50:59 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qg6mb5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:59 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnZBR025906; Wed, 1 Jul 2026 20:50:58 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqh9ph-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:50:58 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kove029229662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:50:57 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4FEE858054; Wed, 1 Jul 2026 20:50:57 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8875E5803F; Wed, 1 Jul 2026 20:50:54 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:54 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wpTUN/g422QkWVrgo YIQSi7D3hcIhUr4WflTKyKfC40=; b=aM3cQ6M1W5SdbH2/u6/r3RDujs+7jkvjy IKEE1pxzLr1SOdzrEeIA7ZHTbjxuZnHYAEnXDQusAfG4biLEy1lxhvd+HPUHC4mw HMklie3fiQCapQTLxN5DgJjyCaP82veZ2js+4lBEeAFGpNn+ZRn1qdrHcnxmX0ig bBhJeH24iAXJLDvjREP9dKaoWErzn149KvDnlz61+MPNv+xWHhJfl7NJPXwQDBje Da4j+JQq7CU+yMLp4HKoU2mTlZs2x65kCZa3Z1rs9YAjmHEhhyiEkuE/WVGejcM9 mlBPoW0uHWScsf3md+k1e6CzZ9lKkADRVwJflxb5xwVfb5loGsLxw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 30/35] hw/s390x/ipl: Handle secure boot with multiple boot devices Date: Wed, 1 Jul 2026 16:49:16 -0400 Message-ID: <20260701204922.1320349-31-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a457db3 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=cD7SlcjL7adLwvBW5s8A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXzBhnN5qItLw3 6raC0g+EAl/i2nqBr25JIESqoJXmWpViTXWA/iMAPIbNU4pwR/N5wDEFxoqABgDdBlFWYJZWzmx PE7+8uCzli/GALWyvjQQ4wKOAOHcZVQ= X-Proofpoint-GUID: RRGrpLkmNRYD51BcYL-han-lAUoEa4bQ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX00b7Io8QCuz9 lmKWrVm2PSr5htJ1HVt+Rqv6YyFG7I+pYTE5l9X2ldWom1/quVKQS7H5K2ub4mZRpSAIUYCa8f1 aO2avKIR8L/4cKil/jcX/PW5GI8UJN7cryd/X7E/pr/oUthKtiIA/m1iWF+nK07HssUYmt65Gs6 ALJwWl2Ju8D2vFnDvDZN4Ho4J+/eE1VElPYzziL+aMiMc1Bshe2FvBNQzUlAjftgv+KH3NnfL3U UwioF1RbPPdJlgoGi1dFsSeBc6hDkt1s4L5kZMTEBG3mYKKkaEsSCKNEhVaIwDNsFaXEsLeFAo8 O7GCii+NhahEJiUAb0TdBVcdN6ARY/sQ5zVvyH5mf4fDiFmx4AloJy6AI1w9IgiYCmPx+OGhsVf Rn80swopwMKLTM0G73UQcl1+Ep7mUeokdOMyzXymyXOuzXcSbsR3k3lm9SimcS1JN6YfSssbZZN PSkPhs6P16xKAAzztVg== X-Proofpoint-ORIG-GUID: RRGrpLkmNRYD51BcYL-han-lAUoEa4bQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939165365158500 Content-Type: text/plain; charset="utf-8" The current approach to enable secure boot relies on providing secure-boot and boot-certs parameters of s390-ccw-virtio machine type option, which apply to all boot devices. With the possibility of multiple boot devices, secure boot expects all provided devices to be supported and eligible (e.g., virtio-blk/virtio-scsi using the SCSI scheme). If multiple boot devices are provided and include an unsupported (e.g., ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will terminate with an error logged to the console. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth --- hw/s390x/ipl.c | 89 +++++++++++++++++++++++++++++------------ pc-bios/s390-ccw/main.c | 3 -- 2 files changed, 64 insertions(+), 28 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index da826908c1..0d6a783d9f 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -472,6 +472,68 @@ static bool s390_secure_boot_enabled(void) return S390_CCW_MACHINE(qdev_get_machine())->secure_boot; } =20 +static bool s390_validate_secure_boot_device(int devtype, Error **errp) +{ + switch (devtype) { + case CCW_DEVTYPE_VFIO: + error_setg(errp, "Passthrough (vfio) CCW device does not support se= cure boot!"); + return false; + case CCW_DEVTYPE_VIRTIO_NET: + error_setg(errp, "Virtio net boot device does not support secure bo= ot!"); + return false; + default: + return true; + } +} + +static void s390_set_secure_boot_flags(IplParameterBlock *iplb, + bool secure_boot, bool audit_mode) +{ + if (!secure_boot && !audit_mode) { + return; + } + + /* + * If secure-boot is enabled, then toggle the secure IPL flags (SIPL) = to + * trigger secure boot in the s390 BIOS. + * + * Boot process will terminate if any error occurs during secure boot. + */ + if (secure_boot) { + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_SIPL; + } + + /* + * For both secure boot and audit mode, enable the IPL Information + * Report (IPLIR) flag so that the firmware generates an IPL + * Information Report Block (IIRB). + * + * Results of secure boot will be stored in IIRB. + * + * Extend the IPL parameter block to its maximum length to ensure + * sufficient space for the BIOS to populate the IIRB. + */ + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); +} + +static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype, + bool secure_boot, bool audit_mode) +{ + Error *local_error =3D NULL; + + if (!secure_boot && !audit_mode) { + return; + } + + if (!s390_validate_secure_boot_device(devtype, &local_error)) { + error_report_err(local_error); + exit(1); + } + + s390_set_secure_boot_flags(iplb, secure_boot, audit_mode); +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -528,31 +590,8 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 - /* - * If secure-boot is enabled, then toggle the secure IPL flags to - * trigger secure boot in the s390 BIOS. - * - * Boot process will terminate if any error occurs during secure b= oot. - * - * If SIPL is on, IPLIR must also be on. - */ - if (s390_secure_boot_enabled()) { - iplb->hdr_flags |=3D (DIAG308_IPIB_FLAGS_SIPL | DIAG308_IPIB_F= LAGS_IPLIR); - iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); - } - /* - * Secure boot in audit mode will perform - * if certificate(s) exist in the key store. - * - * IPL Information Report Block (IIRB) will exist - * for secure boot in audit mode. - * - * Results of secure boot will be stored in IIRB. - */ - else if (s390_has_certificate()) { - iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; - iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); - } + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); =20 return true; } diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 687946c471..3eccdf1c99 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -305,9 +305,6 @@ static void ipl_ccw_device(void) switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: - IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), - "Passthrough (vfio) CCW device does not support secure= boot!"); - dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939311; cv=none; d=zohomail.com; s=zohoarc; b=Qgl14L7N4OkD9Th0CedJSfovhUaR9xV1FLff9DM9JtSz+cK/B2SRYYw8QYxiLNDiXmWJ26TXk+Xdcb8zL4eLzMpnfa/WPJBZ0PI3yDNf+y/NRM0GzklAhggqf7VhM038/M0wQVUUKnPWF1VGA4HhYKxthPXB3yBiKh1bIcq8mi4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939311; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4DBhf71wYueLdk98k6AXVO8AGJk+X2XyM/Xiq7OivUw=; b=MPholnuGKA7s6OsNU5rqsJhutgLkjBGklsaYSIbcQUS9IvUq0U9SN/tCG+Z6FrHOz1QST4+VQVLZ8cxAwlKNQG3LV51jANgOFNUtey5xrB0lEwwnI0poRxpoxndEjdFIEGAqj0HmeswL2EIs3h7/4PuHL+JDjJ3mT4Wkp6Ftna0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939311219922.9544932075758; Wed, 1 Jul 2026 13:55:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tn-0005Wu-Ni; Wed, 01 Jul 2026 16:51:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tj-0005EN-TD; Wed, 01 Jul 2026 16:51:09 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1ti-0004Vt-9w; Wed, 01 Jul 2026 16:51:07 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn0pI1339987; Wed, 1 Jul 2026 20:51:03 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa6a13-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:03 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KndWZ006294; Wed, 1 Jul 2026 20:51:02 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhygu92-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:02 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kp0rM66519410 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:51:00 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9F2655804E; Wed, 1 Jul 2026 20:51:00 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 88B805803F; Wed, 1 Jul 2026 20:50:57 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:50:57 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=4DBhf71wYueLdk98k 6AXVO8AGJk+X2XyM/Xiq7OivUw=; b=OC/5U7IQVwJkCWPVhuq0MJhU8th/l4hL9 8xR6L48THBoLAGLooDcCTlceY0IZAOe1XrVrzClEj7q+m7tymHwFvCIHgs7OSzlI b9fSC2rtcF2y/0d9HoLTm8dB+Gws/qz+rIo/XB9zKj7N3ieDNdLsyEHpkyfUfp2O ImVXaOzVhKECOj1MFSx/Clp+AhK20sNLOREgjcQcpi4DClFjhwgpNeU/GaWoDyZV xEjKOph6jHwO2NNh7Ywdiac7sAGwbfjMfwcmYQrJacmQKymT00TCuhaEN+ttkYs1 XTQqYY3atjBcj7XDtsPoJzmytRWNRVBAHIzrS79g+J6LP3T8i1brw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 31/35] hw/s390x/ipl: Handle secure boot without specifying a boot device Date: Wed, 1 Jul 2026 16:49:17 -0400 Message-ID: <20260701204922.1320349-32-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX41FNPtDmk3Fn Dr8Jcf3xUVVArEZgPSKrT+HDAgva6Q0/et5zIJ38jNi6DdMxFO+9QbmuOOogcQDX4IYDN8zAx/q EscUP+YZIUUyET7K85OsR0y3DHR5jhLjy1diNPz+tZo3BuzXGRlqbWsHGYiHrf2gPPXYQn1tL6l OLGwPkcRHcxT02LhkamgGkIkf+D7T8ucu4cbF3ZtRZTfP80ZmNd+udHvAqJPUuSBAiFQYStjs5t dD2wFp5qTwvnm5Cz95K4b2a09wqOHsOh4siCXpVfjQGEVEYoHrhORo6ZYw0fZ3rQb+zXpv9fHdc lqCD6vWyC7k9UJQ3cPqF7Ok4qZ+Iy+S4k1/+4uT4z56ebX87ywlEGHLUNo8A8EntMUj0Pp/uo8l Nzu75Nb5NM58tkjBMnQkqQlEKudgH/zxYqNfSRRYyppUIkMpCQcmiNoxMh8304/wmcUyfvaa54Q dCMZqCcS751vDpQvHFQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX9c+vrVxEjMna OnTCbGGQpySHeaSPxIOiJJBpdBlPxtUrpP1ENFvyr5Y6SIlDts5yOUZuOLXWzCulFuQoqByEGYH dIWqfedHVBAAiB3dm/RQv48jO64AVsk= X-Proofpoint-GUID: crShxhrcMPONxrqsZXVGqlLSpbMvFUOK X-Proofpoint-ORIG-GUID: crShxhrcMPONxrqsZXVGqlLSpbMvFUOK X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457db7 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=98YBU2wH__9RKlX8yukA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939312135158500 Content-Type: text/plain; charset="utf-8" If secure boot in audit mode or True Secure IPL mode is enabled without specifying a boot device, the boot process will terminate with an error. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth --- hw/s390x/ipl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 0d6a783d9f..f4e01b6918 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -865,6 +865,16 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) cpu->env.psw.addr =3D ipl->bios_start_addr; if (!ipl->iplb_valid) { ipl->iplb_valid =3D s390_init_all_iplbs(ipl); + + /* + * Secure IPL without specifying a boot device. + * IPLB is not generated if no boot device is defined. + */ + if ((s390_has_certificate() || s390_secure_boot_enabled()) && + !ipl->iplb_valid) { + error_report("No boot device defined for Secure IPL"); + exit(1); + } } else { ipl->qipl.chain_len =3D 0; } --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939267; cv=none; d=zohomail.com; s=zohoarc; b=QlSWoGO/Z7UW0RX74uQnyI2EWrKq8zCuAWqxZXX2KaEERvDtL84B94mILqrl5N2F+CgcM8yN7U1bXVgZukVvRLLJNQ/h+VEphDA/jcrQdAOYk8tyFJnoF2ueDBCYgojip1tQwJqgaxVwQuK6eQZEsBD/7J+jGf3IIN66wBh7FA4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939267; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JbxLzSL2g7Atg+2SDcsJiJbzAuuwSlleV+K3OwKPTCw=; b=UvSwLau/RQPGbw+JEWwV4hvXu/CU4TqAIGGovEAxg8XMJ1xkb0HCaySWimFvIM048YpV4AMrrr/AGm61BPVW/H6Zm5OIrA1rvmDv4mv8M7G5vpnZcXLIKdyWEF9zJMK6nfNVFT85VJ4N0O0v5Oa7SZFUCyNvVN62Q1oZjwO+mZA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939266998524.6998403756033; Wed, 1 Jul 2026 13:54:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tr-0005ff-44; Wed, 01 Jul 2026 16:51:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tm-0005LP-6k; Wed, 01 Jul 2026 16:51:10 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tk-0004WC-JV; Wed, 01 Jul 2026 16:51:09 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GnQAl1296349; Wed, 1 Jul 2026 20:51:05 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26mjxafd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:05 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnbSP006913; Wed, 1 Jul 2026 20:51:04 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhh0w8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:04 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kp3QW33030804 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:51:03 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 80AC25804E; Wed, 1 Jul 2026 20:51:03 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D6DCB5803F; Wed, 1 Jul 2026 20:51:00 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:51:00 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=JbxLzSL2g7Atg+2SD csJiJbzAuuwSlleV+K3OwKPTCw=; b=HM2n2gHkT8+82qJh9LvfSiQrFF5ntw9bC YG2i8Ruo80uZqiUcnPeBoVsgFZEgKYzCdw4gmdq3gM7tMPmblfwiYAQHITPFfrYk Oi+sD+yfwdiAavE5k/5g1VlpL583UYxhMgV2pJGuCd0x/9oo07dlnIFfCQsEe7xU gGqOpQGWG03pWb2cfFQrhFP9JR0PD1/zeQsjJ7f7UYzYtyjkCEHpNI92jzxA2mOx uG/29LyRaNWO7EhGbGdpk90QgnrYwdWCkko1g+V82BVAnkhJvqMzrFyav9RZmQHm yEEhIfEXH2ie+4W8h2wpMoywSWbP6Mqc5iw3yxWNGJjYPVvf+/BcQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 32/35] s390x/ipl: re-apply secure boot flags on DIAG 308 reboot Date: Wed, 1 Jul 2026 16:49:18 -0400 Message-ID: <20260701204922.1320349-33-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX+J153HIX0NRA KhDs/Q8k5DIBHJT179BHzZ12kT7nJHVClqRIXTwt3u39zaiNpQNLEkgH7J8HdzpJCqdQq7SKGMF x/7n/q9Cfo3Y7mipQWycQ7o9kAMhFBGDnRa0a5dLWm/jU/wKxXFL3NxIEpfmtjc9UwF8rK+gy5k ToTMWy6AUmz1FIDbw0qGidmSJ3VNjYZw/v/CF/E9jgv2Bxx97yuZ3LYjZJ6YF0fCKJ+32BsPUto zNjkAG6yHCFvfhl0KkV9XgHtkKD4FehNgZNjMmm/cArieKW5HXB5B92Qei2RA3O4Vfq7zrKgz7i JrKTI7kZMZe7zoWaLBKUNuvMcx/fMBYCYFBH7Ds7u/Z5E6GQM1+7Sv9ALvH4IeCjQjyPLkGJOn5 iouSCZZZTggO9wlb43ZtJ7SCxstVuwN5fHclPNT1BccBusdBCAbcZXpst30akihk3BAvz93vDxb UX+Ut8yt1OVIsHsxTuA== X-Proofpoint-GUID: T_7Wxynw_3QI7AFqRZEQKyrJ3UxebIXX X-Authority-Analysis: v=2.4 cv=Z8bc2nRA c=1 sm=1 tr=0 ts=6a457db9 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=GJyF48k09KdBxdLS7nQA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX6duhhcGt1RSo dFjIGzBRXNOFlY1UaIVMOEq6vHUlgpbCy07RXlaDEKijWLo1q9d5efcrUrdZ+Kp7pgCMmEKGY/+ BvHB5rzg3WRZKnDzodJAjsiQFzbqIzU= X-Proofpoint-ORIG-GUID: T_7Wxynw_3QI7AFqRZEQKyrJ3UxebIXX X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939267888158500 Content-Type: text/plain; charset="utf-8" The Linux kernel does not preserve hdr_flags in the IPLB across a reboot, causing secure IPL flags to be lost on re-IPL. Set secure IPL flasg from s390_ipl_update_diag308() to restore the flags from the current machine configuration. Device validation is skipped here as it was already enforced during initial boot. Signed-off-by: Zhuoying Cai --- hw/s390x/ipl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index f4e01b6918..f970b34126 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -737,6 +737,14 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) } else { ipl->iplb =3D *iplb; ipl->iplb_valid =3D true; + + /* + * The kernel does not preserve secure boot flags across a reboot. + * Re-apply them here based on the current machine configuration. + */ + s390_set_secure_boot_flags(&ipl->iplb, + s390_secure_boot_enabled(), + s390_has_certificate()); } =20 update_machine_ipl_properties(iplb); --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939324; cv=none; d=zohomail.com; s=zohoarc; b=CVAsOKXJp3FWOi6FKJTG9Xuu3K8jM6DnREuqsB4SXcZJW8YcRdsjgzls/SbDv5SZo4Ol9XNHYPogKPfM2K/uDj1yrZNXxiD7jeUaBEOFY2PuSZGlWdYqlw4zgTa8799vMQ+rh+Esp6qGiOU6ka4t0rqi9ptHfuqL6+VAiVk0vY0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939324; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=y2ZEOyPJnq6RBxjSGXHxCe6xCdeisLlDMUSdLmHcyQo=; b=aq+7K39gYY+lA8y5HDXY6/NMGqsHkXdw3VGfdb8gkX1r7VlSsHqvok8hBgqMupdZJqKLQt+0CfqnPODtQX1QOW7yEFoDM1Qc8/OL9DfJClu5Z6y7yhZaJuW0l9HP3fQ26qInDSUB2drQpvx7W4askqIHf7yDSGpD6FP7HY6p5Pc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939324570713.6054095089497; Wed, 1 Jul 2026 13:55:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tx-0006X4-98; Wed, 01 Jul 2026 16:51:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tv-0006Hp-Ih; Wed, 01 Jul 2026 16:51:19 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tn-0004X6-Rp; Wed, 01 Jul 2026 16:51:13 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmjPT1295225; Wed, 1 Jul 2026 20:51:08 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26mjxafk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:08 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnbkB001596; Wed, 1 Jul 2026 20:51:07 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7w963m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:07 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kp6qf33489574 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:51:06 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 64D195804E; Wed, 1 Jul 2026 20:51:06 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BAE035803F; Wed, 1 Jul 2026 20:51:03 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:51:03 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=y2ZEOyPJnq6RBxjSG XHxCe6xCdeisLlDMUSdLmHcyQo=; b=iumfKVfRyAn9Bjm7mfjuMLPyf/J7TW5TC HAA0dFA2FvJ3/IcmAriMkcAjxOgPdP+Rel5t04MFan8Hj1QaWVnMPGNOqU9/HeFY 2Udl36dvpAvbi5fN4BEMuQKwSh/J5/KoTFlb2pvnh4UpLvbgL8gyMyTtkMktdgcO VPF8lXBYjqAPCj6VwTG3eCSvwcwdOVhrsQIeEWhU21EGttKReb4qQcVs7FDrQN0y oXrWsbi6RLWqUO0LUhAQezstjl0ufC9uLvNlZ5C4a+oeF2DWuxZKJd2JDb02h0Oj kcZlnGknXo0g8PU1gfaM1Qx+A8uHa3zpEz2TbxbD8UKwex9hTTwYw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 33/35] tests/functional/s390x: Add secure IPL functional test Date: Wed, 1 Jul 2026 16:49:19 -0400 Message-ID: <20260701204922.1320349-34-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfXxXFk8SvTOYFa +KNjmH0YxJqXfh9fddgChYFefesP6tl0K9Ej4l4TfRIn9kQVQIiv/op97j6+JastQ7jS5onnSO6 eB7kuy6IwDC6rSC9n8ugli1lNeLyeVJCR/V1QPD2qQpk98KIwZlN2Jsrgh+Gqt6ggn2rhr5QO7d wJZ7tIEa8wanYw2s0Ysv+M5IDogv5bwu4EGCNGglftlB629J5qPBn+GTWTQYM6N2swu4QloCi3a W4rtB+GTdFz9scz9p2oHfW09QFH0PDxBVQyD64L/QulP2Bk0nnB2vPnwszTRO/+TgJJqWqOzLV1 znT5fXBbFspF9hLzM8b9D1wPJ3cLvghDYsUUGfFDwiVLMa70qycDXF5smk962+Qy+XK8dCoQmOl tHXQkKwhmll867AJFBGdAqoXF0gS6gMznt/7cAiYtd1wP1KbBdTg7kaH2h/Ggb55JxoZCbjDFL/ s0We1zrFglYbgDSQlLA== X-Proofpoint-GUID: JW1I7PefiyOb24AX83uvlLXG0b3ddocO X-Authority-Analysis: v=2.4 cv=Z8bc2nRA c=1 sm=1 tr=0 ts=6a457dbc cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=vTr9H3xdAAAA:8 a=VnNF1IyMAAAA:8 a=WP5zsaevAAAA:8 a=vvdW6g1Vg8v77fwKLDIA:9 a=t8Kx07QrZZTALmIZmm-o:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX2b2N5hRHGBR9 Mra32HnCncUjF3S6ZKKq8gL4aaXjB7y1Iw1qN+DPz1xIYfymGxADN1xYeUIpv/hfaaECBLAdGrM kFSAYYUkkCWp2vwOB1TLx6Htz6ais3E= X-Proofpoint-ORIG-GUID: JW1I7PefiyOb24AX83uvlLXG0b3ddocO X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939326318158500 Content-Type: text/plain; charset="utf-8" Add functional test for secure IPL. Signed-off-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- tests/functional/s390x/meson.build | 2 + tests/functional/s390x/test_secure_ipl.py | 172 ++++++++++++++++++++++ 2 files changed, 174 insertions(+) create mode 100755 tests/functional/s390x/test_secure_ipl.py diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/me= son.build index b065b666bc..16da5f0054 100644 --- a/tests/functional/s390x/meson.build +++ b/tests/functional/s390x/meson.build @@ -2,6 +2,7 @@ =20 test_s390x_timeouts =3D { 'ccw_virtio' : 420, + 'secure_ipl' : 360, } =20 tests_s390x_system_quick =3D [ @@ -14,6 +15,7 @@ tests_s390x_system_thorough =3D [ 'ccw_virtio', 'pxelinux', 'replay', + 'secure_ipl', 'topology', 'tuxrun', ] diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py new file mode 100755 index 0000000000..06fc93e404 --- /dev/null +++ b/tests/functional/s390x/test_secure_ipl.py @@ -0,0 +1,172 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +""" +s390x Secure IPL functional test. + +Validates s390x secure boot by preparing a signed guest image, booting with +secure-boot enabled, and verifying cryptographic validation results. +""" + +from subprocess import check_call, DEVNULL + +from qemu_test import QemuSystemTest, Asset, get_qemu_img +from qemu_test import exec_command_and_wait_for_pattern, exec_command +from qemu_test import wait_for_console_pattern, skipBigDataTest + +class S390xSecureIpl(QemuSystemTest): + """Test s390x Secure IPL (secure boot) functionality.""" + ASSET_F40_QCOW2 =3D Asset( + ('https://archives.fedoraproject.org/pub/archive/' + 'fedora-secondary/releases/40/Server/s390x/images/' + 'Fedora-Server-KVM-40-1.14.s390x.qcow2'), + '091c232a7301be14e19c76ce9a0c1cbd2be2c4157884a731e1fc4f89e7455a5f') + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.root_password =3D None + self.qcow2_path =3D None + self.cert_path =3D None + self.prompt =3D None + + def _create_certificate(self, vm): + """Generate x509 certificate""" + exec_command_and_wait_for_pattern(self, + 'openssl version', 'OpenSSL 3.2.= 1 30', + vm=3Dvm) + exec_command_and_wait_for_pattern(self, + 'openssl req -new -x509 -newkey rsa:2048 ' + '-keyout mykey.pem -outform PEM -out mycert.pe= m ' + '-days 36500 -subj "/CN=3DMy Name/" -nodes -ve= rbose', + 'Writing private key to \'mykey.pem\'', vm=3Dv= m) + + def _sign_binaries(self, vm): + """Sign stage3 binary and kernel""" + # Install kernel-devel (needed for sign-file) + exec_command_and_wait_for_pattern(self, + 'sudo dnf install kernel-devel-$(uname -r)= -y', + 'Complete!', vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + exec_command_and_wait_for_pattern(self, + 'ls /usr/src/kernels/$(uname -r)/scrip= ts/', + 'sign-file', vm=3Dvm) + + # Sign stage3 binary and kernel + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' + 'sha256 mykey.pem mycert.pem /lib/s390-tools/stage3.bi= n', + vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' + 'sha256 mykey.pem mycert.pem /boot/vmlinuz-$(uname -r)= ', + vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + + def _run_zipl_secure(self, vm): + """Run zipl to prepare for secure boot""" + exec_command_and_wait_for_pattern(self, 'zipl --secure 1 -VV', 'Do= ne.', + vm=3Dvm) + + def _extract_certificate(self, vm): + """Extract certificate from VM to host filesystem""" + out =3D exec_command_and_wait_for_pattern(self, 'cat mycert.pem', + '-----END CERTIFICATE-----= ', + vm=3Dvm) + # strip first line to avoid console echo artifacts + cert =3D "\n".join(out.decode("utf-8").splitlines()[1:]) + self.log.info("%s", cert) + + self.cert_path =3D self.scratch_file("mycert.pem") + + with open(self.cert_path, 'w', encoding=3D"utf-8") as file_object: + file_object.write(cert) + + def setup_s390x_secure_ipl(self): + """ + Prepare a secure boot-enabled guest image. + + Boots a temporary VM to generate a certificate, sign boot componen= ts + (stage3 and kernel), run zipl, and extract the certificate to host. + """ + self.require_netdev('user') + + temp_vm =3D self.get_vm(name=3D'sipl_setup') + temp_vm.set_machine('s390-ccw-virtio') + + asset_path =3D self.ASSET_F40_QCOW2.fetch() + self.qcow2_path =3D self.scratch_file('f40.qcow2') + qemu_img =3D get_qemu_img(self) + check_call([qemu_img, 'create', '-f', 'qcow2', '-b', asset_path, + '-F', 'qcow2', self.qcow2_path], stdout=3DDEVNULL, std= err=3DDEVNULL) + + temp_vm.set_console() + temp_vm.add_args('-nographic', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') + temp_vm.launch() + + # Initial root account setup (Fedora first boot screen) + self.root_password =3D 'fedora40password' + wait_for_console_pattern(self, 'Please make a selection from the a= bove', + vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, '4', 'Password:', vm=3Dtem= p_vm) + exec_command_and_wait_for_pattern(self, self.root_password, + 'Password (confirm):', vm=3Dtemp= _vm) + exec_command_and_wait_for_pattern(self, self.root_password, + 'Please make a selection from the abov= e', + vm=3Dtemp_vm) + + # Login as root + self.prompt =3D '[root@localhost ~]#' + exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', v= m=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= temp_vm) + exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt, + vm=3Dtemp_vm) + + self._create_certificate(temp_vm) + self._sign_binaries(temp_vm) + self._run_zipl_secure(temp_vm) + self._extract_certificate(temp_vm) + + # Shutdown temp vm + temp_vm.shutdown() + + @skipBigDataTest() + def test_s390x_secure_ipl(self): + """ + Verify secure boot validation during s390x guest boot. + + Expects two "Verified component" messages and confirms + /sys/firmware/ipl/secure reports secure boot is active. + """ + self.require_accelerator('kvm') + self.setup_s390x_secure_ipl() + + self.set_machine('s390-ccw-virtio') + + self.vm.set_console() + self.vm.add_args('-nographic', + '-machine', 's390-ccw-virtio,secure-boot=3Don,' + f'boot-certs.0.path=3D{self.cert_path}', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + '-device', 'virtio-blk-ccw,drive=3Ddrive1,bootind= ex=3D1') + self.vm.launch() + + # Expect two verified components + verified_output =3D "Verified component" + wait_for_console_pattern(self, verified_output) + wait_for_console_pattern(self, verified_output) + + # Login and verify the vm is booted using secure boot + wait_for_console_pattern(self, 'localhost login:') + exec_command_and_wait_for_pattern(self, 'root', 'Password:') + exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt) + exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/sec= ure', '1') + +if __name__ =3D=3D '__main__': + QemuSystemTest.main() --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939280; cv=none; d=zohomail.com; s=zohoarc; b=Ife6waQc60FgLl332WgiBB6M1hBohrZjMCRFlugwBB46XQWjIB/CBu78cGwTRRan462jI6ImvV5YZMEqXtuf+fJFtRP3L25vo95MFofg6wwnzrVz3ijafV6vWOgb5xO2uI6fn2dKAnmYLmMlGEuyfLX7Q/j6l4IkcEIkiJGfouA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939280; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZcTm5HiNVqmSFXumIkNpUiKe2D0AR+6g1yrv6mfwb+Y=; b=EhF0ggV9rvsTJvOHxaC6/J0VEazgIXEzciG7LbC1AVt74fEYyZNS4aLoNVUWkCT0g8i4WfhaU6fbk/JEPwDwx/5/Ijc6YI0op016IVfv5/qMDVUXzhS7O6uAX1aSHavrHbqg3Qp8dt2t5PZPyW8rz6searr7sNHhD0fPRzEQyzs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939280809670.6557983048224; Wed, 1 Jul 2026 13:54:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1tz-0006mF-95; Wed, 01 Jul 2026 16:51:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tx-0006ZG-9J; Wed, 01 Jul 2026 16:51:21 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tu-0004XK-Q4; Wed, 01 Jul 2026 16:51:20 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661GmtPb1339859; Wed, 1 Jul 2026 20:51:12 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qa6a1h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:11 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661Knan8030792; Wed, 1 Jul 2026 20:51:10 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2ggxxg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:10 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661Kp9Ef6357576 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:51:09 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 74AA658055; Wed, 1 Jul 2026 20:51:09 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9C20958054; Wed, 1 Jul 2026 20:51:06 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:51:06 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ZcTm5HiNVqmSFXumI kNpUiKe2D0AR+6g1yrv6mfwb+Y=; b=A6i92flu8ugLWxXZm5g5gmKqCMLMt+xXG pwIlJ40ghDo/Nh+hfjlGDDJnU+PetN0/u9ifWC+qV+mJYRb5EJoxeD206/cjgVmR Xe6NBYLEl+QdXld4HwP3z18n2WkCOIQG1HJ2JYD9qe+aLxF9+EL0dAzEn8+HMd0a 2fFnzLr9zkS56Zqfj/kpSXhIevLNsaMWNgnsJJ+1n4pA1RcV+k2YRGVKEt9KHTdf Kuojyqgvx9PizhUYwpsj91YU5fjSRuKNOpjNqXXxWTjbKYhJ7LxXqNBewUj7Qlpj 1loObvorCjg2fFp/iufHsa5DO2ttQZ3HWTey05xWib4mzye/ENi+Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 34/35] docs/specs: Add secure IPL documentation Date: Wed, 1 Jul 2026 16:49:20 -0400 Message-ID: <20260701204922.1320349-35-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX/EQ14cTvU7Dd CCXUn6u9O1ZNC/jg3tOhzdC85dSX94sepr7vLXxN6Xt2rDMoMQKhEcUN/RwmtA7OnBT46OG1N2z PuoKSYBTYvgTBfMEu8D+xwHqctpWsjNmiTujYnImWHD/bGVqjJUeQVjuWG9/m3WLibhypR89blV 0wlGdxFbkkDKGsj23u0grGJiA257gTe3qdMORAVb5bOLzF6GH7wC9CjnLBajm8Q/Vj0ZxK4lJ4N IP+sdQMdeq1R9aTvK63/wZiyS0BRadD0hkr4Ss9X2qvoJCQ55RUtNejptt7ixPiP0bavuIlRp6/ LVmZTgjkOktSBZOADd5813AeT4nyowT1vGEDw1sY0zsptTEpWzuwVWx71gpOAMDMV6VDWaf5fDy zXd+ieR5BiyRMDQ8aQmn38M9IzSM89D/QRU6mOTozFGR5tMGVWs/hbj3TCxSawknG+NTZKhtvwc zQiEPKmDgkclk1sfgWQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX6OYaiaG4H34e GZb5pY7hsQ9xFuGB/0YIaBJ5tcLQC4VWW0ch/VfMmgRTamj28+ePAIAOVpm8rgszqJmnM7j1nSB FI1WP2lc1cjoQ43QpZ9os41HpI1keh4= X-Proofpoint-GUID: jjLAveQ8jGaeSVbgz224XkcjgWDnN2Fi X-Proofpoint-ORIG-GUID: jjLAveQ8jGaeSVbgz224XkcjgWDnN2Fi X-Authority-Analysis: v=2.4 cv=WZ88rUhX c=1 sm=1 tr=0 ts=6a457dbf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=XijvyHP8Q_8UnoOVIU8A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939282014158500 Content-Type: text/plain; charset="utf-8" Add documentation for secure IPL Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- docs/specs/s390x-secure-ipl.rst | 55 +++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 0f92ff96b9..65a4b2f624 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -1,5 +1,60 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL (a.k.a. secure boot) enables s390-ccw virtual machines to +leverage qcrypto libraries and z/Architecture emulations to verify the +integrity of signed kernels. The qcrypto libraries are used to perform +certificate validation and signature-verification, whereas the +z/Architecture emulations are used to ensure secure IPL data has not +been tampered with, convey data between QEMU and guest code, and set up +the relevant secure IPL data structures with verification results. + +To find out more about using this feature, see +:doc:`documentation `. + +Note that "guest code" will refer to the s390-ccw BIOS unless stated +otherwise. + +Both QEMU and guest code work in cooperation to perform secure IPL. The Se= cure +Loading Attributes Facility (SCLAF) is used to check the Secure Code +Loading Attribute Block (SCLAB) and ensure that secure IPL data has not +been tampered with. DIAGNOSE 'X'320' is invoked by guest code to query +the certificate store info and retrieve specific certificates from QEMU. +DIAGNOSE 'X'508' is used by guest code to leverage qcrypto libraries to +perform signature-verification in QEMU. Lastly, guest code generates and +appends an IPL Information Report Block (IIRB) at the end of the IPL +Parameter Block, which is used by the kernel to store signed and +verified entries. + +The logical steps are as follows: + +- guest code reads data payload from disk (e.g. stage3 boot loader, kernel) +- guest code checks the validity of the SCLAB +- guest code invokes DIAG 508 subcode 1 and provides it the payload +- QEMU handles DIAG 508 request by reading the payload and retrieving the + certificate store +- QEMU DIAG 508 utilizes qcrypto libraries to perform signature-verificati= on on + the payload, attempting with each cert in the store (until success or + exhausted) +- QEMU DIAG 508 returns: + + - success: index of cert used to verify payload + - failure: error code + +- guest code responds to this operation: + + - success: retrieves cert from store via DIAG 320 using returned index + - failure: reports with warning (audit mode), aborts with error (secure = mode) + +- guest code appends IIRB at the end of the IPLB +- guest code kicks off IPL + +More information regarding the respective DIAGNOSE commands and IPL data +structures are outlined within this document. + + s390 Certificate Store and Functions ------------------------------------ =20 --=20 2.54.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782939247; cv=none; d=zohomail.com; s=zohoarc; b=Eu2kCvRRBAbDF2kmJl41KMlnc6nUaw7G6cSdjYwuwdSYNPQGyun5DdtAttclKkfQwQj0Wo8W4c21DXsA9xx0dJ6e/A/ZtFe2cTwHNZ/Crg5nmf7gMinsaDTPuuSup9aSZbKVvKCywlVPUHYnjQ6Ykleqk4S2LxbvsbFgrbU9a2Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782939247; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nsK9FBAMBCYC7/MgwSTu9dE/HE+nAwhf3LNFJfKCU0E=; b=HNbGwJo/Ay2GLO9UvAAoE8Sgb7nBcy6eo/U7NqNAgJg7Ms7DFamLRmXjOqj4YZdAnpfBBDR2aUmdUsMKAjsRvTS/tzPlw5NHibQanDITtsmRxDuyn58a1qRX7lBxlOM/GG/5v3FIWJMP0X8P+3IY2qKGAvJipnPbp4oj8blSyXI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782939247364106.15322681171847; Wed, 1 Jul 2026 13:54:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wf1u3-0007Hi-HG; Wed, 01 Jul 2026 16:51:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1ty-0006kn-TK; Wed, 01 Jul 2026 16:51:22 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wf1tv-0004XW-Mf; Wed, 01 Jul 2026 16:51:22 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 661Gn7ie1341374; Wed, 1 Jul 2026 20:51:15 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26rf66g1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:14 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 661KnakX027027; Wed, 1 Jul 2026 20:51:14 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2suk930x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 01 Jul 2026 20:51:14 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 661KpCjN55574828 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Jul 2026 20:51:12 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 81E9B5804E; Wed, 1 Jul 2026 20:51:12 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AFE6E5803F; Wed, 1 Jul 2026 20:51:09 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.149.234]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 1 Jul 2026 20:51:09 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=nsK9FB AMBCYC7/MgwSTu9dE/HE+nAwhf3LNFJfKCU0E=; b=tSUu6riru0Mb5wg+boYZdt C9+D5RuXeLF3qngdb6nSeinfhbIqKIxyQNH1MPX/R1QiVV286gtcdMxuEbbTGriz 0XZnRQYhM56PaJdTwdXZgsJXBZEUJU6Hw205qOEAb6aJRmbil6qdiVVto4nl1xsQ ga6ftVGcEum7lEz7vNL1JzFFyJg//nXL6pbMATRIXoe83pZb7V0S0lfav/1HQh5M Ue+u1sIKXI7jxEz1pJjInYKkoYIzl291VeFh/hBOZJI3OxFMsDSoia2X00OdMIjK BfgNQ00XWZq6t6VXMJCBSjy1R2xrHYsHxkMAVTZZ+ui1FY2dDBneFUs+IJ7JTd4w == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v12 35/35] docs/system/s390x: Add secure IPL documentation Date: Wed, 1 Jul 2026 16:49:21 -0400 Message-ID: <20260701204922.1320349-36-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260701204922.1320349-1-zycai@linux.ibm.com> References: <20260701204922.1320349-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=a4kAM0SF c=1 sm=1 tr=0 ts=6a457dc2 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=q5T4S90kAAAA:8 a=xOmL8MRHFtDrr2fuNQ0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=LnBBZQxPVJ0Z7KJyRdxh:22 X-Proofpoint-ORIG-GUID: wrImkqN6-OI9bs2vKshiY2mAAzcpojDD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX6OzJ6lyXrmmh a44iuUs4IisLD/wpsLbQAs/NTW9JG7tFEyJUZoi/5VnnTWh7NHE1DoSm93mU5xO/rl+qf3I9GaJ 80a1RL13UZoMFSLfuo2tLsV+SIyXlPaSYc4X6mH7eeFqw2NOChVvwDTE0WdAYY/zrkoRa8HUxJV wKlPee97sS9uhM9bUrluLip3kiQswjsMEx7d1cjI+qi/FCJt9T9uORegWb1K1r0D8jhU8rIqeZr PZe8a0MqcE5Hdm9ivX2sgx6IwToCRsEyN0n0wlqz95mKKcueBZz46a7briWXgdi8ITRaAwgGXGy BE6Dzdmt/wxDMDHKEnX1Mqd+AWQ6FPFOjcFfDhQtgmYIF/eREYpeVl3J+pBR/L6a+Kyaa7JBqnc HJHMpb7EeHA7SVLa44GlBLrOjkKliTw9oSMunxC74aGyYHSZAWo5K3Tfr5rZPm8vseL4fr/uT14 eYWd3MsQ8XA2wIaRo3g== X-Proofpoint-GUID: wrImkqN6-OI9bs2vKshiY2mAAzcpojDD X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAxMDIyMiBTYWx0ZWRfX1PzMgh4/td5K myKVlV4brVjHhDMsEhek02AQQtKjhN+XYm1y5EmiE4fnMYwOs5FlKcHuz87MpMKzzp12jdbUuAF 4COeocMEGnOxzrSjD0njIPuXdzxch8w= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-01_04,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 priorityscore=1501 adultscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607010222 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782939247847158500 Add documentation for secure IPL Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Joshua Daley Reviewed-by: Matthew Rosato --- docs/system/s390x/secure-ipl.rst | 103 +++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index c8fb887ac0..91c9c4be11 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -1,5 +1,22 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL, also known as secure boot, enables s390-ccw virtual machines to +verify the integrity of guest kernels. + +For technical details of this feature, see the +:doc:`specs document `. + +This document explains how to use secure IPL with s390x in QEMU. It covers +the command line options for providing certificates and enabling secure IP= L, +the different IPL modes (Normal, Audit, and Secure), and system requiremen= ts. + +A quickstart guide is provided to demonstrate how to generate certificates, +sign images, and start a guest in Secure Mode. + + Secure IPL Command Line Options ------------------------------- =20 @@ -79,3 +96,89 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don,boot-certs= .0.path=3D/.../qemu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + + +Constraints +----------- + +The following constraints apply when attempting to boot an s390x guest in = secure +mode: + +- z16 or "qemu" CPU model +- certificates must be in X.509 PEM format +- only support for SCSI scheme of virtio-blk/virtio-scsi devices +- a boot device must be specified +- any unsupported devices (e.g., ECKD and VFIO) or non-eligible devices (e= .g., + network) will cause the entire boot process terminating early with an er= ror + logged to the console. + + +Secure IPL Quickstart +--------------------- + +Build QEMU with gnutls enabled +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: shell + + ./configure =E2=80=A6 --enable-gnutls + +Generate certificate (e.g. via certtool) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +A private key is required before generating a certificate. This key must b= e kept +secure and confidential. + +Use an RSA private key for signing. + +.. code-block:: shell + + certtool --generate-privkey > key.pem + +A self-signed certificate requires the organization name. Use the ``cert.i= nfo`` +template to pre-fill values and avoid interactive prompts from certtool. + +.. code-block:: shell + + cat > cert.info <