From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201287; cv=none; d=zohomail.com; s=zohoarc; b=jTYzjbkDVmq/GbWRnXzmN/EAXMEmxRo8x3Ch7R7g13nvBDeAb9MccrZa6p+gKb23E88EoLw/X3w3rx6rmG17h1OT+8YiN9xX8O1iGlJNLsF6yBpMuU/N5CaQ38skZM6403grUsnNE0UsqqHvp0SeNKIuO4dI6zChtklGehwRVYc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201287; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tbuG974DVy7BcZimxvx/tFbgAyqKjL+BcjNFMhSXDvw=; b=iPDk7+bp0quk8ijKK7+3Vt+Pf60HlzYNXtIWcBEqI3Rg7q+bDniaYJd93canEHWHz/wf7R4ioC0+FG0FQAdrxtKkNUSOY1kx6zCOCrKSHQZ20jDHbe9NKTTo9OTOzk7YCVyOo+tE7z+NRp9BgCuW2H4+kvMjMrgwV9gJu3mBf0w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201287028929.7050022440362; Sat, 4 Jul 2026 14:41:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85x-0007MC-HO; Sat, 04 Jul 2026 17:40:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85t-0007JO-02; Sat, 04 Jul 2026 17:40:13 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85q-0007Qw-Jt; Sat, 04 Jul 2026 17:40:12 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmaQM2705986; Sat, 4 Jul 2026 21:39:59 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7ej-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:39:59 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYxxi010144; Sat, 4 Jul 2026 21:39:58 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbrq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:39:58 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LduXa31130196 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:39:56 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A6E8B58056; Sat, 4 Jul 2026 21:39:56 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 89B7258050; Sat, 4 Jul 2026 21:39:54 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:39:54 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=tbuG974DVy7BcZimx vx/tFbgAyqKjL+BcjNFMhSXDvw=; b=OT0ByQ8dSPxyCYf2KytNxZRPzhYPASqke obuHAdzk3fsp9HH6xf7WsPs9pD36g40JF2jQR1yL1Oe8WYUEKbM6E6JTNqA1DZEO siEhbkNxgR/uepRrSG6OJnwU6Jl5U9+wo++jhU6iMS6huKvE2Pb5FsSHf9iAhAtr TJ9HFhs+xB+jVaqLn4EvpaW7CObP4TPFCG0uM7XKu8pNq3IUjTpa4kioGgwsi+aX QSyit2j1d75rPl5RKCKcomQLeu2+fSZz8ly8/3RvveAKsGT4EpPNzjm0QEjZJHQ4 mD2j0C8EXPHUod6bmeacgw1oQtaYT8oYwaz8RiN6Arqhx2OWaDRwQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 01/33] Add boot-certs to s390-ccw-virtio machine type option Date: Sat, 4 Jul 2026 17:39:17 -0400 Message-ID: <20260704213950.2118823-2-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX2Mju2Dvvvg1N n+UTSULEkj2YZ4WJw5XM0r7UXBZB68JZxVC4/RpJgK6ivJDrTw/QjnQdB7LaU1sJGJ71hfo1el/ BQ2GMSeIFaes9APOz0JOzG6wRiT0icI= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/im66bG5P6jk UbsfwBB4my5ZzK15aXEE4jZkEJr1RNi0laVz/rXWADKLplwuDDSn4t+j+mVoYAaQ+RnExoOE3Wr uJFPZG8lIZZDa5Jz4tsar48dsyjlt71PD0jEry15NJs7N+GWcPqottYWbl/+5g0atwM2o1TkT4H mQncyPsQUdiZehFqo8qY18CKIALtP+wA+/nxkvhCmdLT0JTDbZByBwqqveBSNOKNwWTtJH+Abqk CkV2ZWmpsQRmXPmb8VN4O2Uq6ch26Q/4ncH/tD7kBq8DseY3JBmHrEMdBJ6m3AviLZC/oVgXZ/y UBKvDjS0w5RGChs4+4rhzm0olVzWmeS3KmEhFHfLniY2N87S0DXTll2JiAObAPTrCWsb0ssNzXW 6nagoHcud6K0V58MdWQ08574O/3qbpziVk+jlGWoJ3MnCgxuBlTnlnIQNVhqd+AK7XVJf+k1Jx6 STWiZx8MNREKmEiLElw== X-Proofpoint-GUID: 7XEEeLLP5FIjKkBbnD6JrGW5PSnsu6R5 X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497daf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=wzXgNLvc2PBhCEj-crYA:9 X-Proofpoint-ORIG-GUID: 7XEEeLLP5FIjKkBbnD6JrGW5PSnsu6R5 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201288114158500 Content-Type: text/plain; charset="utf-8" Introduce a new `boot-certs` machine type option for the s390-ccw-virtio machine. This allows users to specify one or more certificate file paths or directories to be used during secure boot. Each entry is specified using the syntax: boot-certs..path=3D/path/to/cert.pem Multiple paths can be specify using array properties: boot-certs.0.path=3D/path/to/cert.pem, boot-certs.1.path=3D/path/to/cert-dir, boot-certs.2.path=3D/path/to/another-dir... Signed-off-by: Zhuoying Cai Acked-by: Markus Armbruster Reviewed-by: Matthew Rosato --- docs/system/s390x/secure-ipl.rst | 20 +++++++++++++++ docs/system/target-s390x.rst | 1 + hw/s390x/s390-virtio-ccw.c | 40 ++++++++++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 3 +++ qapi/machine-s390x.json | 23 +++++++++++++++++ qapi/pragma.json | 1 + qemu-options.hx | 6 ++++- 7 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 docs/system/s390x/secure-ipl.rst diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst new file mode 100644 index 0000000000..88df52ce2f --- /dev/null +++ b/docs/system/s390x/secure-ipl.rst @@ -0,0 +1,20 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +Secure IPL Command Line Options +------------------------------- + +The s390-ccw-virtio machine type supports secure IPL. These parameters all= ow +users to provide certificates and enable secure IPL directly via the comma= nd +line. + +Providing Certificates +^^^^^^^^^^^^^^^^^^^^^^ + +The certificate store can be populated by supplying a list of X.509 certif= icate +file paths or directories containing certificate files on the command-line: + +Note: certificate files must have a .pem extension. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/docs/system/target-s390x.rst b/docs/system/target-s390x.rst index 94c981e732..8938a13d10 100644 --- a/docs/system/target-s390x.rst +++ b/docs/system/target-s390x.rst @@ -35,3 +35,4 @@ Architectural features s390x/bootdevices s390x/protvirt s390x/cpu-topology + s390x/secure-ipl diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 25a9fa4955..c68a760f75 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -44,6 +44,7 @@ #include "target/s390x/kvm/pv.h" #include "migration/blocker.h" #include "qapi/visitor.h" +#include "qapi/qapi-visit-machine-s390x.h" #include "hw/s390x/cpu-topology.h" #include "kvm/kvm_s390x.h" #include "hw/virtio/virtio-md-pci.h" @@ -788,6 +789,36 @@ static void machine_set_loadparm(Object *obj, Visitor = *v, g_free(val); } =20 +static void machine_get_boot_certs(Object *obj, Visitor *v, + const char *name, void *opaque, + Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertificatesList **certs =3D &ms->boot_certs; + + visit_type_BootCertificatesList(v, name, certs, errp); +} + +static void machine_set_boot_certs(Object *obj, Visitor *v, const char *na= me, + void *opaque, Error **errp) +{ + S390CcwMachineClass *s390mc =3D S390_CCW_MACHINE_GET_CLASS(obj); + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + BootCertificatesList *cert_list =3D NULL; + + if (!s390mc->use_certs) { + error_setg(errp, "boot-certs is not supported by this machine vers= ion"); + return; + } + + visit_type_BootCertificatesList(v, name, &cert_list, errp); + if (!cert_list) { + return; + } + + ms->boot_certs =3D cert_list; +} + /* * S390x-specific global compatibility properties. * @@ -813,6 +844,7 @@ static void ccw_machine_class_init(ObjectClass *oc, con= st void *data) =20 s390mc->max_threads =3D 1; s390mc->use_cpi =3D true; + s390mc->use_certs =3D true; mc->reset =3D s390_machine_reset; mc->block_default_type =3D IF_VIRTIO; mc->no_cdrom =3D 1; @@ -856,6 +888,11 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars conve= rted" " to upper case) to pass to machine loader, boot manager," " and guest kernel"); + + object_class_property_add(oc, "boot-certs", "BootCertificatesList", + machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); + object_class_property_set_description(oc, "boot-certs", + "provide paths to a directory and/or a certificate file for se= cure boot"); } =20 static inline void s390_machine_initfn(Object *obj) @@ -941,6 +978,9 @@ static void ccw_machine_11_0_instance_options(MachineSt= ate *machine) =20 static void ccw_machine_11_0_class_options(MachineClass *mc) { + S390CcwMachineClass *s390mc =3D S390_CCW_MACHINE_CLASS(mc); + + s390mc->use_certs =3D false; /* * Preserve v11.0 and older version behavior: * keep legacy virtio-pci enabled. diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index f1f06119d6..d30f1fcc4c 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -14,6 +14,7 @@ #include "hw/core/boards.h" #include "qom/object.h" #include "hw/s390x/sclp.h" +#include "qapi/qapi-types-machine-s390x.h" =20 #define TYPE_S390_CCW_MACHINE "s390-ccw-machine" =20 @@ -31,6 +32,7 @@ struct S390CcwMachineState { uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; + BootCertificatesList *boot_certs; =20 SCLPDevice *sclp; }; @@ -55,6 +57,7 @@ struct S390CcwMachineClass { /*< public >*/ int max_threads; bool use_cpi; + bool use_certs; }; =20 #endif diff --git a/qapi/machine-s390x.json b/qapi/machine-s390x.json index ea430e1b88..bbe3646e91 100644 --- a/qapi/machine-s390x.json +++ b/qapi/machine-s390x.json @@ -140,3 +140,26 @@ { 'event': 'SCLP_CPI_INFO_AVAILABLE', 'features': [ 'unstable' ] } + +## +# @BootCertificates: +# +# Boot certificates for secure IPL. +# +# @path: path to an X.509 certificate file or a directory containing +# certificate files. +# +# Since: 11.1 +## +{ 'struct': 'BootCertificates', + 'data': {'path': 'str'} } + +## +# @DummyBootCertificates: +# +# Not used by QMP; hack to let us use BootCertificatesList internally. +# +# Since: 11.1 +## +{ 'struct': 'DummyBootCertificates', + 'data': {'unused-boot-certs': ['BootCertificates'] } } diff --git a/qapi/pragma.json b/qapi/pragma.json index 24aebbe8f5..342cedc42e 100644 --- a/qapi/pragma.json +++ b/qapi/pragma.json @@ -49,6 +49,7 @@ 'DisplayProtocol', 'DriveBackupWrapper', 'DummyBlockCoreForceArrays', + 'DummyBootCertificates', 'DummyForceArrays', 'DummyVirtioForceArrays', 'HotKeyMod', diff --git a/qemu-options.hx b/qemu-options.hx index e44b47de68..83915bd7ef 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -46,7 +46,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " memory-backend=3D'backend-id' specifies explicitly pr= ovided backend for main RAM (default=3Dnone)\n" " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" " sgx-epc.0.memdev=3Dmemid,sgx-epc.0.node=3Dnumaid\n" - " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n", + " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -214,6 +215,9 @@ SRST :: =20 -machine smp-cache.0.cache=3Dl1d,smp-cache.0.topology=3Dcore,s= mp-cache.1.cache=3Dl1i,smp-cache.1.topology=3Dcore + + ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` + Provide paths to a directory and/or a certificate file on the host= [s390x only]. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201329; cv=none; d=zohomail.com; s=zohoarc; b=jeCsg2rNr6Cj4CejhwTTI8pYErpz5WyiqAY7vZbjnjNTR7fKlcbz/Rp8mbguB0a9qsWg8W3sPbl7RmxDMAR7vAVfX0WCzsKFXEEvXFMBTbaxu8iK+U41I7mA6yPYfOwpYqivKLXyYpe4cfxgdtaXqq4ZfL8nsiVjjARTfj8lSS4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201329; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SRItF3Rpj3r/qWUSqrHn8Lr/8FzyN807OwVIui3tyWE=; b=aI9Udcwkm0UM2y58q2V7dBKZFogq4NGACsf2gY4Bwfl1Im6ajlJWDxDwYsSt/6mn1hb3cauh/Cl0QrD6sq27uSecyiNahMKn9jzJYyMEddWCrqwl+aHSdoH67VXje3Zx6Y0mYgxapFpQNsiLzHTOGEWs/h9HyJrvstw2wTHaaC0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201329001254.81410181521267; Sat, 4 Jul 2026 14:42:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85v-0007KC-1l; Sat, 04 Jul 2026 17:40:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85s-0007J7-Dm; Sat, 04 Jul 2026 17:40:12 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85q-0007RP-L2; Sat, 04 Jul 2026 17:40:12 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmKNV2593552; Sat, 4 Jul 2026 21:40:01 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sp3b8y3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:01 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYcgh013619; Sat, 4 Jul 2026 21:40:00 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxq68-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:00 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LdxiZ24445476 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:39:59 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E4B1E58045; Sat, 4 Jul 2026 21:39:58 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CEE7058050; Sat, 4 Jul 2026 21:39:56 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:39:56 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=SRItF3 Rpj3r/qWUSqrHn8Lr/8FzyN807OwVIui3tyWE=; b=cDSkWBSV0Ewn78Pc+VLfPJ J+BWakgngNPgQjk/ISjDuP/wslLNS3ClniD8suv6+A9RiXFK4X4ohTW+fb/E9f9x Al1GX8ZDjk05W9RgmXICb8qc4BHipcAabZthFG211MgAJfifrYl4KNehqax8vTEQ Z4ZMVfCpz2xKGD9fcc0iN0REam3Gwj0E8vS+zRMGanbCY/2Q56WKuGXApRo7fjrP Q4++W0YswWP1A5C386mOKhGZam/cN+fv6sgC3cc4I2j6kruHvYL1FH5GOxxiXfNG UrK0tuNzGF0saNCGQXdkSndH/QvB/dycnFZtnPBwLJ3UdU7EmN/dmmtamG4fhmTw == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 02/33] crypto/x509-utils: Refactor with GNUTLS fallback Date: Sat, 4 Jul 2026 17:39:18 -0400 Message-ID: <20260704213950.2118823-3-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=KsJ9H2WN c=1 sm=1 tr=0 ts=6a497db1 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=FUyA0-9y5A7gcD0mOlIA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX5FlHeXlTLxOC JdtmYlt89iC2PGjI0pHDjGrzvAth+l0r6a/DzK4VJp/crugDiR8V/c7ZMzowB2fh3LXylHPKSga TCWKMrHTHko+Zl2CJK1KB+YRLYM1v5M= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX3XxOeZFx0yJo VLYQNUDXZmYqaulE7fUNbFb6CeBiJFy2AM0dUFLv+m/yK0ZgXJ2sDzYyCm7iTAxhX19rw5Ew35p /qaUXKxRv/JU1rBwYglQ3HWG00K4Bw456C5W7fEYc2Yp3HABCi1LW2n/zkW31t97Ac9GqrORVmE izcGbY5Q8IQnbsheTEZB/aGJcqvQBktf/zYpsPXEp25QIr0rig37Vh22FXnTQim4Oqf4w64DOkB 4GkzWFq6MwRO74RrVohFUP4aMSDUwhO138dyJnqCCW7Ymjfrhzcgb6oAjGZ1DwG39B9KV5X8Gsz 0Ug9G34BAcqvEHcVVUNP9vdVMUTdmkucsqc26Tknc0YvdyUe4XvmzwnVHUBCdSGzRoy7Toc/gM+ kkEuSrzoGu+lk2M5mQixkmcAYXDbNyknYC4kE4WiuKZRcy1537USS2fyGcYKkNb+btNF7n2yeIb nWUKxMrEOWGANGjP81A== X-Proofpoint-ORIG-GUID: XiAuVlfzZMnaHwseH-dzdBX0vsu2Zmro X-Proofpoint-GUID: XiAuVlfzZMnaHwseH-dzdBX0vsu2Zmro X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 spamscore=0 adultscore=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201330508158500 Always compile x509-utils.c and add a fallback when GNUTLS is unavailable. These functions will be needed in the s390x code regardless of whether GNUTLS is available. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/meson.build | 2 +- crypto/x509-utils.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/crypto/meson.build b/crypto/meson.build index b51597a879..fda85543de 100644 --- a/crypto/meson.build +++ b/crypto/meson.build @@ -22,12 +22,12 @@ crypto_ss.add(files( 'tlscredsx509.c', 'tlssession.c', 'rsakey.c', + 'x509-utils.c', )) =20 if gnutls.found() crypto_ss.add(files( 'tlscredsbox.c', - 'x509-utils.c', )) endif =20 diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 39bb6d4d8c..6176a88653 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -11,6 +11,8 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "crypto/x509-utils.h" + +#ifdef CONFIG_GNUTLS #include #include #include @@ -78,3 +80,17 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, gnutls_x509_crt_deinit(crt); return ret; } + +#else /* ! CONFIG_GNUTLS */ + +int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, + QCryptoHashAlgo hash, + uint8_t *result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get fingerprint"); + return -1; +} + +#endif /* ! CONFIG_GNUTLS */ --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201251; cv=none; d=zohomail.com; s=zohoarc; b=NbdGIncn645vGmtLbT/0Pu/E9xlLe5+QjvD37SIBdEfA0kZbaFek+eZe0pD9z2C1XT9iVsgIUK1h2zbovrmypSWLrl73iY5lZdh5B/Zp1cnS+GAEtc8uZphSGSrURcU1QnFcJNSJBJ9zHuW5bflnnAzZD5pT0Kt4C5jIMD8cKw4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201251; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/3eqHNbv4aXfd+u4AnT0IFpGYmbYJdEcHut8ZRCL9ww=; b=ISThE3SuNxxQeBVrWnPIeyWcwp2Z9y2o25PQCJa+3eaB/4hv4rGBCi9wIjVIQKwRXUPk4IarPbQDBBCbLLm8HLcpmBUtKtcH3DYhO62+Lvz/EhRqIsXW7ZMZbxHvISEveX+xUdCz4xttuOEk26NYqHNQ2L+TAIhCOAqanPp22xA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201251037219.9698588066218; Sat, 4 Jul 2026 14:40:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85w-0007LE-JL; Sat, 04 Jul 2026 17:40:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85u-0007KB-LU; Sat, 04 Jul 2026 17:40:14 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85t-0007S5-0d; Sat, 04 Jul 2026 17:40:14 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmIGx2457287; Sat, 4 Jul 2026 21:40:03 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hjc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:03 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYerS025619; Sat, 4 Jul 2026 21:40:02 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhxdny-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:02 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Le1Kp32637478 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:01 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1901D58054; Sat, 4 Jul 2026 21:40:01 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 22B1C58050; Sat, 4 Jul 2026 21:39:59 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:39:59 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=/3eqHN bv4aXfd+u4AnT0IFpGYmbYJdEcHut8ZRCL9ww=; b=c9S2BWI9IRSuUK41YG9btS atRjDfwLPKff3/jN5neNVQ/TwQ9mA3jlILKYZV7LtYJKPRGIRFF8/6CxBfGnIqn8 Wn4AJKnxjRZWSJ6U1dGTWo8Gb+mOa3QOhqhy1hPJHycA9/xKxf/pVUAVXiUHrJJe QxKAyI/e6qo7W8L3espHUTwbWXVvktQTRkEDNJU82I3wydADTlbfofjKtz81ZHnw 9EIEdSeHRuZNVoYRdOpIz3mSd6n51vLeNIIvxJuG91eJkoF6kzpYOS5NPRueidTz 8FlHJKqoD4QQWdnW1cD7gTi01HT47UrVBI3criBUbTyJ44VV/DFLMGz+LPahaEWg == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 03/33] crypto/x509-utils: Add helper functions for certificate store Date: Sat, 4 Jul 2026 17:39:19 -0400 Message-ID: <20260704213950.2118823-4-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497db3 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=GX81FK21qHpjiM7aGUoA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-GUID: 6KjkH_mrBlJcr9VQG2L5-8wLhEVRrzNp X-Proofpoint-ORIG-GUID: 6KjkH_mrBlJcr9VQG2L5-8wLhEVRrzNp X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX2nwNVmps7Uj7 Gl1LJlVbGbBy1hT9ZH0Dzff0O+VLsiJDZgHUq7uMXet5pT+1JpZWu31ZNlkprLpgQ5kS8O0rMXw 0QTTQNasdRpW7pR7qQG9o9s6MOJAvOM= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXyPNCukbflcix l3Rt1snncuqE/YiwUPcg6zCXlHisTEiSnXgl0RPrK/bO+RQu2bFadeaAjezX9bTiC2k95jwmht2 W6a0ahYzs7QcOb9weJXiBcvpENsPpH/0ry42bIbUHOaexriLMuo+XRTYpA9RLtHNXBvgumVntLX LMWLdriRV3ZDsgqahhv9/5xfB/yzE+rRqiv/1OYAqvcSkkhgMXRXSA3v/Y8St0JVP92EOzZD8wl TQw5GLoLELcpOF1GIwPJ1kAfDILZQdUGC9vz1wtId+nrraYP6eKAJtJZqP7V7nT2I/DlVhZ7xPQ hNauh8WfrO6miF4ft73gNX9Q6AfVl90BB9/dAHYJ92S6vZeAdVWVbc1qRH9zqEfrBGngF+0fylA MNOylGKHw/d+Z+IISjsfoql2gfKcSWBH1YpeijALvbz10PASUPgePlX7ZytbfJZ4P5QzGmz+xE+ LHMl75Gt8ofvrv5tA0w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201252525158500 Introduce new helper functions for x509 certificate, which will be used by the certificate store: qcrypto_x509_convert_cert_der() - converts a certificate from PEM to DER fo= rmat These functions provide support for certificate format conversion. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/x509-utils.c | 49 +++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 21 ++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 6176a88653..68cf008938 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -81,6 +81,46 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, return ret; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + gnutls_datum_t datum_der =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_export2(crt, GNUTLS_X509_FMT_DER, &datum_der); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert certificate to DER format: %s", + gnutls_strerror(rc)); + goto cleanup; + } + + *resultlen =3D datum_der.size; + *result =3D g_memdup2(datum_der.data, datum_der.size); + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + g_free(datum_der.data); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -93,4 +133,13 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, si= ze_t size, return -1; } =20 +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export X.509 certificate"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 1e99661a71..91ae79fb03 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -19,4 +19,25 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, siz= e_t size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_convert_cert_der + * @cert: pointer to the raw certificate data in PEM format + * @size: size of the certificate + * @result: output location for the allocated buffer for the certificate + * in DER format + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer (will be updated with the + * actual size of the DER-encoded certificate) + * @errp: error pointer + * + * Convert the given @cert from PEM to DER format. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, + uint8_t **result, + size_t *resultlen, + Error **errp); + #endif --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201412; cv=none; d=zohomail.com; s=zohoarc; b=Nff5GZGyqNFpnh/fU49J+/Zl+7lVw2KmegtIE0Sv4vOWOm19TvvZbqgg2zVFQXVThKSS1lHyYItuD58D8zds5YhFt0WWSrS5Kh9r7u5B9RNUf9QcBwAp2XiV53w93cyRRab78i2WP/0jzigYVCWDcSxakF6kGcrqEwgIJx+Kx9g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201412; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4M97esORC/B91O2w5Ayn8cazfYSsYe2zbhK18a0AD80=; b=moRyuGdajCQ3HyGKdXdgownfPly32ARP2+J77BSaDv9KtGE80nJaq9I8PX5lesh8jV3aXsOy5HtEoxFoOTMpIfUDbjrOuKCT2XxV25lIoQCjAaTuzpyd+H97TAQE8C3zCDcyfrkh1yKgCHp2PIp7UqVZN7ihTzlTtNQqxVjmzsc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201412205304.221701643305; Sat, 4 Jul 2026 14:43:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85y-0007MJ-3M; Sat, 04 Jul 2026 17:40:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85u-0007Je-25; Sat, 04 Jul 2026 17:40:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85r-0007RK-HV; Sat, 04 Jul 2026 17:40:13 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmFYm2705384; Sat, 4 Jul 2026 21:40:06 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7f9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:05 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYZDh011754; Sat, 4 Jul 2026 21:40:04 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgjf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:04 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Le36r15270408 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:03 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 490C658050; Sat, 4 Jul 2026 21:40:03 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4147C5805E; Sat, 4 Jul 2026 21:40:01 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:01 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=4M97esORC/B91O2w5 Ayn8cazfYSsYe2zbhK18a0AD80=; b=I6wbXCuwAhE1iw2u23nknJha5akA5Nu+O iHgP3j6nR0awgLzTV3S+Uf+0HjWeJR+Kiqa7M986XVnUpAeJpn72GWMCxQiygm68 saxe3PKKGDxXM5gDB3XZo/rMR/Xo1LAisC+ojETx+uDOTDszXzFPmzXZKa8lCnI3 8nkhmJOjgGoHva6+Jmr7Hd2lifhHApjHbJ+XNIK5A+2YXILBgltnsXswlk5IF5X7 JahFQCxHT6uCnB1KNYOi3vV4u5AbOS/WLcaYN0HUMG8KUdapTSbs7aKNWF43fESP PYJvAqf96bfHPGJflMNG0FA/gZhgHauNQBotA7d0yg/NLq+V9bKQA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 04/33] hw/s390x/ipl: Create certificate store Date: Sat, 4 Jul 2026 17:39:20 -0400 Message-ID: <20260704213950.2118823-5-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX7DViSiWc5Xbz h2hSKscnkcgXBiL5GDOH/VhBnDvvguibFTOGYoJyvDiugzONMyP62IAFBRKi+FRcYlfi+b9htir NIXubhJFPmQQU0rWsh1/g4rmVCbEXDY= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/q6lfCkHdFV2 5QOr8I9qoSoriZjH1ci7X/6/NswTDttI4AGVsJpKDgL3d9b3ww5izASadwAO603JN3cXx8SLZ1Z Roy0n9ui4wQ6ITUnsCjYYG8U9+fIi+7EdJhQlia3UmmM3c0h906vzp3vwFthBcirjWDNxjwaIt2 6ujzzufWgYjIpgAUIMwk13Hr7CulHTbnctWQC+/h2UKbpEHA57qWghhQpa713gSb+Xy+3PMQDJ4 oAwwL/Le6UIRthNb+oaPiglqGMYD9Z4LRNqyBIly1AzlO9zypDIOKs27q1Xje8z+xzzn4xP9Rnb FfzrJl3SlXxR1ZFlVg8NAMeT2WtMsMwpYfMim3w1Ad22kqVbl2TIe5RUxP+TfoUuPllQsVmwJhr Mo/+5MKPtWdCy72Io0CwUI5XTnfrfrSG8fwawMfN4L1+vzecg/XIpA1U2tI7SvipjmmvcCKQV3W vCtDpIlGrskQxu76kvg== X-Proofpoint-GUID: 0yG9LZq2DMxhem0OHzaj34oFQZ4ft7o3 X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497db6 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=U0tahsH2YktMir8Gk2YA:9 X-Proofpoint-ORIG-GUID: 0yG9LZq2DMxhem0OHzaj34oFQZ4ft7o3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201412609158500 Content-Type: text/plain; charset="utf-8" Create a certificate store for boot certificates used for secure IPL. Load certificates from the `boot-certs` parameter of s390-ccw-virtio machine type option into the cert store. Currently, only X.509 certificates in PEM format are supported, as the QEMU command line accepts certificates in PEM format only. The raw Base64 data is stored, as well as the certificate's size. The binary (DER) size is stored as well, which may later be utilized for secure boot (signature verification). Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Matthew Rosato --- docs/specs/index.rst | 1 + docs/specs/s390x-secure-ipl.rst | 20 +++ hw/s390x/cert-store.c | 238 ++++++++++++++++++++++++++++++++ hw/s390x/cert-store.h | 39 ++++++ hw/s390x/ipl.c | 10 ++ hw/s390x/ipl.h | 3 + hw/s390x/meson.build | 1 + include/hw/s390x/ipl/qipl.h | 2 + 8 files changed, 314 insertions(+) create mode 100644 docs/specs/s390x-secure-ipl.rst create mode 100644 hw/s390x/cert-store.c create mode 100644 hw/s390x/cert-store.h diff --git a/docs/specs/index.rst b/docs/specs/index.rst index b7909a108a..76d439782c 100644 --- a/docs/specs/index.rst +++ b/docs/specs/index.rst @@ -40,3 +40,4 @@ guest hardware that is specific to QEMU. riscv-aia aspeed-intc iommu-testdev + s390x-secure-ipl diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst new file mode 100644 index 0000000000..9222ad9c12 --- /dev/null +++ b/docs/specs/s390x-secure-ipl.rst @@ -0,0 +1,20 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +s390 Certificate Store and Functions +------------------------------------ + +s390 Certificate Store +^^^^^^^^^^^^^^^^^^^^^^ + +A certificate store is implemented for s390-ccw guests to retain within +memory all certificates provided by the user via the command-line, which +are expected to be stored somewhere on the host's file system. The store +will keep track of the number of certificates, their respective size, +and a summation of the sizes. + +Each certificate is stored in an S390IPLCertificate struct, which has a +name (converted to EBCDIC), size fields of PEM and DER data, and the raw +PEM Base64 data. + +Note: A maximum of 64 certificates are allowed to be stored in the certifi= cate +store. diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c new file mode 100644 index 0000000000..c679406c2c --- /dev/null +++ b/hw/s390x/cert-store.c @@ -0,0 +1,238 @@ +/* + * S390 certificate store implementation + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "cert-store.h" +#include "qapi/error.h" +#include "qemu/error-report.h" +#include "qemu/option.h" +#include "qemu/config-file.h" +#include "hw/s390x/ebcdic.h" +#include "hw/s390x/s390-virtio-ccw.h" +#include "qemu/cutils.h" +#include "crypto/x509-utils.h" +#include "qapi/qapi-types-machine-s390x.h" + +static BootCertificatesList *s390_get_boot_certs(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->boot_certs; +} + +static S390IPLCertificate *init_cert(char *path, Error **errp) +{ + int rc; + size_t size; + size_t der_len; + char name[CERT_NAME_MAX_LEN]; + g_autofree char *buf =3D NULL; + g_autofree gchar *filename =3D NULL; + S390IPLCertificate *cert =3D NULL; + g_autofree uint8_t *cert_der =3D NULL; + Error *local_err =3D NULL; + + filename =3D g_path_get_basename(path); + + if (!g_file_get_contents(path, &buf, &size, NULL)) { + error_setg(errp, "Failed to load certificate: %s", path); + return NULL; + } + + rc =3D qcrypto_x509_convert_cert_der((uint8_t *)buf, size, + &cert_der, &der_len, &local_err); + if (rc !=3D 0) { + error_propagate_prepend(errp, local_err, + "Failed to initialize certificate: %s: ", = path); + return NULL; + } + + cert =3D g_new0(S390IPLCertificate, 1); + cert->size =3D size; + /* + * Store DER length only - reused for size calculation. + * cert_der is discarded because DER certificate data will be used once + * and can be regenerated from cert->raw. + */ + cert->der_size =3D der_len; + /* store raw pointer - ownership transfers to cert */ + cert->raw =3D (uint8_t *)g_steal_pointer(&buf); + + /* + * Left justified certificate name with padding on the right with blan= ks. + * Convert certificate name to EBCDIC. + */ + strpadcpy(name, CERT_NAME_MAX_LEN, filename, ' '); + ebcdic_put(cert->name, name, CERT_NAME_MAX_LEN); + + return cert; +} + +static int update_cert_store(S390IPLCertificateStore *cert_store, + S390IPLCertificate *cert) +{ + size_t data_buf_size; + size_t keyid_buf_size; + size_t hash_buf_size; + size_t cert_buf_size; + + if (cert_store->count >=3D MAX_CERTIFICATES) { + error_report("Cert store is full"); + return -1; + } + + /* length field is word aligned for later DIAG use */ + keyid_buf_size =3D ROUND_UP(CERT_KEY_ID_LEN, 4); + hash_buf_size =3D ROUND_UP(CERT_HASH_LEN, 4); + cert_buf_size =3D ROUND_UP(cert->der_size, 4); + data_buf_size =3D keyid_buf_size + hash_buf_size + cert_buf_size; + + if (cert_store->largest_cert_size < data_buf_size) { + cert_store->largest_cert_size =3D data_buf_size; + } + + cert_store->certs[cert_store->count] =3D *cert; + cert_store->total_bytes +=3D data_buf_size; + cert_store->count++; + + return 0; +} + +static GPtrArray *get_cert_paths(Error **errp) +{ + struct stat st; + BootCertificatesList *path_list =3D NULL; + BootCertificatesList *list =3D NULL; + gchar *cert_path; + GDir *dir =3D NULL; + const gchar *filename; + bool is_empty; + g_autoptr(GError) err =3D NULL; + g_autoptr(GPtrArray) cert_path_builder =3D g_ptr_array_new_full(0, g_f= ree); + + path_list =3D s390_get_boot_certs(); + + for (list =3D path_list; list; list =3D list->next) { + cert_path =3D list->value->path; + + if (g_strcmp0(cert_path, "") =3D=3D 0) { + error_setg(errp, "Empty path in certificate path list is not a= llowed"); + goto fail; + } + + if (stat(cert_path, &st) !=3D 0) { + error_setg(errp, "Failed to stat path '%s': %s", + cert_path, g_strerror(errno)); + goto fail; + } + + if (S_ISREG(st.st_mode)) { + if (!g_str_has_suffix(cert_path, ".pem")) { + error_setg(errp, "Certificate file '%s' must have a .pem e= xtension", + cert_path); + goto fail; + } + + g_ptr_array_add(cert_path_builder, g_strdup(cert_path)); + } else if (S_ISDIR(st.st_mode)) { + dir =3D g_dir_open(cert_path, 0, &err); + if (dir =3D=3D NULL) { + error_setg(errp, "Failed to open directory '%s': %s", + cert_path, err->message); + + goto fail; + } + + is_empty =3D true; + while ((filename =3D g_dir_read_name(dir))) { + is_empty =3D false; + + if (g_str_has_suffix(filename, ".pem")) { + g_ptr_array_add(cert_path_builder, + g_build_filename(cert_path, filename, = NULL)); + } else { + warn_report("skipping '%s': not a .pem file", filename= ); + } + } + + if (is_empty) { + warn_report("'%s' directory is empty", cert_path); + } + + g_dir_close(dir); + } else { + error_setg(errp, "Path '%s' is neither a file nor a directory"= , cert_path); + goto fail; + } + } + + qapi_free_BootCertificatesList(path_list); + return g_steal_pointer(&cert_path_builder); + +fail: + qapi_free_BootCertificatesList(path_list); + return NULL; +} + +static void s390_ipl_destroy_cert_store(S390IPLCertificateStore *cert_stor= e) +{ + for (int i =3D 0; i < cert_store->count; i++) { + g_free(cert_store->certs[i].raw); + } + memset(cert_store, 0, sizeof(*cert_store)); +} + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store) +{ + GPtrArray *cert_path_builder; + Error *err =3D NULL; + + /* If cert store is already populated, then no work to do */ + if (cert_store->count) { + return; + } + + cert_path_builder =3D get_cert_paths(&err); + if (cert_path_builder =3D=3D NULL) { + error_report_err(err); + exit(1); + } + + if (cert_path_builder->len =3D=3D 0) { + g_ptr_array_free(cert_path_builder, TRUE); + return; + } + + if (cert_path_builder->len > MAX_CERTIFICATES) { + error_report("Cert store exceeds maximum of %d certificates", MAX_= CERTIFICATES); + g_ptr_array_free(cert_path_builder, TRUE); + exit(1); + } + + cert_store->largest_cert_size =3D 0; + cert_store->total_bytes =3D 0; + + for (int i =3D 0; i < cert_path_builder->len; i++) { + g_autofree S390IPLCertificate *cert =3D + init_cert((char *) cert_path_builder->pdata[i], + &err); + if (!cert) { + error_report_err(err); + g_ptr_array_free(cert_path_builder, TRUE); + s390_ipl_destroy_cert_store(cert_store); + exit(1); + } + + if (update_cert_store(cert_store, cert)) { + g_ptr_array_free(cert_path_builder, TRUE); + s390_ipl_destroy_cert_store(cert_store); + exit(1); + } + } + + g_ptr_array_free(cert_path_builder, TRUE); +} diff --git a/hw/s390x/cert-store.h b/hw/s390x/cert-store.h new file mode 100644 index 0000000000..7fc9503cb9 --- /dev/null +++ b/hw/s390x/cert-store.h @@ -0,0 +1,39 @@ +/* + * S390 certificate store + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HW_S390_CERT_STORE_H +#define HW_S390_CERT_STORE_H + +#include "hw/s390x/ipl/qipl.h" +#include "crypto/x509-utils.h" + +#define CERT_NAME_MAX_LEN 64 + +#define CERT_KEY_ID_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 +#define CERT_HASH_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 + +struct S390IPLCertificate { + uint8_t name[CERT_NAME_MAX_LEN]; + size_t size; + size_t der_size; + uint8_t *raw; +}; +typedef struct S390IPLCertificate S390IPLCertificate; + +struct S390IPLCertificateStore { + uint16_t count; + size_t largest_cert_size; + size_t total_bytes; + S390IPLCertificate certs[MAX_CERTIFICATES]; +}; +typedef struct S390IPLCertificateStore S390IPLCertificateStore; + +void s390_ipl_create_cert_store(S390IPLCertificateStore *cert_store); + +#endif diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 4cca21c621..09c24203c7 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -38,6 +38,7 @@ #include "qemu/option.h" #include "qemu/ctype.h" #include "standard-headers/linux/virtio_ids.h" +#include "cert-store.h" =20 #define KERN_IMAGE_START 0x010000UL #define LINUX_MAGIC_ADDR 0x010008UL @@ -453,6 +454,13 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t= *ebcdic_lp) } } =20 +S390IPLCertificateStore *s390_ipl_get_certificate_store(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return &ipl->cert_store; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -767,6 +775,8 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) cpu->env.psw.addr =3D ipl->start_addr; cpu->env.psw.mask =3D IPL_PSW_MASK; =20 + s390_ipl_create_cert_store(&ipl->cert_store); + if (!ipl->kernel || ipl->iplb_valid) { cpu->env.psw.addr =3D ipl->bios_start_addr; if (!ipl->iplb_valid) { diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index fac30763df..f5a49a4431 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -13,6 +13,7 @@ #ifndef HW_S390_IPL_H #define HW_S390_IPL_H =20 +#include "cert-store.h" #include "target/s390x/cpu.h" #include "exec/target_page.h" #include "system/address-spaces.h" @@ -35,6 +36,7 @@ int s390_ipl_pv_unpack(struct S390PVResponse *pv_resp); void s390_ipl_prepare_cpu(S390CPU *cpu); IplParameterBlock *s390_ipl_get_iplb(void); IplParameterBlock *s390_ipl_get_iplb_pv(void); +S390IPLCertificateStore *s390_ipl_get_certificate_store(void); =20 enum s390_reset { /* default is a reset not triggered by a CPU e.g. issued by QMP */ @@ -63,6 +65,7 @@ struct S390IPLState { IplParameterBlock iplb; IplParameterBlock iplb_pv; QemuIplParameters qipl; + S390IPLCertificateStore cert_store; uint64_t start_addr; uint64_t compat_start_addr; uint64_t bios_start_addr; diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build index 57cc2a6be3..6b39ad012f 100644 --- a/hw/s390x/meson.build +++ b/hw/s390x/meson.build @@ -17,6 +17,7 @@ s390x_ss.add(files( 'sclpcpu.c', 'sclpquiesce.c', 'tod.c', + 'cert-store.c', )) s390x_ss.add(when: 'CONFIG_KVM', if_true: files( 'tod-kvm.c', diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 8d3c83a80b..ed1a91182a 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -31,6 +31,8 @@ typedef enum S390IplType S390IplType; =20 #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 +#define MAX_CERTIFICATES 64 + /* * The QEMU IPL Parameters will be stored at absolute address * 204 (0xcc) which means it is 32-bit word aligned but not --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201316; cv=none; d=zohomail.com; s=zohoarc; b=Ihg5hjjCeQnH8awdgNKrbJ82w87+lD0KCFumUbNr1k+dM+JYURHtgMHFg8eXvuwhFaxEsOBnfiwz13MaqEC6sRIv35hE1jXaPg5k+bMCt683+gq8XIX1Cl5/jmSPNW8J7Mfrm9UPHqBS273JjQ961iHp0Z97/v5s2VOYH5j4T1A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201316; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0vUuKx1BBNdaErNuHKCxJriZkM9t34PxAkbDNGK8lc0=; b=JKcydWwt9eMiBAdYXPLmdvZw0OwnIdKxiep+WeTGMcCg7NTiU0EtpRep6cgOJLsgj467PRUly7dH+j1I8m0RVlJ2Ab9j9X92qhFQtc9CBFSNAa1JSF/iioeqGHYjZPQUWAOw+6SCRdIcQrt5eZJ0GPK0Pn7RQJT4vx9hHrcfmXU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201316068664.6906384324798; Sat, 4 Jul 2026 14:41:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85x-0007M6-Ai; Sat, 04 Jul 2026 17:40:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85u-0007Ji-A2; Sat, 04 Jul 2026 17:40:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85r-0007Rq-Rl; Sat, 04 Jul 2026 17:40:14 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmEFn2705329; Sat, 4 Jul 2026 21:40:08 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7fh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:08 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYZrb009653; Sat, 4 Jul 2026 21:40:07 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbs7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:07 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Le5eq22217254 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:05 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8ECEF58045; Sat, 4 Jul 2026 21:40:05 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 786DA58054; Sat, 4 Jul 2026 21:40:03 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:03 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=0vUuKx1BBNdaErNuH KCxJriZkM9t34PxAkbDNGK8lc0=; b=WVxhkJqQXxJ5pQJbMyXPZwiyWFrJfqbtS AIlIBsxPu1Y6ruEbmCgQD8RgITnyvGfTJK987YWOI8ab/SNUfhrSlmpO12FogfHH N0iNnLtoDXPy66rd1LNcGredO9z3EsF3CLXzojSniLeTCxYctlgPCukNHxOOftpv Iy60EFeOTMiQFWYq9f8HErCJXSO7eqfpNgrLte7Flgm315ewbf4Qg0dYberS5rPb NeMeIHLnXwFphwKckJzfq3Y1eqI8gmYBqlH+gBFgZuHuSyTVTq3ntisURKbma589 2ch5GkETP6FIlymhQwL77Pv5tCaSbDRSDBSoI5BwwPclGCN+R3+Hw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 05/33] s390x/diag: Introduce DIAG 320 for Certificate Store Facility Date: Sat, 4 Jul 2026 17:39:21 -0400 Message-ID: <20260704213950.2118823-6-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX92HVDAcn9vD8 ZVI2IOMPsKjGCpdkFxD/9Xs/V0W3x6lUWrlL1v0oBv4gP13UatYny6a54aOiieLgv4TAesnu1ys LobHVTwMq1sl46Ldnh5R3fQk4bE3ULE= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/n5q4xRlRCZD Vq+1ijn9F6pUqJUMd9kcWDBNnTf8Qq43qnrs7hfGIMfhAkyILqddyLhQCJ6FO5pe9Kt9BkG4NO9 M0flXS+TfBB4mwkZDTmMGPGTynDd+Y712l55/hi2ZDduSqyt43LwKMNEcvVpPJ4Kh/HKgEpVJTM fnfbFS/P5SdpYSvy1fJD9sS9CGolnAkHov/bQGTqdLMMd7tDnvibMfYMiERhdczC64wcnhtWNmo kFLCX8Ftf0a9tHCzyBrQFe4h2OkkUcdgeVPboHERJw9OV0/PuCWjONHDvf+YWEOf3zB1XIfRpPD FnhMmT+kem7WdgdB4j47qdlPlcSrHumPUtgfX8Yy+mpT8WIMFTRgxkB68ZcFdec7oSkRCrpMxtL v0gnS3UKG0MYMWCWKbTZoNH/15lONXrVBc4DJ/9aHKGAlhTi2M4tI2E0jSNFssxVJ1WFCgOSiAx ohrPwIbExjXNB5bA1tg== X-Proofpoint-GUID: FfVMCkOHP3IhQqGSa2_mL36myh7UVoyS X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497db8 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=mM8oulnVqnlOJU-pfAMA:9 X-Proofpoint-ORIG-GUID: FfVMCkOHP3IhQqGSa2_mL36myh7UVoyS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201318329158500 Content-Type: text/plain; charset="utf-8" DIAGNOSE 320 is introduced to support Certificate Store (CS) Facility, which includes operations such as query certificate storage information and provide certificates in the certificate store. Currently, only subcode 0 is supported with this patch, which is used to query the Installed Subcodes Mask (ISM). This subcode is only supported when the CS facility is enabled. Availability of CS facility is determined by byte 134 bit 5 of the SCLP Read Info block. Byte 134's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Note: secure IPL is not available for Secure Execution (SE) guests, as their images are already integrity protected, and an additional protection of the kernel by secure IPL is not necessary. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- docs/specs/s390x-secure-ipl.rst | 12 +++++++++ include/hw/s390x/ipl/diag320.h | 20 ++++++++++++++ target/s390x/cpu_features.c | 1 + target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 2 ++ target/s390x/diag.c | 41 +++++++++++++++++++++++++++++ target/s390x/gen-features.c | 3 +++ target/s390x/kvm/kvm.c | 16 +++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++ 10 files changed, 105 insertions(+) create mode 100644 include/hw/s390x/ipl/diag320.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 9222ad9c12..cc497ea09a 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -18,3 +18,15 @@ PEM Base64 data. =20 Note: A maximum of 64 certificates are allowed to be stored in the certifi= cate store. + +DIAGNOSE function code 'X'320' - Certificate Store Facility +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +DIAGNOSE 'X'320' is used to provide support for guest code to directly +query the s390 certificate store. Guest code may be the s390-ccw BIOS or +the guest kernel. + +Subcode 0 - query installed subcodes + Returns a 256-bit installed subcodes mask (ISM) stored in the installed + subcodes block (ISB). This mask indicates which subcodes are currently + installed and available for use. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h new file mode 100644 index 0000000000..aa04b699c6 --- /dev/null +++ b/include/hw/s390x/ipl/diag320.h @@ -0,0 +1,20 @@ +/* + * S/390 DIAGNOSE 320 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG320_H +#define S390X_DIAG320_H + +#define DIAG_320_SUBC_QUERY_ISM 0 + +#define DIAG_320_RC_OK 0x0001 +#define DIAG_320_RC_NOT_SUPPORTED 0x0102 + +#define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 + +#endif diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 896914888a..c6cd411e04 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -147,6 +147,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC134: clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; case S390_FEAT_TYPE_SCLP_FAC139: clear_be_bit(s390_feat_def(S390_FEAT_SIE_ASTFLEIE2)->bit, data); diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index a822f0f2fe..ae96f2381f 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -138,6 +138,7 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s =20 /* Features exposed via SCLP SCCB Facilities byte 134 (bit numbers relativ= e to byte-134) */ DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") +DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certificate Store function= s") =20 /* Features exposed via SCLP SCCB Facilities byte 139 (bit numbers relativ= e to byte-139) */ DEF_FEAT(SIE_ASTFLEIE2, "astfleie2", SCLP_FAC139, 1, "SIE: ASTFLE interpre= tation execution facility 2") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 2dd9aac807..14db9c085e 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -248,6 +248,7 @@ bool s390_has_feat(S390Feat feat) if (s390_is_pv()) { switch (feat) { case S390_FEAT_DIAG_318: + case S390_FEAT_CERT_STORE: case S390_FEAT_HPMA2: case S390_FEAT_SIE_F2: case S390_FEAT_SIE_SKEY: @@ -506,6 +507,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_PTFF_STOUE, S390_FEAT_MULTIPLE_EPOCH }, { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 80f0958478..eab50bd0d7 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -18,6 +18,7 @@ #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" #include "hw/s390x/ipl.h" +#include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -199,3 +200,43 @@ out: return false; } } + +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + S390CPU *cpu =3D env_archcpu(env); + uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if (!s390_has_feat(S390_FEAT_CERT_STORE) || + (subcode & ~0x000ffULL) || + (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + switch (subcode) { + case DIAG_320_SUBC_QUERY_ISM: + /* + * The Installed Subcode Block (ISB) can be up 8 words in size, + * but the current set of subcodes can fit within a single word + * for now. + */ + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + + if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return; + } + + env->regs[r1 + 1] =3D DIAG_320_RC_OK; + break; + default: + env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; + break; + } +} diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index a309dc2c09..e6a586bce7 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -721,6 +721,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP, S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_SIE_ASTFLEIE2, + S390_FEAT_CERT_STORE, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -920,6 +921,8 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_KIMD_SHA_512, S390_FEAT_KLMD_SHA_512, S390_FEAT_PRNO_TRNG, + S390_FEAT_EXTENDED_LENGTH_SCCB, + S390_FEAT_CERT_STORE, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 9af2a397f5..2ef4734559 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -99,6 +99,7 @@ #define DIAG_TIMEREVENT 0x288 #define DIAG_IPL 0x308 #define DIAG_SET_CONTROL_PROGRAM_CODES 0x318 +#define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 =20 @@ -1531,6 +1532,16 @@ static void handle_diag_318(S390CPU *cpu, struct kvm= _run *run) } } =20 +static void kvm_handle_diag_320(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1561,6 +1572,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_KVM_BREAKPOINT: r =3D handle_sw_breakpoint(cpu, run); break; + case DIAG_CERT_STORE: + kvm_handle_diag_320(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); @@ -2472,6 +2486,8 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) set_bit(S390_FEAT_DIAG_318, model->features); } =20 + set_bit(S390_FEAT_CERT_STORE, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index 35d1e34ef4..1945bdf40c 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -388,6 +388,8 @@ int handle_diag_288(CPUS390XState *env, uint64_t r1, ui= nt64_t r3); /* Return whether a CPU reset is pending */ bool handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index 09a45e58a5..403388145e 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -147,6 +147,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) /* time bomb (watchdog) */ r =3D handle_diag_288(env, r1, r3); break; + case 0x320: + /* cert store */ + bql_lock(); + handle_diag_320(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201381; cv=none; d=zohomail.com; s=zohoarc; b=jqCt4BdGt8+SFOr/XTOLgIAK03J8QVbxQnQ1cMGDGj3uOJwjZXWguSkipB7wjDKJeQsXQftzNgUMmsgOqeq2KoP66cri6zNyMwxcnP3DNa5e8X8uQNAEpvs/PqX04mAeVF0A/o6s8dVdwGkd0aqI8QfPfnLIdwtHqAeOk6H9ayk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201381; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KmuGgN3GyuURanxgWRmwKyYKqKpGWI8kywQEEHzL2lE=; b=g97j2u1aAaylAdvyP0BFzOde71o03GmTtMNpSDVfAb+e2RJYBLFc5Cze2o3HUw5ASuZl7xXk4WXacMyCi7VP/a3JF0Dt4raJWiwLQJrgi5HBwB9b4XmKZPcWII4lszZB3NJ1xUNxWPgsg2/Chf+a7bcffJGHqXV72UOKa9rxpcE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201381365809.025487996513; Sat, 4 Jul 2026 14:43:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg85z-0007No-QU; Sat, 04 Jul 2026 17:40:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85y-0007MI-0J; Sat, 04 Jul 2026 17:40:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85w-0007Uw-DV; Sat, 04 Jul 2026 17:40:17 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664Kmb182428598; Sat, 4 Jul 2026 21:40:09 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7gy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:09 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYnc0027696; Sat, 4 Jul 2026 21:40:09 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7wpk0w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:09 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Le7Qg63308056 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:07 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A5F1658056; Sat, 4 Jul 2026 21:40:07 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B6C3C58050; Sat, 4 Jul 2026 21:40:05 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:05 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=KmuGgN3GyuURanxgW RmwKyYKqKpGWI8kywQEEHzL2lE=; b=cHM18MgWuARZNt7tO9O3N3orcH8M6XryA zGeLIKvb9lMaaAkzF/6G5EGntwvFve89DJTum7MdTHreLEgNK4RQyDMDbwgPx+kp 1hvOS2ihTBww2rNn4HXpDCNX6Y/D+XIGIQ5PoakAlnJJAUMmqmwHBVAgFhl3FNa0 +qQAV0ulJEI5RO8UUoqb+If78a1H+RrTtjoQOUjtaObk29IM8Z4uORnplzEUkN/y yebRxjWdElBruuqWmDRrHUAOwuvPIQQ13RE6NH1weY1J9hoef8a0PzQIT3Ivl3nk gGEHR87MtuMiFxhCqwzE72oD0vy8df/qi7DwfqrnGGyZWv69AeklA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 06/33] s390x/diag: Refactor address validation check from diag308_parm_check Date: Sat, 4 Jul 2026 17:39:22 -0400 Message-ID: <20260704213950.2118823-7-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 1D_-ci4QAiWx6cuVHvVWi8dEYLTs9GKS X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX8Jc9QsfVGBX0 48dSQ7DhE5Ryu63OVaf5PIuovyB3oZIk6jifQ3qf5E84hPVxi1QlXEyHp+27L7QSPCVgJafBzAG 7TUafU1jbVbYV2nNAGfY5kHrRG8aXig= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497db9 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=130TwiEZxdn8fhqcL5YA:9 X-Proofpoint-GUID: 1D_-ci4QAiWx6cuVHvVWi8dEYLTs9GKS X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX0LcOIyui7FlV pyAlIF63YCZ1JZ0MCUFro5gEoJLEznW0UNQ3i2TZDm5KEzZPzEwTzu2+xhTxg0HWhEEB7gDW5+4 eSFva5cMUpzvRADnoj8c8aqjW2p1enzbh7Ai343MXYxNGr9Js+DF3NroPUG1UVKG3OYiYwKGcwH 2+CvYD/w4Mbbxvyn71RhhpNpZdFmjEGy0iAGobXAv4gx93aEyc0uNa9R6Sp5K0i8WJRITjW3bST H+cJdyoeAYs3dfB5hLiCzh2cplgLEilYJ9eRg0DK51QB/SBT41BT3HdtfkI3F+KUey4xTAkjZqY tBYTsrWSJQS+MhkwQzd+3rCK7mBIdMvjKc9Fxj33nN+qf46Q/QGcF1wOYHC4vV0msF5ZtJqk2fQ jcJsvqggVLFBZok4VqaKA6O8gTpFiql9VrF1fTSYov+Ssr6q+8u3sH+61+2bZs9eiMr9qbhWwO4 g9w3MHCqt9L9ZY9aP6w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201382340158500 Content-Type: text/plain; charset="utf-8" Create a function to validate the address parameter of DIAGNOSE. Refactor the function for reuse in the next patch, which allows address validation in read or write operation of DIAGNOSE. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling Reviewed-by: Hendrik Brueckner Reviewed-by: Thomas Huth --- target/s390x/diag.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/target/s390x/diag.c b/target/s390x/diag.c index eab50bd0d7..db0f3a26e4 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -26,6 +26,12 @@ #include "qemu/error-report.h" =20 =20 +static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) +{ + return address_space_access_valid(&address_space_memory, addr, + size, write, MEMTXATTRS_UNSPECIFIED); +} + int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3) { uint64_t func =3D env->regs[r1]; @@ -65,9 +71,7 @@ static int diag308_parm_check(CPUS390XState *env, uint64_= t r1, uint64_t addr, s390_program_interrupt(env, PGM_SPECIFICATION, ra); return -1; } - if (!address_space_access_valid(&address_space_memory, addr, - sizeof(IplParameterBlock), write, - MEMTXATTRS_UNSPECIFIED)) { + if (!diag_parm_addr_valid(addr, sizeof(IplParameterBlock), write)) { s390_program_interrupt(env, PGM_ADDRESSING, ra); return -1; } --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201285; cv=none; d=zohomail.com; s=zohoarc; b=lYkTXJBXrOjmNagFPLT6N7STdhjv4BlwAsFwYPJtNDGe2NFzFWv2XtFb783Z/baF5hQC7EQX93JhGjJ+wKBOF19dyZmqWOm1lbf8e6hYbyQFiCRUviQlih5s6Qui0fOV/Z6k8s9q2ZNYNhlrF2MnzCFxV+RCWm2fbmUY/jrGHEw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201285; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=SRQ3RLsB75vei8v/0XzyrqWwEAmQWUk19/ss3dh67Yo=; b=P4q2RU9iPNE37SO5eB9vrwZun1e9F0BS6Yx5MYYmRk+FRv66eADINuZrBklv4IhZvw9hFEG0bqoW22IfwL8nk1IGiBKWlFwphr6R+M4350X9mwOB1U4thfILqYR4pVyZVRFBtco34gthwjNJjPlxdu/1dQNw+fnDlHin5IRKyIY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201285134403.5761853020322; Sat, 4 Jul 2026 14:41:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg861-0007P7-Qx; Sat, 04 Jul 2026 17:40:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85y-0007MV-BP; Sat, 04 Jul 2026 17:40:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85w-0007VA-DG; Sat, 04 Jul 2026 17:40:18 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmOpx2428233; Sat, 4 Jul 2026 21:40:12 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7h3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:12 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYeq3013634; Sat, 4 Jul 2026 21:40:11 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxq73-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:11 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Le9AC17039910 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:09 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C754A58052; Sat, 4 Jul 2026 21:40:09 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE31C58056; Sat, 4 Jul 2026 21:40:07 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:07 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=SRQ3RLsB75vei8v/0 XzyrqWwEAmQWUk19/ss3dh67Yo=; b=CH/eMQl3+41xU+/unf3RS89CMp1o+f5gq mgowVh17Ef+7BSttlHM9rKnZJ0TzODmxK1Xza4sM8SnZj4YvP2gnk2skeFQL120R v4JPfWQzpA6A76/bvyG+yvCEZt2qS+sfKhcHPlHh1mxa45LZ6fWAjXiYf9XCIPcm KLx0z/geZAn2v+iMmqRUoqATWWUCOrteHPheO32BLz32kcZ1+pOW5rW/OAhfRQsL 1DW5nlTWkQxlRgZmU3uBSJbCHH9GZJv+jDDrF+++QOzAf5wbPa97hE31PP6PjUCj fCW5/6GyPQ1y0A+qgw/7jlko9bkIQmP64y6OtOU9aKR9cif8gRZeQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 07/33] s390x/diag: Implement DIAG 320 subcode 1 Date: Sat, 4 Jul 2026 17:39:23 -0400 Message-ID: <20260704213950.2118823-8-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: AU_JzKf0w3puyDEF-UoIKu7c9WPG7bhc X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX++1J+coMKan8 ANKYF3YRZHNq5rAEcFUEhOjN2oU7JAleDfaWraD8fx2bbfLmWzNbgyK6lUlAkRX3q1Dcy0xC66X l7ZXJKiRuQVocLYreC6naEK0xSF+Hkg= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497dbc cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=MguaJt8dR91BFOVN_IAA:9 X-Proofpoint-GUID: AU_JzKf0w3puyDEF-UoIKu7c9WPG7bhc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX6LaUQqSD0Xuz JHLhIcPt0YkTDDUf1Rn7v+NFeEOzlnBEAsj0ZFTEyMjzQ3El/y7gfkcwcraA8QoqLvXWuH0uLOs fSAxz5fjX2ztbSHGB5e1euXNFzA7aD+Z4LEMyz7nraYdzge07Q2GQfGopRurQAkOqXoUjuKMba1 VZoX1t12IJchU+EqiY5H4tY9PiZf3kvZizf1wecSqMaRU3DIFyeA4dNzXERt9Qe0Ur/4atDKEwR Oxm59YZQVd84r3U38RP7Lo+6zFDUk5o3MEAnygcURkdPEQ4Nmd6XNCLsqKrjQ0JVLXwVFgP4f0w ZVUWYq6HFpJGlWVeUwmi7H8AZOimUZPFfEFcCZyJOR52CFH6Mmrd7YjeopW32zmH+HbalZNVhzU os8sfBcX+YiU4kkyW+LSEcVUuVjZBArLNCW1WwJ9GCqP+42XPMtjnheLfN8nUnccBmyKlv7PXux lS/BTEhJDuYkx5oaPDg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201286425158500 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 1 provides information needed to determine the amount of storage to store one or more certificates from the certificate store. Upon successful completion, this subcode returns information of the current cert store, such as the number of certificates stored and allowed in the ce= rt store, amount of space may need to be allocate to store a certificate, etc for verification-certificate blocks (VCBs). The subcode value is denoted by setting the left-most bit of an 8-byte field. The verification-certificate-storage-size block (VCSSB) contains the output data when the operation completes successfully. A VCSSB length of 4 indicates that no certificate are available in the cert store. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling Reviewed-by: Eric Farman --- docs/specs/s390x-secure-ipl.rst | 12 +++++++ hw/s390x/cert-store.h | 3 +- include/hw/s390x/ipl/diag320.h | 57 ++++++++++++++++++++++++++++++ target/s390x/diag.c | 61 ++++++++++++++++++++++++++++++++- 4 files changed, 130 insertions(+), 3 deletions(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index cc497ea09a..201cc74c7c 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -30,3 +30,15 @@ Subcode 0 - query installed subcodes Returns a 256-bit installed subcodes mask (ISM) stored in the installed subcodes block (ISB). This mask indicates which subcodes are currently installed and available for use. + +Subcode 1 - query verification certificate storage information + Provides the information required to determine the amount of memory ne= eded + to store one or more verification-certificates (VCs) from the certific= ate + store (CS). + + Upon successful completion, this subcode returns various storage size = values + for verification-certificate blocks (VCBs). + + The output is returned in the verification-certificate-storage-size bl= ock + (VCSSB). A VCSSB length of 4 indicates that no certificates are availa= ble + in the CS. diff --git a/hw/s390x/cert-store.h b/hw/s390x/cert-store.h index 7fc9503cb9..6f5ee63177 100644 --- a/hw/s390x/cert-store.h +++ b/hw/s390x/cert-store.h @@ -11,10 +11,9 @@ #define HW_S390_CERT_STORE_H =20 #include "hw/s390x/ipl/qipl.h" +#include "hw/s390x/ipl/diag320.h" #include "crypto/x509-utils.h" =20 -#define CERT_NAME_MAX_LEN 64 - #define CERT_KEY_ID_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 #define CERT_HASH_LEN QCRYPTO_HASH_DIGEST_LEN_SHA256 =20 diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index aa04b699c6..d37d8eaa86 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -11,10 +11,67 @@ #define S390X_DIAG320_H =20 #define DIAG_320_SUBC_QUERY_ISM 0 +#define DIAG_320_SUBC_QUERY_VCSI 1 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 +#define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 +#define DIAG_320_ISM_QUERY_VCSI 0x40000000 + +#define VCSSB_NO_VC 4 +#define VCSSB_LEN_VALID 128 + +#define CERT_NAME_MAX_LEN 64 + +struct VCStorageSizeBlock { + uint32_t length; + uint8_t reserved0[3]; + uint8_t version; + uint32_t reserved1[6]; + uint16_t total_vc_ct; + uint16_t max_vc_ct; + uint32_t reserved3[11]; + uint32_t max_single_vcb_len; + uint32_t total_vcb_len; + uint32_t reserved4[10]; +}; +typedef struct VCStorageSizeBlock VCStorageSizeBlock; + +struct VCEntryHeader { + uint32_t len; + uint8_t flags; + uint8_t key_type; + uint16_t cert_idx; + uint8_t name[CERT_NAME_MAX_LEN]; + uint8_t format; + uint8_t reserved0; + uint16_t keyid_len; + uint8_t reserved1; + uint8_t hash_type; + uint16_t hash_len; + uint32_t reserved2; + uint32_t cert_len; + uint32_t reserved3[2]; + uint16_t hash_offset; + uint16_t cert_offset; + uint32_t reserved4[7]; +}; +typedef struct VCEntryHeader VCEntryHeader; + +struct VCBlockHeader { + uint32_t in_len; + uint32_t reserved0; + uint16_t first_vc_index; + uint16_t last_vc_index; + uint32_t reserved1[5]; + uint32_t out_len; + uint8_t reserved2[4]; + uint16_t stored_ct; + uint16_t remain_ct; + uint32_t reserved3[5]; +}; +typedef struct VCBlockHeader VCBlockHeader; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index db0f3a26e4..fad99e0269 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -205,11 +205,52 @@ out: } } =20 +static int handle_diag320_query_vcsi(S390CPU *cpu, uint64_t addr, uint64_t= r1, + uintptr_t ra, S390IPLCertificateStore= *cs) +{ + g_autofree VCStorageSizeBlock *vcssb =3D NULL; + + vcssb =3D g_new0(VCStorageSizeBlock, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcssb, sizeof(*vcssb))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + if (be32_to_cpu(vcssb->length) !=3D VCSSB_LEN_VALID) { + return DIAG_320_RC_INVAL_VCSSB_LEN; + } + + if (!cs->count) { + vcssb->length =3D cpu_to_be32(VCSSB_NO_VC); + } else { + vcssb->version =3D 0; + vcssb->total_vc_ct =3D cpu_to_be16(cs->count); + vcssb->max_vc_ct =3D cpu_to_be16(MAX_CERTIFICATES); + vcssb->max_single_vcb_len =3D cpu_to_be32(sizeof(VCBlockHeader) + + sizeof(VCEntryHeader) + + cs->largest_cert_size); + vcssb->total_vcb_len =3D cpu_to_be32(sizeof(VCBlockHeader) + + cs->count * sizeof(VCEntryHeade= r) + + cs->total_bytes); + } + + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcssb, be32_to_cpu(vcssb->l= ength))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + return DIAG_320_RC_OK; +} + +QEMU_BUILD_BUG_MSG(sizeof(VCStorageSizeBlock) !=3D VCSSB_LEN_VALID, + "size of VCStorageSizeBlock is wrong"); + void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { S390CPU *cpu =3D env_archcpu(env); + S390IPLCertificateStore *cs =3D s390_ipl_get_certificate_store(); uint64_t subcode =3D env->regs[r3]; uint64_t addr =3D env->regs[r1]; + int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { s390_program_interrupt(env, PGM_PRIVILEGED, ra); @@ -230,7 +271,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * but the current set of subcodes can fit within a single word * for now. */ - uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES); + uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | + DIAG_320_ISM_QUERY_VCSI); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -239,6 +281,23 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 env->regs[r1 + 1] =3D DIAG_320_RC_OK; break; + case DIAG_320_SUBC_QUERY_VCSI: + if (addr & 0x7) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + if (!diag_parm_addr_valid(addr, sizeof(VCStorageSizeBlock), true))= { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag320_query_vcsi(cpu, addr, r1, ra, cs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201510; cv=none; d=zohomail.com; s=zohoarc; b=V45flQfgQVSnQ6I+EYWBvox9uIQzo1ACzu4296kFjXAzgphwjyoX88Ja8LhF7ZgAts1KcvOt9tG+GoS8rTN7Zp74Gof+MoFEe7sNnSH2+OlHr3Undr/JWCZ8UmNIxv/ciGvzRiQy6/CGU/CE0cnzPIMyUwTEPPsD3A4dMIn6doM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201510; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wQ+il+s9Xg/o08k/00pPOPcbrUnAgwjkgTF3VysbxK4=; b=OegDOh9dll1aWhSVtBGPkRiYxoT3TiYT1l2ZipfjRgowFXx2Gcn2H6Rriaj81Gt2GLH3idbFGzn3rHJ6rNSety+0gOMfnxZ070S1u1SvfbH5I5sAwwvCHRcVDy0eamkEedp3OIBho4f7YCnI0G9EfW60YYD4Ivo7ynItq7VRnqE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201510887947.9519855156607; Sat, 4 Jul 2026 14:45:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg862-0007Pk-UB; Sat, 04 Jul 2026 17:40:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg860-0007OY-UA; Sat, 04 Jul 2026 17:40:20 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85y-0007bf-N4; Sat, 04 Jul 2026 17:40:20 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmUEG2446189; Sat, 4 Jul 2026 21:40:14 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc4m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:14 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYm4I025660; Sat, 4 Jul 2026 21:40:13 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhxdq7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:13 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeCZY18809506 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:12 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E884A5805E; Sat, 4 Jul 2026 21:40:11 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EFA4E58045; Sat, 4 Jul 2026 21:40:09 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:09 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=wQ+il+ s9Xg/o08k/00pPOPcbrUnAgwjkgTF3VysbxK4=; b=YpgA5uODhlmGhVJ/t4aij5 BiAZyqDI7stT4sQ5PuCVIdGbo6RVvNzt+6FpuZxOKngmglyGz6iZqQF/hjyGnmau 2UcKWeZ6ngeO+DCGZbeAQAeIRlstKTcpSpbrEUzNAvt7RoqmCRg/nEICbKHJvxQF AAY6G7hydfHAFMbxVe3sftOq+XYjhZ2RdtCO9L9HLUloURPI1RHDRsEugQi7iZUc M7eGokR1A7p8dCldji5VooUZAuYcUqzHmxNIhJ5C3sEaur71shV1BXrcCNeKreQa mpTU0J5705sHDZhTBt57o3Om8zLOVrcT5n0FYeBra4wf+cs79EUhqKCj8enOgYOQ == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 08/33] crypto/x509-utils: Add helper functions for DIAG 320 subcode 2 Date: Sat, 4 Jul 2026 17:39:24 -0400 Message-ID: <20260704213950.2118823-9-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497dbe cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=cx8EP_J7U0ANkHmDKVUA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX6r1PNIWraAVb zVyKRfTqr0eRYVmGESz1MXhgUw6UxJk2XviUhwKIk+GtIjLG9I3iuSoRaFNcdI5B9kpw8CJnhCx qnMVUPsyW3B9Xib2wKJvAafFsNRGUd4LZGqEY0OswwIL7buLCwAtzibrKboG88cKOluxofIcC+o Jq9QCWTk1mWAaqrqtTO+59uTyms4vWpHSfsToy5iof9RMyI8zsQsF8uNpsGsIbCqddwaB5ysYI6 8Q+ZIFZgLsi0cIQB9eyhZO5XaKhT9M7Hw+0pZYVAwXcRQhKJGBF4NN/YzmuZL1JcuErYzasXy0u r1mqq0h9JIu0Y3v9a/nJtFEdZ/Au5vSztzGXlwPw4gUGWafS5tAhvW2hceN9ecPfuEKiEjhRFAP sm3AxRh8IsjOzxy0F6N5MrPhou+4ooAPCPmBBzK3/Ny2YnrHNsI2/aYI4qJ9yPe+lMrdmOQc12i MdF+Yydo7Z6puwNAHzA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX8txjtNnsguUO UHWkdknfM8SlDhOMHr6e5t8qDCCigG5Kn4OZRY8bDI8DDfKF84EO1QddgE3RRddu5rTqSFFHhXQ X/PBfXCoY6e9YcCZFa48hUyNV8DrTNQ= X-Proofpoint-GUID: 30FGK5zN8PtaNc11bcmerI4NvR046TZM X-Proofpoint-ORIG-GUID: 30FGK5zN8PtaNc11bcmerI4NvR046TZM X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201511167158500 Introduce new helper functions to extract certificate metadata: qcrypto_x509_check_cert_times() - validates the certificate's validity peri= od against the current time qcrypto_x509_get_cert_key_id() - extracts the key ID from the certificate qcrypto_x509_check_ecc_curve_p521() - determines the ECC public key algorit= hm uses P-521 curve These functions provide support for metadata extraction and validity checki= ng for X.509 certificates. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali --- crypto/x509-utils.c | 236 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 51 ++++++++ 2 files changed, 287 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 68cf008938..d0e0384e9c 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -27,6 +27,16 @@ static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_= HASH_ALGO__MAX] =3D { [QCRYPTO_HASH_ALGO_RIPEMD160] =3D GNUTLS_DIG_RMD160, }; =20 +static const int qcrypto_to_gnutls_keyid_flags_map[] =3D { + [QCRYPTO_HASH_ALGO_MD5] =3D -1, + [QCRYPTO_HASH_ALGO_SHA1] =3D GNUTLS_KEYID_USE_SHA1, + [QCRYPTO_HASH_ALGO_SHA224] =3D -1, + [QCRYPTO_HASH_ALGO_SHA256] =3D GNUTLS_KEYID_USE_SHA256, + [QCRYPTO_HASH_ALGO_SHA384] =3D -1, + [QCRYPTO_HASH_ALGO_SHA512] =3D GNUTLS_KEYID_USE_SHA512, + [QCRYPTO_HASH_ALGO_RIPEMD160] =3D -1, +}; + int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, QCryptoHashAlgo alg, uint8_t *result, @@ -121,6 +131,210 @@ cleanup: return ret; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + time_t now =3D time(NULL); + time_t exp_time; + time_t act_time; + + if (now =3D=3D ((time_t)-1)) { + error_setg_errno(errp, errno, "Cannot get current time"); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + exp_time =3D gnutls_x509_crt_get_expiration_time(crt); + if (exp_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate expiration time"); + goto cleanup; + } + if (exp_time < now) { + error_setg(errp, "The certificate has expired"); + goto cleanup; + } + + act_time =3D gnutls_x509_crt_get_activation_time(crt); + if (act_time =3D=3D ((time_t)-1)) { + error_setg(errp, "Failed to get certificate activation time"); + goto cleanup; + } + if (act_time > now) { + error_setg(errp, "The certificate is not yet active"); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +static int qcrypto_x509_get_pk_algorithm(uint8_t *cert, size_t size, Error= **errp) +{ + int rc; + int ret =3D -1; + unsigned int bits; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_get_pk_algorithm(crt, &bits); + if (rc < 0) { + error_setg(errp, "Unknown public key algorithm %d", rc); + goto cleanup; + } + + ret =3D rc; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + + if (hash_alg >=3D G_N_ELEMENTS(qcrypto_to_gnutls_hash_alg_map)) { + error_setg(errp, "Unknown hash algorithm %d", hash_alg); + return ret; + } + + if (hash_alg >=3D G_N_ELEMENTS(qcrypto_to_gnutls_keyid_flags_map) || + qcrypto_to_gnutls_keyid_flags_map[hash_alg] =3D=3D -1) { + error_setg(errp, "Unsupported key id flag %d", hash_alg); + return ret; + } + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + *resultlen =3D gnutls_hash_get_len(qcrypto_to_gnutls_hash_alg_map[hash= _alg]); + if (*resultlen =3D=3D 0) { + error_setg(errp, "Failed to get hash algorithm length: %s", gnutls= _strerror(rc)); + goto cleanup; + } + + *result =3D g_malloc0(*resultlen); + if (gnutls_x509_crt_get_key_id(crt, + qcrypto_to_gnutls_keyid_flags_map[hash_= alg], + *result, resultlen) !=3D 0) { + error_setg(errp, "Failed to get key ID from certificate"); + g_clear_pointer(result, g_free); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + return ret; +} + +static int qcrypto_x509_get_ecc_curve(uint8_t *cert, size_t size, Error **= errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt; + gnutls_datum_t datum =3D {.data =3D cert, .size =3D size}; + gnutls_ecc_curve_t curve_id; + gnutls_datum_t x =3D {.data =3D NULL, .size =3D 0}; + gnutls_datum_t y =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + return ret; + } + + rc =3D gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_get_pk_ecc_raw(crt, &curve_id, &x, &y); + if (rc !=3D 0) { + error_setg(errp, "Failed to get ECC public key curve: %s", gnutls_= strerror(rc)); + goto cleanup; + } + + ret =3D curve_id; + +cleanup: + gnutls_x509_crt_deinit(crt); + g_free(x.data); + g_free(y.data); + return ret; +} + +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp) +{ + int algo; + int curve_id; + + algo =3D qcrypto_x509_get_pk_algorithm(cert, size, errp); + if (algo !=3D GNUTLS_PK_ECDSA) { + return 0; + } + + curve_id =3D qcrypto_x509_get_ecc_curve(cert, size, errp); + if (curve_id =3D=3D -1) { + error_setg(errp, "Failed to get ECC curve"); + return -1; + } + + if (curve_id =3D=3D GNUTLS_ECC_CURVE_INVALID) { + error_setg(errp, "Invalid ECC curve"); + return -1; + } + + return curve_id =3D=3D GNUTLS_ECC_CURVE_SECP521R1; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -142,4 +356,26 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_= t size, return -1; } =20 +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp) +{ + error_setg(errp, "GNUTLS is required to get certificate times"); + return -1; +} + +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to get key ID"); + return -1; +} + +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp) +{ + error_setg(errp, "GNUTLS is required to determine ecc curve"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index 91ae79fb03..fcace73c49 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -40,4 +40,55 @@ int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t = size, size_t *resultlen, Error **errp); =20 +/** + * qcrypto_x509_check_cert_times + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Check whether the activation and expiration times of @cert + * are valid at the current time. + * + * Returns: 0 if the certificate times are valid, + * -1 on error. + */ +int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp= ); + +/** + * qcrypto_x509_get_cert_key_id + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @hash_alg: the hash algorithm flag + * @result: output location for the allocated buffer for key ID + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + * (will be updated with the actual size of key id) + * @errp: error pointer + * + * Retrieve the key ID from the @cert based on the specified @hash_alg. + * + * Returns: 0 if key ID was successfully stored in @result, + * -1 on error. + */ +int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, + QCryptoHashAlgo hash_alg, + uint8_t **result, + size_t *resultlen, + Error **errp); + +/** + * qcrypto_x509_check_ecc_curve_p521 + * @cert: pointer to the raw certificate data + * @size: size of the certificate + * @errp: error pointer + * + * Determine whether the ECC public key in the given certificate uses the = P-521 + * curve. + * + * Returns: 0 if ECC public key does not use P521 curve. + * 1 if ECC public key uses P521 curve. + * -1 on error. + */ +int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp); + #endif --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201392; cv=none; d=zohomail.com; s=zohoarc; b=cRx4/ZuHZEIesk8IC/rZTkHT0rICbNxYRTW84HS/73IDGl77DojVI/oP3g8LbiIafOOn9XkfilivG68rzL4rOnACn3YwLAEvq6gNz7iNXA0mTt2j0jvzWJPJk73mH+EMqq+NYtrJtco2BFfh+kO4hr6xinaOGm4BjgCSlCj+Uag= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201392; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M6jKI+IkEhmxBw4d1X1lJVxW8OEiBedsZN4aO5yBTz4=; b=HbgoBfyXGNCOejpM281slvg78igoVN6qz41WfOPO2OUN2kgs8FYOW+/XeMeXFmEqu4Alaz3CIIHRqaNxFYk5AeIJRVyTAkW9d+9ltJA9j8FL1PlPIjDidAW06vLk3XZqE1HEOWz86pMDjSkuTVj8jqNNfdMvqAwHvw+9l/63+6g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201392795497.0160303792808; Sat, 4 Jul 2026 14:43:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg864-0007Qc-Gw; Sat, 04 Jul 2026 17:40:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg862-0007PW-8E; Sat, 04 Jul 2026 17:40:22 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg85z-0007cJ-Na; Sat, 04 Jul 2026 17:40:21 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmqWa2458213; Sat, 4 Jul 2026 21:40:16 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hkc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:16 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYeUU011950; Sat, 4 Jul 2026 21:40:15 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgkh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:15 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeEp129229816 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:14 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 19BEF58054; Sat, 4 Jul 2026 21:40:14 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F59558045; Sat, 4 Jul 2026 21:40:12 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:11 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=M6jKI+IkEhmxBw4d1 X1lJVxW8OEiBedsZN4aO5yBTz4=; b=CqXjrxLnDwknZs4NrHciU2X545/fqYYf+ vk1LZ/z7anJa44gX9uozhpBU2Y6a8xopQxgPiIdoEkpAvB/7CdX8o/h1ZAoK4AUC 2mhwv4mKYT0A68hGIQvhhsN6ejBT84zJZZrD0dMjYHCw0IAslHwnWIWIdTJV6oHI NtRwFrWBrfYgXq9riA4tI0oOF0D7JTd7DxlUQIV9TFOUIOpHuBql9JteaBY1c7H5 4e5NpefJMYO9CFUJeiflzg56GXTv6oxQlZUiRYpLqvXq0HrGV2N5en7zHdtOCjTE o/t8+m5e8TZmKHeEl4LF1P0CIXoufOiyDxXcMMObLfHzblT/SfLog== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 09/33] s390x/diag: Implement DIAG 320 subcode 2 Date: Sat, 4 Jul 2026 17:39:25 -0400 Message-ID: <20260704213950.2118823-10-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497dc0 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=yb4F8fGd1MjoyQfLk7gA:9 X-Proofpoint-GUID: J-JBkfD4A2PnKkFLf5MnjaefxbYhroqu X-Proofpoint-ORIG-GUID: J-JBkfD4A2PnKkFLf5MnjaefxbYhroqu X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXwDX+Xz04Q1Gi pu3rYDztDQpdHkmtT1tCB21be4cU97PK6Gn7t2woGPeEn6WKp7I2ksg3b6cFzEB8+hayStwN1cq UjrYQxW3EXeHqgLIefJF/uzMZ/SYsUM= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXxaSiZNHUoAXZ 5d7pZHWyxfYuJYVL5Z2fw1kwlH7c0JcPs13k1tGA59XfJ/VG5nEH1z7R0n9MO0c8gfmyIwSAJrH HuPDIbtOVKDBkuI/5nhsbvjtTd10OXXg1h8bQbMLz3hGpud/qdmj+D6hYsiZkQZIllogLT6NVQf grqCTNSrLof18jY67sQPsvPNOiuhSwmLf2sbnsQxrNQhgHM1Wqbdhxaxr9K6ggg6/oQDBmCwyfd xBVH8qXPhdDVDj0OEcLfsRCvQ77EYBAvJdE7HFgEvCqzZ1y2szyXnQdJDlIp759VqeOPfZGKY93 6iVUO+hXn7GTlL5BophriEbp04uSvKj5LqmjPLaBEbXXXbkMspioj4T/dDMRM+Mv1FibkjjE2lo 0o18Dor1wL/58nzerXtTHZ9LY3Y9hjKzdQMzXMTuG7f5+RfF+s4YRk1yi/MHSiUeUGNybKQY3QM dkM5VkWlTpbwneRXsSg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201394545158500 Content-Type: text/plain; charset="utf-8" DIAG 320 subcode 2 provides verification-certificates (VCs) that are in the certificate store. Only X509 certificates in DER format and SHA-256 hash type are recognized. The subcode value is denoted by setting the second-left-most bit of an 8-byte field. The Verification Certificate Block (VCB) contains the output data when the operation completes successfully. It includes a common header followed by zero or more Verification Certificate Entries (VCEs), depending on the VCB input length and the VC range (from the first VC index to the last VC index) in the certificate store. Each VCE contains information about a certificate retrieved from the S390IPLCertificateStore, such as the certificate name, key type, key ID length, hash length, and the raw certificate data. The key ID and hash are extracted from the raw certificate by the crypto AP= I. Note: SHA2-256 VC hash type is required for retrieving the hash (fingerprint) of the certificate. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman Reviewed-by: Jared Rossi --- docs/specs/s390x-secure-ipl.rst | 24 +++ include/hw/s390x/ipl/diag320.h | 38 ++++ target/s390x/diag.c | 316 +++++++++++++++++++++++++++++++- 3 files changed, 377 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 201cc74c7c..99052041c1 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -42,3 +42,27 @@ Subcode 1 - query verification certificate storage infor= mation The output is returned in the verification-certificate-storage-size bl= ock (VCSSB). A VCSSB length of 4 indicates that no certificates are availa= ble in the CS. + +Subcode 2 - store verification certificates + Provides VCs that are in the certificate store. + + The output is provided in a VCB, which includes a common header follow= ed by + zero or more verification-certificate entries (VCEs). + + The instruction expects the cert store to maintain an origin of 1 for = the + index (i.e. a retrieval of the first certificate in the store should be + denoted by setting first-VC to 1). + + The first-VC and last-VC fields of the VCB specify the index range of + VCs to be stored in the VCB. Certs are stored sequentially, starting + with first-VC index. As each cert is stored, a "stored count" is + incremented. If there is not enough space to store all certs requested + by the index range, a "remaining count" will be recorded and no more + certificates will be stored. + + Each VCE contains a header followed by information extracted from a + certificate within the certificate store. The information includes: + key-id, hash, and certificate data. This information is stored + contiguously in a VCE (with zero-padding). Following the header, the + key-id is immediately stored. The hash and certificate data follow and + may be accessed via the respective offset fields stored in the VCE. diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index d37d8eaa86..7fda2d44fd 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -12,19 +12,45 @@ =20 #define DIAG_320_SUBC_QUERY_ISM 0 #define DIAG_320_SUBC_QUERY_VCSI 1 +#define DIAG_320_SUBC_STORE_VC 2 =20 #define DIAG_320_RC_OK 0x0001 #define DIAG_320_RC_NOT_SUPPORTED 0x0102 #define DIAG_320_RC_INVAL_VCSSB_LEN 0x0202 +#define DIAG_320_RC_INVAL_VCB_LEN 0x0204 +#define DIAG_320_RC_BAD_RANGE 0x0302 =20 #define DIAG_320_ISM_QUERY_SUBCODES 0x80000000 #define DIAG_320_ISM_QUERY_VCSI 0x40000000 +#define DIAG_320_ISM_STORE_VC 0x20000000 =20 #define VCSSB_NO_VC 4 #define VCSSB_LEN_VALID 128 =20 #define CERT_NAME_MAX_LEN 64 =20 +/* + * If the VCE flags indicate an invalid certificate, + * the VCE length is set to 72, containing only the + * first five fields of VCEntry. + */ +#define VCE_INVALID_LEN 72 + +#define DIAG_320_VCE_FLAGS_VALID 0x80 + +typedef enum Diag320VceKeyType { + DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING =3D 0, + DIAG_320_VCE_KEYTYPE_ECDSA_P521 =3D 1, +} Diag320VceKeyType; + +typedef enum Diag320VceFormat { + DIAG_320_VCE_FORMAT_X509_DER =3D 1, +} Diag320VceFormat; + +typedef enum Diag320VceHashType { + DIAG_320_VCE_HASHTYPE_SHA2_256 =3D 1, +} Diag320VceHashType; + struct VCStorageSizeBlock { uint32_t length; uint8_t reserved0[3]; @@ -60,6 +86,12 @@ struct VCEntryHeader { }; typedef struct VCEntryHeader VCEntryHeader; =20 +struct VCEntry { + VCEntryHeader vce_hdr; + uint8_t cert_buf[]; +}; +typedef struct VCEntry VCEntry; + struct VCBlockHeader { uint32_t in_len; uint32_t reserved0; @@ -74,4 +106,10 @@ struct VCBlockHeader { }; typedef struct VCBlockHeader VCBlockHeader; =20 +struct VCBlock { + VCBlockHeader vcb_hdr; + uint8_t vce_buf[]; +}; +typedef struct VCBlock VCBlock; + #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index fad99e0269..452ac3ca79 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -17,13 +17,16 @@ #include "s390x-internal.h" #include "hw/watchdog/wdt_diag288.h" #include "system/cpus.h" +#include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" #include "target/s390x/kvm/pv.h" +#include "qapi/error.h" #include "qemu/error-report.h" +#include "crypto/x509-utils.h" =20 =20 static inline bool diag_parm_addr_valid(uint64_t addr, size_t size, bool w= rite) @@ -241,8 +244,306 @@ static int handle_diag320_query_vcsi(S390CPU *cpu, ui= nt64_t addr, uint64_t r1, return DIAG_320_RC_OK; } =20 +static bool is_cert_valid(const S390IPLCertificate *cert) +{ + int rc; + Error *err =3D NULL; + + rc =3D qcrypto_x509_check_cert_times(cert->raw, cert->size, &err); + if (rc !=3D 0) { + error_report_err(err); + return false; + } + + return true; +} + +static int handle_key_id(VCEntry *vce, const S390IPLCertificate *cert) +{ + int rc; + g_autofree unsigned char *key_id_data =3D NULL; + size_t key_id_len; + Error *err =3D NULL; + + rc =3D qcrypto_x509_get_cert_key_id(cert->raw, cert->size, + QCRYPTO_HASH_ALGO_SHA256, + &key_id_data, &key_id_len, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + if (sizeof(VCEntryHeader) + key_id_len > be32_to_cpu(vce->vce_hdr.len)= ) { + error_report("Unable to write key ID: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.keyid_len =3D cpu_to_be16(key_id_len); + + memcpy(vce->cert_buf, key_id_data, key_id_len); + + return ROUND_UP(key_id_len, 4); +} + +static int handle_hash(VCEntry *vce, const S390IPLCertificate *cert, + uint16_t keyid_field_len) +{ + int rc; + uint16_t hash_offset; + g_autofree void *hash_data =3D NULL; + size_t hash_len; + Error *err =3D NULL; + + hash_len =3D CERT_HASH_LEN; + hash_data =3D g_malloc0(hash_len); + rc =3D qcrypto_get_x509_cert_fingerprint(cert->raw, cert->size, + QCRYPTO_HASH_ALGO_SHA256, + hash_data, &hash_len, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + hash_offset =3D sizeof(VCEntryHeader) + keyid_field_len; + if (hash_offset + hash_len > be32_to_cpu(vce->vce_hdr.len)) { + error_report("Unable to write hash: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.hash_len =3D cpu_to_be16(hash_len); + vce->vce_hdr.hash_type =3D DIAG_320_VCE_HASHTYPE_SHA2_256; + vce->vce_hdr.hash_offset =3D cpu_to_be16(hash_offset); + + memcpy((uint8_t *)vce + hash_offset, hash_data, hash_len); + + return ROUND_UP(hash_len, 4); +} + +static int handle_cert(VCEntry *vce, const S390IPLCertificate *cert, + uint16_t hash_field_len) +{ + int rc; + uint16_t cert_offset; + g_autofree uint8_t *cert_der =3D NULL; + size_t der_size; + Error *err =3D NULL; + + rc =3D qcrypto_x509_convert_cert_der(cert->raw, cert->size, + &cert_der, &der_size, &err); + if (rc < 0) { + error_report_err(err); + return 0; + } + + cert_offset =3D be16_to_cpu(vce->vce_hdr.hash_offset) + hash_field_len; + if (cert_offset + der_size > be32_to_cpu(vce->vce_hdr.len)) { + error_report("Unable to write certificate: exceeds buffer bounds"); + return 0; + } + + vce->vce_hdr.format =3D DIAG_320_VCE_FORMAT_X509_DER; + vce->vce_hdr.cert_len =3D cpu_to_be32(der_size); + vce->vce_hdr.cert_offset =3D cpu_to_be16(cert_offset); + + memcpy((uint8_t *)vce + cert_offset, cert_der, der_size); + + return ROUND_UP(der_size, 4); +} + +static int get_key_type(const S390IPLCertificate *cert) +{ + int rc; + Error *err =3D NULL; + + rc =3D qcrypto_x509_check_ecc_curve_p521(cert->raw, cert->size, &err); + if (rc =3D=3D -1) { + error_report_err(err); + return -1; + } + + return (rc =3D=3D 1) ? DIAG_320_VCE_KEYTYPE_ECDSA_P521 : + DIAG_320_VCE_KEYTYPE_SELF_DESCRIBING; +} + +static int build_vce_header(VCEntry *vce, const S390IPLCertificate *cert, = int idx) +{ + int key_type; + + vce->vce_hdr.len =3D cpu_to_be32(sizeof(VCEntryHeader)); + vce->vce_hdr.cert_idx =3D cpu_to_be16(idx + 1); + memcpy(vce->vce_hdr.name, cert->name, CERT_NAME_MAX_LEN); + + if (!is_cert_valid(cert)) { + return -1; + } + + key_type =3D get_key_type(cert); + if (key_type =3D=3D -1) { + return -1; + } + vce->vce_hdr.key_type =3D key_type; + + return 0; +} + +static int build_vce_data(VCEntry *vce, const S390IPLCertificate *cert, + uint32_t vce_max_len) +{ + uint16_t keyid_field_len; + uint16_t hash_field_len; + uint32_t cert_field_len; + uint32_t vce_len; + + vce->vce_hdr.len =3D cpu_to_be32(vce_max_len); + + keyid_field_len =3D handle_key_id(vce, cert); + if (!keyid_field_len) { + return -1; + } + + hash_field_len =3D handle_hash(vce, cert, keyid_field_len); + if (!hash_field_len) { + return -1; + } + + cert_field_len =3D handle_cert(vce, cert, hash_field_len); + if (!cert_field_len) { + return -1; + } + + vce_len =3D sizeof(VCEntryHeader) + keyid_field_len + hash_field_len += cert_field_len; + if (vce_len > vce_max_len) { + return -1; + } + + vce->vce_hdr.flags |=3D DIAG_320_VCE_FLAGS_VALID; + + /* Update vce length to reflect the actual size used by vce */ + vce->vce_hdr.len =3D cpu_to_be32(vce_len); + + return 0; +} + +static int handle_diag320_store_vc(S390CPU *cpu, uint64_t addr, uint64_t r= 1, uintptr_t ra, + S390IPLCertificateStore *cs) +{ + g_autofree VCBlockHeader *vcb_hdr =3D NULL; + size_t remaining_space; + uint16_t first_vc_index; + uint16_t last_vc_index; + int cs_start_index; + int cs_end_index; + uint32_t vce_max_len; + uint32_t vce_len; + uint32_t in_len; + + vcb_hdr =3D g_new0(VCBlockHeader, 1); + if (s390_cpu_virt_mem_read(cpu, addr, r1, vcb_hdr, sizeof(*vcb_hdr))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + in_len =3D be32_to_cpu(vcb_hdr->in_len); + first_vc_index =3D be16_to_cpu(vcb_hdr->first_vc_index); + last_vc_index =3D be16_to_cpu(vcb_hdr->last_vc_index); + + if (in_len % TARGET_PAGE_SIZE !=3D 0) { + return DIAG_320_RC_INVAL_VCB_LEN; + } + + if (first_vc_index > last_vc_index) { + return DIAG_320_RC_BAD_RANGE; + } + + vcb_hdr->out_len =3D sizeof(VCBlockHeader); + + /* + * DIAG 320 subcode 2 expects to query a certificate store that + * maintains an index origin of 1. However, the S390IPLCertificateStore + * maintains an index origin of 0. Thus, the indices must be adjusted + * for correct access into the cert store. A couple of special cases + * must also be accounted for. + */ + + /* Both indices are 0; return header with no certs */ + if (first_vc_index =3D=3D 0 && last_vc_index =3D=3D 0) { + goto out; + } + + /* Normalize indices */ + cs_start_index =3D (first_vc_index =3D=3D 0) ? 0 : first_vc_index - 1; + cs_end_index =3D last_vc_index - 1; + + /* Requested range is outside the cert store; return header with no ce= rts */ + if (cs_start_index >=3D cs->count || cs_end_index >=3D cs->count) { + goto out; + } + + remaining_space =3D in_len - sizeof(VCBlockHeader); + + for (int i =3D cs_start_index; i <=3D cs_end_index; i++) { + const S390IPLCertificate *cert =3D &cs->certs[i]; + /* + * Each field of the VCE is word-aligned. + * Allocate enough space for the largest possible size for this VC= E. + * As the certificate fields (key-id, hash, data) are parsed, the + * VCE's length field will be updated accordingly. + */ + vce_max_len =3D sizeof(VCEntryHeader) + ROUND_UP(CERT_KEY_ID_LEN, = 4) + + ROUND_UP(CERT_HASH_LEN, 4) + ROUND_UP(cert->der_size= , 4); + g_autofree VCEntry *vce =3D g_malloc0(vce_max_len); + + /* + * Bit 0 of the VCE flags indicates whether the certificate is val= id. + * The caller of DIAG320 subcode 2 is responsible for verifying th= at + * the VCE contains a valid certificate. + */ + if (build_vce_header(vce, cert, i) || build_vce_data(vce, cert, vc= e_max_len)) { + /* + * Error occurs - VCE does not contain a valid certificate. + * Bit 0 of the VCE flags is 0 and the VCE length is set. + */ + vce->vce_hdr.len =3D cpu_to_be32(VCE_INVALID_LEN); + } + vce_len =3D be32_to_cpu(vce->vce_hdr.len); + + /* + * If there is no more space to store the cert, + * set the remaining verification cert count and + * break early. + */ + if (remaining_space < vce_len) { + vcb_hdr->remain_ct =3D cpu_to_be16(last_vc_index - i); + break; + } + + /* Write VCE */ + if (s390_cpu_virt_mem_write(cpu, addr + vcb_hdr->out_len, r1, vce,= vce_len)) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + vcb_hdr->out_len +=3D vce_len; + remaining_space -=3D vce_len; + vcb_hdr->stored_ct++; + } + vcb_hdr->stored_ct =3D cpu_to_be16(vcb_hdr->stored_ct); + +out: + vcb_hdr->out_len =3D cpu_to_be32(vcb_hdr->out_len); + + if (s390_cpu_virt_mem_write(cpu, addr, r1, vcb_hdr, sizeof(VCBlockHead= er))) { + s390_cpu_virt_mem_handle_exc(cpu, ra); + return -1; + } + + return DIAG_320_RC_OK; +} + QEMU_BUILD_BUG_MSG(sizeof(VCStorageSizeBlock) !=3D VCSSB_LEN_VALID, "size of VCStorageSizeBlock is wrong"); +QEMU_BUILD_BUG_MSG(sizeof(VCBlock) !=3D 64, "size of VCBlock is wrong"); +QEMU_BUILD_BUG_MSG(sizeof(VCEntry) !=3D 128, "size of VCEntry is wrong"); =20 void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { @@ -272,7 +573,8 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra) * for now. */ uint32_t ism_word0 =3D cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES | - DIAG_320_ISM_QUERY_VCSI); + DIAG_320_ISM_QUERY_VCSI | + DIAG_320_ISM_STORE_VC); =20 if (s390_cpu_virt_mem_write(cpu, addr, r1, &ism_word0, sizeof(ism_= word0))) { s390_cpu_virt_mem_handle_exc(cpu, ra); @@ -298,6 +600,18 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) } env->regs[r1 + 1] =3D rc; break; + case DIAG_320_SUBC_STORE_VC: + if (addr & ~TARGET_PAGE_MASK) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + rc =3D handle_diag320_store_vc(cpu, addr, r1, ra, cs); + if (rc =3D=3D -1) { + return; + } + env->regs[r1 + 1] =3D rc; + break; default: env->regs[r1 + 1] =3D DIAG_320_RC_NOT_SUPPORTED; break; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201318; cv=none; d=zohomail.com; s=zohoarc; b=dIjfcffad72uVyC13JUQ6P/rpx1H5qB5DcbZK4/hENZDpZ47wdC51JHP4eBBG4vfv2B4JJ7AyqMkfsnPzflPxsWuiC7XECE47WjN1IKtaGX7FeWN5hAFA3UZ0hMZ1m74vNNF+sfNZKYJR5L6rzqaMlV4xLj7ay8ypaTbkUBncQk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201318; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vD/1H4gQ5LszeVnNgz6n6n6V5b2d1QIE7rx4i5ZK6n4=; b=JHTX0pTcSjZA0E6+2PbrohxuUtWHg6XCXDM92NPo3iLiaYKzHmruBfPBvtS3omMy58HO+wyI27kiFBZiQ2D5yBs5obEYfL4Q2AunH3hu8WND9B/zrRZhShSleU/PF26Q/wQw2sH1+pUJjxHGoMCRGamPunpvFh8z7vxqW8VPpxw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201318011952.1113933936263; Sat, 4 Jul 2026 14:41:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86C-0007TE-It; Sat, 04 Jul 2026 17:40:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg869-0007S0-Vj; Sat, 04 Jul 2026 17:40:29 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg868-0007rw-ED; Sat, 04 Jul 2026 17:40:29 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmucL2447066; Sat, 4 Jul 2026 21:40:18 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc4u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:18 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYapH009719; Sat, 4 Jul 2026 21:40:17 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbss-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:17 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeGkS24707680 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:16 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 25C8358045; Sat, 4 Jul 2026 21:40:16 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4212858056; Sat, 4 Jul 2026 21:40:14 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:14 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=vD/1H4gQ5LszeVnNg z6n6n6V5b2d1QIE7rx4i5ZK6n4=; b=Ulxwh93nOEf6GWY0wJBlYExKJS/8hcG1q 0aZWLsFcBYpVx5cpSdiW37tjnKIZkTMksC+hsvn/1dprOEpxlHjtz5ugT+0tfLGQ 1PaaxlUi7zalcMUAMP7jxow5OD5/dmYNIVirDcrHjF8lrtyprBrrzlKXEpE/WTYY /68wNdYkqoWdUAL4VNU7Pe941bGPyO28qlsIqLJORbweF4o9a5cW7n33TQX6Ys7D H+qetVNSeeWoxXcftbucdJ+Z3iJQNjXYJ+vCLelnKJKMCQz90JTmlU4ppRk+UuiU tMS3RCvMg8SEL9Z+1aLufZN/uzGvV9SCp+0sdnQTaLZuZ+nRTr/Zw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 10/33] hw/s390x: Define finite size for single entry VCEntry Date: Sat, 4 Jul 2026 17:39:26 -0400 Message-ID: <20260704213950.2118823-11-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497dc2 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=HeWPiYe96b1ufxwsDYQA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX3/lRU3OuME2p GN/XrDigEZQNxFxHSpPQmVcaXh8bfOYV4yw/haLZ+NBSKSLJJqWL8bRWi1SLItucWgo3vzPEJC2 EV67OAaBy2RUZ+zLoq2SfxxCLgW5H0iBUTpW1MA74zL4p9/pNYDPwnOy48eLC8N6rZSFU23AeFC jO5r/ozowgqzszOcNQRJLZZX4xBrJ3PsLErk2Oig+9kZfPp1bZIIJAI2RLA1hXEGrU7KrY0md72 sTdvrFPTA4NjHOy2fXKu5JCDeOGCC8R0z1XxMFY9Y7FQWBqk20DpM9DtwJmBmmNGe54hgqqflB5 iLNPXkFDwi1FVcPTKuscl1By4IyBRKi1CIRz4qXnVMd7B/NUOvfBWDEpTnpCPArKvsR0+nHmwyF 5ML1CkeLbQbMUy7SWsleMRMPtVebWfeQDxtiNTNm4OBr+Ne4hpFkCR0h/IkFwX733QdkYqWdvST 64U8MXbsU54JseKcn1Q== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX+iZ+rA+aY+DE OwyxDuM2U0i3E7D259riq9AoU4zaad6GY362d7NiO3cJMCjPkBlFIWxZ2202yGw+O+J2jW4cqHO a6FoDw+w3JSe13w7icvZXo6/b1KQGMk= X-Proofpoint-GUID: hj7ZFsOjvHW2r2V1nSVbGdD6Gu60kmZ1 X-Proofpoint-ORIG-GUID: hj7ZFsOjvHW2r2V1nSVbGdD6Gu60kmZ1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201318218158500 Content-Type: text/plain; charset="utf-8" Define MAX_VCENTRY_SIZE(8KB) and CERT_BUF_MAX_LEN to establish a finite size for a single entry VCEntry. Add validation in update_cert_store() to ensure certificate data does not exceed this limit. This finite size definition is needed for proper memory allocation and will be used in a later commit to handle VCEntry structures with known size constraints. Signed-off-by: Zhuoying Cai Reviewed-by: Matthew Rosato Reviewed-by: Eric Farman --- hw/s390x/cert-store.c | 6 ++++++ include/hw/s390x/ipl/diag320.h | 3 +++ 2 files changed, 9 insertions(+) diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c index c679406c2c..e253777880 100644 --- a/hw/s390x/cert-store.c +++ b/hw/s390x/cert-store.c @@ -91,6 +91,12 @@ static int update_cert_store(S390IPLCertificateStore *ce= rt_store, cert_buf_size =3D ROUND_UP(cert->der_size, 4); data_buf_size =3D keyid_buf_size + hash_buf_size + cert_buf_size; =20 + if (data_buf_size > CERT_BUF_MAX_LEN) { + error_report("Certificate data size %zu exceeds maximum buffer siz= e %ld", + data_buf_size, CERT_BUF_MAX_LEN); + return -1; + } + if (cert_store->largest_cert_size < data_buf_size) { cert_store->largest_cert_size =3D data_buf_size; } diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index 7fda2d44fd..f3c23a3176 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -92,6 +92,9 @@ struct VCEntry { }; typedef struct VCEntry VCEntry; =20 +#define MAX_VCENTRY_SIZE (8 * 1024) +#define CERT_BUF_MAX_LEN (MAX_VCENTRY_SIZE - sizeof(VCEntryHeader)) + struct VCBlockHeader { uint32_t in_len; uint32_t reserved0; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201481; cv=none; d=zohomail.com; s=zohoarc; b=OvHSbJXBLrAKghhW4V14HQMDRVWNhlDG3VynPY/lJx90/EH1t1aJ5hpyRPBR4bG+mFIAd0SmnRcQrdioDnOCoC98C/WMn6sLQ/JzLyMNhsV93ycCaTOAT4srWVpcntXknZoa+9e1iNJb8sSTkMSStRHuIw09T9IlyA5524t9KXg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201481; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DTtterQwjTqSJ/c8MAfMybVRcMbL6tarADwzRmHFMZQ=; b=U0Qgh2amvkivKFpmAATiuTvIhJbjo6cE5s3gYZIafysXx2LCdBcPkNQ0Qrxv/Apr3mYRTfFvbOY1qyesyiv5GKLNzC2Quloq9RFcAu+txds4H/cDN1Pkv+QbiN6yJuErc0W2wnyjafgE/025YasF/HQsYEiDZaQyyNv087wQ9b8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201481261939.839737797028; Sat, 4 Jul 2026 14:44:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg867-0007RD-J7; Sat, 04 Jul 2026 17:40:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg866-0007Qv-DS; Sat, 04 Jul 2026 17:40:26 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg864-0007nW-Eu; Sat, 04 Jul 2026 17:40:26 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmFVp2593225; Sat, 4 Jul 2026 21:40:20 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sp3b912-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:20 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYm4K025660; Sat, 4 Jul 2026 21:40:19 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhxdqr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:19 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeI7931261234 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:18 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 448C458054; Sat, 4 Jul 2026 21:40:18 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5060958056; Sat, 4 Jul 2026 21:40:16 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:16 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=DTtterQwjTqSJ/c8M AfMybVRcMbL6tarADwzRmHFMZQ=; b=AEgmGh1icJqwCK6iL0t4sZmpEPkVdou/f xXAvl42xd6/JiGOr6ng1ufYozQDqzEgraYQS4ng1/4MKPkZjitOoX8Qxu8gsD5hC tkh3GPLRzthYELDPXTNGiffORlCVJHHv3dI7YKw9jdu9sZTfhDK+owSELlpDEs0D jZSkwOTlZGR7ozxXS4JGTU1dsti+DLeIYMkmrCVN0UqZpxDDM9ki7Nv3YR7Xog7z P1oDspYXqdrnpZNkkxjV9HwPmLUvBuYy7UJ+hyoyT1S6OUNWdqDJQsTAlp7uJneF Twx5Vvg1SuF/vekeK7puWMFPRtYnc8X/uQZueVq7nbxgutRVZD0aA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 11/33] s390x/diag: Introduce DIAG 508 for secure IPL operations Date: Sat, 4 Jul 2026 17:39:27 -0400 Message-ID: <20260704213950.2118823-12-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=KsJ9H2WN c=1 sm=1 tr=0 ts=6a497dc4 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=hXQcL9AfcS-IPDpH2m0A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXx+yhP3rtSkfY lp/Q0LdEnwe7GIt1GxjKqzgET4HzB+2aGiqXgSETxtWh5dIPPTCqdnbTzpMnzWU6i8tiQycvNWS q9Xm5K4gdyzQfKJc5/sdfv8RQTMDRiM= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX16s/Dfk21QTg tDEKxbkYjT43zofIel1l88wdkq3Zz5Kesrfyxj+s5rDRye4ec5q2Gk6pBDWxe5a9//gQzLw/Nty Qhp9en4JB8CIHBR1F2cYffQbOBwaL9cDnJCtkoOc4d+BNtWU02kIi2ayp9qTxeG9BMOoq4GUX10 OOyTec+HYfidngRItfeF4WZaJlo6VpqwqMeth4bm2WbplcEwXkigPIkbx1EDr6o5b3soL31N6mC AXu1nsqPThEM/vO81jCMBLDyQKbYvv2y/b8MyQmJOedrmxi5TNVbIHiX19TMZLk7cwRbZ13Js5I zoPSHX3OvLs2vtcXxdfGZRlUMpLFAeBPiDoYQVYoXSY+RXqGFcESUrhJLjhdrIaxHY82obW7uT/ MrjfsdDDf2xO65iFbiEOc5/Cd3eZvX1MQqSoajb+xIXgUAQz6G/53wdhyIwOC1+hsclzRSnJSIL VrP+5j+izLHQV6L6SAA== X-Proofpoint-ORIG-GUID: yVhLAXxjp8j8bsi81kNzNaNXnym6o9h7 X-Proofpoint-GUID: yVhLAXxjp8j8bsi81kNzNaNXnym6o9h7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 spamscore=0 adultscore=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201483016158500 Content-Type: text/plain; charset="utf-8" From: Collin Walling In order to support secure IPL (aka secure boot) for the s390-ccw BIOS, a new s390 DIAGNOSE instruction is introduced to leverage QEMU for handling operations such as signature verification and certificate retrieval. Currently, only subcode 0 is supported with this patch, which is used to query a bitmap of which subcodes are supported. Signed-off-by: Collin Walling Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- docs/specs/s390x-secure-ipl.rst | 18 ++++++++++++++++++ include/hw/s390x/ipl/diag508.h | 15 +++++++++++++++ target/s390x/diag.c | 27 +++++++++++++++++++++++++++ target/s390x/kvm/kvm.c | 14 ++++++++++++++ target/s390x/s390x-internal.h | 2 ++ target/s390x/tcg/misc_helper.c | 7 +++++++ 6 files changed, 83 insertions(+) create mode 100644 include/hw/s390x/ipl/diag508.h diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 99052041c1..776270d816 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -66,3 +66,21 @@ Subcode 2 - store verification certificates contiguously in a VCE (with zero-padding). Following the header, the key-id is immediately stored. The hash and certificate data follow and may be accessed via the respective offset fields stored in the VCE. + + +Secure IPL Data Structures, Facilities, and Functions +----------------------------------------------------- + +DIAGNOSE function code 'X'508' - IPL extensions +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +DIAGNOSE 'X'508' is reserved for guest use in order to facilitate communic= ation +of additional IPL operations that cannot be handled by guest code, such as +signature verification for secure IPL. + +If the function code specifies 0x508, IPL extension functions are performe= d. +These functions are meant to provide extended functionality for s390 guest= boot +that requires assistance from QEMU. + +Subcode 0 - query installed subcodes + Returns a 64-bit mask indicating which subcodes are supported. diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h new file mode 100644 index 0000000000..6281ad8299 --- /dev/null +++ b/include/hw/s390x/ipl/diag508.h @@ -0,0 +1,15 @@ +/* + * S/390 DIAGNOSE 508 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Collin Walling + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG508_H +#define S390X_DIAG508_H + +#define DIAG_508_SUBC_QUERY_SUBC 0x0000 + +#endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 452ac3ca79..6e7f2d5cb3 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -20,6 +20,7 @@ #include "hw/s390x/cert-store.h" #include "hw/s390x/ipl.h" #include "hw/s390x/ipl/diag320.h" +#include "hw/s390x/ipl/diag508.h" #include "hw/s390x/s390-virtio-ccw.h" #include "system/kvm.h" #include "kvm/kvm_s390x.h" @@ -617,3 +618,29 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) break; } } + +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) +{ + uint64_t subcode =3D env->regs[r3]; + int rc; + + if (env->psw.mask & PSW_MASK_PSTATE) { + s390_program_interrupt(env, PGM_PRIVILEGED, ra); + return; + } + + if ((subcode & ~0x0ffffULL) || (r1 & 1)) { + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + + switch (subcode) { + case DIAG_508_SUBC_QUERY_SUBC: + rc =3D 0; + break; + default: + s390_program_interrupt(env, PGM_SPECIFICATION, ra); + return; + } + env->regs[r1 + 1] =3D rc; +} diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 2ef4734559..42417bb1c7 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -102,6 +102,7 @@ #define DIAG_CERT_STORE 0x320 #define DIAG_KVM_HYPERCALL 0x500 #define DIAG_KVM_BREAKPOINT 0x501 +#define DIAG_SECURE_IPL 0x508 =20 #define ICPT_INSTRUCTION 0x04 #define ICPT_PROGRAM 0x08 @@ -1542,6 +1543,16 @@ static void kvm_handle_diag_320(S390CPU *cpu, struct= kvm_run *run) handle_diag_320(&cpu->env, r1, r3, RA_IGNORED); } =20 +static void kvm_handle_diag_508(S390CPU *cpu, struct kvm_run *run) +{ + uint64_t r1, r3; + + r1 =3D (run->s390_sieic.ipa & 0x00f0) >> 4; + r3 =3D run->s390_sieic.ipa & 0x000f; + + handle_diag_508(&cpu->env, r1, r3, RA_IGNORED); +} + #define DIAG_KVM_CODE_MASK 0x000000000000ffff =20 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb) @@ -1575,6 +1586,9 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *= run, uint32_t ipb) case DIAG_CERT_STORE: kvm_handle_diag_320(cpu, run); break; + case DIAG_SECURE_IPL: + kvm_handle_diag_508(cpu, run); + break; default: trace_kvm_insn_diag(func_code); kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION); diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h index 1945bdf40c..81da207a5f 100644 --- a/target/s390x/s390x-internal.h +++ b/target/s390x/s390x-internal.h @@ -390,6 +390,8 @@ bool handle_diag_308(CPUS390XState *env, uint64_t r1, u= int64_t r3, uintptr_t ra); void handle_diag_320(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra); +void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, + uintptr_t ra); =20 =20 /* translate.c */ diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c index 403388145e..f1c8563af0 100644 --- a/target/s390x/tcg/misc_helper.c +++ b/target/s390x/tcg/misc_helper.c @@ -154,6 +154,13 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uin= t32_t r3, uint32_t num) bql_unlock(); r =3D 0; break; + case 0x508: + /* secure ipl operations */ + bql_lock(); + handle_diag_508(env, r1, r3, GETPC()); + bql_unlock(); + r =3D 0; + break; default: r =3D -1; break; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201251; cv=none; d=zohomail.com; s=zohoarc; b=VgGmmL8/LaQO7EzvVWJChKT4FmIVIA4yk9HsrzelzlRqm1VLjV533ZNGPLU5iaT0iA3W9zjChSpkiWWRJQzXek5CNZRMSf8qO3nqzj7gETdqGgZqYLUEJSCwJbh2c8hhFcpftjd5EGZvDWnGpKKoZCPn+g1VOqKVCdC0yZgGOHo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201251; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DyMl8qF3jNVhD51OSymeerrgPeo6B/3T977W+RhnFvY=; b=oIWs1MsPNQa5NeTozpBEfIUPBkvRh36FEBltrHE/bJYyMBkni1Wtddi1yzB2DAymtXzONBWoysbLMEcE1FhioK+doGuaWfeg7+J7sNO4NAZFKeCdxN+u0+hTmM/wgIMF0P3FBCLp0UV7x+d24NG1eq2ZbctgUfhdT7C57C3/hWU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178320125154140.19844198147143; Sat, 4 Jul 2026 14:40:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86B-0007Sj-5s; Sat, 04 Jul 2026 17:40:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg868-0007Rk-JF; Sat, 04 Jul 2026 17:40:28 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg866-0007qz-Jq; Sat, 04 Jul 2026 17:40:28 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmK1C2705583; Sat, 4 Jul 2026 21:40:23 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7gp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:22 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYbpN019080; Sat, 4 Jul 2026 21:40:22 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8dr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:21 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeKQR27853372 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:20 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6D0AE58052; Sat, 4 Jul 2026 21:40:20 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 71D4358050; Sat, 4 Jul 2026 21:40:18 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:18 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=DyMl8q F3jNVhD51OSymeerrgPeo6B/3T977W+RhnFvY=; b=ECP6yOVu8gjcVtcTbWahB2 s56HFUvN94v6PMJ5D+ze9uM/hHyhe7Emda31kbSP1lKqQA0HdtKP0XCTSg7PPAyH vpcZPFH6DZ4/PkSpw/zUOLY5gGV97CyNdwi1e4TWpEjyswDwpr7hQnRLUTsu/pdG 6A3oRpaZGTx8mt+/kSycTgu716gBDNad8VjgtN38P0xz9lNl4ms4Sl1EOMSW2nYY 2IBgI3QHL8bI2q3jJg03jhktLIp41FfdFzUchBO7WSSM8u69YfMrGToBRj9TLrrV VljWiXYkMh2IknU62ovCaI98Umxxh4h49f9eoADYuIMyBn1quoGk6Roa2D8wLCtw == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 12/33] crypto/x509-utils: Add helper functions for DIAG 508 subcode 1 Date: Sat, 4 Jul 2026 17:39:28 -0400 Message-ID: <20260704213950.2118823-13-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXz0KQ6pbFf80G e+Qe3P2j2rqsC/gtbFKJgp9noHwHWkNPcqRGkPl0OqCjakrt7jMzntd8Mhr78Vl/K36+/Ra2UVk 833KtQM0BxeybsKjG6GCiXRD/iECrz8= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX57QOGDh66x2R kQ5w/JtChvvA466xP3mlm8VmzKn6GaN82C1aL6aefQb0PvHzHs7JrkCrzcL09diErSuZIGoNNXo rl4/DTfmf9gg8t2xPbNCzX92iT7oourgezUsQYTjIl0ZuyKe11twQegefMdd76x7irG1/jdXLit l6S8ehBJZVxL2SBFLgXbghwnAwUY+ru5AdtxWm/K9LY8dmFEkSjsK9f3hpySgwQ0e2CuJWksnU3 hh12KfAouzR9Nb9xB8pyGYkcJB1ATdhlkvDX10PeQoNV0jZT33l8IqEEBA/tdJyXZwmz0u3MBdP Zpbv6aoMnvjidHt5LRyDwvmod1/LhgV9a2qzVCpMwt6/74KX2Ezcy/R0Ag/ZLr7jiG74L7E2aBt jT8m314gD85DwJhZ3SdiudwG0OPmX+5EFis8y9+e+Uxcp9rwG77uYjMtrAGbx0wQymhfUpAl5Z7 RCLK7Q5dEgFPtOUkt7A== X-Proofpoint-GUID: 3w37acfhKycKSrcrqvsyyi2t7un9hQNe X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497dc7 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=Ehcw9bocbOASTidboh8A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: 3w37acfhKycKSrcrqvsyyi2t7un9hQNe X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201252560158500 Introduce helper functions to support signature verification required by DIAG 508 subcode 1: qcrypto_pkcs7_convert_sig_pem() =E2=80=93 converts a signature from DER to = PEM format qcrypto_x509_verify_sig() =E2=80=93 verifies the provided data against the = given signature These functions enable basic signature verification support. Signed-off-by: Zhuoying Cai Acked-by: Daniel P. Berrang=C3=A9 Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Farhan Ali Reviewed-by: Thomas Huth --- crypto/x509-utils.c | 108 ++++++++++++++++++++++++++++++++++++ include/crypto/x509-utils.h | 41 ++++++++++++++ 2 files changed, 149 insertions(+) diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index d0e0384e9c..856182559e 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -16,6 +16,7 @@ #include #include #include +#include =20 static const int qcrypto_to_gnutls_hash_alg_map[QCRYPTO_HASH_ALGO__MAX] = =3D { [QCRYPTO_HASH_ALGO_MD5] =3D GNUTLS_DIG_MD5, @@ -335,6 +336,96 @@ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, s= ize_t size, Error **errp) return curve_id =3D=3D GNUTLS_ECC_CURVE_SECP521R1; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, size_t *resultlen, + Error **errp) +{ + int ret =3D -1; + int rc; + gnutls_pkcs7_t signature; + gnutls_datum_t sig_datum_der =3D {.data =3D sig, .size =3D sig_size}; + gnutls_datum_t sig_datum_pem =3D {.data =3D NULL, .size =3D 0}; + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initialize pkcs7 data: %s", gnutls_str= error(rc)); + return ret; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum_der, GNUTLS_X509_FMT_= DER); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_export2(signature, GNUTLS_X509_FMT_PEM, &sig_datum= _pem); + if (rc !=3D 0) { + error_setg(errp, "Failed to convert signature to PEM format: %s", + gnutls_strerror(rc)); + goto cleanup; + } + + *resultlen =3D sig_datum_pem.size; + *result =3D g_memdup2(sig_datum_pem.data, sig_datum_pem.size); + + ret =3D 0; + +cleanup: + gnutls_pkcs7_deinit(signature); + g_free(sig_datum_pem.data); + return ret; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + int rc; + int ret =3D -1; + gnutls_x509_crt_t crt =3D NULL; + gnutls_pkcs7_t signature =3D NULL; + gnutls_datum_t cert_datum =3D {.data =3D cert, .size =3D cert_size}; + gnutls_datum_t data_datum =3D {.data =3D comp, .size =3D comp_size}; + gnutls_datum_t sig_datum =3D {.data =3D sig, .size =3D sig_size}; + + rc =3D gnutls_x509_crt_init(&crt); + if (rc < 0) { + error_setg(errp, "Failed to initialize certificate: %s", gnutls_st= rerror(rc)); + goto cleanup; + } + + rc =3D gnutls_x509_crt_import(crt, &cert_datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import certificate: %s", gnutls_strerr= or(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_init(&signature); + if (rc < 0) { + error_setg(errp, "Failed to initialize pkcs7 data: %s", gnutls_str= error(rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_import(signature, &sig_datum, GNUTLS_X509_FMT_PEM); + if (rc !=3D 0) { + error_setg(errp, "Failed to import signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + rc =3D gnutls_pkcs7_verify_direct(signature, crt, 0, &data_datum, 0); + if (rc !=3D 0) { + error_setg(errp, "Failed to verify signature: %s", gnutls_strerror= (rc)); + goto cleanup; + } + + ret =3D 0; + +cleanup: + gnutls_x509_crt_deinit(crt); + gnutls_pkcs7_deinit(signature); + return ret; +} + #else /* ! CONFIG_GNUTLS */ =20 int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, @@ -378,4 +469,21 @@ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, s= ize_t size, Error **errp) return -1; } =20 +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp) +{ + error_setg(errp, "GNUTLS is required to export pkcs7 signature"); + return -1; +} + +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp) +{ + error_setg(errp, "GNUTLS is required for signature-verification suppor= t"); + return -1; +} + #endif /* ! CONFIG_GNUTLS */ diff --git a/include/crypto/x509-utils.h b/include/crypto/x509-utils.h index fcace73c49..c256d7bfad 100644 --- a/include/crypto/x509-utils.h +++ b/include/crypto/x509-utils.h @@ -91,4 +91,45 @@ int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t s= ize, */ int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **= errp); =20 +/** + * qcrypto_pkcs7_convert_sig_pem + * @sig: pointer to the PKCS#7 signature in DER format + * @sig_size: size of the signature + * @result: output location for the allocated buffer for the signature in + * PEM format + * (the function allocates memory which must be freed by the call= er) + * @resultlen: pointer to the size of the buffer + * (will be updated with the actual size of the PEM-encoded + * signature) + * @errp: error pointer + * + * Convert given PKCS#7 @sig from DER to PEM format. + * + * Returns: 0 if PEM-encoded signature was successfully stored in @result, + * -1 on error. + */ +int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, + uint8_t **result, + size_t *resultlen, + Error **errp); + +/** + * qcrypto_x509_verify_sig + * @cert: pointer to the raw certificate data + * @cert_size: size of the certificate + * @comp: pointer to the component to be verified + * @comp_size: size of the component + * @sig: pointer to the signature + * @sig_size: size of the signature + * @errp: error pointer + * + * Verify the provided @comp against the @sig and @cert. + * + * Returns: 0 on success, + * -1 on error. + */ +int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size, Error **errp); + #endif --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201251; cv=none; d=zohomail.com; s=zohoarc; b=nqgit488hjNCr/njU1sLCLdmVSn3lMV+7OuUrIL+qh142J4Xb1zXn45rf67XLh9IsUSzDVecpKmchqlASSdoe3roCoS6oa3Twfx4WCPjFyqkAhXSHjmT1bjWqL49vqV3yhhvvJBUxfnpCxRz5Dfgd0Cfze86Rddo34xWNoKVzrA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201251; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Htgs+fgBjHi/nLZzqV/aa/uUi1okSFBXk2/yQC+7jm4=; b=FSw50eU2Pam2RIYm7hS/gvrMg7fLx3AZ+w+8daGAQTvjuouea5SL6XF5ZSdHSkhAyEBigU+EXnQdrGilziofDuL6zVQh6NWcsz/nOWWKek49LAiaVSi3z96fOaFlA0/tTHZGJv2kg63MiYfA+U3kOazJSPP6nPFJHofrP0Fdw74= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201251510875.6028344154156; Sat, 4 Jul 2026 14:40:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86D-0007TO-2F; Sat, 04 Jul 2026 17:40:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86A-0007SQ-IU; Sat, 04 Jul 2026 17:40:30 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg869-0007s3-1h; Sat, 04 Jul 2026 17:40:30 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmLh92445985; Sat, 4 Jul 2026 21:40:25 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc58-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:24 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYaVS013501; Sat, 4 Jul 2026 21:40:24 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxq86-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:24 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeMSo52167018 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:22 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8765B58050; Sat, 4 Jul 2026 21:40:22 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9581058054; Sat, 4 Jul 2026 21:40:20 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:20 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Htgs+fgBjHi/nLZzq V/aa/uUi1okSFBXk2/yQC+7jm4=; b=GWXr5U94wKqeQbUtjI5soHz2WOP7o5iAS yJ7WOPsnI/TIOVJbryo9M+++H3Hpz4+vj59Qs+oY35+MLM95CMyLvzMpydl8g98i ofdfmb/Vz37URH4iznngOrJ9sb8YSKUtKoXMsH1XZbCEIYTWb9E4jJE+1BjMBKvY UUQ3Uhn91A3g6bviUXuCw9PzU7SX9G6iQUB2SeZjBM13Ma1VdGQVZCIbnXKOaOcL 1jfwVDfazX+Nf9TerwmBCVcMWBX0HjA4IOL59JRk12Gnrs0cGjtUrQO2jEJrIyga MG2j/46wn3HEnmpk/4zoQLteyMagLomb4ohgOr5I2eI0DiTfBMuZQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 13/33] s390x/diag: Generalize s390_ipl_read/write to accept void * Date: Sat, 4 Jul 2026 17:39:29 -0400 Message-ID: <20260704213950.2118823-14-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497dc9 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=CkZHjoNxVx3BTC6vW7wA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX52jv4Yfd3VXW VmZ/ZfnhPbFzDt4cSKQt1jIxJKmgB821waVHDBVod8FvtTUWaBiJLwdvonTveiBV8HW/XKt4PxH UTBO3fA40Bh1sCeA5mJBlSY3yW2xDLFz4Xou5lhb04X82TelEUFmwNGHumxlV8JTy8+0LcG//8S rYLlmcuwuEZIiOPmwDMeSeF2yX+dM/lcYqmp9H4eOzSEmWMkb+3+cFBo32UmOVSifw9fXzxxvlm nfWtKdO5um1yTdpgma1TYYwaa/TVhrL+B1r52YCVpYnrcFrCYKk5hGWD6wTiTsXKlBxQZ9MzyEt OErNKW90q9M6M1cpQ2zWVT9D5uip1QB4KCkmggkfJ8zowmIxc0hZUAVgJYHFlw2TVJN8yZBZDzH u/eodEjovHXR/XR/UuT8BwkkDP8QI5HT/p51aCdrgMl4CSgbbnRBXpU/GbkJS0JG0r4mu0k5USw 6UeQNSGaeOq6hjvcwGQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX3K0GpxUaafmB +PfcLh7LTM++daUs+zcZW6NlWgdR7INymJBFuX1RwHchIxWu1id0/Yw49VZbe/dD9vAspJpoIuF 6T4wj5oOPV/5mL/NYEBFZGYgCqTF2LI= X-Proofpoint-GUID: dkvvFkHZB1HuIdL43MMVo6rtxXPqkhIx X-Proofpoint-ORIG-GUID: dkvvFkHZB1HuIdL43MMVo6rtxXPqkhIx X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201252476158500 Content-Type: text/plain; charset="utf-8" Change the data parameter of s390_ipl_read() and s390_ipl_write() from IplParameterBlock * to void *, so the helpers can be reused beyond DIAG 308. Signed-off-by: Zhuoying Cai Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato --- target/s390x/diag.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 6e7f2d5cb3..8bcf204268 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -83,24 +83,24 @@ static int diag308_parm_check(CPUS390XState *env, uint6= 4_t r1, uint64_t addr, } =20 static void s390_ipl_read(CPUS390XState *env, uint64_t addr, - IplParameterBlock *iplb, size_t size) + void *data, size_t size) { if (s390_is_pv()) { - s390_cpu_pv_mem_read(env_archcpu(env), 0, iplb, size); + s390_cpu_pv_mem_read(env_archcpu(env), 0, data, size); } else { address_space_read(cpu_get_address_space(env_cpu(env), 0), addr, - MEMTXATTRS_UNSPECIFIED, iplb, size); + MEMTXATTRS_UNSPECIFIED, data, size); } } =20 static void s390_ipl_write(CPUS390XState *env, uint64_t addr, - IplParameterBlock *iplb, size_t size) + void *data, size_t size) { if (s390_is_pv()) { - s390_cpu_pv_mem_write(env_archcpu(env), 0, iplb, size); + s390_cpu_pv_mem_write(env_archcpu(env), 0, data, size); } else { address_space_write(cpu_get_address_space(env_cpu(env), 0), addr, - MEMTXATTRS_UNSPECIFIED, iplb, size); + MEMTXATTRS_UNSPECIFIED, data, size); } } =20 --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201485; cv=none; d=zohomail.com; s=zohoarc; b=S0wwuZ46mJC/zxdRNMxF9WvTQRU+eAYan+xQX8oiDZQnCTndBenAK/UvIQPyZNtd0ZmbO/QaE0uhCJhWePbaGZoiZAC9tBC/gV9UHdQ1Pez0sHekwntOMXHl78eeVQ1FLDbQi3r65SGFrFusrSKbEj7jEKYAAcPWGbZ87u8TQss= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201485; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ydvWns9K4xND5fNs1Ky/vLAXUyZ8GaKQrQTv/A2mfWs=; b=HSLDjf08DLaSfyN5yy3sC282pXa+9TMR0k+k2xPnDzFFj4tuHEoKt8Uax4d2BaVAwvDQfzph8JkZMAN+sbMgaKU+A9JWVRqvHGHVGTpROvMOQsm01yIipgEjksyQwM6aGdmUzKMrj+sgKvObsVwf5Aoh6o24qzyA+AebmEsV/pQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201485295866.8551774131755; Sat, 4 Jul 2026 14:44:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86H-0007Un-9K; Sat, 04 Jul 2026 17:40:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86F-0007U7-FK; Sat, 04 Jul 2026 17:40:35 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86D-0007sV-C9; Sat, 04 Jul 2026 17:40:35 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmLR12428175; Sat, 4 Jul 2026 21:40:27 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7j1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:26 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYu2m027749; Sat, 4 Jul 2026 21:40:26 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7wpk2h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:26 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeOju21758624 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:25 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AFB4F58056; Sat, 4 Jul 2026 21:40:24 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B6C3858050; Sat, 4 Jul 2026 21:40:22 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:22 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ydvWns9K4xND5fNs1 Ky/vLAXUyZ8GaKQrQTv/A2mfWs=; b=gn2LUGF7nW2zLB+XjSN+OnkM8lxr32Sqo TpaKUrFbRO9ByxJOqbg7T7S+0mq/QTRoLPpud6K0TkpL1xDXbr9GPoSD9NuiASNg XGhXhhRPOLMTXniUZMBw92IHNYGwfXLRjiz+XYuZzpZAdkYLRygnEhfjHcfjHbOt /CHTSPZTHMN7GXE6rjAFLG1W2m/UPKDS24laIS2yUW2mfOI/AoqGBIIAWq3YX2i0 mn3EvazTGL1+gvAmbH5K0Xfj2DtF5d9V7IUZQ6H6Bqkb41JuD5efaffZFF2IhJ3B KWn0Gfbji551yP5Mwa77kxLxqek0GQAWMKBYU6SGjejLiRx/sEfZg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 14/33] s390x/diag: Implement DIAG 508 subcode 1 for signature verification Date: Sat, 4 Jul 2026 17:39:30 -0400 Message-ID: <20260704213950.2118823-15-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: n1H9_ZBRFbwv1iOu5cQrUXuoDhyi2p7v X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXyAreaZWhG1Ux G+e/8fbi2x64tYy1MUj4zboy+HsXENth5UIuOxdyRxpjCYiDFHfj2XfQWxxLkkfpFhhwStQKtdx jHUiw7TAToYux5zPj5PWbhrAK7aPsFM= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497dcb cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=K66z3tz1c1WH2lCF3KIA:9 X-Proofpoint-GUID: n1H9_ZBRFbwv1iOu5cQrUXuoDhyi2p7v X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX8e2fryoD3TDL MQMIzlGZblveuOa/Xsl2QTKNiopyGuYeZ7kfPmHtYPrnKxK4WqT2Zn0/OS/ZTs0jeHnrXe5SX5X Vf5rJ7XYAkWTydyhpvJI7zR5A7MIgr/3WnhcCvbilMc2uwo8jHh0wVvX80ROuWZXt/pXGCUlVSo cvT09BEunKShkNZWsCB8ll8jQOKVeX9+LTKJRPEALIYzlCzrlr6ZkD4jZ/0ZSVuYHLA+G/RurmX eJobO02RXX3VNaXjzegvsKlBCFqQxjjMW5MBgW/VYoGK5W+SCD6Jiq0X8zsPBmzd9xYYKgrFFsC f9EdEBIkmuY3xVSfob/6Ze5LrYNIXPS89xY1O7IPOFk5HGhuefNSViEt6mDtE3FgCH6zs1GqUUh TLC6Z8NSQgZVx+THzMCSdFj/9VM1Cdme3ZnYRi7Oi1EZrSPT4sdBcXOIbwN2Cda1OUWsGhx181n Qs+ydXtIVO4jEqKbMbg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201487065158500 Content-Type: text/plain; charset="utf-8" From: Collin Walling DIAG 508 subcode 1 performs signature-verification on signed components. A signed component may be a Linux kernel image, or any other signed binary. **Verification of initrd is not supported.** The instruction call expects two item-pairs: an address of a device component, an address of the analogous signature file (in PKCS#7 DER format= ), and their respective lengths. All of this data should be encapsulated within a Diag508SigVerifBlock. The DIAG handler will read from the provided addresses to retrieve the necessary data, parse the signature file, then perform the signature-verification. Because there is no way to correlate a specific certificate to a component, each certificate in the store is tried until either verification succeeds, or all certs have been exhausted. A return code of 1 indicates success, and the index and length of the corresponding certificate will be set in the Diag508SigVerifBlock. The following values indicate failure: 0x0102: no certificates are available in the store 0x0202: component data is invalid 0x0302: PKCS#7 format signature is invalid 0x0402: signature-verification failed 0x0502: length of Diag508SigVerifBlock is invalid Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Farhan Ali --- docs/specs/s390x-secure-ipl.rst | 17 +++++ include/hw/s390x/ipl/diag508.h | 30 +++++++++ target/s390x/diag.c | 111 +++++++++++++++++++++++++++++++- 3 files changed, 157 insertions(+), 1 deletion(-) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 776270d816..d8dcc77ba2 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -84,3 +84,20 @@ that requires assistance from QEMU. =20 Subcode 0 - query installed subcodes Returns a 64-bit mask indicating which subcodes are supported. + +Subcode 1 - perform signature verification + Perform signature-verification on a signed component, using certificat= es + from the certificate store and leveraging qcrypto libraries to perform + this operation. + + Note: verification of initrd is not supported. + + A return code of 1 indicates success, and the index and length of the + corresponding certificate will be set in the Diag508SigVerifBlock. + The following values indicate failure: + + * ``0x0102``: no certificates are available in the store + * ``0x0202``: component data is invalid + * ``0x0302``: PKCS#7 format signature is invalid + * ``0x0402``: signature-verification failed + * ``0x0502``: length of Diag508SigVerifBlock is invalid diff --git a/include/hw/s390x/ipl/diag508.h b/include/hw/s390x/ipl/diag508.h index 6281ad8299..bd967954b9 100644 --- a/include/hw/s390x/ipl/diag508.h +++ b/include/hw/s390x/ipl/diag508.h @@ -11,5 +11,35 @@ #define S390X_DIAG508_H =20 #define DIAG_508_SUBC_QUERY_SUBC 0x0000 +#define DIAG_508_SUBC_SIG_VERIF 0x8000 + +#define DIAG_508_RC_OK 0x0001 +#define DIAG_508_RC_NO_CERTS 0x0102 +#define DIAG_508_RC_INVAL_COMP_DATA 0x0202 +#define DIAG_508_RC_INVAL_PKCS7_SIG 0x0302 +#define DIAG_508_RC_FAIL_VERIF 0x0402 +#define DIAG_508_RC_INVAL_LEN 0x0502 + +/* + * Maximum component and signature sizes for current secure boot implement= ation + * Not architecturally defined and may need to revisit if increased + */ +#define DIAG_508_MAX_COMP_LEN 0x10000000 +#define DIAG_508_MAX_SIG_LEN 4096 + +struct Diag508SigVerifBlock { + uint32_t length; + uint8_t reserved0[3]; + uint8_t version; + uint32_t reserved[2]; + uint8_t cert_store_index; + uint8_t reserved1[7]; + uint64_t cert_len; + uint64_t comp_len; + uint64_t comp_addr; + uint64_t sig_len; + uint64_t sig_addr; +}; +typedef struct Diag508SigVerifBlock Diag508SigVerifBlock; =20 #endif diff --git a/target/s390x/diag.c b/target/s390x/diag.c index 8bcf204268..0128d0caaa 100644 --- a/target/s390x/diag.c +++ b/target/s390x/diag.c @@ -619,9 +619,110 @@ void handle_diag_320(CPUS390XState *env, uint64_t r1,= uint64_t r3, uintptr_t ra) } } =20 +static bool diag_508_verify_sig(uint8_t *cert, size_t cert_size, + uint8_t *comp, size_t comp_size, + uint8_t *sig, size_t sig_size) +{ + g_autofree uint8_t *sig_pem =3D NULL; + size_t sig_size_pem; + int rc; + + /* + * PKCS#7 signature with DER format + * Convert to PEM format for signature verification + * + * Ignore errors during qcrypto signature format conversion and verifi= cation + * Return false on any error, treating it as a verification failure + */ + rc =3D qcrypto_pkcs7_convert_sig_pem(sig, sig_size, &sig_pem, &sig_siz= e_pem, NULL); + if (rc < 0) { + return false; + } + + rc =3D qcrypto_x509_verify_sig(cert, cert_size, + comp, comp_size, + sig_pem, sig_size_pem, NULL); + if (rc < 0) { + return false; + } + + return true; +} + +static int handle_diag508_sig_verif(CPUS390XState *env, uint64_t addr) +{ + int verified; + uint32_t svb_len; + uint64_t comp_len, comp_addr; + uint64_t sig_len, sig_addr; + g_autofree uint8_t *comp =3D NULL; + g_autofree uint8_t *sig =3D NULL; + g_autofree Diag508SigVerifBlock *svb =3D NULL; + size_t svb_size =3D sizeof(Diag508SigVerifBlock); + S390IPLCertificateStore *cs =3D s390_ipl_get_certificate_store(); + + if (!cs->count) { + return DIAG_508_RC_NO_CERTS; + } + + svb =3D g_new0(Diag508SigVerifBlock, 1); + s390_ipl_read(env, addr, svb, svb_size); + + svb_len =3D be32_to_cpu(svb->length); + if (svb_len !=3D svb_size) { + return DIAG_508_RC_INVAL_LEN; + } + + comp_len =3D be64_to_cpu(svb->comp_len); + comp_addr =3D be64_to_cpu(svb->comp_addr); + sig_len =3D be64_to_cpu(svb->sig_len); + sig_addr =3D be64_to_cpu(svb->sig_addr); + + if (!comp_len || !comp_addr || comp_len > DIAG_508_MAX_COMP_LEN) { + if (comp_len > DIAG_508_MAX_COMP_LEN) { + warn_report("DIAG 0x508: component length %lu exceeds current = maximum %u", + comp_len, DIAG_508_MAX_COMP_LEN); + } + return DIAG_508_RC_INVAL_COMP_DATA; + } + + if (!sig_len || !sig_addr || sig_len > DIAG_508_MAX_SIG_LEN) { + if (sig_len > DIAG_508_MAX_SIG_LEN) { + warn_report("DIAG 0x508: signature length %lu exceeds current = maximum %u", + sig_len, DIAG_508_MAX_SIG_LEN); + } + return DIAG_508_RC_INVAL_PKCS7_SIG; + } + + comp =3D g_malloc0(comp_len); + s390_ipl_read(env, comp_addr, comp, comp_len); + + sig =3D g_malloc0(sig_len); + s390_ipl_read(env, sig_addr, sig, sig_len); + + for (int i =3D 0; i < cs->count; i++) { + verified =3D diag_508_verify_sig(cs->certs[i].raw, + cs->certs[i].size, + comp, comp_len, + sig, sig_len); + if (verified) { + svb->cert_store_index =3D i; + svb->cert_len =3D cpu_to_be64(cs->certs[i].der_size); + s390_ipl_write(env, addr, svb, svb_size); + return DIAG_508_RC_OK; + } + } + + return DIAG_508_RC_FAIL_VERIF; +} + +QEMU_BUILD_BUG_MSG(sizeof(Diag508SigVerifBlock) !=3D 64, + "size of Diag508SigVerifBlock is wrong"); + void handle_diag_508(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr= _t ra) { uint64_t subcode =3D env->regs[r3]; + uint64_t addr =3D env->regs[r1]; int rc; =20 if (env->psw.mask & PSW_MASK_PSTATE) { @@ -636,7 +737,15 @@ void handle_diag_508(CPUS390XState *env, uint64_t r1, = uint64_t r3, uintptr_t ra) =20 switch (subcode) { case DIAG_508_SUBC_QUERY_SUBC: - rc =3D 0; + rc =3D DIAG_508_SUBC_SIG_VERIF; + break; + case DIAG_508_SUBC_SIG_VERIF: + if (!diag_parm_addr_valid(addr, sizeof(Diag508SigVerifBlock), true= )) { + s390_program_interrupt(env, PGM_ADDRESSING, ra); + return; + } + + rc =3D handle_diag508_sig_verif(env, addr); break; default: s390_program_interrupt(env, PGM_SPECIFICATION, ra); --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201482; cv=none; d=zohomail.com; s=zohoarc; b=hBBBjhBeu6QNwvQ8t2ssQobRkpG4ObhFhl9RbyFfo57tkl7NfPPjYF+wLzDXKw4GE0uusvL2guDPcgETR/7Oy2bBartpafZrlAy2m5V0XpdYy2DCd/qPzteW4wj5cnYyDQfTEWiocoG9XNsmpF099WxSf+frIOCE8wa8rmlMEsM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201482; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vPbsf0fQDz21lLYPEu+ScWbC6o6g/o4YbVFU/Zd/T54=; b=cIhapFjL8wZXv+xcI1o5UTkHcWxtdFz3uXxsd4YwZ67hyRRK20CfIvA+NuCxGcNytUMqbS9e0KQEfQI3ftjdRQkl7hvl9A9HNXa9al9T7KMtzSK2tIFi9eD03LIsXuSf0l+btKIXx7dG/Cu5NH6Sh8NP84rigWiTFOSPbhCps1E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201482108665.4050967814735; Sat, 4 Jul 2026 14:44:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86M-0007Xu-Gf; Sat, 04 Jul 2026 17:40:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86K-0007WA-6T; Sat, 04 Jul 2026 17:40:40 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86I-0007sw-BR; Sat, 04 Jul 2026 17:40:39 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmL4w2445986; Sat, 4 Jul 2026 21:40:30 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc5e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:28 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYeq7013634; Sat, 4 Jul 2026 21:40:28 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxq8e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:28 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeQ3h20054586 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:27 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D5C2C58056; Sat, 4 Jul 2026 21:40:26 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DA7A95805E; Sat, 4 Jul 2026 21:40:24 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:24 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=vPbsf0 fQDz21lLYPEu+ScWbC6o6g/o4YbVFU/Zd/T54=; b=Vec1AeHGmxyymkI2ujPDOJ sAmISdrxKXzlvKV6zAzrr7vPM8kXSIq/EDt8N8CBERbBo5BSYnmniiHklomsmDtH FMcvXAok3GyXvyUrz0HPySbWYjsXBsyJ2+X8Qth5DCiLjVw68uluCUFCDDz1GeSZ R9LpUmBKlsjOnmB7M5mDZ16fCFka0xwaBzR+bmeyd1tQbE79xl4dgaZiFKrivBlI U9rvSJD1uC9g+I7g6WFYtZsxD4chizzOYhAAf+pf8hECfOMZM/SpJ9//PTLzN70n CPUYPVp6PTJfzijO/iKk9B84f5ICamOss8GuXnp3XQjzjGba1xAPQFcPa8JjPkBw == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 15/33] s390x/ipl: Introduce IPL Information Report Block (IIRB) Date: Sat, 4 Jul 2026 17:39:31 -0400 Message-ID: <20260704213950.2118823-16-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497dcc cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=1NTGDykL02WXTEG3Jz0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX+pFW+/s4pUGv 0GIdhKtix0Ht+XZpsAo2r7cXNHnUxYmfw7vzpd6Vjrt6u3z+oUR60VvqYBAGwz934kAKZwfNg1K MUeiZxVKL9N8khxAnanUpOHWwDVuwzsFwdRqlS5vruUWReoF+CEKCEcBvjD4tKcpgJOKVnb8CQk vxOtZHzUAiOWzz6l7SZfBG4lhcNmAoZBe8IZKThHm01kBY3BoXJyDRds24+upd/h7Q8FTJnhXxn CVmtORFbbtFoRm7GCFZ8JJ+nY7ZqEfAqIVAw5JOMA63CQgASemVhGYIsZ0JOFDLbUBVNAJ78qvb fYXVPtkBdDL8C2x8rjieKT1fZy4L8h2/b/jWOdanQRMOvavUf/JLuoHQAdR4/i+VGk28xn7hdoq o/7BeHaqKjKarkM8CsujRpMSzixVW3eS8bjLY0lGc/tJqwSytXDOzS9/pdJdc5rW3nzHM2xiEsF Pv2X8tYItcZ6p7KKvFQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX2kHno2qWAdQe XoiB+gJ4UwIV0j1Khb4kSG9Zk4h4+2BMz6AOGDqLWHS2xchEoOqgGof03wojPX5zr1XpCgXJhTO dSDHapFq/MJz68u8oIOfB7lcdXwBX1Y= X-Proofpoint-GUID: EZn6afhPLeUvQagMqQKmjXgrSlCpoiqn X-Proofpoint-ORIG-GUID: EZn6afhPLeUvQagMqQKmjXgrSlCpoiqn X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201483001158500 The IPL information report block (IIRB) contains information used to locate IPL records and to report the results of signature verification of one or more secure components of the load device. IIRB is stored immediately following the IPL Parameter Block. Results on component verification in any case (failure or success) are stored. The IIRB data is reserved and protected by the guest kernel during early boot to prevent it from being overwritten before the certificate data is permanently saved. Signed-off-by: Zhuoying Cai Reviewed-by: Farhan Ali Reviewed-by: Collin Walling --- docs/specs/s390x-secure-ipl.rst | 21 +++++++++++ include/hw/s390x/ipl/qipl.h | 62 +++++++++++++++++++++++++++++++++ 2 files changed, 83 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index d8dcc77ba2..113acbeda9 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -101,3 +101,24 @@ Subcode 1 - perform signature verification * ``0x0302``: PKCS#7 format signature is invalid * ``0x0402``: signature-verification failed * ``0x0502``: length of Diag508SigVerifBlock is invalid + +IPL Information Report Block +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The IPL Parameter Block (IPLB), utilized for IPL operation, is extended wi= th an +IPL Information Report Block (IIRB), which contains the results from secur= e IPL +operations such as: + +* component data +* verification results +* certificate data + +During early boot, the guest kernel reserves the memory region +containing the IIRB. This preserves the data while the guest kernel is +operating and during re-IPL. + +The guest kernel uses the contents in the IIRB for: + +* Boot logging: reports which components were loaded and verified. +* kexec operations: builds the next kernel=E2=80=99s IPL report from the e= xisting one. +* Keying: installs IPL certificates into the platform trusted keyring. diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index ed1a91182a..45d25264f4 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -32,6 +32,9 @@ typedef enum S390IplType S390IplType; #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 #define MAX_CERTIFICATES 64 +/* largest supported block size - same as VIRTIO_DASD_DEFAULT_BLOCK_SIZE */ +#define VIRTIO_MAX_BLOCK_SIZE 4096 +#define MAX_COMP_ENTRIES ((VIRTIO_MAX_BLOCK_SIZE - 32) / 32) =20 /* * The QEMU IPL Parameters will be stored at absolute address @@ -146,4 +149,63 @@ union IplParameterBlock { } QEMU_PACKED; typedef union IplParameterBlock IplParameterBlock; =20 +struct IplInfoReportBlockHeader { + uint32_t len; + uint8_t flags; + uint8_t reserved1[11]; +}; +typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; + +struct IplInfoBlockHeader { + uint32_t len; + uint8_t type; + uint8_t reserved1[11]; +}; +typedef struct IplInfoBlockHeader IplInfoBlockHeader; + +enum IplInfoBlockType { + IPL_INFO_BLOCK_TYPE_CERTIFICATES =3D 1, + IPL_INFO_BLOCK_TYPE_COMPONENTS =3D 2, +}; + +struct IplSignatureCertificateEntry { + uint64_t addr; + uint64_t len; +}; +typedef struct IplSignatureCertificateEntry IplSignatureCertificateEntry; + +struct IplSignatureCertificateList { + IplInfoBlockHeader ipl_info_header; + IplSignatureCertificateEntry cert_entries[MAX_CERTIFICATES]; +}; +typedef struct IplSignatureCertificateList IplSignatureCertificateList; + +#define S390_IPL_DEV_COMP_FLAG_SC 0x80 +#define S390_IPL_DEV_COMP_FLAG_CSV 0x40 + +struct IplDeviceComponentEntry { + uint64_t addr; + uint64_t len; + uint8_t flags; + uint8_t reserved1[5]; + uint16_t cert_index; + uint8_t reserved2[8]; +}; +typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; + +struct IplDeviceComponentList { + IplInfoBlockHeader ipl_info_header; + IplDeviceComponentEntry device_entries[MAX_COMP_ENTRIES]; +}; +typedef struct IplDeviceComponentList IplDeviceComponentList; + +#define COMP_LIST_MAX sizeof(IplDeviceComponentList) +#define CERT_LIST_MAX sizeof(IplSignatureCertificateList) + +struct IplInfoReportBlock { + IplInfoReportBlockHeader hdr; + uint8_t info_blks[COMP_LIST_MAX + CERT_LIST_MAX]; +}; +typedef struct IplInfoReportBlock IplInfoReportBlock; + #endif --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201464; cv=none; d=zohomail.com; s=zohoarc; b=dyyg2K6LUQGqMAcU0B4mAK3SwUZ6FWXtNBTEUAnwYOaUP3LGgXuMDrvm68sSabXtHcRMBC6/jBVMjLAN/sFrpoVl4eHQb6LgZLZRGSREM6eeXdD6zj8/w4r+8sYyq0B7FjThUehXs5P+UubhnPvLYyfsUpLBl3YJTJRcVEmCLmU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201464; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=X6HKAkf8RA3YZ51Ruq3a0g/ukNaNC9oVnBhA2kpOIww=; b=nporXzz6GtzIkhvPnfBHK1/H0jLOoDxDHn3bxA4e0WgMCGm6rnWG8xbrbsfPvBWmcpkxCcRSBKuBjjn0FO41ezBE3YvfkR0+tKb4JTHAsIhJJvi/AdS1/pK3IsM92sw0+LK2yP7N/6rB8EvoKLQl8m2gTvkClYYJiddvfndc2CA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201464410386.76010852144896; Sat, 4 Jul 2026 14:44:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86L-0007Wg-17; Sat, 04 Jul 2026 17:40:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86J-0007Vl-Lb; Sat, 04 Jul 2026 17:40:39 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86H-0007sr-Mw; Sat, 04 Jul 2026 17:40:39 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmZxR2457585; Sat, 4 Jul 2026 21:40:31 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hm3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:31 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYatZ009682; Sat, 4 Jul 2026 21:40:30 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbta-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:30 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeTls24183470 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:29 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 252B658052; Sat, 4 Jul 2026 21:40:29 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F26C5805E; Sat, 4 Jul 2026 21:40:27 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:26 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=X6HKAkf8RA3YZ51Ru q3a0g/ukNaNC9oVnBhA2kpOIww=; b=FlVXEoZDDrE5YjrG6OZfL3c6p4JqvYRLK 5nlO5w26PUV4Yo+TKAgDDZD9dpqkfNeJTd7wGhnnG8biHGfIeDn4bZAymTJU12B/ au+tIWvTkb37KU3Y4X9YvVVUHkCFif7h4PKfirrklPSzSU5Yj4R3Vf0KCbyJ6oo5 RM5xfOK3wiyAXJ911tpQaxtWzc67nmqQKiz/C9QqeBALLKJIfmFEBHb4KX2RxOee 1R8HOeWJdamRtLwkXxA/2O0AyISLViQV/xGTZkQ+W3lLUyp+9/u1XkCwOHWs0mgV P++HXeTc+cLLScU0yQD9y+WaNMNY3+N4WjHAxsOpWCTJLMmcxwbfQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 16/33] pc-bios/s390-ccw: Define memory for IPLB and convert IPLB to pointers Date: Sat, 4 Jul 2026 17:39:32 -0400 Message-ID: <20260704213950.2118823-17-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497dcf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=_GZQR2ZoBes7ElOevS0A:9 X-Proofpoint-GUID: 6g_diFqvfCSsit4hTG34FWQdx3ZjL87r X-Proofpoint-ORIG-GUID: 6g_diFqvfCSsit4hTG34FWQdx3ZjL87r X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX3gR03xVqtCWR WHpJ/N7MaI3eaCGSurxXF8VNVpLukGWX+s/xt/fMOX5ciGkzmlpaBTb1DVeABC3Vdko9ELsnvrr PirQHbX0aG1D8OrAf+w0R8XbPRIDbMY= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX35Y/t6wtL5N7 6ZHxiBUwejK2RLxZJ9V4JWm2mpmSDz42kxzweFq8InT1JHnpYETW4OSmSlJfqM5NBykO9MuiTk0 TmxDU5wO/CO8IAjATvrkL5PC2ZqM6bzeRUtxII/btwDZSZ7TQKZW/4c3nxTfO1Qu1aQsv/h5QR8 iofJG1ML+LFjxlxEsnBn6YYJPkUuSZpLtU4+7I0z/qT+rotpheotx7fv4C9WEzIgjtdoMEjS+BL RRXSnyOznJDosBnU8ve7iZfW7+HEp7Yq3jAGQCEBFKzZ7P5ioY5/S1AGbWQcWBQh//v9gFwe+G2 FOSnpD3TpDX++sHHArNbb9Rh9RvM5RZZdaff6ziDcfgeJL1+AiH/xZL+lvoYk3Ro1FuhPlUow5/ AUK182msXH82uJ2BHKLQQYRLRRKz+ASpb2ksN60mTnIPSkNrIZ8cC2bceW5uNMkVMKvvhkedjEF e6SQuUTh1smLviiKlDg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201464948158500 Content-Type: text/plain; charset="utf-8" Define a memory space for both IPL Parameter Block (IPLB) and IPL Information Report Block (IIRB) since IIRB is stored immediately following IPLB. Convert IPLB to pointer and it points to the start of the defined memory sp= ace. IIRB points to the end of IPLB. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Farhan Ali Reviewed-by: Jared Rossi --- include/hw/s390x/ipl/qipl.h | 6 ++++++ pc-bios/s390-ccw/iplb.h | 5 +++-- pc-bios/s390-ccw/jump2ipl.c | 6 +++--- pc-bios/s390-ccw/main.c | 34 +++++++++++++++++++--------------- pc-bios/s390-ccw/netmain.c | 8 ++++---- 5 files changed, 35 insertions(+), 24 deletions(-) diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 45d25264f4..9940f1457c 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -208,4 +208,10 @@ struct IplInfoReportBlock { }; typedef struct IplInfoReportBlock IplInfoReportBlock; =20 +struct IplBlocks { + IplParameterBlock iplb; + IplInfoReportBlock iirb; +}; +typedef struct IplBlocks IplBlocks; + #endif diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index 926e8eed5d..c92a3d0f0c 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -20,8 +20,9 @@ #include =20 extern QemuIplParameters qipl; -extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +extern IplParameterBlock *iplb; extern bool have_iplb; +extern IplBlocks ipl_blocks; =20 static inline bool manage_iplb(IplParameterBlock *iplb, bool store) { @@ -61,7 +62,7 @@ static inline bool load_next_iplb(void) =20 qipl.index++; next_iplb =3D (IplParameterBlock *) qipl.next_iplb; - memcpy(&iplb, next_iplb, sizeof(IplParameterBlock)); + memcpy(iplb, next_iplb, sizeof(IplParameterBlock)); =20 qipl.chain_len--; qipl.next_iplb =3D qipl.next_iplb + sizeof(IplParameterBlock); diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c index 86321d0f46..fa2ca5cbe1 100644 --- a/pc-bios/s390-ccw/jump2ipl.c +++ b/pc-bios/s390-ccw/jump2ipl.c @@ -43,11 +43,11 @@ int jump_to_IPL_code(uint64_t address) * The IPLB for QEMU SCSI type devices must be rebuilt during re-ipl. = The * iplb.devno is set to the boot position of the target SCSI device. */ - if (iplb.pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { - iplb.devno =3D qipl.index; + if (iplb->pbt =3D=3D S390_IPL_TYPE_QEMU_SCSI) { + iplb->devno =3D qipl.index; } =20 - if (have_iplb && !set_iplb(&iplb)) { + if (have_iplb && !set_iplb(iplb)) { panic("Failed to set IPLB"); } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 26287cfd81..b8f836c682 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -24,7 +24,9 @@ static SubChannelId blk_schid =3D { .one =3D 1 }; static char loadparm_str[LOADPARM_LEN + 1]; QemuIplParameters qipl; -IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE))); +/* Ensure that IPLB and IIRB are page aligned and sequential in memory */ +IplBlocks ipl_blocks __attribute__((__aligned__(PAGE_SIZE))); +IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ @@ -53,7 +55,7 @@ void write_subsystem_identification(void) void write_iplb_location(void) { if (cutype =3D=3D CU_TYPE_VIRTIO && virtio_get_device_type() !=3D VIRT= IO_ID_NET) { - lowcore->ptr_iplb =3D ptr2u32(&iplb); + lowcore->ptr_iplb =3D ptr2u32(iplb); } } =20 @@ -213,14 +215,14 @@ static void boot_setup(void) char lpmsg[] =3D "LOADPARM=3D[________]\n"; VDev *vdev =3D virtio_get_device(); =20 - if (have_iplb && memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) !=3D= 0) { - ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN= ); + if (have_iplb && memcmp(iplb->loadparm, NO_LOADPARM, LOADPARM_LEN) != =3D 0) { + ebcdic_to_ascii((char *) iplb->loadparm, loadparm_str, LOADPARM_LE= N); } else { sclp_get_loadparm_ascii(loadparm_str); } =20 if (have_iplb) { - vdev->ipl_type =3D iplb.pbt; + vdev->ipl_type =3D iplb->pbt; menu_setup(vdev); } else { vdev->ipl_type =3D QEMU_DEFAULT_IPL; @@ -244,21 +246,21 @@ static bool find_boot_device(void) switch (vdev->ipl_type) { case S390_IPL_TYPE_CCW: vdev->scsi_device_selected =3D false; - debug_print_int("device no. ", iplb.ccw.devno); - blk_schid.ssid =3D iplb.ccw.ssid & 0x3; + debug_print_int("device no. ", iplb->ccw.devno); + blk_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", blk_schid.ssid); - found =3D find_subch(iplb.ccw.devno); + found =3D find_subch(iplb->ccw.devno); break; case S390_IPL_TYPE_QEMU_SCSI: vdev->scsi_device_selected =3D true; - vdev->selected_scsi_device.channel =3D iplb.scsi.channel; - vdev->selected_scsi_device.target =3D iplb.scsi.target; - vdev->selected_scsi_device.lun =3D iplb.scsi.lun; - blk_schid.ssid =3D iplb.scsi.ssid & 0x3; - found =3D find_subch(iplb.scsi.devno); + vdev->selected_scsi_device.channel =3D iplb->scsi.channel; + vdev->selected_scsi_device.target =3D iplb->scsi.target; + vdev->selected_scsi_device.lun =3D iplb->scsi.lun; + blk_schid.ssid =3D iplb->scsi.ssid & 0x3; + found =3D find_subch(iplb->scsi.devno); break; case S390_IPL_TYPE_PCI: - found =3D find_fid(iplb.pci.fid); + found =3D find_fid(iplb->pci.fid); break; default: puts("Unsupported IPLB"); @@ -377,10 +379,12 @@ static void probe_boot_device(void) =20 void main(void) { + iplb =3D &ipl_blocks.iplb; + copy_qipl(); sclp_setup(); css_setup(); - have_iplb =3D store_iplb(&iplb); + have_iplb =3D store_iplb(iplb); if (!have_iplb) { boot_setup(); probe_boot_device(); diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c index 651cedf6ef..9b4dfd4638 100644 --- a/pc-bios/s390-ccw/netmain.c +++ b/pc-bios/s390-ccw/netmain.c @@ -528,11 +528,11 @@ static bool virtio_setup(void) */ enable_mss_facility(); =20 - if (have_iplb || store_iplb(&iplb)) { - IPL_assert(iplb.pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expect= ed"); - dev_no =3D iplb.ccw.devno; + if (have_iplb || store_iplb(iplb)) { + IPL_assert(iplb->pbt =3D=3D S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expec= ted"); + dev_no =3D iplb->ccw.devno; debug_print_int("device no. ", dev_no); - net_schid.ssid =3D iplb.ccw.ssid & 0x3; + net_schid.ssid =3D iplb->ccw.ssid & 0x3; debug_print_int("ssid ", net_schid.ssid); found =3D find_net_dev(&schib, dev_no); } else { --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201379; cv=none; d=zohomail.com; s=zohoarc; b=ibs65Wy2aQN99Rin8sjb8fHABXMir43z0iY3fdhrVNvckEP1uY52AL6xSUIrV9J5TW6u1YEpX1lZS2XgbWJwmvTyxkqeETa28u/fTGQTlxdylo3RP2/eSaCGk0/ehRSOX3ruQt45LLz+naTSJ4ayN9NsR/eL26Ye8vBNePsM2Wc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201379; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bfOshnfnLjcMxaDNVafW2X6etk7uW6LTS1pBWI+FBc0=; b=aHeBL5t/NU06LOkfsSISohscb7xCrqFVHpsjhYJQR5SGSaHBm49PgGgDgP1RtlOsXeChDVoguYiZ6fteXPe0zg9h7BlL/ammeOTmYyku0E6gdtjEXwqM6A5QKRksd96KHTJsV0HxvI3o4aFjJf4LkwO1ywHB2wKKZh6XYKrXoeY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201379744637.3217472855356; Sat, 4 Jul 2026 14:42:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86N-0007YW-Et; Sat, 04 Jul 2026 17:40:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86L-0007X7-Bv; Sat, 04 Jul 2026 17:40:41 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86J-0007t6-8X; Sat, 04 Jul 2026 17:40:41 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmMm42428210; Sat, 4 Jul 2026 21:40:33 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7jb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:33 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYh5u025641; Sat, 4 Jul 2026 21:40:32 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2tbhxdrq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:32 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeV8Z29491894 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:31 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8B7DC58054; Sat, 4 Jul 2026 21:40:31 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 546F258050; Sat, 4 Jul 2026 21:40:29 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:29 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=bfOshnfnLjcMxaDNV afW2X6etk7uW6LTS1pBWI+FBc0=; b=aH8DRXWmENqv9NQc3J6PY9rF8cJ6bdcaU PZRt/kJfQHCiKxBkbN/DQjHuwl5AStCbYcoFPJrmrc8jrH5yF+b+Bmvw1YvHDHGX Ca+GfK5IvMpqXNaiptdojqFXluHrT3PzbVTV+Cp5cpIJHC+gn0vSBYL8q7eII1Uy btYe/Lu+hXNW5XCW4ronFY8sbj4Ky9tIG4JJXXEyzvfTxCOTAVjr/wh+JIBRY5Yl BWn/uxwGqSuPoVid6bZLZgoSkqIAkOG2nSyxBQZpUoDTO5NBREMHPFHcvzDdkEYf 6fzfgdGDP6lhrIz3v7bjXNvMNivFq5FwNO14q2GtvG8ZsxM/bYELg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 17/33] hw/s390x/ipl: Add IPIB flags to IPL Parameter Block Date: Sat, 4 Jul 2026 17:39:33 -0400 Message-ID: <20260704213950.2118823-18-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: pXaS77wd6u8wgE8wSzOmEBqtnk3CO8wK X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/wnykKwywmm+ 8DhwvQ0Vcub/lppupIONYM+/Yh47Pfw7C1QzSrPV+W8v9QosVoenqky7svdpcIjqPSXzAEeh3OV VSkh30xwxVNg2xQhzQtiE+ySBzHWcY4= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497dd1 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=ZDXLRS20C3ackK2NFGcA:9 X-Proofpoint-GUID: pXaS77wd6u8wgE8wSzOmEBqtnk3CO8wK X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXzaHkmB5nbHyR +1VIfMdLJzlsREiy71X/9AhxHfm/GWr1gj6GhYF0wULRp6UNridPbtFylo8cHRq4+oe7UTll+c7 jDj062+r8s1CHaxMoGVx+2HQTm4SurTiAXdDGLm9ITAa0FR5HC1TMOAPkhbFfeFyoCYm4YkOuXq 7URgR2aemHOL5RGzDQEBLidkqEp0VWVGHOayxFOcMzQrp/6gJuPgjQMCH3WKJiDHUj3BnX0USHc v7ELJBzgh+dZtbtMhqaUXGhrbL/1Wg7qYepFS8eoAuRSIIXgR2trLZ0002aaIe0xW7Rwo4ZqVvY Vyh9E3A1ikj5/K+M4V1VVVH4N3czO2jAOUFRlofQtfag73b+m3p8RjFQii/I4sVXAigZRgjxw8c m3cl08OD/I7go7IGTrEVuXARnoKDc+Ik3D3ZvyyCjahhSyoAkfsdgupQK251BbTCPY53ii2ZtB7 wdajEVWG0x8dy6FC09A== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201380493158500 Content-Type: text/plain; charset="utf-8" Add IPIB flags to IPL Parameter Block to determine if IPL needs to perform securely and if IPL Information Report Block (IIRB) exists. Move DIAG308 flags to a separated header file and add flags for secure IPL. Move IPLB length related definitions to include/hw/s390x/ipl/qipl.h and add a maximum length constant to support secure IPL. Secure boot in audit mode will perform if certificate(s) exist in the key store. IIRB will exist and results of verification will be stored in IIRB. To ensure proper alignment of the IIRB and prevent overlap, set iplb->len to the maximum length of the IPLB, allowing alignment constraints to be determined based on its size. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- hw/s390x/ipl.c | 36 ++++++++++++++++++++++++++++++++++ hw/s390x/ipl.h | 24 ----------------------- include/hw/s390x/ipl/diag308.h | 34 ++++++++++++++++++++++++++++++++ include/hw/s390x/ipl/qipl.h | 13 +++++++++++- 4 files changed, 82 insertions(+), 25 deletions(-) create mode 100644 include/hw/s390x/ipl/diag308.h diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 09c24203c7..f9f14d7b67 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -461,6 +461,34 @@ S390IPLCertificateStore *s390_ipl_get_certificate_stor= e(void) return &ipl->cert_store; } =20 +static bool s390_has_certificate(void) +{ + S390IPLState *ipl =3D get_ipl_device(); + + return ipl->cert_store.count > 0; +} + +static void s390_set_secure_boot_flags(IplParameterBlock *iplb, + bool audit_mode) +{ + if (!audit_mode) { + return; + } + + /* + * For audit mode, enable the IPL Information + * Report (IPLIR) flag so that the firmware generates an IPL + * Information Report Block (IIRB). + * + * Results of secure boot will be stored in IIRB. + * + * Extend the IPL parameter block to its maximum length to ensure + * sufficient space for the BIOS to populate the IIRB. + */ + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_IPLIR; + iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -517,6 +545,8 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + s390_set_secure_boot_flags(iplb, s390_has_certificate()); + return true; } =20 @@ -653,6 +683,12 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) } else { ipl->iplb =3D *iplb; ipl->iplb_valid =3D true; + + /* + * The kernel does not preserve secure boot flags across a reboot. + * Re-apply them here based on the current machine configuration. + */ + s390_set_secure_boot_flags(&ipl->iplb, s390_has_certificate()); } =20 update_machine_ipl_properties(iplb); diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index f5a49a4431..9807ef18f2 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -23,7 +23,6 @@ #include "qom/object.h" #include "target/s390x/kvm/pv.h" =20 -#define DIAG308_FLAGS_LP_VALID 0x80 #define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex= */ =20 void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp); @@ -90,29 +89,6 @@ struct S390IPLState { }; QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wr= ong"); =20 -#define DIAG_308_RC_OK 0x0001 -#define DIAG_308_RC_NO_CONF 0x0102 -#define DIAG_308_RC_INVALID 0x0402 -#define DIAG_308_RC_NO_PV_CONF 0x0902 -#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 - -#define DIAG308_RESET_MOD_CLR 0 -#define DIAG308_RESET_LOAD_NORM 1 -#define DIAG308_LOAD_CLEAR 3 -#define DIAG308_LOAD_NORMAL_DUMP 4 -#define DIAG308_SET 5 -#define DIAG308_STORE 6 -#define DIAG308_PV_SET 8 -#define DIAG308_PV_STORE 9 -#define DIAG308_PV_START 10 - -#define S390_IPLB_HEADER_LEN 8 -#define S390_IPLB_MIN_PV_LEN 148 -#define S390_IPLB_MIN_CCW_LEN 200 -#define S390_IPLB_MIN_FCP_LEN 384 -#define S390_IPLB_MIN_PCI_LEN 376 -#define S390_IPLB_MIN_QEMU_SCSI_LEN 200 - static inline bool iplb_valid_len(IplParameterBlock *iplb) { return be32_to_cpu(iplb->len) <=3D sizeof(IplParameterBlock); diff --git a/include/hw/s390x/ipl/diag308.h b/include/hw/s390x/ipl/diag308.h new file mode 100644 index 0000000000..6e62f29215 --- /dev/null +++ b/include/hw/s390x/ipl/diag308.h @@ -0,0 +1,34 @@ +/* + * S/390 DIAGNOSE 308 definitions and structures + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef S390X_DIAG308_H +#define S390X_DIAG308_H + +#define DIAG_308_RC_OK 0x0001 +#define DIAG_308_RC_NO_CONF 0x0102 +#define DIAG_308_RC_INVALID 0x0402 +#define DIAG_308_RC_NO_PV_CONF 0x0902 +#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 + +#define DIAG308_RESET_MOD_CLR 0 +#define DIAG308_RESET_LOAD_NORM 1 +#define DIAG308_LOAD_CLEAR 3 +#define DIAG308_LOAD_NORMAL_DUMP 4 +#define DIAG308_SET 5 +#define DIAG308_STORE 6 +#define DIAG308_PV_SET 8 +#define DIAG308_PV_STORE 9 +#define DIAG308_PV_START 10 + +#define DIAG308_FLAGS_LP_VALID 0x80 + +#define DIAG308_IPIB_FLAGS_SIPL 0x40 +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 + +#endif diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 9940f1457c..a2180719b1 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -12,6 +12,8 @@ #ifndef S390X_QIPL_H #define S390X_QIPL_H =20 +#include "diag308.h" + /* Boot Menu flags */ #define QIPL_FLAG_BM_OPTS_CMD 0x80 #define QIPL_FLAG_BM_OPTS_ZIPL 0x40 @@ -31,6 +33,14 @@ typedef enum S390IplType S390IplType; =20 #define QEMU_DEFAULT_IPL S390_IPL_TYPE_CCW =20 +#define S390_IPLB_HEADER_LEN 8 +#define S390_IPLB_MIN_PV_LEN 148 +#define S390_IPLB_MIN_CCW_LEN 200 +#define S390_IPLB_MIN_FCP_LEN 384 +#define S390_IPLB_MIN_PCI_LEN 376 +#define S390_IPLB_MIN_QEMU_SCSI_LEN 200 +#define S390_IPLB_MAX_LEN 4096 + #define MAX_CERTIFICATES 64 /* largest supported block size - same as VIRTIO_DASD_DEFAULT_BLOCK_SIZE */ #define VIRTIO_MAX_BLOCK_SIZE 4096 @@ -125,7 +135,8 @@ typedef struct IplBlockPci IplBlockPci; union IplParameterBlock { struct { uint32_t len; - uint8_t reserved0[3]; + uint8_t hdr_flags; + uint8_t reserved0[2]; uint8_t version; uint32_t blk0_len; uint8_t pbt; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201368; cv=none; d=zohomail.com; s=zohoarc; b=VKAU9tDULpuZAyZveZItsaDl6QFYhnWJMITLq02sAKvUp9xxivslc2gmDuqBmUIDzOPxyvEraBRnPnwK2X2QfncJJTrP6PninngTmPbTr9B0Ko4XUrYLyDyEhAPMl2chbhj5DMCJoB06yJzCk2lcSF+NRTktci7xYDxW0X3sZEw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201368; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iSzYIKlyChYUo1IT7XVDTbS8gklKwP/8KAaWWJvgnag=; b=R9+FWpSZTZrjIKMuuZuAcLQukLQi1hkkp1SLl2GOFbl2mhjzG+AmpgHHjnuB/CH5sSkU65SDuNBYHFaEzVKuD9CQr2MhSZFDCJS809R0JnrGN71t5Kc4ZA/cZdGQWPO8zSf4+q2rHWYfZeHpvN2nUoxUYeBnW2D6rkPKkLuEOJ4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201368858337.5953859297158; Sat, 4 Jul 2026 14:42:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86N-0007ZI-St; Sat, 04 Jul 2026 17:40:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86L-0007XH-IW; Sat, 04 Jul 2026 17:40:41 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86J-0007t4-JG; Sat, 04 Jul 2026 17:40:41 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmGEF2705476; Sat, 4 Jul 2026 21:40:36 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7hg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:36 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYata009682; Sat, 4 Jul 2026 21:40:35 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbtf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:35 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeXRM65077644 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:33 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A5F2C58054; Sat, 4 Jul 2026 21:40:33 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B8F0958045; Sat, 4 Jul 2026 21:40:31 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=iSzYIKlyChYUo1IT7 XVDTbS8gklKwP/8KAaWWJvgnag=; b=fd7meyPG0iBIeiJfcAKtRGG+Vp+0SdRA5 Et65h6xAhVYTAXn2k8Dp7T2Djbl6sDcwgx3yksk2sEnBp2DQaKlDrhgWJjAX3Xnf lLGsqT7DbNqz+tyiCcAzSM3C60CMlsjM6Fvq0qo4ocF0tGZeEeD1JU2IhLxWxtuW KQFVsUXEsZlVSSsqw/8FCWbqW/h9H09ezuTH+rg8RwInKEYDYxMIOww5laLweon4 8eYsOYzTOPiriIfvJgRtLPnwMk5gPclpqvLPVIYQY182vEm8qZwsSYqTLm7VckVE oH+8e9m7ZfElnjA1SuEQFfdN4iICB6vMLN2l29QmITW6v/c3/ZEWQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 18/33] hw/s390x/ipl: Rework s390_ipl_map_iplb_chain for certificate storage Date: Sat, 4 Jul 2026 17:39:34 -0400 Message-ID: <20260704213950.2118823-19-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/YsKBBbL0VFC K5HiueZYp26dOc0MV5VsoAxq4JRPx+ptLC6FM35pDkrM9G2/bXVIKCcwSpotswcHGV860vKmaZ2 +LUZlIo6RW/TTrntzMpyOmElAaYZvwQ= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX35HQgqgywUtm 8dAeV3BHIoLG6uTAIy32WCCCzeVMV73dLAv820eKzu9kgDKliY/BEhfYsQCc/702+c8Be+UvGXd o3IonBm7fppx2AWHfIU/PBaPwHV5A0flCsYVYLki+9yWM+0q1WiOYKrqb/efrKCIEpnSI5MFUwh xA09QMvO6fr4GSdz8LSInOeSv/bG+x8txz/nw2T6tBnt590gjdtfe/J3PvQaTtfbGwLrPaUM6b4 Q5Gro8sxm0ALJqJVIDFriuSFU/BfKbkT7ctMwSVvmf375Mp87/ejuWwLYcSfQniVK65cRur2m16 4P0ofteDO2YnCbk85eIT1avdJXHT/EYiLzfoIDWNU6AJGrxxefIFMMKjkt15ecL7fUJtzNsP3u/ STTrN8nRl/T+H1amGigolfumtCxUKl6dvJzJDYjLmw+mdL+SbKEVrQT9K3W6+nxFG8UW6CyI1IL LNHsNdShw2JHcWhiZBg== X-Proofpoint-GUID: i9TqixtStQa9pTvJLemKat05YxjJbVVj X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497dd4 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=6n7imOYxnT_JOqVJOMMA:9 X-Proofpoint-ORIG-GUID: i9TqixtStQa9pTvJLemKat05YxjJbVVj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201370505158500 Content-Type: text/plain; charset="utf-8" Rework s390_ipl_map_iplb_chain to always allocate maximum memory for the IPLB chain, regardless of the number of boot devices. This space is also used to store certificates during secure boot, providing a safe location for certificates until the kernel reads them during boot. Rename next_iplb to ipl_data to better reflect its multiple purposes: storing both IPLB chains and certificate data. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- hw/s390x/ipl.c | 18 ++++++++++++++---- hw/s390x/ipl.h | 2 -- include/hw/s390x/ipl/qipl.h | 5 ++++- pc-bios/s390-ccw/iplb.h | 4 ++-- 4 files changed, 20 insertions(+), 9 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index f9f14d7b67..8dbabb1c2b 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -425,10 +425,9 @@ static S390PCIBusDevice *s390_get_pci_device(DeviceSta= te *dev_st, int *devtype) return pbdev; } =20 -static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain) +static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain, uin= t16_t count) { S390IPLState *ipl =3D get_ipl_device(); - uint16_t count =3D be16_to_cpu(ipl->qipl.chain_len); uint64_t len =3D sizeof(IplParameterBlock) * count; uint64_t chain_addr =3D find_iplb_chain_addr(ipl->bios_start_addr, cou= nt); =20 @@ -592,7 +591,7 @@ void s390_rebuild_iplb(uint16_t dev_index, IplParameter= Block *iplb) static bool s390_init_all_iplbs(S390IPLState *ipl) { int iplb_num =3D 0; - IplParameterBlock iplb_chain[7]; + IplParameterBlock iplb_chain[MAX_BOOT_DEVS - 1] =3D { 0 }; DeviceState *dev_st =3D get_boot_device(0); Object *machine =3D qdev_get_machine(); =20 @@ -638,13 +637,24 @@ static bool s390_init_all_iplbs(S390IPLState *ipl) dev_st =3D get_boot_device(i); s390_build_iplb(dev_st, &iplb_chain[i - 1]); } + } =20 - ipl->qipl.next_iplb =3D cpu_to_be64(s390_ipl_map_iplb_chain(iplb_c= hain)); + /* + * Allocate maximum space for IPLB chain and/or certificate storage. + * Once a valid boot device is found, this space will be used to store + * certificates if secure boot is enabled. + */ + if (iplb_num > 1 || s390_has_certificate()) { + ipl->qipl.ipl_data =3D cpu_to_be64(s390_ipl_map_iplb_chain(iplb_ch= ain, + MAX_BOOT_= DEVS - 1)); } =20 return iplb_num; } =20 +QEMU_BUILD_BUG_MSG(sizeof(IplParameterBlock) * (MAX_BOOT_DEVS - 1) !=3D CE= RT_BUF_SIZE, + "certificate buffer size is wrong"); + static void update_machine_ipl_properties(IplParameterBlock *iplb) { Object *machine =3D qdev_get_machine(); diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 9807ef18f2..7b8a51452b 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -23,8 +23,6 @@ #include "qom/object.h" #include "target/s390x/kvm/pv.h" =20 -#define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex= */ - void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp); void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp); void s390_rebuild_iplb(uint16_t index, IplParameterBlock *iplb); diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index a2180719b1..37452faaa6 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -41,7 +41,10 @@ typedef enum S390IplType S390IplType; #define S390_IPLB_MIN_QEMU_SCSI_LEN 200 #define S390_IPLB_MAX_LEN 4096 =20 +#define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex= */ + #define MAX_CERTIFICATES 64 +#define CERT_BUF_SIZE ((MAX_BOOT_DEVS - 1) * 4096) /* largest supported block size - same as VIRTIO_DASD_DEFAULT_BLOCK_SIZE */ #define VIRTIO_MAX_BLOCK_SIZE 4096 #define MAX_COMP_ENTRIES ((VIRTIO_MAX_BLOCK_SIZE - 32) / 32) @@ -61,7 +64,7 @@ struct QemuIplParameters { uint32_t boot_menu_timeout; uint8_t reserved3[2]; uint16_t chain_len; - uint64_t next_iplb; + uint64_t ipl_data; } QEMU_PACKED; typedef struct QemuIplParameters QemuIplParameters; =20 diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h index c92a3d0f0c..c807e7f49b 100644 --- a/pc-bios/s390-ccw/iplb.h +++ b/pc-bios/s390-ccw/iplb.h @@ -61,11 +61,11 @@ static inline bool load_next_iplb(void) } =20 qipl.index++; - next_iplb =3D (IplParameterBlock *) qipl.next_iplb; + next_iplb =3D (IplParameterBlock *) qipl.ipl_data; memcpy(iplb, next_iplb, sizeof(IplParameterBlock)); =20 qipl.chain_len--; - qipl.next_iplb =3D qipl.next_iplb + sizeof(IplParameterBlock); + qipl.ipl_data =3D qipl.ipl_data + sizeof(IplParameterBlock); =20 return true; } --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201495; cv=none; d=zohomail.com; s=zohoarc; b=nqNb/DxXPtOhFLfx91u6/DZ1NtbMa/H+KBwGTZnAAlhDNKHSwTnN0wmB27g/8MfSz3ZJkwaKwa2+IUjHanlOODf9aks5J2CRlI2EfH3bWR1mFKI1iVTwdYwDnBo+wcISFMQHyzkrjPNdGo7VV4nybjOHTd161PXS1559rV0XrOQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201495; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vEJ0cIslkhzsFangbjDTHF15nceQUPz871CrhYYa+t8=; b=VW7QUC+GwI8n6ax7ScBoGUAGp2AhH9tKceyrmBxS6OH0INR+BpKG7Rbxd0FE36y3z0N/NnF2rfSyHod1fDV+euKtS7q4eevfy+K6auxJVadlddQz5DOEhSfWczEhM99eNbAQuFZOxpbeYmFcoy3TuJEVWUWA3aQQyXA1218hQHE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201495519300.4565772398922; Sat, 4 Jul 2026 14:44:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86P-0007aB-IY; Sat, 04 Jul 2026 17:40:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86N-0007ZU-W4; Sat, 04 Jul 2026 17:40:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86L-0007ta-PZ; Sat, 04 Jul 2026 17:40:43 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmcCD2594454; Sat, 4 Jul 2026 21:40:38 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sp3b92a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:38 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYYkY013404; Sat, 4 Jul 2026 21:40:37 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxq8x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:37 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeZKR8192754 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:35 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C71FA58054; Sat, 4 Jul 2026 21:40:35 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D324158052; Sat, 4 Jul 2026 21:40:33 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=vEJ0cIslkhzsFangb jDTHF15nceQUPz871CrhYYa+t8=; b=njlQ96TJ6lXzKpyKRaO3yWrWmvHqzX3ac c2n2egh40GxV9s+BemaWP75ORJU484uMrnGf/YMU1hdraystRvWjde5aJcLn8Bm4 ub9Ndj7dYYakm++SFpR7CLbRcVqZ9NwAtNoPqBChpoqp0m/vzSOQiub9A5uYdQME /FIq9dQm5Y1QP0pPYmVDokwPS2S/gvleMh70Cpc/m0BOpu0k+1F1gr0tqRRhZMif W7qKUAxLOWOgGy145fZhr37fcBK+i5fGrqfJeHvGaxcBuSMFPZq40XvfD0g/UCS/ zBJ1TM1IMedVy4VSFjCN8ig2flbN82hTPSkf0xzVHVeIV1Orq7txA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 19/33] s390x: Guest support for Secure-IPL Facility Date: Sat, 4 Jul 2026 17:39:35 -0400 Message-ID: <20260704213950.2118823-20-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=KsJ9H2WN c=1 sm=1 tr=0 ts=6a497dd6 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=Bichc5AjJS213ZhIJUEA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX0q26tJAZ3j9R El60obEQkPQwmx43hIdeudUehIwkuITtH17+FLJ1CPaaxxBzZX1O60U9gCwLMpRk7E7WjrwpE6Y cwtbKpnrVvPsqMVfKn++hKSjV8z3pNc= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/MxlN2FTAYan nrbPR45j55flrCbpLkW3BAjggppOdf/meqG8dKEroAf1k1K/Q8BPJQzH9f9vPnM+zSc2b64hMYM e8VlRiXAKs8qf4vjqi2pm8fGOGwFmYlmjjpQRyXlb10AVnxQx/8ryRRANt8/HNj3RLly43/S101 9cEDGfO3OosHv4XwUbqAnMXsEIhuQVaA/6onjMOty+R+t8XDrAC2de82+wJNIxAGw3mBFUv7HMj hBDNk38AAT4pPfE8f7sRWQMPpyLp5oMdFpu7FC51QnssZoYxPeRzD7aIgRlV9u+MSNt6miV7bMh Rbz+2x2wpa6wmFbtF9Xc4T5bm2Cum0a69/cPLSmOG+4bxxSUGLqk/fxgAb9CfGnLARv8IsG084P 9x/H5iCgCfCl8tZg9a+OqL9Cwt42sxk33mhV/9lmEUPbZA24qi4TegLgPw3Gal3s6VbX7Ao8bfj LW5vbhQp4OZN79B9hdQ== X-Proofpoint-ORIG-GUID: i9eoJ6JgCZkSrlhdX4RxZ9A-LUTemG3K X-Proofpoint-GUID: i9eoJ6JgCZkSrlhdX4RxZ9A-LUTemG3K X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 spamscore=0 adultscore=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201497070158500 Content-Type: text/plain; charset="utf-8" Introduce Secure-IPL (SIPL) facility. Use fac_ipl to represent bytes 136 and 137 for IPL device facilities of the SCLP Read SCP Info. Availability of SIPL facility is determined by byte 136 bit 1 of the SCLP Read SCP Info. Byte 136's facilities cannot be represented without the availability of the extended-length-SCCB, so add it as a check for consistency. Secure IPL is not available for guests under protected virtualization. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Thomas Huth Reviewed-by: Matthew Rosato --- hw/s390x/sclp.c | 2 ++ include/hw/s390x/sclp.h | 6 ++++-- target/s390x/cpu_features.c | 4 ++++ target/s390x/cpu_features.h | 1 + target/s390x/cpu_features_def.h.inc | 3 +++ target/s390x/cpu_models.c | 2 ++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 3 +++ 8 files changed, 21 insertions(+), 2 deletions(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 2d2cde7803..87371749e2 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -146,6 +146,8 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb) if (s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB)) { s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC134, &read_info->fac134); + s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC_IPL, + read_info->fac_ipl); s390_get_feat_block(S390_FEAT_TYPE_SCLP_FAC139, &read_info->fac139); } diff --git a/include/hw/s390x/sclp.h b/include/hw/s390x/sclp.h index e1f9b0f6bc..dba9d8d463 100644 --- a/include/hw/s390x/sclp.h +++ b/include/hw/s390x/sclp.h @@ -136,9 +136,11 @@ typedef struct ReadInfo { uint32_t hmfai; uint8_t _reserved7[134 - 128]; /* 128-133 */ uint8_t fac134; - uint8_t _reserved8[139 - 135]; /* 135-138 */ + uint8_t _reserved8; + uint8_t fac_ipl[2]; /* 136-137 */ + uint8_t _reserved9; uint8_t fac139; - uint8_t _reserved9[144 - 140]; /* 140-143 */ + uint8_t _reserved10[144 - 140]; /* 140-143 */ struct CPUEntry entries[]; /* * When the Extended-Length SCCB (ELS) feature is enabled the diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index c6cd411e04..27f38636a9 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -119,6 +119,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * Some facilities are not available for CPUs in protected mode: * - All SIE facilities because SIE is not available * - DIAG318 + * - Secure IPL Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -149,6 +150,9 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, clear_be_bit(s390_feat_def(S390_FEAT_DIAG_318)->bit, data); clear_be_bit(s390_feat_def(S390_FEAT_CERT_STORE)->bit, data); break; + case S390_FEAT_TYPE_SCLP_FAC_IPL: + clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + break; case S390_FEAT_TYPE_SCLP_FAC139: clear_be_bit(s390_feat_def(S390_FEAT_SIE_ASTFLEIE2)->bit, data); break; diff --git a/target/s390x/cpu_features.h b/target/s390x/cpu_features.h index 52a82da751..421978faa4 100644 --- a/target/s390x/cpu_features.h +++ b/target/s390x/cpu_features.h @@ -24,6 +24,7 @@ typedef enum { S390_FEAT_TYPE_SCLP_CONF_CHAR, S390_FEAT_TYPE_SCLP_CONF_CHAR_EXT, S390_FEAT_TYPE_SCLP_FAC134, + S390_FEAT_TYPE_SCLP_FAC_IPL, S390_FEAT_TYPE_SCLP_FAC139, S390_FEAT_TYPE_SCLP_CPU, S390_FEAT_TYPE_MISC, diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index ae96f2381f..0153a6aa67 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -140,6 +140,9 @@ DEF_FEAT(SIE_IBS, "ibs", SCLP_CONF_CHAR_EXT, 10, "SIE: = Interlock-and-broadcast-s DEF_FEAT(DIAG_318, "diag318", SCLP_FAC134, 0, "Control program name and ve= rsion codes") DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certificate Store function= s") =20 +/* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ +DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") + /* Features exposed via SCLP SCCB Facilities byte 139 (bit numbers relativ= e to byte-139) */ DEF_FEAT(SIE_ASTFLEIE2, "astfleie2", SCLP_FAC139, 1, "SIE: ASTFLE interpre= tation execution facility 2") =20 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index 14db9c085e..b22841c2bc 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -263,6 +263,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_CMMA: case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: + case S390_FEAT_SIPL: case S390_FEAT_CONFIGURATION_TOPOLOGY: case S390_FEAT_SIE_ASTFLEIE2: return false; @@ -508,6 +509,7 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP }, { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index e6a586bce7..6bf61447de 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -722,6 +722,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_SIE_ASTFLEIE2, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -923,6 +924,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_PRNO_TRNG, S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, + S390_FEAT_SIPL, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 42417bb1c7..fb42d8c132 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2502,6 +2502,9 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 set_bit(S390_FEAT_CERT_STORE, model->features); =20 + /* Some Secure IPL facilities are emulated by QEMU */ + set_bit(S390_FEAT_SIPL, model->features); + /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); =20 --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201398; cv=none; d=zohomail.com; s=zohoarc; b=PpESzN2k586SoFrC5WWUggLAZRIHDV3GW5ueeFlMrftYf6a7sFtZu2Gn4VQDWJvNgapKENQDBcl/84t7y2CIdKSy/lPvdspHD9QLIZ62OWzwviu+yIjz4RBw5hj4kUbUFdX14y2fv4xr1nJH3iIPItNh984WTd2DGv4eapJ38Jg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201398; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YZsz+3Sw2LgxbyYlnLsi1LzrSQj0K5ETutA/Sq2xLrk=; b=g/3gtoD1y/RKcUQQRCKCdFkTwizUMdgRoiWKGwuDPsPKt/QPNGjsejxiJLFiy3I+Vqdg/JCU+MD9Qpodygceqc/v3CsahuKsL8Ck+wIC/7frWF24Hahx0+eYaeY6pRaqacKHURrvtB4akyGB6cskY0h2cd8iJeoinZsVPqDSioM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201398268831.8424928649023; Sat, 4 Jul 2026 14:43:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86R-0007bj-Tv; Sat, 04 Jul 2026 17:40:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86P-0007aT-Vf; Sat, 04 Jul 2026 17:40:46 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86O-0007ub-BM; Sat, 04 Jul 2026 17:40:45 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmIwX2705537; Sat, 4 Jul 2026 21:40:41 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7hs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:40 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYZDs011754; Sat, 4 Jul 2026 21:40:39 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgn5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:39 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LecwR15008306 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:38 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB42958045; Sat, 4 Jul 2026 21:40:37 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EFBC458050; Sat, 4 Jul 2026 21:40:35 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:35 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=YZsz+3 Sw2LgxbyYlnLsi1LzrSQj0K5ETutA/Sq2xLrk=; b=l2KmSIx+VuNjqAE5f9v3qm sS/pMF4F4zlqh1t9vSQC90KHGIX1Pdc3EpwOzyeAV4hR9VBGKHRdb7eG/ErfGd05 zyR+h/EhdfGusddpe0uRd4bu55TfEwZ9Dgekl2LpQy+PM4GWQkl26XK+GGo9fblo CAnaOrW3ip+vnoeue9xFPTCdEMAyl6gHLQ4QsRL9SDc7cYQmXlvOdFCyiD7vO0rh kx9DSqeounNFDdW0Lr6al1zpsmDyDdlrBW1tZUl0CKCcYjSyMeBRAelp7VeqvVXy 0D2rqR2gl//b1gt73nVd2LTGydnRLo25GrLqyzLUHP1sLUca2LaqEy3yFEQqJSPQ == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 20/33] pc-bios/s390-ccw: Refactor zipl_run() Date: Sat, 4 Jul 2026 17:39:36 -0400 Message-ID: <20260704213950.2118823-21-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXwmdGhtRWjyhM aqXIikwsZOmL5EcjIh0FANx1VFx+r/rgpYi9p93yWX2ZQcvfDVbQRHTWw6KZHRKO9jMLHjZsfqU HTlfGEFw1CFosiO1WxzRVHO7tpMfXLg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX4QjptSEpXagp tKls4aGw+Ajfryzb2t8HSqXMf4qHPB2vWqyoofZdYM01Vzad8x98VuliDMbR8MoTvCeA6RqcmJG yYEEuZGepncIsdcQZJUrfl0Nv6HFDDA/fRPyh52IkFSyRPe6OegIyEEHjpdj1frNS+CjS3+hIAU MRqfbwrOUvJEnKG90T3gL1Ot/5EtgWkNN1iPWHN+yTiudL470dOwofUHMVPjgMxDMHhD+dVWUvH cFXpduu/l8a656QEvPnny+xQn+C8D21Ctk/GymgPGsguLYRjHMswG94jGoErlY8nB7aPRZdawDf F8aBmnYDZyQiBW2VPZJz6F/jomtWbbY2Q6mVNHsMxRyoXULcyLk4RZew/D5EYQkXPOqntDjSP0Z KobPO9aH4NdKIgkkKPQnmtOwz/uP6hgut+EqfynPH/g7GZEZ7Eb7+pcSNIW5aUr22J5MvsHLaZ3 Dk3SH02sqx7eUbBx2Lw== X-Proofpoint-GUID: tnL52ycanruLC5ct1BIDDpdj0hXFUnhY X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497dd8 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=EUspDBNiAAAA:8 a=aJVrDPNlQ3gWXBXSk9UA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: tnL52ycanruLC5ct1BIDDpdj0hXFUnhY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201398424158500 Refactor to enhance readability before enabling secure IPL in later patches. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Jared Rossi Reviewed-by: Collin Walling Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- pc-bios/s390-ccw/bootmap.c | 51 ++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 420ee32eff..03841672be 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -674,12 +674,42 @@ static int zipl_load_segment(ComponentEntry *entry) return 0; } =20 +static int zipl_run_normal(ComponentEntry **entry_ptr, const uint8_t *tmp_= sec) +{ + ComponentEntry *entry =3D *entry_ptr; + + while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || + entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + + /* Secure boot is off, so we skip signature entries */ + if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { + entry++; + continue; + } + + if (zipl_load_segment(entry)) { + return -1; + } + + entry++; + + if ((uint8_t *)&entry[1] > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + return -EINVAL; + } + } + + *entry_ptr =3D entry; + return 0; +} + /* Run a zipl program */ static int zipl_run(ScsiBlockPtr *pte) { ComponentHeader *header; ComponentEntry *entry; uint8_t tmp_sec[MAX_SECTOR_SIZE]; + int rc; =20 if (virtio_read(pte->blockno, tmp_sec)) { puts("Cannot read header"); @@ -700,25 +730,10 @@ static int zipl_run(ScsiBlockPtr *pte) =20 /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); - while (entry->component_type =3D=3D ZIPL_COMP_ENTRY_LOAD || - entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - - /* We don't support secure boot yet, so we skip signature entries = */ - if (entry->component_type =3D=3D ZIPL_COMP_ENTRY_SIGNATURE) { - entry++; - continue; - } - - if (zipl_load_segment(entry)) { - return -1; - } =20 - entry++; - - if ((uint8_t *)(&entry[1]) > (tmp_sec + MAX_SECTOR_SIZE)) { - puts("Wrong entry value"); - return -EINVAL; - } + rc =3D zipl_run_normal(&entry, tmp_sec); + if (rc) { + return rc; } =20 if (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201374; cv=none; d=zohomail.com; s=zohoarc; b=I/ZBUmuvYgtcBhgdWrP9RnHRm8j0w77urGcl29wZtEJUwcHGAn6fNH1AwAOPrh5uM4zd0KBRtHxfitqG9kKGTE/JBp0yGVmEV7D7XlxX5dfypHIETFAI4bfiwPngeTsvdI8FzGBcEsorOUqNn5Fs6gQGXo2g3HUcgfbsTV0xwc8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201374; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5Ky+fnX6oF5CPabK0sIsR4Ty2MY5COE6puS0MLlcNhY=; b=ZCxuTX3PHFu8heyuYFkF1EZHCIvi3AU2LjnV+v+vdAwO5Hegx5+nI+Xsz2EXu7Uq0KMn4sO4wr4ijUcEZlMywhTfZqGdGYT87croxLfle93f4TR08oEt5gWqssDCB0R8ZAkRm54swYR82rQGv1ZcjXEGvdcTVzDLZH4vF7Txrk4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201374635891.1020808053346; Sat, 4 Jul 2026 14:42:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86T-0007ce-7W; Sat, 04 Jul 2026 17:40:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86R-0007bF-1o; Sat, 04 Jul 2026 17:40:47 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86P-0007wf-E6; Sat, 04 Jul 2026 17:40:46 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmNDP2428215; Sat, 4 Jul 2026 21:40:42 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7jt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:42 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYbpS019080; Sat, 4 Jul 2026 21:40:41 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8fd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:41 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LeeT925297522 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:40 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1AC0A58052; Sat, 4 Jul 2026 21:40:40 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F60358050; Sat, 4 Jul 2026 21:40:38 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:38 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5Ky+fnX6oF5CPabK0 sIsR4Ty2MY5COE6puS0MLlcNhY=; b=dgW6OiQfNmS4VgJgMOXkKR8GakKoKsUwC 87whitqAqBLWuA6cweXcmngxWY/taq0Lx1Hh0IY6vz0/fZsZgZjyfEhhS3jJoQqR Xes4L//AZLKI+vTiBtH/UdnFsv9HjImi6G6/js5++tySkgg78FQMXVw3nLnYtV4a ydCnHvIfVfOxo965ab5QmqET1JmlHtCH+Wk72/25Ns/JhPQp1whvwnDNF3pAuzd9 5vvffmn0w/V5S/H5BxVCZ42NdWbgLhG2mxN5iJ4BYM7acybhNRlSGkHjQg1tGk7p fLpp+KM2lxdbd+L8Y+xc8kISJZLI7j+8NdJ5s/V3wvhiGR/jfjvjA== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 21/33] pc-bios/s390-ccw: Rework zipl_load_segment function Date: Sat, 4 Jul 2026 17:39:37 -0400 Message-ID: <20260704213950.2118823-22-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: QzOOtXKHeqU5VCaBYF390MtuyVg_lBez X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX31CnsHBtYS79 /laoFr60yCMZd+fWSLjip2fAmhYLFNTgGJ9NuZg9+LcS1jHPgm6kBFVoYcgrC62JUi0kF38QKr0 TFX90UAUGIHRjrTdm26pUjpyL0Yb2sU= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497dda cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=uL_FI9FW9AP7juJAwn4A:9 X-Proofpoint-GUID: QzOOtXKHeqU5VCaBYF390MtuyVg_lBez X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXyIBYHDjNDhRW UzrOHsS9TMYi8nJaUo9KZZ9nfh1ryeCukWJ/VgQX6Lz5vPIb63ull96gBS/fwjk94ZQ2HYyOIHT xNZZuqLEZQIvmvrpWfUzrjIdorZEoqCDkl4E6IJN0uYBVcyiJyhaDzBmMY8wDjSlRubuV++unNm catfAn60nsVMhrx06ma0Ci6hObryA+6OF49SX8nCubyjowQGGKcmV6WtLTy5WfMtTtt+xTxKbpr QzRfL7TXf4NB+Tq+jOm3mhIfWTsjidffyrkvf0HBaqtOk7MvFvYBKM7hHHXWHH/hZTiAzbkA5mr Rz1hCKP0G0ZBt5EYaToCmtLeQqDqb4FdeiZ8u9K3kZSPanCOnq0/VOq6ITqL2abySXnrEIM2MOK dgOC/HsuqMK5oZwg2wAMeUZ0rYM1WWAxgKTYdPvR1CVamUDFD9LcU8Bggro6HlBYRArkFJvkaQj GhgWJuYVdeh29CSEE7w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201376404158500 Content-Type: text/plain; charset="utf-8" Change zipl_load_segment() to accept explicit blockno and address parameters instead of ComponentEntry pointer and return segment length. Modify this function to allow the caller to specify a memory address where segment data should be loaded into. seg_len variable is necessary to store the calculated segment length and is used during signature verification. Return the length on success, or a negative return code on failure. Remove static qualifier and add function declaration to bootmap.h to make it accessible to other modules. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- pc-bios/s390-ccw/bootmap.c | 14 ++++++-------- pc-bios/s390-ccw/bootmap.h | 13 +++++++++++++ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 03841672be..d0ac97795d 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -613,19 +613,15 @@ static int ipl_eckd(void) * IPL a SCSI disk */ =20 -static int zipl_load_segment(ComponentEntry *entry) +int zipl_load_segment(block_number_t blockno, uint64_t address) { const int max_entries =3D (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr)); ScsiBlockPtr *bprs =3D (void *)sec; const int bprs_size =3D sizeof(sec); - block_number_t blockno; - uint64_t address; int i; char err_msg[] =3D "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ"; char *blk_no =3D &err_msg[30]; /* where to print blockno in (those ZZs= ) */ - - blockno =3D entry->data.blockno; - address =3D entry->compdat.load_addr; + int seg_len =3D 0; =20 debug_print_int("loading segment at block", blockno); debug_print_int("addr", address); @@ -668,10 +664,12 @@ static int zipl_load_segment(ComponentEntry *entry) puts("zIPL load segment failed"); return -EIO; } + + seg_len +=3D bprs->size * (bprs[i].blockct + 1); } } while (blockno); =20 - return 0; + return seg_len; } =20 static int zipl_run_normal(ComponentEntry **entry_ptr, const uint8_t *tmp_= sec) @@ -687,7 +685,7 @@ static int zipl_run_normal(ComponentEntry **entry_ptr, = const uint8_t *tmp_sec) continue; } =20 - if (zipl_load_segment(entry)) { + if (zipl_load_segment(entry->data.blockno, entry->compdat.load_add= r) < 0) { return -1; } =20 diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h index 95943441d3..40580600b5 100644 --- a/pc-bios/s390-ccw/bootmap.h +++ b/pc-bios/s390-ccw/bootmap.h @@ -113,6 +113,19 @@ typedef struct ScsiMbr { ScsiBlockPtr pt; /* block pointer to program table */ } __attribute__ ((packed)) ScsiMbr; =20 +/** + * zipl_load_segment + * @blockno: block number of the first BPRS describing the segment. + * @address: guest physical address at which to load the segment. + * + * Walks the BPRS chain starting at @blockno, loading each data block + * into guest memory at @address. + * + * Returns: length of the segment on success, + * negative value on error. + */ +int zipl_load_segment(block_number_t blockno, uint64_t address); + #define ZIPL_MAGIC "zIPL" #define ZIPL_MAGIC_EBCDIC "\xa9\xc9\xd7\xd3" #define IPL1_MAGIC "\xc9\xd7\xd3\xf1" /* =3D=3D "IPL1" in EBCDIC */ --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201468; cv=none; d=zohomail.com; s=zohoarc; b=SLKmRVOngW9pveVp04a+dAZptyDkdRkey1yl0tOxrx8WaZSeE76NHvRBXznHA2DMB5mnJFE5uPzPW7brmdfRP71+3CPrBtGtUU0Cl0bw/KAU5JpjdP3xAHmkImU+gBAo3y72/6uUVEXln++P1NO8iQnz2pWjEIKVBBl1HuPZ5BY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201468; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bZXLpTCRIet5K2tU2fLmGUZ3A8s/JQPRk7JCn2t/yA4=; b=nHGBqK0AkZyQ5FO+mO/ZeOXGzCPH9RtkaPZPXD0nvuLRL8/yBUfWTxqlyehlWmjQDxOQi5u2oVNYq9eS650rgZHimJmZO4TVPMG0Spl88Z7NCBr38Kc3RR8h/CCrZjC7iE3LvE5ZBP9X2oM62tXnNA0CgX6M+UalqF4bArgknpw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201468210979.264064823574; Sat, 4 Jul 2026 14:44:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86W-0007lN-Mv; Sat, 04 Jul 2026 17:40:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86U-0007gu-OC; Sat, 04 Jul 2026 17:40:50 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86S-0008CN-RT; Sat, 04 Jul 2026 17:40:50 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmUWj2446208; Sat, 4 Jul 2026 21:40:46 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc66-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:44 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYxxp010144; Sat, 4 Jul 2026 21:40:43 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2u2gxbtx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:43 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LegxB9372264 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:42 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 72ABC58056; Sat, 4 Jul 2026 21:40:42 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4575958050; Sat, 4 Jul 2026 21:40:40 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=bZXLpTCRIet5K2tU2 fLmGUZ3A8s/JQPRk7JCn2t/yA4=; b=khEpaHQ1u1xzyTrJ3cG69+/HvdUYPU7fN f6hn1m1QzOPg90JrBcATUJrmlu4HfAuP1viMSUU8K65PEbS/+buJhTDgtE90/j3o XojNeAz+OfT5GvbowKMnTgaoe6vfwUOvsG78jwlz+wUPK4g7JWUDhLOzBo+2G73N 2U1LDsxix8hHFF8vX0QwaoXZx3jk75sQ7T0LBErykudw1690UXriKFNskdDUYp0u jC3wyCpedzrB5UcDokUZDlDNO3FqEuM1ae2doCafslORiE53sQJyuWpibTM0mVHt jLzmmOWVN8Xhqgr9b505qQAzckPWZCHLrT6FUkWncdKBsYqKAe96A== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 22/33] pc-bios/s390-ccw: Introduce ZiplBootMode enum for IPL mode selection Date: Sat, 4 Jul 2026 17:39:38 -0400 Message-ID: <20260704213950.2118823-23-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497ddc cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=6Ycx5JGYSpe9m2xj7koA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX6RGmSCSz93b+ B3LXYnojmdZzxt+ry3usyhYRV2pb7DzrTZg0XBs/FIlcBtScrHCUCCoylTJ0dNj4+tqJbCWvPq4 0tdABQ2Wbn6kuBfvQx8GhRdYnJ16xG/iibAoIJUm5utnLAVsPA1tqUleoKGXANLsLI+BsBXQAKJ GpdXhjVh+Zq6ohkQp7LKh7FXtV2T5q8qIs8ibuI+TfTQaX1j+UqmvB9GWvT3pRffv9TAxHRbLzO VlQVM/rNjNRUjCK7Msdlp+62UZY4t6QnmywlIuPe8c7z/oNXxF/6t27uuWEyvLzRSSIywZ2RR4Z cij42rEK2CP6ystDSLQ1WyVz2eBTDQiHmWPYhwMKNYTu8zZfR5Douj7zveVwoKj2gJ2NApoYO6y DKu1LKkZkmtUYMaqgshVzDecweZviiwcYJYO9vefUdceUqaKbjYZO86Yqr/JS1lzVOvI1HFoAkp h+vKcInos/KcdsFVpkg== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXy8JdAgaticHB PzzfDoBhzFXnnlvsMqjUrxnomP9bFjjachvk0zZXxGa7LxjzDps/uJK8g1GCwQZIxisIFMq4u7X xVSAThZKwSCfU+WRUqUYttUpwTD/bec= X-Proofpoint-GUID: JHWdbNrIdFP4AMoKbJXbI8RWdogRzvov X-Proofpoint-ORIG-GUID: JHWdbNrIdFP4AMoKbJXbI8RWdogRzvov X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201468910158500 Content-Type: text/plain; charset="utf-8" Add ZiplBootMode enumeration to support multiple IPL boot configurations. Boot modes differentiate between normal boot and secure IPL operations, enabled based on boot certificates specified via the boot-certs option. Normal Mode: IPL when no certificates are provided. No signature verification is performed. This prepares for future secure IPL modes requiring signature verification. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Jared Rossi --- docs/system/s390x/secure-ipl.rst | 21 +++++++++++++++++++++ pc-bios/s390-ccw/bootmap.c | 16 +++++++++++++++- pc-bios/s390-ccw/main.c | 6 ++++++ pc-bios/s390-ccw/s390-ccw.h | 6 ++++++ 4 files changed, 48 insertions(+), 1 deletion(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 88df52ce2f..9d7d33f5ed 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -18,3 +18,24 @@ Note: certificate files must have a .pem extension. .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + + +IPL Modes +--------- + +Multiple IPL modes are available to differentiate between the various IPL +configurations. These modes are mutually exclusive and enabled based on the +``boot-certs`` option on the QEMU command line. + +Normal Mode +^^^^^^^^^^^ + +The absence of certificates will attempt to IPL a guest without secure IPL +operations. No checks are performed, and no warnings/errors are reported. +This is the default mode. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio ... diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index d0ac97795d..7791ca179a 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -330,6 +330,9 @@ static int run_eckd_boot_script(block_number_t bmt_bloc= k_nr, /* The S1B block number is NULL_BLOCK_NR if and only if it's an LD-IPL= */ bool ldipl =3D (s1b_block_nr =3D=3D NULL_BLOCK_NR); =20 + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Secure boot with the ECKD scheme is not supported!"); + if (menu_is_enabled_zipl() && !ldipl) { loadparm =3D eckd_get_boot_menu_index(s1b_block_nr); } @@ -729,7 +732,14 @@ static int zipl_run(ScsiBlockPtr *pte) /* Load image(s) into RAM */ entry =3D (ComponentEntry *)(&header[1]); =20 - rc =3D zipl_run_normal(&entry, tmp_sec); + switch (boot_mode) { + case ZIPL_BOOT_MODE_NORMAL: + rc =3D zipl_run_normal(&entry, tmp_sec); + break; + default: + panic("Unknown boot mode"); + } + if (rc) { return rc; } @@ -1101,12 +1111,16 @@ void zipl_load(void) VDev *vdev =3D virtio_get_device(); =20 if (vdev->is_cdrom) { + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Secure boot from ISO image is not supported!"); ipl_iso_el_torito(); puts("Failed to IPL this ISO image!"); return; } =20 if (virtio_get_device_type() =3D=3D VIRTIO_ID_NET) { + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Virtio net boot device does not support secure boot!"= ); netmain(); puts("Failed to IPL from this network!"); return; diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index b8f836c682..cd3d0776b0 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -30,6 +30,7 @@ IplParameterBlock *iplb; bool have_iplb; static uint16_t cutype; LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */ +ZiplBootMode boot_mode; =20 #define LOADPARM_PROMPT "PROMPT " #define LOADPARM_EMPTY " " @@ -303,6 +304,9 @@ static void ipl_ccw_device(void) switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: + IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), + "Passthrough (vfio) CCW device does not support secure= boot!"); + dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: @@ -390,6 +394,8 @@ void main(void) probe_boot_device(); } =20 + boot_mode =3D ZIPL_BOOT_MODE_NORMAL; + while (have_iplb) { boot_setup(); if (have_iplb && find_boot_device()) { diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 1e1f71775e..5420443ad2 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -69,6 +69,12 @@ int sclp_read(char *str, size_t count); /* bootmap.c */ void zipl_load(void); =20 +typedef enum ZiplBootMode { + ZIPL_BOOT_MODE_NORMAL =3D 0, +} ZiplBootMode; + +extern ZiplBootMode boot_mode; + /* jump2ipl.c */ void write_reset_psw(uint64_t psw); int jump_to_IPL_code(uint64_t address); --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201331; cv=none; d=zohomail.com; s=zohoarc; b=lcWTCTS52vSmT7xlLGvsgwtLi+VqUeCG3UPgQ/jMoPTajsGvB7IxGxqdNIuFRmQ/rjMbhL/shDmY1q11rkGOX6NouuEKd8Aprajh2Acaq4kdiqiyQx9vwVezFmG84KK2A64NPh66PliKx2tT8UezBGaUm66PqnjMnCYwsmr1K6E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201331; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qzaE6Fe9dh8Hdm1kXyhtZCoS1vrF02JLoyQefDTO/yg=; b=J/uaOvQsOtN0Nrvk4BHQr3facAVkxSySPsh5bPMsV3XLqgHY2S+fVy2R4hHnD9WAGYDoyXLz0X57o3VTA7ormI2oxygYlyIT8yIweO+hDcAHl0ktRBw+nDszdjp2f78Rw2PCUQCJsubrTnd0cg9A80Ga8i2pcMCnKJzyH7JVioQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201331454553.0510892619925; Sat, 4 Jul 2026 14:42:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86a-0007na-KM; Sat, 04 Jul 2026 17:40:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86Z-0007mT-62; Sat, 04 Jul 2026 17:40:55 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86V-0008E9-Qo; Sat, 04 Jul 2026 17:40:54 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmDFq2513132; Sat, 4 Jul 2026 21:40:47 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sw4b7np-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:47 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYbLk011929; Sat, 4 Jul 2026 21:40:46 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgnk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:46 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Leigx21627420 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:44 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B76F558045; Sat, 4 Jul 2026 21:40:44 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AE30958050; Sat, 4 Jul 2026 21:40:42 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qzaE6Fe9dh8Hdm1kX yhtZCoS1vrF02JLoyQefDTO/yg=; b=EEDG4XhjEfP+J+g5m2Ztr46nQQ9pnY17R PMGhaGn38VGp1Lyvn6+E/TEjKSaRMxnCZo2du2bp5lqhjXXM6sBPiSTv1WbrH8hY KgFwT0iGzS1SE8HWITvgfdOPKMDMHB5ERaLyh/LM6RMBvRj0rtJDKU69Uai/PAfO iwi+ld8AkAm3MG5t5NjsrIkW4J7mlW6LMmD0vNEKTq9WKdmUUARMP6Mf61SO6PTb Rz8BxMxy+d3in3Fq4csGhP54ir9nBp7tvzduGMphuvn39Fsya536dO3iCgp2rOnG JrD9m6YJ9pBQ8J78O307ndED58Mrsg6gjwVHNI13FxkZ304SqRT/A== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 23/33] pc-bios/s390-ccw: Add signature verification for secure IPL in audit mode Date: Sat, 4 Jul 2026 17:39:39 -0400 Message-ID: <20260704213950.2118823-24-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: l1GSBfIfvW4QTUbOcD5P1-ywMbvGN8lO X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/gDfNdE66Fmi zZ+vI2ADRGFPTI16fLYRvdd9ni/rDeLPIdQxm9GWDPCy+wG9I104QmFq+BI90h8QkgEsciOIEKq vht6Pb/0N/SnQdy9lm3n3djMwrHenX58XrA3ORUCl//RUmFy4OEFAojS0/F80OU56YuawPDvQsD QRyEzhf9z/34OJzO9KPAx24NdaiPwfOBWL5FLyURygL0QETEKni2rZ63yqrk3LW11Z2daNLguqZ j6/n42ViVAJonT2gkS6J2pltlbFlED16GfjAJ6aUt5Ywzjz/4KDz8Ax9XJpkEASJCkuYW5dBjiY XXj2wcIwLVXXhNcVNA5SsMHqh5QLtE6swhhCufTgtsoEdZIiqdA4B2U3wRvj/y6TofO6vtyEx+N gC6Xrek4M84OV+klqASpVlrBg1B1zQxr0qkxS0hAz9+YMajOgKlaxXJ6qpw9g5XunNpntSVo4YC VmLvNrhA8HMjYXXzs/w== X-Proofpoint-ORIG-GUID: l1GSBfIfvW4QTUbOcD5P1-ywMbvGN8lO X-Authority-Analysis: v=2.4 cv=FqQ1OWrq c=1 sm=1 tr=0 ts=6a497ddf cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=Tktb4ypIQN7ojq7NPMkA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX6c4V0iHijeyp /+vfZIUNlFaUbcttTPVR8Ic0AWaTJE5FomeQnlSZA/FMynt+8LPKZaZQd+aLQMvvcR4eT2hj+yh 0Qh5z7X/RVuaTqykgJgqrBBYa6FW3k0= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201332276158500 Content-Type: text/plain; charset="utf-8" Enable secure IPL in audit mode, which performs signature verification, but any error does not terminate the boot process. Only warnings will be logged to the console instead. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities (Secure IPL Facility, Certificate Store Facility and secure IPL extension support). Note: Secure IPL in audit mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman --- docs/system/s390x/secure-ipl.rst | 15 ++ hw/s390x/ipl.c | 9 + pc-bios/s390-ccw/Makefile | 2 +- pc-bios/s390-ccw/bootmap.c | 27 +++ pc-bios/s390-ccw/bootmap.h | 9 + pc-bios/s390-ccw/jump2ipl.c | 7 + pc-bios/s390-ccw/main.c | 19 +- pc-bios/s390-ccw/s390-ccw.h | 20 ++ pc-bios/s390-ccw/sclp.c | 27 +++ pc-bios/s390-ccw/sclp.h | 6 + pc-bios/s390-ccw/secure-ipl.c | 363 +++++++++++++++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 115 ++++++++++ 12 files changed, 617 insertions(+), 2 deletions(-) create mode 100644 pc-bios/s390-ccw/secure-ipl.c create mode 100644 pc-bios/s390-ccw/secure-ipl.h diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 9d7d33f5ed..cf6ccf5d57 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -39,3 +39,18 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio ... + +Audit Mode +^^^^^^^^^^ + +When the certificate store is populated with at least one certificate +and no additional secure IPL parameters are provided on the command +line, then secure IPL will proceed in "audit mode". All secure IPL +operations will be performed with signature verification errors reported +as non-disruptive warnings. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 8dbabb1c2b..ee251d03a8 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -827,6 +827,15 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) cpu->env.psw.addr =3D ipl->bios_start_addr; if (!ipl->iplb_valid) { ipl->iplb_valid =3D s390_init_all_iplbs(ipl); + + /* + * Secure IPL without specifying a boot device. + * IPLB is not generated if no boot device is defined. + */ + if (s390_has_certificate() && !ipl->iplb_valid) { + error_report("No boot device defined for Secure IPL"); + exit(1); + } } else { ipl->qipl.chain_len =3D 0; } diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile index 3e5dfb64d5..2109d16781 100644 --- a/pc-bios/s390-ccw/Makefile +++ b/pc-bios/s390-ccw/Makefile @@ -35,7 +35,7 @@ QEMU_DGFLAGS =3D -MMD -MP -MT $@ -MF $(@D)/$(*F).d =20 OBJECTS =3D start.o main.o bootmap.o jump2ipl.o sclp.o menu.o netmain.o \ virtio.o virtio-net.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o \ - virtio-ccw.o clp.o pci.o virtio-pci.o + virtio-ccw.o clp.o pci.o virtio-pci.o secure-ipl.o =20 SLOF_DIR :=3D $(SRC_PATH)/../../roms/SLOF =20 diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 7791ca179a..276080709d 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -10,11 +10,13 @@ =20 #include #include +#include #include "s390-ccw.h" #include "s390-arch.h" #include "bootmap.h" #include "virtio.h" #include "bswap.h" +#include "secure-ipl.h" =20 #ifdef DEBUG /* #define DEBUG_FALLBACK */ @@ -710,6 +712,9 @@ static int zipl_run(ScsiBlockPtr *pte) ComponentHeader *header; ComponentEntry *entry; uint8_t tmp_sec[MAX_SECTOR_SIZE]; + IplDeviceComponentList comp_list =3D { 0 }; + IplSignatureCertificateList cert_list =3D { 0 }; + uint8_t *tmp_cert_buf =3D NULL; int rc; =20 if (virtio_read(pte->blockno, tmp_sec)) { @@ -736,6 +741,9 @@ static int zipl_run(ScsiBlockPtr *pte) case ZIPL_BOOT_MODE_NORMAL: rc =3D zipl_run_normal(&entry, tmp_sec); break; + case ZIPL_BOOT_MODE_SECURE_AUDIT: + rc =3D zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &t= mp_cert_buf); + break; default: panic("Unknown boot mode"); } @@ -751,6 +759,13 @@ static int zipl_run(ScsiBlockPtr *pte) =20 /* should not return */ write_reset_psw(entry->compdat.load_psw); + + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + update_cert_list(&cert_list); + update_iirb(&comp_list, &cert_list); + free(tmp_cert_buf); + } + jump_to_IPL_code(0); return -1; } @@ -1106,6 +1121,18 @@ static int zipl_load_vscsi(void) * IPL starts here */ =20 +ZiplBootMode get_boot_mode(uint8_t hdr_flags) +{ + bool sipl_set =3D hdr_flags & DIAG308_IPIB_FLAGS_SIPL; + bool iplir_set =3D hdr_flags & DIAG308_IPIB_FLAGS_IPLIR; + + if (!sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE_AUDIT; + } + + return ZIPL_BOOT_MODE_NORMAL; +} + void zipl_load(void) { VDev *vdev =3D virtio_get_device(); diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h index 40580600b5..e1f4130752 100644 --- a/pc-bios/s390-ccw/bootmap.h +++ b/pc-bios/s390-ccw/bootmap.h @@ -88,9 +88,18 @@ typedef struct BootMapTable { BootMapPointer entry[]; } __attribute__ ((packed)) BootMapTable; =20 +#define DER_SIGNATURE_FORMAT 1 + +typedef struct SignatureInformation { + uint8_t format; + uint8_t reserved[3]; + uint32_t sig_len; +} SignatureInformation; + typedef union ComponentEntryData { uint64_t load_psw; uint64_t load_addr; + SignatureInformation sig_info; } ComponentEntryData; =20 typedef struct ComponentEntry { diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c index fa2ca5cbe1..8e87c566f9 100644 --- a/pc-bios/s390-ccw/jump2ipl.c +++ b/pc-bios/s390-ccw/jump2ipl.c @@ -75,6 +75,13 @@ int jump_to_IPL_code(uint64_t address) "diag %%r1,%%r1,0x308\n\t" : : : "1", "memory"); puts("IPL code jump failed"); + + /* + * A failed jump only occurs in extreme conditions, so abort the IPL e= ntirely. + * This also prevents attempts to boot from the chain area if it has b= een + * overwritten with component data. + */ + qipl.chain_len =3D 0; return -1; } =20 diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index cd3d0776b0..b94a08e7bf 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -20,6 +20,7 @@ #include "dasd-ipl.h" #include "clp.h" #include "virtio-pci.h" +#include "secure-ipl.h" =20 static SubChannelId blk_schid =3D { .one =3D 1 }; static char loadparm_str[LOADPARM_LEN + 1]; @@ -383,6 +384,8 @@ static void probe_boot_device(void) =20 void main(void) { + int vcssb_len; + iplb =3D &ipl_blocks.iplb; =20 copy_qipl(); @@ -394,7 +397,21 @@ void main(void) probe_boot_device(); } =20 - boot_mode =3D ZIPL_BOOT_MODE_NORMAL; + boot_mode =3D get_boot_mode(iplb->hdr_flags); + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + if (!secure_ipl_supported()) { + panic("Unable to boot in audit mode"); + } + + vcssb_len =3D zipl_secure_get_vcssb(); + if (vcssb_len =3D=3D 0) { + panic("Failed to query certificate storage information!"); + } + break; + default: + break; + } =20 while (have_iplb) { boot_setup(); diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 5420443ad2..ca2737054d 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -40,6 +40,22 @@ typedef unsigned long long u64; ((b) =3D=3D 0 ? (a) : (MIN(a, b)))) #endif =20 +/* + * Round number down to multiple. Requires that d be a power of 2. + * Works even if d is a smaller type than n. + */ +#ifndef ROUND_DOWN +#define ROUND_DOWN(n, d) ((n) & -(0 ? (n) : (d))) +#endif + +/* + * Round number up to multiple. Requires that d be a power of 2. + * Works even if d is a smaller type than n. + */ +#ifndef ROUND_UP +#define ROUND_UP(n, d) ROUND_DOWN((n) + (d) - 1, (d)) +#endif + #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0])) =20 #include "cio.h" @@ -64,6 +80,8 @@ void sclp_print(const char *string); void sclp_set_write_mask(uint32_t receive_mask, uint32_t send_mask); void sclp_setup(void); void sclp_get_loadparm_ascii(char *loadparm); +bool sclp_is_diag320_on(void); +bool sclp_is_fac_ipl_flag_on(uint16_t fac_ipl_flag); int sclp_read(char *str, size_t count); =20 /* bootmap.c */ @@ -71,9 +89,11 @@ void zipl_load(void); =20 typedef enum ZiplBootMode { ZIPL_BOOT_MODE_NORMAL =3D 0, + ZIPL_BOOT_MODE_SECURE_AUDIT =3D 1, } ZiplBootMode; =20 extern ZiplBootMode boot_mode; +ZiplBootMode get_boot_mode(uint8_t hdr_flags); =20 /* jump2ipl.c */ void write_reset_psw(uint64_t psw); diff --git a/pc-bios/s390-ccw/sclp.c b/pc-bios/s390-ccw/sclp.c index 4a07de018d..48bdfedf1f 100644 --- a/pc-bios/s390-ccw/sclp.c +++ b/pc-bios/s390-ccw/sclp.c @@ -113,6 +113,33 @@ void sclp_get_loadparm_ascii(char *loadparm) } } =20 +bool sclp_is_diag320_on(void) +{ + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + return sccb->fac134 & SCCB_FAC134_DIAG320_BIT; + } + + return 0; +} + +/* check if specified IPL facility flag is enabled */ +bool sclp_is_fac_ipl_flag_on(uint16_t fac_ipl_flag) +{ + ReadInfo *sccb =3D (void *)_sccb; + + memset((char *)_sccb, 0, sizeof(ReadInfo)); + sccb->h.length =3D SCCB_SIZE; + if (!sclp_service_call(SCLP_CMDW_READ_SCP_INFO, sccb)) { + return sccb->fac_ipl & fac_ipl_flag; + } + + return 0; +} + int sclp_read(char *str, size_t count) { ReadEventData *sccb =3D (void *)_sccb; diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index 64b53cad29..a8a41cd004 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -50,6 +50,8 @@ typedef struct SCCBHeader { } __attribute__((packed)) SCCBHeader; =20 #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) +#define SCCB_FAC134_DIAG320_BIT 0x4 +#define SCCB_FAC_IPL_SIPL_BIT 0x4000 =20 typedef struct ReadInfo { SCCBHeader h; @@ -57,6 +59,10 @@ typedef struct ReadInfo { uint8_t rnsize; uint8_t reserved[13]; uint8_t loadparm[LOADPARM_LEN]; + uint8_t reserved1[102]; + uint8_t fac134; + uint8_t reserved2; + uint16_t fac_ipl; } __attribute__((packed)) ReadInfo; =20 typedef struct SCCB { diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c new file mode 100644 index 0000000000..1ab41e5543 --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -0,0 +1,363 @@ +/* + * S/390 Secure IPL + * + * Functions to support IPL in secure boot mode (DIAG 320, DIAG 508, + * signature verification, and certificate handling). + * + * For secure IPL overview: docs/system/s390x/secure-ipl.rst + * For secure IPL technical: docs/specs/s390x-secure-ipl.rst + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include +#include +#include "s390-ccw.h" +#include "sclp.h" +#include "secure-ipl.h" + +static VCStorageSizeBlock vcssb __attribute__((__aligned__(8))); + +#define for_each_rb_entry(entry, list) \ + for (entry =3D (void *)(list) + sizeof((list)->ipl_info_header); \ + (void *)(entry) + sizeof(*(entry)) <=3D \ + (void *)(list) + (list)->ipl_info_header.len; \ + entry++) + +int zipl_secure_get_vcssb(void) +{ + /* avoid retrieving vcssb multiple times */ + if (vcssb.length =3D=3D VCSSB_LEN_VALID) { + goto out; + } + + vcssb.length =3D VCSSB_LEN_VALID; + if (_diag320(&vcssb, DIAG_320_SUBC_QUERY_VCSI) !=3D DIAG_320_RC_OK) { + vcssb.length =3D 0; + } + +out: + return vcssb.length; +} + +static uint32_t request_certificate(uint8_t *cert_buf, uint8_t index) +{ + VCEntryHeader *vce_hdr; + struct vcb { + VCBlockHeader vcb_hdr; + struct vce { + VCEntryHeader vce_hdr; + uint8_t cert_buf[CERT_BUF_MAX_LEN]; + } vce; + } __attribute__((__aligned__(PAGE_SIZE))) vcb =3D { 0 }; + + /* + * Request single entry + * Fill input fields of single-entry VCB + * + * First and last index must be equal because only one + * VCE per VCB is currently supported + */ + vcb.vcb_hdr.in_len =3D ROUND_UP(vcssb.max_single_vcb_len, PAGE_SIZE); + vcb.vcb_hdr.first_vc_index =3D index; + vcb.vcb_hdr.last_vc_index =3D index; + + if (_diag320(&vcb, DIAG_320_SUBC_STORE_VC) !=3D DIAG_320_RC_OK) { + puts("Could not get certificate"); + return 0; + } + + if (vcb.vcb_hdr.out_len =3D=3D sizeof(VCBlockHeader)) { + puts("No certificate entry"); + return 0; + } + + if (vcb.vcb_hdr.remain_ct !=3D 0) { + panic("Not enough memory to store requested certificate"); + } + + vce_hdr =3D &vcb.vce.vce_hdr; + if (!(vce_hdr->flags & DIAG_320_VCE_FLAGS_VALID)) { + puts("Invalid certificate"); + return 0; + } + + memcpy(cert_buf, (uint8_t *)&vcb.vce + vce_hdr->cert_offset, vce_hdr->= cert_len); + + return vce_hdr->cert_len; +} + +static int cert_list_add(IplSignatureCertificateList *cert_list, + IplSignatureCertificateEntry cert_entry) +{ + int cert_entry_idx; + + cert_entry_idx =3D (cert_list->ipl_info_header.len - sizeof(IplInfoBlo= ckHeader)) / + sizeof(IplSignatureCertificateEntry); + + cert_list->cert_entries[cert_entry_idx] =3D cert_entry; + cert_list->ipl_info_header.len +=3D sizeof(IplSignatureCertificateEntr= y); + + return cert_entry_idx; +} + +static void comp_list_add(IplDeviceComponentList *comp_list, + IplDeviceComponentEntry comp_entry) +{ + int comp_entry_idx; + + comp_entry_idx =3D (comp_list->ipl_info_header.len - sizeof(IplInfoBlo= ckHeader)) / + sizeof(IplDeviceComponentEntry); + if (comp_entry_idx > MAX_COMP_ENTRIES - 1) { + printf("Warning: only %d component entries are supported\n", + MAX_COMP_ENTRIES); + panic("The device component list has reached its maximum capacity"= ); + } + + comp_list->device_entries[comp_entry_idx] =3D comp_entry; + comp_list->ipl_info_header.len +=3D sizeof(IplDeviceComponentEntry); +} + +void update_iirb(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list) +{ + IplInfoReportBlock *iirb; + IplDeviceComponentList *iirb_comps; + IplSignatureCertificateList *iirb_certs; + uint32_t iirb_hdr_len; + uint32_t comps_len; + uint32_t certs_len; + + if (iplb->len % 8 !=3D 0) { + panic("IPL parameter block length field value is not multiple of 8= bytes"); + } + + iirb_hdr_len =3D sizeof(IplInfoReportBlockHeader); + comps_len =3D comp_list->ipl_info_header.len; + certs_len =3D cert_list->ipl_info_header.len; + if ((comps_len + certs_len + iirb_hdr_len) > sizeof(IplInfoReportBlock= )) { + panic("Not enough space to hold all components and certificates in= IIRB"); + } + + /* IIRB immediately follows IPLB */ + iirb =3D &ipl_blocks.iirb; + iirb->hdr.len =3D iirb_hdr_len; + + /* Copy IPL device component list after IIRB Header */ + iirb_comps =3D (IplDeviceComponentList *) iirb->info_blks; + memcpy(iirb_comps, comp_list, comps_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D comps_len; + + /* Copy IPL sig cert list after IPL device component list */ + iirb_certs =3D (IplSignatureCertificateList *) (iirb->info_blks + + iirb_comps->ipl_info_hea= der.len); + memcpy(iirb_certs, cert_list, certs_len); + + /* Update IIRB length */ + iirb->hdr.len +=3D certs_len; +} + +bool secure_ipl_supported(void) +{ + if (!sclp_is_fac_ipl_flag_on(SCCB_FAC_IPL_SIPL_BIT)) { + puts("Secure IPL Facility is not supported by the hypervisor!"); + return false; + } + + if (!is_signature_verif_supported()) { + puts("Secure IPL extensions are not supported by the hypervisor!"); + return false; + } + + if (!is_cert_store_facility_supported()) { + puts("Certificate Store Facility is not supported by the hyperviso= r!"); + return false; + } + + return true; +} + +static void init_lists(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list) +{ + comp_list->ipl_info_header.type =3D IPL_INFO_BLOCK_TYPE_COMPONENTS; + comp_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); + + cert_list->ipl_info_header.type =3D IPL_INFO_BLOCK_TYPE_CERTIFICATES; + cert_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); +} + +static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) +{ + if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { + puts("Signature is not in DER format"); + return -1; + } + + if (zipl_load_segment(entry->data.blockno, sig) < 0) { + return -1; + } + + return entry->compdat.sig_info.sig_len; +} + +void update_cert_list(IplSignatureCertificateList *cert_list) +{ + IplSignatureCertificateEntry *cert_entry; + uint8_t *cert_buf; + + /* Recover the original base address of ipl_data for cert storage */ + cert_buf =3D (uint8_t *)qipl.ipl_data - qipl.index * sizeof(IplParamet= erBlock); + + for_each_rb_entry(cert_entry, cert_list) { + memcpy(cert_buf, (uint8_t *)cert_entry->addr, cert_entry->len); + cert_entry->addr =3D (uint64_t)cert_buf; + cert_buf +=3D cert_entry->len; + } +} + +int zipl_run_secure(ComponentEntry **entry_ptr, const uint8_t *tmp_sec, + IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list, + uint8_t **tmp_cert_buf) +{ + /* + * Keep track of which certificate store indices correspond to the + * certificate data entries within the IplSignatureCertificateList to + * prevent allocating space for the same certificate multiple times. + * + * The array index corresponds to the certificate's cert-store index. + * + * The array value corresponds to the certificate's entry within the + * IplSignatureCertificateList (with a value of -1 denoting no entry + * exists for the certificate). + */ + int cert_list_table[vcssb.total_vc_ct + 1]; + IplSignatureCertificateEntry sig_entry =3D { 0 }; + IplSignatureCertificateEntry cert_entry; + IplDeviceComponentEntry comp_entry; + ComponentEntry *entry =3D *entry_ptr; + int rc =3D -1; + int sig_len =3D 0; + int comp_len; + int cert_entry_idx; + uint64_t comp_addr; + uint8_t cert_table_idx; + uint8_t *tmp_buf; + bool verified; + bool signed_found =3D false; + + if ((MAX_SIGNED_COMP * CERT_BUF_MAX_LEN) > CERT_BUF_SIZE) { + panic("Not enough memory to store certificates"); + } + *tmp_cert_buf =3D malloc(CERT_BUF_SIZE); + tmp_buf =3D *tmp_cert_buf; + + init_lists(comp_list, cert_list); + sig_entry.addr =3D (uint64_t)malloc(MAX_SECTOR_SIZE); + memset(cert_list_table, -1, sizeof(cert_list_table)); + + while (entry->component_type !=3D ZIPL_COMP_ENTRY_EXEC) { + switch (entry->component_type) { + case ZIPL_COMP_ENTRY_SIGNATURE: + if (sig_entry.len) { + goto error; + } + + sig_len =3D zipl_load_signature(entry, sig_entry.addr); + if (sig_len < 0) { + goto error; + } + + sig_entry.len =3D sig_len; + break; + case ZIPL_COMP_ENTRY_LOAD: + comp_addr =3D entry->compdat.load_addr; + comp_len =3D zipl_load_segment(entry->data.blockno, comp_addr); + if (comp_len < 0) { + goto error; + } + + comp_entry =3D (IplDeviceComponentEntry){ 0 }; + comp_entry.addr =3D comp_addr; + comp_entry.len =3D (uint64_t)comp_len; + + /* no signature present (unsigned component) */ + if (!sig_entry.len) { + comp_list_add(comp_list, comp_entry); + break; + } + + /* + * Initialize with SC flag (signed component) + * CSV flag set upon successful verification + */ + comp_entry.flags =3D S390_IPL_DEV_COMP_FLAG_SC; + signed_found =3D true; + + cert_entry =3D (IplSignatureCertificateEntry) { 0 }; + verified =3D verify_signature(comp_entry, sig_entry, + &cert_entry.len, &cert_table_idx); + + if (verified) { + if (cert_list_table[cert_table_idx] =3D=3D -1) { + if (!request_certificate(tmp_buf, cert_table_idx)) { + puts("Could not get certificate"); + goto error; + } + + cert_entry.addr =3D (uint64_t)tmp_buf; + cert_entry_idx =3D cert_list_add(cert_list, cert_entry= ); + /* map cert-store index to cert-list entry index */ + cert_list_table[cert_table_idx] =3D cert_entry_idx; + /* increment for the next certificate */ + tmp_buf +=3D cert_entry.len; + } + + comp_entry.cert_index =3D cert_list_table[cert_table_idx]; + comp_entry.flags |=3D S390_IPL_DEV_COMP_FLAG_CSV; + puts("Verified component"); + } else { + zipl_secure_error("Could not verify component"); + } + + comp_list_add(comp_list, comp_entry); + + /* After a signature is used another new one can be accepted */ + sig_entry.len =3D 0; + break; + default: + puts("Unknown component entry type"); + goto error; + } + + entry++; + + if ((uint8_t *)(&entry[1]) > tmp_sec + MAX_SECTOR_SIZE) { + puts("Wrong entry value"); + rc =3D -EINVAL; + goto error; + } + } + + if (!signed_found) { + zipl_secure_error("Secure boot is on, but components are not signe= d"); + } + + *entry_ptr =3D entry; + free((void *)sig_entry.addr); + + return 0; +error: + free(*tmp_cert_buf); + *tmp_cert_buf =3D NULL; + free((void *)sig_entry.addr); + + return rc; +} diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h new file mode 100644 index 0000000000..e192f8b61d --- /dev/null +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -0,0 +1,115 @@ +/* + * S/390 Secure IPL + * + * Copyright 2025 IBM Corp. + * Author(s): Zhuoying Cai + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef _PC_BIOS_S390_CCW_SECURE_IPL_H +#define _PC_BIOS_S390_CCW_SECURE_IPL_H + +#include "bootmap.h" +#include +#include + +#define MAX_SIGNED_COMP 3 + +int zipl_secure_get_vcssb(void); +bool secure_ipl_supported(void); +void update_iirb(IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list); +void update_cert_list(IplSignatureCertificateList *cert_list); +int zipl_run_secure(ComponentEntry **entry_ptr, const uint8_t *tmp_sec, + IplDeviceComponentList *comp_list, + IplSignatureCertificateList *cert_list, + uint8_t **tmp_cert_buf); + +static inline void zipl_secure_error(const char *message) +{ + switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE_AUDIT: + printf("AUDIT MODE WARNING: %s\n", message); + break; + default: + break; + } +} + +static inline uint64_t _diag320(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x320\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_cert_store_facility_supported(void) +{ + uint32_t d320_ism; + + if (!sclp_is_diag320_on()) { + return false; + } + + if (_diag320(&d320_ism, DIAG_320_SUBC_QUERY_ISM) !=3D DIAG_320_RC_OK) { + return false; + } + + return d320_ism & (DIAG_320_ISM_QUERY_VCSI | DIAG_320_ISM_STORE_VC); +} + +static inline uint64_t _diag508(void *data, unsigned long subcode) +{ + register unsigned long addr asm("0") =3D (unsigned long)data; + register unsigned long rc asm("1") =3D 0; + + asm volatile ("diag %0,%2,0x508\n" + : "+d" (addr), "+d" (rc) + : "d" (subcode) + : "memory", "cc"); + return rc; +} + +static inline bool is_signature_verif_supported(void) +{ + uint64_t d508_subcodes; + + d508_subcodes =3D _diag508(NULL, DIAG_508_SUBC_QUERY_SUBC); + return d508_subcodes & DIAG_508_SUBC_SIG_VERIF; +} + +static inline bool verify_signature(IplDeviceComponentEntry comp_entry, + IplSignatureCertificateEntry sig_entry, + uint64_t *cert_len, uint8_t *cert_idx) +{ + Diag508SigVerifBlock svb; + + svb.length =3D sizeof(Diag508SigVerifBlock); + svb.version =3D 0; + svb.comp_len =3D comp_entry.len; + svb.comp_addr =3D comp_entry.addr; + svb.sig_len =3D sig_entry.len; + svb.sig_addr =3D sig_entry.addr; + + if (_diag508(&svb, DIAG_508_SUBC_SIG_VERIF) =3D=3D DIAG_508_RC_OK) { + *cert_len =3D svb.cert_len; + /* + * DIAG 508 utilizes an index origin of 0 when indexing the cert s= tore. + * The cert_idx will be used for DIAG 320 data structures, which e= xpects + * an index origin of 1. Account for the offset here so it's easie= r to + * manage later. + */ + *cert_idx =3D svb.cert_store_index + 1; + return true; + } + + return false; +} + +#endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */ --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201346; cv=none; d=zohomail.com; s=zohoarc; b=JXDi0q1wYnhjRo3kAsLR7HmGD84ddjdiA5zMq2sncx2AV7DPP4AL4rlOP/9B5FUWsgiLs+wptTcR6RIst01SascMx1w13tMlDogE+n1F+U6/ZN9sFM37Yxl90cbt8IA2mTx7f9NxD/LLgvx6I6P1rGGE7rt2IyavIj7SlzysqnE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201346; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6NU9nRwJLbw41AxunZLuBph5dLXa9xthdNR9pMjf3/c=; b=Q616ENy2eWylJoh2tBalj/Q43Uxe/RK+vu2Zz0L5EusZ/tgcaqH4keAfCtvYFA18R1Ock6Jd85vrHg6CDT91nXeAlY53GgNTQezXJKyJ07TcYaq0qfUhcCFbGiA2MPRfkvbbo5x9vPEcEvcpi9oylLJvDoQMNhX1XNPjlIj97EI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201346368619.3825065011505; Sat, 4 Jul 2026 14:42:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86Z-0007n5-Mi; Sat, 04 Jul 2026 17:40:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86Y-0007lz-Bn; Sat, 04 Jul 2026 17:40:54 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86W-0008GL-Q9; Sat, 04 Jul 2026 17:40:54 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmLa92428190; Sat, 4 Jul 2026 21:40:49 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7k0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:49 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYeX3019258; Sat, 4 Jul 2026 21:40:48 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8fy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:48 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lek8N24707658 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:47 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D536E58050; Sat, 4 Jul 2026 21:40:46 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB02D58045; Sat, 4 Jul 2026 21:40:44 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:44 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=6NU9nRwJLbw41Axun ZLuBph5dLXa9xthdNR9pMjf3/c=; b=YFk8G/BWJQvfC00S/dj4xrHYvU0kebP/B LLFlhsJBHt7IryITSiTkBZ523IQnv5tGEf4YlfqUGUmnGzmtjXezky75JmlIZndp OsYpQU2DxHGjNHZz2ky1C1MxIi1SZ8Hgo7nMlYe2arsmSFbsRd5/nwBmmtWwfArO 7t1M3EcbN6C8FlAkWAL+o9p0Z3tVeysGgo+hrtVevhCkD5AwAsfQIbQAcTmHBFdu vTDetIYqf49P87N6GXNnFBdeXDn9d9LcU18nEa0jJJPgVDfmbHC1s0EHSg8EOKUp q7RbAkJSTyA3cKZSW+b+1ms8hBFML8IMo0PnBKJp59w30FLdCGO7Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 24/33] pc-bios/s390-ccw: Add signed component address overlap checks Date: Sat, 4 Jul 2026 17:39:40 -0400 Message-ID: <20260704213950.2118823-25-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: dflKjgnf31plaoaEfluzr-kOO0mLvXNX X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXzf6tH5fwc9B3 jkdEGs8FG4KwIAS2phyDB43ImuVw6lEGoKx7krQe2g1+WaLGIm0ZZEnHxQFz93DYW3gqymIBWQo olN3rd9UOhL3LS8S+2N0ZDxE270VBfs= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497de1 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=G58Pgg4fZqxeurqYNSYA:9 X-Proofpoint-GUID: dflKjgnf31plaoaEfluzr-kOO0mLvXNX X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXyhk2Buh9Dc4P 6ZfJu9iFHftOwmWputW3nBJV1zhbuQJon0pDEhUwlK/PAvuBWjCsKy8MccgoDmgaAGA+BaG/uhF yfsrzhyqOZSazPuUjxcMLDhV7LXVD95zvn/eCoOjKvlp30DU2kCMLGX8ox4LdRQ98bIggLb7W2W 7uQ5Q6Kj0KSLM58HFyn1Uo3gBqYDIKpBYsIFvs7onEIpysRz7XMBrWw0fw0jWH6eeCN4tQyNYUL m7u6ZQQWP315Qshe3Fj6ejBKdEDxuGFFgqmzjwgn6403o7Gp5FtI/0x+Y0buXouyzU3sALqjFcp 1J/x5q6lIFZACckpxR6BpQHT37AoOKwjnPRtaqmAyMgfoy9tHRrgKDqMwtlXNywt31rITG1lGdo 6/azZvA+W0Bp1dB7v4/PEQfhDBFxRP5eGyNCk4mh/ldGAQLFsXqV1dhEBuS2lku5B1qGavlgB/X xuNXiwVHXomPuxLQzzQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201348307158500 Content-Type: text/plain; charset="utf-8" Add address range tracking and overlap checks to ensure that no component overlaps with a signed component during secure IPL. Signed-off-by: Zhuoying Cai Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato --- pc-bios/s390-ccw/secure-ipl.c | 19 +++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 10 ++++++++++ 2 files changed, 29 insertions(+) diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index 1ab41e5543..cd2d18bfa0 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -193,6 +193,23 @@ static void init_lists(IplDeviceComponentList *comp_li= st, cert_list->ipl_info_header.len =3D sizeof(IplInfoBlockHeader); } =20 +static void check_comp_overlap(IplDeviceComponentList *comp_list, + IplDeviceComponentEntry comp_entry) +{ + IplDeviceComponentEntry *comp; + + /* + * Check component's address range does not overlap with any + * signed component's address range. + */ + for_each_rb_entry(comp, comp_list) { + if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC && + intersects(comp->addr, comp->len, comp_entry.addr, comp_entry.= len)) { + zipl_secure_error("Component addresses overlap"); + } + } +} + static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) { if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { @@ -288,6 +305,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const u= int8_t *tmp_sec, comp_entry.addr =3D comp_addr; comp_entry.len =3D (uint64_t)comp_len; =20 + check_comp_overlap(comp_list, comp_entry); + /* no signature present (unsigned component) */ if (!sig_entry.len) { comp_list_add(comp_list, comp_entry); diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index e192f8b61d..f014ae4b1a 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -112,4 +112,14 @@ static inline bool verify_signature(IplDeviceComponent= Entry comp_entry, return false; } =20 +static inline bool intersects(uint64_t addr0, uint64_t size0, + uint64_t addr1, uint64_t size1) +{ + if (addr1 > addr0) { + return addr1 - addr0 < size0; + } + + return addr0 - addr1 < size1; +} + #endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */ --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201383; cv=none; d=zohomail.com; s=zohoarc; b=kDnE8nZw0YfyI/O0nGXEx60NALEW+rcd5a2d2wJQ4ElhpvuQhhjZLV9rCIjwa8EWxAYhw70CayPYYW8UalqXFUc/jzBXdr1XIcOvLuvRYU0Gdp2+bYVT1sa56tQJp+EsgUxJq79K6yWAb3ReTZBU5TeO12cjZ13QOEnVMbS2XEk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201383; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=shZ4UCa4LzVCmkJdUPp7yAI2PD79fS7KCSXvF1eYJ7s=; b=JcSBQxePmg+VKIZNWmulhIUcIbdibvJOB91m1IR1JlEyr8bFbAJz1DQ4ot5Rq5UdkhIpkr3Ihwn5cWHNy8M03s0aVtQ4wIch3AwNKwdW+bBdKRvu/ENE/yoXcaBkwd173k6nOcEEhVQzTWLnnuJFaAMYoO9knDTuHsofeoaVwvw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201383342567.0340173429121; Sat, 4 Jul 2026 14:43:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86z-0000a0-IU; Sat, 04 Jul 2026 17:41:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86w-0000JH-7N; Sat, 04 Jul 2026 17:41:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86u-0008ML-7x; Sat, 04 Jul 2026 17:41:17 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664Kmb652446602; Sat, 4 Jul 2026 21:40:52 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc6f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:51 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYdkP019254; Sat, 4 Jul 2026 21:40:50 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8g2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:50 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LenpK33292986 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:49 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1C6B458050; Sat, 4 Jul 2026 21:40:49 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0719258045; Sat, 4 Jul 2026 21:40:47 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:46 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=shZ4UC a4LzVCmkJdUPp7yAI2PD79fS7KCSXvF1eYJ7s=; b=B/tb1CWFfInG0mLnAjPbHV BkP3xQJwg4mnAv/u49Qr9JB/EuKEBcrxpxBXU8MpbCc7kG9HH9p6b5vOaKQV3dw0 Guk6/1V9tbzlUHt4NCrkqpeDai8Rh//ROo5Rx7uatuTm3owtbYuiuTUfGmD74Moi 2JuYEfreJ9Nyjq4UUDMRDleyOkE7Jvtdhjq7UAiYAZBdnhceJ8UlqsmPpHHrZL62 /NG0SyiGUCqCvfwoatfmZRicP+Y8yAP/ymYnpLJnC8kjTI3wUgcOC8cDI4TgdzEH pWM60/b3pkW1WDYfKPdz+ReY5z75UhSqxUkSzWyVuH2zCxan2itIjjHw5lR7w4Jg == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 25/33] s390x: Guest support for Secure-IPL Code Loading Attributes Facility (SCLAF) Date: Sat, 4 Jul 2026 17:39:41 -0400 Message-ID: <20260704213950.2118823-26-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497de3 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=s2GHSiDfQs-ooOV4uGMA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX7k3Z2tZuUPsU rCiFkRTB6Vqk/0Vg6PTFztzaXbES9oPicTDIiXjUt4m1l1JqDb64nvHTiPmOIoTYFWTki3H1VRA LIkRnhCdmUpoF6yf6eUitnkkXYcokh0ADWwxmD3+SMosQNL18NXHlSNXkxqn6tku2UW2z2OWnNM 1CQn21l3y5oqZ8y/mskl1WT+IRwkksvDuZ1T979EJCFB+IUhkseGr9mnE8Y2doUt33ukJMpF3KS aobVjIjjGEH2qCxwVQiRlY4xZwC1kyA6LlqCWCNnNNYx0dwh/wpO9+HPuGmYz76K8jeVrSp7cdD 2T2qVD4X4vpxEt/2QbbT+5KRZOo7CW7oICAQ/+kcZWQhclxtiDmkXoO4UWZQpbiqUUa/YMHTqSd IlUNywCFfXM+r3QaRA1K0CojdS2BtGefcCIDOUizKl9QZU9iL0dfto+m4R394kqzaJeaU1RKsMP zyJmTxpltlf/Y8bKkHg== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX/QVeiKz1rgYA XvO5UfMP50OAbwX5SI7ezJMbtmW5sDgLul3jsjY/E4CtwKlfz4W7LpkVaQgAkgONNpwyokFbKRG XYSFz5g+SOIol+7xBXtKQW2VJDbQZ3M= X-Proofpoint-GUID: 0zqbcY97RlDaGyTwzkD1H8oNHUwrlgJ7 X-Proofpoint-ORIG-GUID: 0zqbcY97RlDaGyTwzkD1H8oNHUwrlgJ7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201384414158500 The secure-IPL-code-loading-attributes facility (SCLAF) provides additional security during secure IPL. Availability of SCLAF is determined by byte 136 bit 3 of the SCLP Read SCP Info. This feature is available starting with the gen16 CPU model. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Matthew Rosato --- docs/specs/s390x-secure-ipl.rst | 18 ++++++++++++++++++ target/s390x/cpu_features.c | 2 ++ target/s390x/cpu_features_def.h.inc | 1 + target/s390x/cpu_models.c | 3 +++ target/s390x/gen-features.c | 2 ++ target/s390x/kvm/kvm.c | 1 + 6 files changed, 27 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 113acbeda9..7a603eb956 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -122,3 +122,21 @@ The guest kernel uses the contents in the IIRB for: * Boot logging: reports which components were loaded and verified. * kexec operations: builds the next kernel=E2=80=99s IPL report from the e= xisting one. * Keying: installs IPL certificates into the platform trusted keyring. + +Secure Code Loading Attributes Facility +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The Secure Code Loading Attributes Facility (SCLAF) enhances system securi= ty +during the IPL by enforcing additional verification rules. + +When SCLAF is available, its behavior depends on the IPL mode. It introduc= es +verification of both signed and unsigned components to help ensure that on= ly +authorized code is loaded during the IPL process. Any errors detected by S= CLAF +are reported in the IIRB. + +Unsigned components are restricted to load addresses at or above absolute +storage address ``0x2000``. + +Signed components must include a Secure Code Loading Attribute Block (SCLA= B), +which is appended at the very end of the component. The SCLAB defines secu= rity +attributes for handling the signed code. diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c index 27f38636a9..c634e74123 100644 --- a/target/s390x/cpu_features.c +++ b/target/s390x/cpu_features.c @@ -120,6 +120,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, * - All SIE facilities because SIE is not available * - DIAG318 * - Secure IPL Facility + * - Secure IPL Code Loading Attributes Facility * * As VMs can move in and out of protected mode the CPU model * doesn't protect us from that problem because it is only @@ -152,6 +153,7 @@ void s390_fill_feat_block(const S390FeatBitmap features= , S390FeatType type, break; case S390_FEAT_TYPE_SCLP_FAC_IPL: clear_be_bit(s390_feat_def(S390_FEAT_SIPL)->bit, data); + clear_be_bit(s390_feat_def(S390_FEAT_SCLAF)->bit, data); break; case S390_FEAT_TYPE_SCLP_FAC139: clear_be_bit(s390_feat_def(S390_FEAT_SIE_ASTFLEIE2)->bit, data); diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_feature= s_def.h.inc index 0153a6aa67..a5aa19112a 100644 --- a/target/s390x/cpu_features_def.h.inc +++ b/target/s390x/cpu_features_def.h.inc @@ -142,6 +142,7 @@ DEF_FEAT(CERT_STORE, "cstore", SCLP_FAC134, 5, "Certifi= cate Store functions") =20 /* Features exposed via SCLP SCCB Facilities byte 136 - 137 (bit numbers r= elative to byte-136) */ DEF_FEAT(SIPL, "sipl", SCLP_FAC_IPL, 1, "Secure-IPL facility") +DEF_FEAT(SCLAF, "sclaf", SCLP_FAC_IPL, 3, "Secure-IPL-code-loading-attribu= tes facility") =20 /* Features exposed via SCLP SCCB Facilities byte 139 (bit numbers relativ= e to byte-139) */ DEF_FEAT(SIE_ASTFLEIE2, "astfleie2", SCLP_FAC139, 1, "SIE: ASTFLE interpre= tation execution facility 2") diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index b22841c2bc..2e62559679 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -264,6 +264,7 @@ bool s390_has_feat(S390Feat feat) case S390_FEAT_SIE_PFMFI: case S390_FEAT_SIE_IBS: case S390_FEAT_SIPL: + case S390_FEAT_SCLAF: case S390_FEAT_CONFIGURATION_TOPOLOGY: case S390_FEAT_SIE_ASTFLEIE2: return false; @@ -510,6 +511,8 @@ static void check_consistency(const S390CPUModel *model) { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_CERT_STORE, S390_FEAT_EXTENDED_LENGTH_SCCB }, { S390_FEAT_SIPL, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_EXTENDED_LENGTH_SCCB }, + { S390_FEAT_SCLAF, S390_FEAT_SIPL }, { S390_FEAT_NNPA, S390_FEAT_VECTOR }, { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING }, { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP }, diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c index 6bf61447de..a99a75d14e 100644 --- a/target/s390x/gen-features.c +++ b/target/s390x/gen-features.c @@ -723,6 +723,7 @@ static uint16_t full_GEN16_GA1[] =3D { S390_FEAT_SIE_ASTFLEIE2, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 static uint16_t full_GEN17_GA1[] =3D { @@ -925,6 +926,7 @@ static uint16_t qemu_MAX[] =3D { S390_FEAT_EXTENDED_LENGTH_SCCB, S390_FEAT_CERT_STORE, S390_FEAT_SIPL, + S390_FEAT_SCLAF, }; =20 /****** END FEATURE DEFS ******/ diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index fb42d8c132..9c919575cd 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -2504,6 +2504,7 @@ bool kvm_s390_get_host_cpu_model(S390CPUModel *model,= Error **errp) =20 /* Some Secure IPL facilities are emulated by QEMU */ set_bit(S390_FEAT_SIPL, model->features); + set_bit(S390_FEAT_SCLAF, model->features); =20 /* Test for Ultravisor features that influence secure guest behavior */ query_uv_feat_guest(model->features); --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201346; cv=none; d=zohomail.com; s=zohoarc; b=C7imEWHQURnKTUnDxWB/2s29f1pxIy79OvKASA4ImHTwwLhuAvxIEeg4he2oVMZaeuLjhcUMK9vboIWuZZu9uqCg6R24SB4PEg39gWnRQydrFkzTdYqWKbTiAE1eXbzYd/tBFpLPtVcay4dLx7c5SeBWwb9icXa5YdwaNHmWnJg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201346; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NNlOL3PCglz1eEAlRaU+l0pYi2SYea98awXmCJhBR8s=; b=V/mocUzxEuAF4eSQhJtXL5ny0WvQU/AmSAnVEznN+TNZUEizriSWGoauLVuUSs7UOH8EUciHGNNgjCLus4S74z1W2jQlblfVyiDOmRaJPz11jXziDP24KpNafX40v4FiOyRMmNofTPPOaxPhIbkSdPWc50pFKYR8EEurr5DZ+8U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201346449259.10322512419305; Sat, 4 Jul 2026 14:42:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86f-0007qk-Md; Sat, 04 Jul 2026 17:41:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86e-0007ok-F4; Sat, 04 Jul 2026 17:41:00 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86b-0008Pa-Pt; Sat, 04 Jul 2026 17:41:00 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmF6m2705388; Sat, 4 Jul 2026 21:40:53 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7j9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:53 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYadf018972; Sat, 4 Jul 2026 21:40:52 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8g7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:52 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LepRh19792550 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:51 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2DC9658050; Sat, 4 Jul 2026 21:40:51 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4765B58052; Sat, 4 Jul 2026 21:40:49 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:49 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=NNlOL3PCglz1eEAlR aU+l0pYi2SYea98awXmCJhBR8s=; b=HJG6R4Lee15PiUTCFC+8a5e2A8cIZ16vU Uura1BwGqGuH9P/RTGI0XWQNTjktTWDJmUqigR2B8NmHdqVo/qsmhYRiyGOSpLUo OzXTMfUpqfupQ6xMGHABPQrKYtm3r+D4ANBGa4oW6dN5/Yr8hNJY/z1+Dzlo3vB3 CijxuTYhhg4tWYwQf/gYk7fmYHc24j4LbeQUTNcYb/GjA7UlSeZbehokhnKciimt BNJ5nsIV3u3xnayhSugwh3BrVxluFcwo3XcHGFhdRiaIAUFrpXJ000eoRNb2Gy7Y FbnQkUfbZbM8MpfolPnQkKFotWHFjBb9rk7KpWblJ5EzZ+IYLLzcg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 26/33] pc-bios/s390-ccw: Add additional security checks for secure boot Date: Sat, 4 Jul 2026 17:39:42 -0400 Message-ID: <20260704213950.2118823-27-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXw32rlcH6jCIZ EmFXsa5J3Au70St+NRaC34bBFNAuFapZtnb6w5Enai3/wnFIWElze+1SQJ4DUYKqBxsbdjLIaxW UsqVUPezSvZhaPQimO0CJ8yHpi2J6FU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXylT4Vsn2AH4+ XomOcgPz7wOTLbRUPSr5MtNBw3Zuog6fHL5a5eMO9pHvSc0dIWGpybUEVIN59V2EyPAYxvQRHpn +LRLiIBWkm85aOZSqo7kj+5icgDd5hyajGsuI8Dg+Fvf6Xic8hzxrpCD36brbHzBr6pIAbBKWtX k/CT5MrdMpHwoEPxyId2E4dqmitcP+ekbzH4Z26L5Vn+j2weXl0ahqQ/Cj5Al087lafepfhOSoI fCWA7sgJEaYF4XOhEdeTsvC3nPm+dq5bTf5lfrfUzzFIv3Svuqsj9hQd7hMKRpcgaLg6KXlJaRt 9MFj2MUnJpS5bytYzFpkH6ZfBdCttT4N6viAcRoA9HkInmBVs8OATYEhfIzZkVwX6hSbJwyNhYe eaSEcl9EXpG+9KzyDHmtpvlA5ljEv89fxv8Y8/E+rTGpbc+olzBLWgria54nIbkdU6gp3CKVUtp eUHeMgj94xs2nDluuWw== X-Proofpoint-GUID: 99WVde90bPUAjZtWrji-HWycSGVPc1u6 X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497de5 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=s9pCXNYtFNHZQuK5kQYA:9 X-Proofpoint-ORIG-GUID: 99WVde90bPUAjZtWrji-HWycSGVPc1u6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201348395158500 Content-Type: text/plain; charset="utf-8" Add additional checks to ensure that components do not overlap with signed components when loaded into memory. Add additional checks to ensure the load addresses of unsigned components are greater than or equal to 0x2000. When the secure IPL code loading attributes facility (SCLAF) is installed, all signed components must contain a secure code loading attributes block (SCLAB). The SCLAB provides further validation of information on where to load the signed binary code from the load device, and where to start the execution of the loaded OS code. When SCLAF is installed, its content must be evaluated during secure IPL. Add IPL Information Error Indicators (IIEI) and Component Error Indicators (CEI) for IPL Information Report Block (IIRB). When SCLAF is installed, additional secure boot checks are performed during zipl and store results of verification into IIRB. Signed-off-by: Zhuoying Cai Reviewed-by: Eric Farman --- include/hw/s390x/ipl/qipl.h | 29 +++++- pc-bios/s390-ccw/sclp.h | 1 + pc-bios/s390-ccw/secure-ipl.c | 179 +++++++++++++++++++++++++++++++++- pc-bios/s390-ccw/secure-ipl.h | 51 ++++++++++ 4 files changed, 255 insertions(+), 5 deletions(-) diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index 37452faaa6..37a1a76a2d 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -170,10 +170,20 @@ struct IplInfoReportBlockHeader { }; typedef struct IplInfoReportBlockHeader IplInfoReportBlockHeader; =20 +/* IPL Info Error Indicators */ +#define S390_IIEI_NO_SIGNED_COMP 0x8000 /* bit 0 */ +#define S390_IIEI_NO_SCLAB 0x4000 /* bit 1 */ +#define S390_IIEI_NO_GLOBAL_SCLAB 0x2000 /* bit 2 */ +#define S390_IIEI_MORE_GLOBAL_SCLAB 0x1000 /* bit 3 */ +#define S390_IIEI_FOUND_UNSIGNED_COMP 0x800 /* bit 4 */ +#define S390_IIEI_MORE_SIGNED_COMP 0x400 /* bit 5 */ + struct IplInfoBlockHeader { uint32_t len; uint8_t type; - uint8_t reserved1[11]; + uint8_t reserved1[3]; + uint16_t iiei; + uint8_t reserved2[6]; }; typedef struct IplInfoBlockHeader IplInfoBlockHeader; =20 @@ -197,13 +207,28 @@ typedef struct IplSignatureCertificateList IplSignatu= reCertificateList; #define S390_IPL_DEV_COMP_FLAG_SC 0x80 #define S390_IPL_DEV_COMP_FLAG_CSV 0x40 =20 +/* IPL Device Component Error Indicators */ +#define S390_CEI_INVALID_SCLAB 0x80000000 /* bit 0 */ +#define S390_CEI_INVALID_SCLAB_LEN 0x40000000 /* bit 1 */ +#define S390_CEI_INVALID_SCLAB_FORMAT 0x20000000 /* bit 2 */ +#define S390_CEI_UNMATCHED_SCLAB_LOAD_ADDR 0x10000000 /* bit 3 */ +#define S390_CEI_UNMATCHED_SCLAB_LOAD_PSW 0x8000000 /* bit 4 */ +#define S390_CEI_INVALID_LOAD_PSW 0x4000000 /* bit 5 */ +#define S390_CEI_NUC_NOT_IN_GLOBAL_SCLAB 0x2000000 /* bit 6 */ +#define S390_CEI_SCLAB_OLA_NOT_ONE 0x1000000 /* bit 7 */ +#define S390_CEI_SC_NOT_IN_GLOBAL_SCLAB 0x800000 /* bit 8 */ +#define S390_CEI_SCLAB_LOAD_ADDR_NOT_ZERO 0x400000 /* bit 9 */ +#define S390_CEI_SCLAB_LOAD_PSW_NOT_ZERO 0x200000 /* bit 10 */ +#define S390_CEI_INVALID_UNSIGNED_ADDR 0x100000 /* bit 11 */ + struct IplDeviceComponentEntry { uint64_t addr; uint64_t len; uint8_t flags; uint8_t reserved1[5]; uint16_t cert_index; - uint8_t reserved2[8]; + uint32_t cei; + uint8_t reserved2[4]; }; typedef struct IplDeviceComponentEntry IplDeviceComponentEntry; =20 diff --git a/pc-bios/s390-ccw/sclp.h b/pc-bios/s390-ccw/sclp.h index a8a41cd004..cae65b29b5 100644 --- a/pc-bios/s390-ccw/sclp.h +++ b/pc-bios/s390-ccw/sclp.h @@ -52,6 +52,7 @@ typedef struct SCCBHeader { #define SCCB_DATA_LEN (SCCB_SIZE - sizeof(SCCBHeader)) #define SCCB_FAC134_DIAG320_BIT 0x4 #define SCCB_FAC_IPL_SIPL_BIT 0x4000 +#define SCCB_FAC_IPL_SCLAF_BIT 0x1000 =20 typedef struct ReadInfo { SCCBHeader h; diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c index cd2d18bfa0..8989e9aba5 100644 --- a/pc-bios/s390-ccw/secure-ipl.c +++ b/pc-bios/s390-ccw/secure-ipl.c @@ -180,6 +180,12 @@ bool secure_ipl_supported(void) return false; } =20 + if (!sclp_is_fac_ipl_flag_on(SCCB_FAC_IPL_SCLAF_BIT)) { + puts("Secure IPL Code Loading Attributes Facility is not supported= by" + " the hypervisor!"); + return false; + } + return true; } =20 @@ -210,6 +216,156 @@ static void check_comp_overlap(IplDeviceComponentList= *comp_list, } } =20 +static bool is_psw_valid(uint64_t psw, IplDeviceComponentEntry *comp) +{ + uint32_t addr =3D psw & 0x7fffffff; + + /* + * PSW points within a signed binary code component + * + * Check addr falls within [comp->addr, comp->addr + comp->len - 2], + * ensuring at least 2 bytes (minimum instruction length) remain. + */ + return intersects(addr, 1, comp->addr, comp->len - 1); +} + +void check_global_sclab(const SclaBlock *global_sclab, + IplDeviceComponentEntry *comp_entry, + IplDeviceComponentList *comp_list) +{ + bool psw_valid =3D false; + bool global_psw_valid =3D false; + int signed_count =3D 0; + int unsigned_count =3D 0; + IplDeviceComponentEntry *comp; + + if (!global_sclab) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_NO_GLOBAL_SCLAB; + zipl_secure_error("Global SCLAB does not exist"); + return; + } + + for_each_rb_entry(comp, comp_list) { + if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC) { + psw_valid |=3D is_psw_valid(comp_entry->addr, comp); + global_psw_valid |=3D is_psw_valid(global_sclab->load_psw, com= p); + signed_count +=3D 1; + } else { + unsigned_count +=3D 1; + } + } + + /* validate load PSW with PSW specified in the final entry */ + zipl_secure_validate(psw_valid && global_psw_valid, &comp_entry->cei, + S390_CEI_INVALID_LOAD_PSW, "Invalid PSW"); + + /* compare load PSW with the PSW specified in component */ + zipl_secure_validate(global_sclab->load_psw =3D=3D comp_entry->addr, + &comp_entry->cei, S390_CEI_UNMATCHED_SCLAB_LOAD_P= SW, + "Load PSW does not match with PSW in component"); + + /* Unsigned components are not allowed if NUC flag is set in the globa= l SCLAB */ + if ((global_sclab->flags & S390_SCLAB_NUC) && unsigned_count > 0) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_FOUND_UNSIGNED_COMP; + zipl_secure_error("Unsigned components are not allowed"); + } + + /* + * Only one signed component is allowed if SC flag is set in the globa= l SCLAB + * More than one component in the component table is not allowed + */ + if ((global_sclab->flags & S390_SCLAB_SC) && + (signed_count !=3D 1 || unsigned_count !=3D 0)) { + comp_list->ipl_info_header.iiei |=3D S390_IIEI_MORE_SIGNED_COMP; + zipl_secure_error("Only one signed component is allowed"); + } +} + +static void check_sclab(SclaBlock **global_sclab, + IplDeviceComponentEntry *comp_entry, + IplInfoBlockHeader *comp_list_hdr) +{ + SclabOriginLocator *sclab_locator; + SclaBlock *sclab; + + /* must be large enough to locate the sclab locator, else implies inva= lid SCLAB */ + zipl_secure_validate(comp_entry->len >=3D 8, &comp_entry->cei, + S390_CEI_INVALID_SCLAB, + "Signed component too short to contain SCLAB loca= tor"); + + if (comp_entry->cei & S390_CEI_INVALID_SCLAB) { + return; + } + + /* sclab locator is located at the last 8 bytes of the signed comp */ + sclab_locator =3D (SclabOriginLocator *)(comp_entry->addr + + comp_entry->len - 8); + + /* return early if sclab does not exist */ + zipl_secure_validate(magic_match(sclab_locator->magic, ZIPL_MAGIC), + &comp_entry->cei, S390_CEI_INVALID_SCLAB, + "Magic does not match. SCLAB does not exist"); + + if (comp_entry->cei & S390_CEI_INVALID_SCLAB) { + return; + } + + zipl_secure_validate(sclab_locator->len >=3D S390_SCLAB_MIN_LEN, &comp= _entry->cei, + S390_CEI_INVALID_SCLAB_LEN | S390_CEI_INVALID_SCL= AB, + "Invalid SCLAB length"); + + /* return early if sclab is invalid */ + if (comp_entry->cei & S390_CEI_INVALID_SCLAB) { + return; + } + + sclab =3D (SclaBlock *)(comp_entry->addr + comp_entry->len - + sclab_locator->len); + + zipl_secure_validate(sclab->format =3D=3D 0, &comp_entry->cei, + S390_CEI_INVALID_SCLAB_FORMAT, + "Format-0 SCLAB is not being used"); + + if (!(sclab->flags & S390_SCLAB_OPSW)) { + /* OPSW =3D 0 - Load PSW field in SCLAB must contain zeros */ + zipl_secure_validate(sclab->load_psw =3D=3D 0, &comp_entry->cei, + S390_CEI_SCLAB_LOAD_PSW_NOT_ZERO, + "Load PSW is not zero when Override PSW bit i= s zero"); + } else { + /* OPSW =3D 1 indicating global SCLAB */ + if (*global_sclab) { + comp_list_hdr->iiei |=3D S390_IIEI_MORE_GLOBAL_SCLAB; + zipl_secure_error("More than one global SCLAB"); + } + *global_sclab =3D sclab; + + /* override load address flag must set to one */ + zipl_secure_validate(sclab->flags & S390_SCLAB_OLA, &comp_entry->c= ei, + S390_CEI_SCLAB_OLA_NOT_ONE, + "OLA flag is not set to one in the global SCL= AB"); + } + + if (!(sclab->flags & S390_SCLAB_OLA)) { + /* OLA =3D 0 - Load address field in SCLAB must contain zeros */ + zipl_secure_validate(sclab->load_addr =3D=3D 0, &comp_entry->cei, + S390_CEI_SCLAB_LOAD_ADDR_NOT_ZERO, + "Load Address is not zero when OLA flag is ze= ro"); + } else { + /* OLA =3D 1 - Load address field must match storage address of th= e component */ + zipl_secure_validate(sclab->load_addr =3D=3D comp_entry->addr, &co= mp_entry->cei, + S390_CEI_UNMATCHED_SCLAB_LOAD_ADDR, + "Load Address does not match with component l= oad address"); + } + + zipl_secure_validate(~sclab->flags & S390_SCLAB_NUC || sclab->flags & = S390_SCLAB_OPSW, + &comp_entry->cei, S390_CEI_NUC_NOT_IN_GLOBAL_SCLA= B, + "NUC bit is set, but not in the global SCLAB"); + + zipl_secure_validate(~sclab->flags & S390_SCLAB_SC || sclab->flags & S= 390_SCLAB_OPSW, + &comp_entry->cei, S390_CEI_SC_NOT_IN_GLOBAL_SCLAB, + "SC bit is set, but not in the global SCLAB"); +} + static int zipl_load_signature(ComponentEntry *entry, uint64_t sig) { if (entry->compdat.sig_info.format !=3D DER_SIGNATURE_FORMAT) { @@ -269,6 +425,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const u= int8_t *tmp_sec, uint8_t *tmp_buf; bool verified; bool signed_found =3D false; + bool sclab_found =3D false; + SclaBlock *global_sclab =3D NULL; =20 if ((MAX_SIGNED_COMP * CERT_BUF_MAX_LEN) > CERT_BUF_SIZE) { panic("Not enough memory to store certificates"); @@ -309,6 +467,10 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const = uint8_t *tmp_sec, =20 /* no signature present (unsigned component) */ if (!sig_entry.len) { + zipl_secure_validate(comp_entry.addr >=3D S390_UNSIGNED_MI= N_ADDR, + &comp_entry.cei, S390_CEI_INVALID_UNSIGNED_ADD= R, + "Load address for unsigned component is less t= han 0x2000"); + comp_list_add(comp_list, comp_entry); break; } @@ -320,6 +482,9 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const u= int8_t *tmp_sec, comp_entry.flags =3D S390_IPL_DEV_COMP_FLAG_SC; signed_found =3D true; =20 + check_sclab(&global_sclab, &comp_entry, &comp_list->ipl_info_h= eader); + sclab_found |=3D !(comp_entry.cei & S390_CEI_INVALID_SCLAB); + cert_entry =3D (IplSignatureCertificateEntry) { 0 }; verified =3D verify_signature(comp_entry, sig_entry, &cert_entry.len, &cert_table_idx); @@ -365,9 +530,17 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const = uint8_t *tmp_sec, } } =20 - if (!signed_found) { - zipl_secure_error("Secure boot is on, but components are not signe= d"); - } + zipl_secure_validate(signed_found, &comp_list->ipl_info_header.iiei, + S390_IIEI_NO_SIGNED_COMP, + "Secure boot is on, but components are not signed= "); + + zipl_secure_validate(sclab_found, &comp_list->ipl_info_header.iiei, + S390_IIEI_NO_SCLAB, "No recognizable SCLAB"); + + comp_entry =3D (IplDeviceComponentEntry){ 0 }; + comp_entry.addr =3D entry->compdat.load_psw; + check_global_sclab(global_sclab, &comp_entry, comp_list); + comp_list_add(comp_list, comp_entry); =20 *entry_ptr =3D entry; free((void *)sig_entry.addr); diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index f014ae4b1a..25eaf9cea0 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -26,6 +26,33 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const ui= nt8_t *tmp_sec, IplSignatureCertificateList *cert_list, uint8_t **tmp_cert_buf); =20 +#define S390_SCLAB_OPSW 0x8000 /* override PSW flag */ +#define S390_SCLAB_OLA 0x4000 /* override load address flag */ +#define S390_SCLAB_NUC 0x2000 /* no unsigned components flag */ +#define S390_SCLAB_SC 0x1000 /* single component flag */ + +#define S390_SCLAB_MIN_LEN 32 +#define S390_UNSIGNED_MIN_ADDR 0x2000 + +/* Secure Code Loading Attributes Block */ +struct SclaBlock { + uint8_t format; + uint8_t reserved1; + uint16_t flags; + uint8_t reserved2[4]; + uint64_t load_psw; + uint64_t load_addr; + uint64_t reserved3[]; +} __attribute__ ((packed)); +typedef struct SclaBlock SclaBlock; + +struct SclabOriginLocator { + uint8_t reserved[2]; + uint16_t len; + uint8_t magic[4]; +} __attribute__ ((packed)); +typedef struct SclabOriginLocator SclabOriginLocator; + static inline void zipl_secure_error(const char *message) { switch (boot_mode) { @@ -37,6 +64,30 @@ static inline void zipl_secure_error(const char *message) } } =20 +static inline void zipl_secure_validate_u16(bool condition, uint16_t *flag= s, + uint16_t flag, const char *mes= sage) +{ + if (!condition) { + *flags |=3D flag; + zipl_secure_error(message); + } +} + +static inline void zipl_secure_validate_u32(bool condition, uint32_t *flag= s, + uint32_t flag, const char *mes= sage) +{ + if (!condition) { + *flags |=3D flag; + zipl_secure_error(message); + } +} + +#define zipl_secure_validate(condition, flags, flag, message) \ + _Generic((flags), \ + uint16_t * : zipl_secure_validate_u16, \ + uint32_t * : zipl_secure_validate_u32 \ + )(condition, flags, flag, message) + static inline uint64_t _diag320(void *data, unsigned long subcode) { register unsigned long addr asm("0") =3D (unsigned long)data; --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201475; cv=none; d=zohomail.com; s=zohoarc; b=EbeInrobrvwk1w/+CYNr3c/bB/U3j3+Jrn04OOC1My5nOltWvRyTbpVKV4cUa2h6P72+64ebZ7dlSOH/w2BAJlXk/stZ3PeThGDP6Pg6/IFgjLSFuM2SqsUTzLj/twMS+t9Y7cppPA7de9TC92EpGdCvhrfcwlpDQ9YyiMWVzZ8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201475; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MA+k9kiIc2sdIoHjOjG2e6kKXih+U/hh/xHyPnHpzJs=; b=BbuuGH4egW6CZ+VHHHYO75+ACsx82tgim2TviG1lLrhpRovgdOoaZU47STyJz9MAxgm1c3AYa6Vk6RD/CJG++Vg4KU1MdvBvz0ZHXIs44jaSfqT2df4yn/In5qhsQEiO7Rzydy2elr4jRWgYiRJXbuTMAypPVYsudGQCAUPaOfg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201475387503.17695012811487; Sat, 4 Jul 2026 14:44:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg872-0000jg-4i; Sat, 04 Jul 2026 17:41:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86z-0000aC-HQ; Sat, 04 Jul 2026 17:41:21 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86x-0008WU-K2; Sat, 04 Jul 2026 17:41:21 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmKVU2457433; Sat, 4 Jul 2026 21:40:55 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hn3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:55 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYZDx011754; Sat, 4 Jul 2026 21:40:54 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgnu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:54 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lerui28443208 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:53 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4294858054; Sat, 4 Jul 2026 21:40:53 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5A39B5805E; Sat, 4 Jul 2026 21:40:51 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:51 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=MA+k9kiIc2sdIoHjO jG2e6kKXih+U/hh/xHyPnHpzJs=; b=IsL46MRKfuMrXIurJYveeq5jrJd7Y2RL6 SlJeqBxjkM0H5jvvvgDWpWs820wg5pKXFIWZ4GnDBe2lsxnFxb4Pw5sTsTw61PL8 BkaYg2gzBO/y9Ocx/sxCF2zOr8VkKmVHaNCnqPE40pp4GsX9GyiR7QJKIuAAqanV 6L/WNkMjJ4GPAl8UmltZN0WSbfBlteLHFcp1UtHzwWF4KrIoOO/Y70RqPGD0NsRB XgNXe7NTqyTWZPqaEg5KvvyHwSP7CyzIMAsjn4k1YkoH7doRatxWv9mH5dHK3QTC rrcq1VjxnyGMSdzOmqgjBV5JnCEIi9q053s/tLvK8n3FinHUk7W6Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 27/33] Add secure-boot to s390-ccw-virtio machine type option Date: Sat, 4 Jul 2026 17:39:43 -0400 Message-ID: <20260704213950.2118823-28-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497de7 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=ZvnaDWGK54Hqr3b-QrcA:9 X-Proofpoint-GUID: _-fhp3rBJ5unZnZ5af_HvJzEPTWpupS2 X-Proofpoint-ORIG-GUID: _-fhp3rBJ5unZnZ5af_HvJzEPTWpupS2 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX9vZHkgbhMiLq DGIJak7Vx7ZOgSg/gtKnn82gfQ3jSl6VhTaBm1SXYxjBWAvoy7BbQM1lOkj3fR+V1khPi2Xq9Jf jJHlPpIf+SOx/47GX6rtbV4qeudu8Kw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX+O75h2Va+V4J hry5OzeVXh3M/z1QOc1SYLl8J8TF1hHKatDRj8hpG8jqi7toVATvY7Nprc7S4Wf9sots9Tkl21h AtcnUJkXm+yl1N87N8fqv4H4zaphjIEgK86jSypY4n8MGl9FjlAes6l/IMOdQQUw28RkWxMk1CR NBxIdXStxvDTyBXbxNFZ3oOzu1pobqoW0gb5JwlAwI6CoQLRRnHAuXtk0LI3etaFKmB6P/AU73I KD048q9CFIt49UY3mq2OJ4U3f8vUynwmCaHSoW0f3xM/1Wh5/A6jZQOsCNoAiQLifH2jph224ue otNn2vS4GLwFthGt4BA+/deq2q0ePC5vPxMfyD6Dn7zjojQxtyt4u1DwK1GxAwZSB308PPK7wxN czjhHPbB4P9abbKg/QIGd63EeFUyry1ISQKEUZHsFlR/ucl+D3BPg9ytB8jZh1rcl/GK7P4iyjQ oA8WR4yAxg0agOuLUUQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201476979158500 Content-Type: text/plain; charset="utf-8" Add secure-boot as a parameter of s390-ccw-virtio machine type option. The `secure-boot=3Don|off` parameter is implemented to enable secure IPL. By default, secure-boot is set to false if not specified in the command line. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling --- docs/system/s390x/secure-ipl.rst | 22 +++++++++++++++++----- hw/s390x/s390-virtio-ccw.c | 29 +++++++++++++++++++++++++++++ include/hw/s390x/s390-virtio-ccw.h | 2 ++ qemu-options.hx | 6 +++++- 4 files changed, 53 insertions(+), 6 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index cf6ccf5d57..9e3955f8fc 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -19,20 +19,32 @@ Note: certificate files must have a .pem extension. =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... =20 +Enabling Secure IPL +^^^^^^^^^^^^^^^^^^^ + +Secure IPL is enabled by explicitly setting ``secure-boot=3Don``; if not +specified, secure boot is considered off. + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don|off + =20 IPL Modes --------- =20 Multiple IPL modes are available to differentiate between the various IPL -configurations. These modes are mutually exclusive and enabled based on the -``boot-certs`` option on the QEMU command line. +configurations. These modes are mutually exclusive and enabled based on sp= ecific +combinations of the ``secure-boot`` and ``boot-certs`` options on the QEMU +command line. =20 Normal Mode ^^^^^^^^^^^ =20 -The absence of certificates will attempt to IPL a guest without secure IPL -operations. No checks are performed, and no warnings/errors are reported. -This is the default mode. +The absence of both certificates and the ``secure-boot`` option will attem= pt to +IPL a guest without secure IPL operations. No checks are performed, and no +warnings/errors are reported. This is the default mode, and can be explic= itly +enabled with ``secure-boot=3Doff``. =20 Configuration: =20 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index c68a760f75..662fb44e16 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -819,6 +819,27 @@ static void machine_set_boot_certs(Object *obj, Visito= r *v, const char *name, ms->boot_certs =3D cert_list; } =20 +static inline bool machine_get_secure_boot(Object *obj, Error **errp) +{ + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + return ms->secure_boot; +} + +static inline void machine_set_secure_boot(Object *obj, bool value, + Error **errp) +{ + S390CcwMachineClass *s390mc =3D S390_CCW_MACHINE_GET_CLASS(obj); + S390CcwMachineState *ms =3D S390_CCW_MACHINE(obj); + + if (!s390mc->use_secure) { + error_setg(errp, "secure-boot is not supported by this machine ver= sion"); + return; + } + + ms->secure_boot =3D value; +} + /* * S390x-specific global compatibility properties. * @@ -845,6 +866,7 @@ static void ccw_machine_class_init(ObjectClass *oc, con= st void *data) s390mc->max_threads =3D 1; s390mc->use_cpi =3D true; s390mc->use_certs =3D true; + s390mc->use_secure =3D true; mc->reset =3D s390_machine_reset; mc->block_default_type =3D IF_VIRTIO; mc->no_cdrom =3D 1; @@ -893,6 +915,12 @@ static void ccw_machine_class_init(ObjectClass *oc, co= nst void *data) machine_get_boot_certs, machine_set_boot_cer= ts, NULL, NULL); object_class_property_set_description(oc, "boot-certs", "provide paths to a directory and/or a certificate file for se= cure boot"); + + object_class_property_add_bool(oc, "secure-boot", + machine_get_secure_boot, + machine_set_secure_boot); + object_class_property_set_description(oc, "secure-boot", + "enable/disable secure boot"); } =20 static inline void s390_machine_initfn(Object *obj) @@ -981,6 +1009,7 @@ static void ccw_machine_11_0_class_options(MachineClas= s *mc) S390CcwMachineClass *s390mc =3D S390_CCW_MACHINE_CLASS(mc); =20 s390mc->use_certs =3D false; + s390mc->use_secure =3D false; /* * Preserve v11.0 and older version behavior: * keep legacy virtio-pci enabled. diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-vir= tio-ccw.h index d30f1fcc4c..dcac486bc4 100644 --- a/include/hw/s390x/s390-virtio-ccw.h +++ b/include/hw/s390x/s390-virtio-ccw.h @@ -29,6 +29,7 @@ struct S390CcwMachineState { bool aes_key_wrap; bool dea_key_wrap; bool pv; + bool secure_boot; uint8_t loadparm[8]; uint64_t memory_limit; uint64_t max_pagesize; @@ -58,6 +59,7 @@ struct S390CcwMachineClass { int max_threads; bool use_cpi; bool use_certs; + bool use_secure; }; =20 #endif diff --git a/qemu-options.hx b/qemu-options.hx index 83915bd7ef..f6eee518cf 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -47,7 +47,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \ " cxl-fmw.0.targets.0=3Dfirsttarget,cxl-fmw.0.targets.1= =3Dsecondtarget,cxl-fmw.0.size=3Dsize[,cxl-fmw.0.interleave-granularity=3Dg= ranularity]\n" " sgx-epc.0.memdev=3Dmemid,sgx-epc.0.node=3Dnumaid\n" " smp-cache.0.cache=3Dcachename,smp-cache.0.topology=3D= topologylevel\n" - " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n", + " boot-certs.0.path=3D/path/directory,boot-certs.1.path= =3D/path/file provides paths to a directory and/or a certificate file\n" + " secure-boot=3Don|off enable/disable secure boot (defa= ult=3Doff)\n", QEMU_ARCH_ALL) SRST ``-machine [type=3D]name[,prop=3Dvalue[,...]]`` @@ -218,6 +219,9 @@ SRST =20 ``boot-certs.0.path=3D/path/directory,boot-certs.1.path=3D/path/file`` Provide paths to a directory and/or a certificate file on the host= [s390x only]. + + ``secure-boot=3Don|off`` + Enables or disables secure boot on s390-ccw guest. The default is = off. ERST =20 DEF("M", HAS_ARG, QEMU_OPTION_M, --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201430; cv=none; d=zohomail.com; s=zohoarc; b=TEQ3/06rYQXjEerdiRkltEsMZt7+HYllsofz3yUrWJ4mmy8sle66oOHXXoS/6EJKwjRsT2Y2hqci8sCRrF4FrZf0HFfzH2KER3DPGh2ZivdZgRar+5wi5hmHCUG+oZb7H8Bj43ftiILwulNsmoDojhkcFtJTKS0Miy4J8er8gjk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201430; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ly1ouwdTOS/rCYt3Ul9zQGS01uaq5uMp9fmypZwaBQw=; b=LB3X8hq+QolrDyDyX7oi3SuFP6L+u3B4PZVNlsoL7O6Kn3iGv2KInk+Zrca0rGJME634FyiWNBqgBCDq4RHPIDdJbqmMFr2ejMAWZ9Q6Cq3Bm2ASxC+F0uDGqkyVONw7dT9YuKoh82bK4Ac7+6K+oyZFpAJLciMNW/Upg99Nmos= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201430245416.91346966738774; Sat, 4 Jul 2026 14:43:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86j-0007uO-Fn; Sat, 04 Jul 2026 17:41:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86g-0007ro-Pg; Sat, 04 Jul 2026 17:41:02 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86f-0000A7-6M; Sat, 04 Jul 2026 17:41:02 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmFfo2513155; Sat, 4 Jul 2026 21:40:57 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sw4b7p7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:57 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYg8s019267; Sat, 4 Jul 2026 21:40:56 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyx8gh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:56 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664LetoU16384636 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:55 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6637A58052; Sat, 4 Jul 2026 21:40:55 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6D3BB5805F; Sat, 4 Jul 2026 21:40:53 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:53 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ly1ouwdTOS/rCYt3U l9zQGS01uaq5uMp9fmypZwaBQw=; b=jznanCuLLX20MewaKJeW3Mfmdp01vTopi MMjnHBeR6rAmdRaFNA88yfmkr1hq84FHDOsY7/HZtKBz+WS5Ak50rWrl5ABCKqVp S8w6pfU6yfJ3qSH+M0N3FTVDgqETpf44EqC9Dg0JcRJWkZk3HwxCeGryL4uE3oI7 GYkm1cZUIw+gAr6nlZPens7HuhMDx6jLLHnBfMIowhpiqK0MGvqJ1Ngc2W+kHcqR VEqmuxg5pD5Tiq+CzE7jcRMR5DRDep/h/Tp4EBrsgzLRIQkUXtd1k+ppOfayu/Il 1i+yL2acMqutDk3c+8P8mY8OrRroSHDpKr2qrO466ll6hI7IRXSLg== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 28/33] hw/s390x/ipl: Set IPIB flags for secure IPL Date: Sat, 4 Jul 2026 17:39:44 -0400 Message-ID: <20260704213950.2118823-29-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: wN5q80r1f_7Cu8-uhE6CjtMQ2JetcXZa X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX56W2wdEtZZtB If/x4ox7P3+0NTVIEY3Vb6SslN4bJ6eXvioAlPbvgFyjefZT+pNpB4LRzWJvAOtJvEvAmuX2B4C d/cxX173kXOB9F8ltgKE8CD9dV8HLLU8xLblEuh5uQxJXJpCKZ7JXWs7px/2uMWROYYAo7762HH FwjHDxZ8X1rj3lgxjbmImp489mSVyDTdU5GA549gi90lTn5/eV39+RPgvdPwZZsck+Gihtls/fs YCk3XY2Zoyhkgk5v7D+WOaMnyjGKSuTIjOVgy6+kObo6p91KWOCikiAhL85VUbyYWeZUc9LRAvA EVMWoQKt8RSD3k+mG4Io52JxdpCGsVZTyKHvPT/r65Qr4EYOwtLqjbhj2i5Mf//FUgUXcSAMDyR W2KZDv4XCH8OeGe1mQkzn0BHYOy7lLKjGFEg6VG5G0KlU/buQuiEA3R2BlghAnmlLKh62LxRCQs 1vbGfCkAXy7tNUbMtcw== X-Proofpoint-ORIG-GUID: wN5q80r1f_7Cu8-uhE6CjtMQ2JetcXZa X-Authority-Analysis: v=2.4 cv=FqQ1OWrq c=1 sm=1 tr=0 ts=6a497de9 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=MUQpW0jNMHjpGy_Q9scA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX5XERjpwnSRM9 fiXbJI6RPdnf2Y6irypp5K/x3NgixsHzzYu4/oWgfVnnVnIOgMaMrmZrpP9rGMbkVq12lMIGVKb twjv47FTxG47P/MROvO79A4s+2GFOuE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201430760158501 Content-Type: text/plain; charset="utf-8" If `-M secure-boot=3Don` is specified on the command line option, indicating true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS. Any error that occurs during true secure IPL will cause the IPL to terminate. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling --- hw/s390x/ipl.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index ee251d03a8..24d3ce1147 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -467,15 +467,30 @@ static bool s390_has_certificate(void) return ipl->cert_store.count > 0; } =20 +static bool s390_secure_boot_enabled(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->secure_boot; +} + static void s390_set_secure_boot_flags(IplParameterBlock *iplb, - bool audit_mode) + bool secure_boot, bool audit_mode) { - if (!audit_mode) { + if (!secure_boot && !audit_mode) { return; } =20 /* - * For audit mode, enable the IPL Information + * If secure-boot is enabled, then toggle the secure IPL flags (SIPL) = to + * trigger secure boot in the s390 BIOS. + * + * Boot process will terminate if any error occurs during secure boot. + */ + if (secure_boot) { + iplb->hdr_flags |=3D DIAG308_IPIB_FLAGS_SIPL; + } + + /* + * For both secure boot and audit mode, enable the IPL Information * Report (IPLIR) flag so that the firmware generates an IPL * Information Report Block (IIRB). * @@ -544,7 +559,8 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 - s390_set_secure_boot_flags(iplb, s390_has_certificate()); + s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(), + s390_has_certificate()); =20 return true; } @@ -698,7 +714,9 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) * The kernel does not preserve secure boot flags across a reboot. * Re-apply them here based on the current machine configuration. */ - s390_set_secure_boot_flags(&ipl->iplb, s390_has_certificate()); + s390_set_secure_boot_flags(&ipl->iplb, + s390_secure_boot_enabled(), + s390_has_certificate()); } =20 update_machine_ipl_properties(iplb); --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201497; cv=none; d=zohomail.com; s=zohoarc; b=c3HykE4DUfQrLbx+IFdq+3Xw59xFHpqrMtUAf962x5TkxRk0yut1qMCyKFmC2bJgAPAVM+sTFo6wH4OREPQcfeYT6WCMEQicd5wTscYHwEVR2/J9pod/QHYpnsXbqSqC7qdzJ0cyziy+O2ctAjd8yUiiXrt8QKQzLHH5L4taw7k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201497; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CmpfNhfTYuXRhZnGuT7LNHdwIMqG2/leC7C7+x5k8xc=; b=krgG+7EJp61TwZ7Akn81qAL1lh1eXn491GYKgsfGve/118hY64MYh76IIrkoA0hWp2BTj7uXDJeIsKN5tiXEkoUf2F0+pZRH+yzguFImBDvXABB5UHYYzBJiySZpIb9uKAbe8qhEIWdl+rnUxQVq0a8MksfVZMsmkv1PTw8HhiE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783201497675280.71919671419016; Sat, 4 Jul 2026 14:44:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg878-00012x-DM; Sat, 04 Jul 2026 17:41:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg876-00010p-2S; Sat, 04 Jul 2026 17:41:28 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg874-0000IV-BX; Sat, 04 Jul 2026 17:41:27 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmPSm2457478; Sat, 4 Jul 2026 21:41:00 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hn6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:59 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYeUc011950; Sat, 4 Jul 2026 21:40:59 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2sukpgp2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:40:59 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Levlc34210138 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:40:57 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CD3AE58052; Sat, 4 Jul 2026 21:40:57 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9100558050; Sat, 4 Jul 2026 21:40:55 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:55 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=CmpfNhfTYuXRhZnGu T7LNHdwIMqG2/leC7C7+x5k8xc=; b=MXwNSSemiYACxZTVFcfcKJJMshhGqRIAw uvzOt9534YAhN1dw2UOlUTxfVdpgxWaYlXZ5GriwJa2bRGh12qB9hi+nmoNHeMq7 J5ejCGKobQ/ex9Z1cTpR+MXNVWiA26wwgvTbwWOZuS37hMq0vEMC5QPsWbqHPycU s/UK1TwJRUZLKMN7RGjRZWB9LgOgI7wDmYGF/ktSV5R9E3tvM/GDFoo7RdLfNi36 JmDjfMF0go5nWI00Obgd4LEAaiqit7eBeA10Pci7Ggl7RFC1MmQhC7D5Gs+YDs4y zzd58X/RbtvdU8oTvok1og4saVT5AZ6u/FPSODstseAwcj+VvV8bQ== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 29/33] pc-bios/s390-ccw: Handle true secure IPL mode Date: Sat, 4 Jul 2026 17:39:45 -0400 Message-ID: <20260704213950.2118823-30-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497deb cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=7NyXUy-cZM7U7AFZmwYA:9 X-Proofpoint-GUID: lFiMVbXmQs5TKnNRyoACYye6-zrEYGZR X-Proofpoint-ORIG-GUID: lFiMVbXmQs5TKnNRyoACYye6-zrEYGZR X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXxcFSy8kxcqTl KUv68A8URipDPDrrUuw6ZoRwZGpbdWkFZKdTh79/xqMHpLstFpS3TwMWzGcxpkZSTsBAV1mMhQD Pt8UVmQ1m6XDsRwj0yboqcYW87ECF1I= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX2yJHFVBbH2yr SX7k0v4nu8acNVzpoCxJtY3Fp3d9CAgHrL14vGMKyMU6k6QlO1zGxTIjWTeyhGUL2vl3oJGTdfA LXgxrqHNv2ftmD9dQbIOUVTC+D0YoPDkbWmEalVKIgBvtubwlSbEUHl9A2PBvm16mAkFwXx5vnu ypwVMj8J5OwcEFORlIXqftgZ0rVMt97MbMoOAa09n9fKU88ICFGcdpRbo96LoAxdurnuwQMHpHz CDiE5JzxEtVQ8+qcV6GVYAPrVw72WuPJGPYstDf8tRSFCqP6fdkXxkTe0KLvP26VOORyQXI3DTw 8bZDXwl3/G0JOOc7PA6Ck3tmKX4OKaaK5y2hDyBBm+WOhHHwmt1rVQdQ7MK0YHvDSlE10a5hwfS 1KCk6YnJqNGWXhZdkA+Dzw8gDJKAGxPiFyyF2K6TUcYKkDCAQHMStuedbKxiLm3GSb6uf/FqiCV ZqObr8Wv8YggO2N4WyA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201499050158500 Content-Type: text/plain; charset="utf-8" When secure boot is enabled (-secure-boot on) and certificate(s) are provided, the boot operates in True Secure IPL mode. Any verification error during True Secure IPL mode will cause the entire boot process to terminate. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities. If secure boot is enabled but no certificate is provided, the boot process will also terminate, as this is not a valid secure boot configuration. Note: True Secure IPL mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling Reviewed-by: Matthew Rosato --- docs/system/s390x/secure-ipl.rst | 13 +++++++++++++ hw/s390x/ipl.c | 3 ++- pc-bios/s390-ccw/bootmap.c | 6 +++++- pc-bios/s390-ccw/main.c | 7 ++++++- pc-bios/s390-ccw/s390-ccw.h | 1 + pc-bios/s390-ccw/secure-ipl.h | 3 +++ 6 files changed, 30 insertions(+), 3 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index 9e3955f8fc..c8fb887ac0 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -66,3 +66,16 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=3D/.../qe= mu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + +Secure Mode +^^^^^^^^^^^ + +When the ``secure-boot=3Don`` option is set and certificates are provided, +a secure boot is performed with error reporting enabled. The boot process = aborts +if any error occurs. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don,boot-certs= .0.path=3D/.../qemu/certs,boot-certs.1.path=3D/another/path/cert.pem ... diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 24d3ce1147..361107ba5b 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -850,7 +850,8 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) * Secure IPL without specifying a boot device. * IPLB is not generated if no boot device is defined. */ - if (s390_has_certificate() && !ipl->iplb_valid) { + if ((s390_has_certificate() || s390_secure_boot_enabled()) && + !ipl->iplb_valid) { error_report("No boot device defined for Secure IPL"); exit(1); } diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 276080709d..a506a663a0 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -741,6 +741,7 @@ static int zipl_run(ScsiBlockPtr *pte) case ZIPL_BOOT_MODE_NORMAL: rc =3D zipl_run_normal(&entry, tmp_sec); break; + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: rc =3D zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &t= mp_cert_buf); break; @@ -760,7 +761,8 @@ static int zipl_run(ScsiBlockPtr *pte) /* should not return */ write_reset_psw(entry->compdat.load_psw); =20 - if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE || + boot_mode =3D=3D ZIPL_BOOT_MODE_SECURE_AUDIT) { update_cert_list(&cert_list); update_iirb(&comp_list, &cert_list); free(tmp_cert_buf); @@ -1128,6 +1130,8 @@ ZiplBootMode get_boot_mode(uint8_t hdr_flags) =20 if (!sipl_set && iplir_set) { return ZIPL_BOOT_MODE_SECURE_AUDIT; + } else if (sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE; } =20 return ZIPL_BOOT_MODE_NORMAL; diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index b94a08e7bf..1bf77d1594 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -399,15 +399,20 @@ void main(void) =20 boot_mode =3D get_boot_mode(iplb->hdr_flags); switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: if (!secure_ipl_supported()) { - panic("Unable to boot in audit mode"); + panic("Unable to boot in secure/audit mode"); } =20 vcssb_len =3D zipl_secure_get_vcssb(); if (vcssb_len =3D=3D 0) { panic("Failed to query certificate storage information!"); } + + if (vcssb_len =3D=3D VCSSB_NO_VC) { + panic("Need at least one certificate for secure boot!"); + } break; default: break; diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index ca2737054d..0ea4810f1f 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -90,6 +90,7 @@ void zipl_load(void); typedef enum ZiplBootMode { ZIPL_BOOT_MODE_NORMAL =3D 0, ZIPL_BOOT_MODE_SECURE_AUDIT =3D 1, + ZIPL_BOOT_MODE_SECURE =3D 2, } ZiplBootMode; =20 extern ZiplBootMode boot_mode; diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index 25eaf9cea0..0ffb22b695 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -59,6 +59,9 @@ static inline void zipl_secure_error(const char *message) case ZIPL_BOOT_MODE_SECURE_AUDIT: printf("AUDIT MODE WARNING: %s\n", message); break; + case ZIPL_BOOT_MODE_SECURE: + panic(message); + break; default: break; } --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201319; cv=none; d=zohomail.com; s=zohoarc; b=SIqLeLHmg2U5bifwQklTR6Yw5Vx1H0JGnaaYl5fHZ/Ea+YDjbgjUDCy+yapSe/GZOTZI5W+JqrCpIF0IQM2UrQPV2GsRNyeIsbn6kQFrhnRA+Vfrtyefxe3ClOgit6U9aEX2RK8xWrRtnZm7VJZZX6vAqiKVyAqaWUGKUd8yCfU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201319; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6WNQOqi+1oUHxWISOZG/J6F/2F8CQj/Noj4OCS7AU3I=; b=N20pgtuvxcB4oDV9Cz0Na+3IwuU2HJYXsvDIiD+V+AfMvJz+CgR3je32DFQeEn9ylG/4dPKtq/u3nQYlwAgvBpI/VD9/uYgnRRNN33tZvS2NfwAqvvEygdhUGwo0qyJue7E5VgRcHHlnNaE/3y/E+3lWiFywaTYOxvGsoYbrALc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17832013189821013.8996324551597; Sat, 4 Jul 2026 14:41:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg879-000199-FU; Sat, 04 Jul 2026 17:41:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg877-00012W-KO; Sat, 04 Jul 2026 17:41:29 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg876-0000L2-3H; Sat, 04 Jul 2026 17:41:29 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmPSn2457478; Sat, 4 Jul 2026 21:41:02 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkn3hn9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:02 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYaCj027291; Sat, 4 Jul 2026 21:41:01 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7wpk45-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:01 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lf00D25166358 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:41:00 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 390CB5805F; Sat, 4 Jul 2026 21:41:00 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1276758052; Sat, 4 Jul 2026 21:40:58 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:40:57 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=6WNQOqi+1oUHxWISO ZG/J6F/2F8CQj/Noj4OCS7AU3I=; b=d6SBFBi8hWyyUovflhsjGUgYkBFlqydPq O+qMYZPfE+CGxGXXFFWGtt79uerZKQYVQnC6VLiQPrMF6Tj6cb3ptqxXCVlLxFFM EGBws3hu/z/FHiMr5b/3PC4GCULFf3MiZoCc/CFMfGLrwuV0IZ6qDoGEnylp8604 TpDLsohENrwUsrxxyO2TAHip5WJmN7h88iD3MwOhlSshmVkFAtMl51j6lUWKQQ2w 1O5bnAcngbVrj40L9Rv8MxXIMUtlrZgqd8j5PAzkLMtkVuglEV75tirh3YxqN9PP Lv7chU+jLCrit1KUSeeqZfz3pDBZtgeH6ikv7GejNvk9R1HBXZa5Q== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 30/33] hw/s390x/ipl: Handle secure boot with multiple boot devices Date: Sat, 4 Jul 2026 17:39:46 -0400 Message-ID: <20260704213950.2118823-31-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a497dee cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=NtokSpiRuqd3k76Znq0A:9 X-Proofpoint-GUID: eN2lEfp4rIv0hE-mpvaJpfMLrn7ywyuv X-Proofpoint-ORIG-GUID: eN2lEfp4rIv0hE-mpvaJpfMLrn7ywyuv X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX+J9XfCHb+PAn s//bMYW7kxw9oA0rJq/X8rjXydxJXWCQGUDCNFsEGtk1qLOAgfAYjcjG5TUp3uQXWeDZQwudtLi W87pdIKCCZAGxaLailHmiz7Hnj3PMIY= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXwycIg+SGOTmG TTITD0rt0V8TuV8TaCQQ2grv12Kg5MxfXHo87RCqVUBjkHPM/bXNaF3QzNR5oeZ9MRQsDb84iXZ LNHP+1weTfKBq/SHHINkq8u/MnifcaWZ0PgjBZ2EkDYlL0P26TWsnNL8o8UNAG12yzJTFn4KZ+Z o7iEhV0il5rxOtU7fv47cd/OZzXW22SjcG/j2I5hBB4bIBnhSRX82y9NN6B+q4Vc7eD3nAVwRWI 81shFidnWaoXGmq3NehAAsn+6+K8oSlV3xY/yXQBieON832HXdNihCF7OmiH8a2LdmPJBaI+ags K9uGMONMe4lz+CMPMHcFBrlH0PEXqvxVIQ4/Vt3sn+4MqSQ/1GqD6muTTp7hItUR3RdM/rxfEYa vTWXM/KPjoYyXLXKiPimioIyhw9ERFq8GK1gmejJG1Ekz6N21F4BLT8k2IHcbnW07nBBUPNIjPZ 3fx8yTXPmKk0kOumo2Q== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201320168158500 Content-Type: text/plain; charset="utf-8" The current approach to enable secure boot relies on providing secure-boot and boot-certs parameters of s390-ccw-virtio machine type option, which apply to all boot devices. With the possibility of multiple boot devices, secure boot expects all provided devices to be supported and eligible (e.g., virtio-blk/virtio-scsi using the SCSI scheme). If multiple boot devices are provided and include an unsupported (e.g., ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will terminate with an error logged to the console. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Matthew Rosato --- hw/s390x/ipl.c | 40 ++++++++++++++++++++++++++++++++++++++-- pc-bios/s390-ccw/main.c | 3 --- 2 files changed, 38 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 361107ba5b..b927db8446 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -503,6 +503,37 @@ static void s390_set_secure_boot_flags(IplParameterBlo= ck *iplb, iplb->len =3D cpu_to_be32(S390_IPLB_MAX_LEN); } =20 +static bool s390_validate_secure_boot_device(int devtype, Error **errp) +{ + switch (devtype) { + case CCW_DEVTYPE_VFIO: + error_setg(errp, "Passthrough (vfio) CCW device does not support s= ecure boot!"); + return false; + case CCW_DEVTYPE_VIRTIO_NET: + error_setg(errp, "Virtio net boot device does not support secure b= oot!"); + return false; + default: + return true; + } +} + +static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype, + bool secure_boot, bool audit_mode) +{ + Error *local_error =3D NULL; + + if (!secure_boot && !audit_mode) { + return; + } + + if (!s390_validate_secure_boot_device(devtype, &local_error)) { + error_report_err(local_error); + exit(1); + } + + s390_set_secure_boot_flags(iplb, secure_boot, audit_mode); +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev =3D NULL; @@ -559,14 +590,19 @@ static bool s390_build_iplb(DeviceState *dev_st, IplP= arameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 - s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(), - s390_has_certificate()); + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); =20 return true; } =20 pbdev =3D s390_get_pci_device(dev_st, &devtype); if (pbdev) { + if (s390_secure_boot_enabled() || s390_has_certificate()) { + error_report("Virtio pci boot device does not support secure b= oot!"); + exit(1); + } + pci_lp =3D object_property_get_str(OBJECT(pbdev->pdev), "loadparm"= , NULL); if (pci_lp && strlen(pci_lp) > 0) { lp =3D pci_lp; diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 1bf77d1594..9623d5320f 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -305,9 +305,6 @@ static void ipl_ccw_device(void) switch (cutype) { case CU_TYPE_DASD_3990: case CU_TYPE_DASD_2107: - IPL_assert((boot_mode =3D=3D ZIPL_BOOT_MODE_NORMAL), - "Passthrough (vfio) CCW device does not support secure= boot!"); - dasd_ipl(blk_schid, cutype); break; case CU_TYPE_VIRTIO: --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201352; cv=none; d=zohomail.com; s=zohoarc; b=inkId5BJuhdRxcQy74B4ub9EY9MEBaRXqTK6pjTuiFAPpDW9+0xUToEtp5t7pW2e0HX46l3EN/ZatV81SW7jR2yXW9bCwmggXC8apPxtxqB45cxQJt+o4Ih+4dlj4/9GrFN7stfDCZ5AXusoGNmSeT1O90pILKA8h1oeteB8UBg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201352; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OSDJjncHzyRzVr+4Qd8GFDtzAmwzc+bLwKS6KTWueXU=; b=cKw4I5sr1sPOMyQ375FThXMcFy84KmnP8FvuCjW1VJYSvIusF91me5PbppykqbtUV+k4K0FztzbwOwC+YXFFoVV3A/zFy7Y/5ilrY/pmkDWjnjBrIAgwJ35JDSI8cjK+rj3+ryOEHUWt26p/F1wJw2ZLejKWZ0A2XN8tda04eK8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17832013526481008.4078643989072; Sat, 4 Jul 2026 14:42:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg87L-0001fU-0e; Sat, 04 Jul 2026 17:41:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg87D-0001RY-Ef; Sat, 04 Jul 2026 17:41:35 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg87B-0000Ln-EN; Sat, 04 Jul 2026 17:41:35 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664Kn7v82447319; Sat, 4 Jul 2026 21:41:05 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdbc6y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:04 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYcgx013619; Sat, 4 Jul 2026 21:41:03 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2ruqxqaj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:03 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lf25l27329092 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:41:02 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5A43A58052; Sat, 4 Jul 2026 21:41:02 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6421958056; Sat, 4 Jul 2026 21:41:00 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:41:00 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=OSDJjncHzyRzVr+4Q d8GFDtzAmwzc+bLwKS6KTWueXU=; b=ANBw7hERg1RjUVbAi4Oku7yQrzEi1+qFl xlXgxKTgUQmLcKppvqyYHg/VDPkIyCCxnKGTGjPK/Y2dOGY4rz1P4l6ckekqC/aG Mqu7TDw+LLqOXBSs8J4Tpp06tHD5cOsDvzneMGlGbXQ2mQNDBCWpPoiIuTFZwN52 /64Y79GX4jJhmvqJpGQVMymjgJmknKV+8VWUdMv+hKhU7AAWIpnj8stS2M7pl2mr G2TQDsM8MkJECr6+7tPyx9D4QQi2P7eMegZBI1NDleKpyyxvwCDE/moGCYvD1IHb D0LOi751NiUJt3uNXHRVef2r9gQCNpfTLqGvm7B9MpXeyGLs56Xnw== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 31/33] tests/functional/s390x: Add secure IPL functional test Date: Sat, 4 Jul 2026 17:39:47 -0400 Message-ID: <20260704213950.2118823-32-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a497df0 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=vTr9H3xdAAAA:8 a=VnNF1IyMAAAA:8 a=WP5zsaevAAAA:8 a=vvdW6g1Vg8v77fwKLDIA:9 a=t8Kx07QrZZTALmIZmm-o:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX3yz+grwMIx31 dvINRxic2z7zYgSd2NYUfNaKOTpT4Xv79wl4TlPdwkQWkKSCPdMfK8ya2ZZjkAwe8sAcTRp/Mtb RFuKpoo6l/FJvcFC4vHwBuKl0z4UUiLEJSFEmKGrtY+6Cw0gwt3n8kYAhZ1SBcAhqO8/3yb05FJ 8Y4GLCkJ1X4/6hY/Ikw/z5KfzahCwMuQTQzwMYR8gHdPTEW+Ko526mqK5IawredqDkhbP12KiH9 Wqfy+3mXxbjdF/XjXtChjmTA0QNAYOh+4Q889/+1r98AmTUxVfFniHPeNJZR6ugywsMrQZVlkPb hG6mLGNgE2djoxYJkfHwfSToKMQel89IPj46O7I8NK9jWaJEUNMQkLEdUpBg1NKxwHZRl5Qp9Aw tgF/EvwcPfWvSve3iPPw1GDk8Mv5bfSc72tFSAPgoyadwzM9HgJ3X1Valfrh1hutInCsrm6KRAv /3vv4xD9liK7e5o5Q+g== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX6kWO2sxvgnsx CjgNyXklqOja18PmiCkbKrkaaCnBRZgVIxe511YKRSE7kzrRR5Bb1YB/qo67XDlr8RW1lt4FAcV FeaEv5IWJqIZ424cPndmZuaVDNWJ86A= X-Proofpoint-GUID: xvODkE9yB4mjOZG41FajuEb1euY54QiI X-Proofpoint-ORIG-GUID: xvODkE9yB4mjOZG41FajuEb1euY54QiI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201354469158500 Content-Type: text/plain; charset="utf-8" Add functional test for secure IPL. Signed-off-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- tests/functional/s390x/meson.build | 2 + tests/functional/s390x/test_secure_ipl.py | 172 ++++++++++++++++++++++ 2 files changed, 174 insertions(+) create mode 100755 tests/functional/s390x/test_secure_ipl.py diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/me= son.build index b065b666bc..16da5f0054 100644 --- a/tests/functional/s390x/meson.build +++ b/tests/functional/s390x/meson.build @@ -2,6 +2,7 @@ =20 test_s390x_timeouts =3D { 'ccw_virtio' : 420, + 'secure_ipl' : 360, } =20 tests_s390x_system_quick =3D [ @@ -14,6 +15,7 @@ tests_s390x_system_thorough =3D [ 'ccw_virtio', 'pxelinux', 'replay', + 'secure_ipl', 'topology', 'tuxrun', ] diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py new file mode 100755 index 0000000000..06fc93e404 --- /dev/null +++ b/tests/functional/s390x/test_secure_ipl.py @@ -0,0 +1,172 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +""" +s390x Secure IPL functional test. + +Validates s390x secure boot by preparing a signed guest image, booting with +secure-boot enabled, and verifying cryptographic validation results. +""" + +from subprocess import check_call, DEVNULL + +from qemu_test import QemuSystemTest, Asset, get_qemu_img +from qemu_test import exec_command_and_wait_for_pattern, exec_command +from qemu_test import wait_for_console_pattern, skipBigDataTest + +class S390xSecureIpl(QemuSystemTest): + """Test s390x Secure IPL (secure boot) functionality.""" + ASSET_F40_QCOW2 =3D Asset( + ('https://archives.fedoraproject.org/pub/archive/' + 'fedora-secondary/releases/40/Server/s390x/images/' + 'Fedora-Server-KVM-40-1.14.s390x.qcow2'), + '091c232a7301be14e19c76ce9a0c1cbd2be2c4157884a731e1fc4f89e7455a5f') + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.root_password =3D None + self.qcow2_path =3D None + self.cert_path =3D None + self.prompt =3D None + + def _create_certificate(self, vm): + """Generate x509 certificate""" + exec_command_and_wait_for_pattern(self, + 'openssl version', 'OpenSSL 3.2.= 1 30', + vm=3Dvm) + exec_command_and_wait_for_pattern(self, + 'openssl req -new -x509 -newkey rsa:2048 ' + '-keyout mykey.pem -outform PEM -out mycert.pe= m ' + '-days 36500 -subj "/CN=3DMy Name/" -nodes -ve= rbose', + 'Writing private key to \'mykey.pem\'', vm=3Dv= m) + + def _sign_binaries(self, vm): + """Sign stage3 binary and kernel""" + # Install kernel-devel (needed for sign-file) + exec_command_and_wait_for_pattern(self, + 'sudo dnf install kernel-devel-$(uname -r)= -y', + 'Complete!', vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + exec_command_and_wait_for_pattern(self, + 'ls /usr/src/kernels/$(uname -r)/scrip= ts/', + 'sign-file', vm=3Dvm) + + # Sign stage3 binary and kernel + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' + 'sha256 mykey.pem mycert.pem /lib/s390-tools/stage3.bi= n', + vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' + 'sha256 mykey.pem mycert.pem /boot/vmlinuz-$(uname -r)= ', + vm=3Dvm) + wait_for_console_pattern(self, self.prompt, vm=3Dvm) + + def _run_zipl_secure(self, vm): + """Run zipl to prepare for secure boot""" + exec_command_and_wait_for_pattern(self, 'zipl --secure 1 -VV', 'Do= ne.', + vm=3Dvm) + + def _extract_certificate(self, vm): + """Extract certificate from VM to host filesystem""" + out =3D exec_command_and_wait_for_pattern(self, 'cat mycert.pem', + '-----END CERTIFICATE-----= ', + vm=3Dvm) + # strip first line to avoid console echo artifacts + cert =3D "\n".join(out.decode("utf-8").splitlines()[1:]) + self.log.info("%s", cert) + + self.cert_path =3D self.scratch_file("mycert.pem") + + with open(self.cert_path, 'w', encoding=3D"utf-8") as file_object: + file_object.write(cert) + + def setup_s390x_secure_ipl(self): + """ + Prepare a secure boot-enabled guest image. + + Boots a temporary VM to generate a certificate, sign boot componen= ts + (stage3 and kernel), run zipl, and extract the certificate to host. + """ + self.require_netdev('user') + + temp_vm =3D self.get_vm(name=3D'sipl_setup') + temp_vm.set_machine('s390-ccw-virtio') + + asset_path =3D self.ASSET_F40_QCOW2.fetch() + self.qcow2_path =3D self.scratch_file('f40.qcow2') + qemu_img =3D get_qemu_img(self) + check_call([qemu_img, 'create', '-f', 'qcow2', '-b', asset_path, + '-F', 'qcow2', self.qcow2_path], stdout=3DDEVNULL, std= err=3DDEVNULL) + + temp_vm.set_console() + temp_vm.add_args('-nographic', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') + temp_vm.launch() + + # Initial root account setup (Fedora first boot screen) + self.root_password =3D 'fedora40password' + wait_for_console_pattern(self, 'Please make a selection from the a= bove', + vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, '4', 'Password:', vm=3Dtem= p_vm) + exec_command_and_wait_for_pattern(self, self.root_password, + 'Password (confirm):', vm=3Dtemp= _vm) + exec_command_and_wait_for_pattern(self, self.root_password, + 'Please make a selection from the abov= e', + vm=3Dtemp_vm) + + # Login as root + self.prompt =3D '[root@localhost ~]#' + exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', v= m=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= temp_vm) + exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt, + vm=3Dtemp_vm) + + self._create_certificate(temp_vm) + self._sign_binaries(temp_vm) + self._run_zipl_secure(temp_vm) + self._extract_certificate(temp_vm) + + # Shutdown temp vm + temp_vm.shutdown() + + @skipBigDataTest() + def test_s390x_secure_ipl(self): + """ + Verify secure boot validation during s390x guest boot. + + Expects two "Verified component" messages and confirms + /sys/firmware/ipl/secure reports secure boot is active. + """ + self.require_accelerator('kvm') + self.setup_s390x_secure_ipl() + + self.set_machine('s390-ccw-virtio') + + self.vm.set_console() + self.vm.add_args('-nographic', + '-machine', 's390-ccw-virtio,secure-boot=3Don,' + f'boot-certs.0.path=3D{self.cert_path}', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + '-device', 'virtio-blk-ccw,drive=3Ddrive1,bootind= ex=3D1') + self.vm.launch() + + # Expect two verified components + verified_output =3D "Verified component" + wait_for_console_pattern(self, verified_output) + wait_for_console_pattern(self, verified_output) + + # Login and verify the vm is booted using secure boot + wait_for_console_pattern(self, 'localhost login:') + exec_command_and_wait_for_pattern(self, 'root', 'Password:') + exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt) + exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/sec= ure', '1') + +if __name__ =3D=3D '__main__': + QemuSystemTest.main() --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201362; cv=none; d=zohomail.com; s=zohoarc; b=UgX4jcvd4Yn5ekPz/jI+l+StFKYEVm1dj+W754WXWjBdh+6BaE1THI9ldZdi+OwjyxPfOznN8sIpylm97T8+Qv/q6zQh4Oqf32rp7Ie/rGGakWRp/gC3dApWI6z51GNV3m/l/7/4OVfE1WdB5RMq4hln7aHU2LRx6SNDBcXt6JQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201362; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mO1xJczG/rfcgg+EA8Gt0jcljAPl6ijYegEFkjO8YRg=; b=KOXmtoldrnf6JuseXQuYi7PWEm5n0+IuVOCCgdeGnaM7fY2LhmcZ9uKs64e8NbMJpgn3zlVqj4E0ZM8kXcKiHyvQJjP6HYSfW57MVEXZBVlWkyercVGeBHBMBcTB/gXyMqOGqqqyi2ZVdTACgauBiyjjD9zuopnjVVQjpJkyMyU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17832013620891022.8178228173393; Sat, 4 Jul 2026 14:42:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg86s-0008QH-UZ; Sat, 04 Jul 2026 17:41:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86r-0008Jz-KW; Sat, 04 Jul 2026 17:41:13 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg86o-0000LN-Tx; Sat, 04 Jul 2026 17:41:13 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmKRk2705564; Sat, 4 Jul 2026 21:41:07 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqb7jv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:07 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYbxW027483; Sat, 4 Jul 2026 21:41:06 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7wpk4r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:06 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lf41527787868 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:41:04 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 76BB958054; Sat, 4 Jul 2026 21:41:04 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8762458050; Sat, 4 Jul 2026 21:41:02 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:41:02 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=mO1xJczG/rfcgg+EA 8Gt0jcljAPl6ijYegEFkjO8YRg=; b=szuSeEqUVDG9tapF1/DtY7/6MfQKb2wiI 4kWJNLk4Kh/UYuEfnx8aWkZ+BRdOrhlWXE3X23b1JiaWuH2bMmlHvSkxSA7bJ8Oj T0KxezR3nPUUzF7bsv4zSPwEyLL/ACd3wI45/c4APllBuoxYEB2Zm3WFWH2ZlQK3 FySKWNCkKEwAosfAxN9KiRLnHVJPfXkGydnchoujz86E5h54UYGRwYuWFIantZHT FmBXTWxuJDb2fFK037I5CAVwgDaQdGGlfidZ5CPH+bHxrMwvDofDsBLNf+tU5PCm uD+52NbJWkW7+cL3oHZ7KkrAqDHdb6RbDiF9vdwG6d3Kqoa3Xc28A== From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 32/33] docs/specs: Add secure IPL documentation Date: Sat, 4 Jul 2026 17:39:48 -0400 Message-ID: <20260704213950.2118823-33-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX9Sjcj2fkqx5N BPnXZAsMaGZ4gaJhVqVX9sFFu3b0KNCO/5ZFfRhGf94OVEOPvaLpiLL6/wcqvRmCgjcDeAFOzth lAS8NI89hs4oCxhCX7mA59Hfx5paOzA= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXxppDmhFSBHir IJ/BHfQzCxWCHEz4mX9A8QFdX8j7VvEu0IGxHD/0QZrIA38tA+UqV518NZX4quwuB3PgiYymzjP MZKY5fFWurV8fVnWgXYkQr+lrBxvvx4fiiCZ2yBqfUPFysT9wASulHjnyNGDAYN7UjHWv07nnM7 JHFRZ27cil37r+IBsei0cOcDNbp+cYSEuLoOs45qoodfhHYfV8DX0723va1472hWA57EXbbdMjY apXtWVsV3Awxd5UTi38sKo73iILzfG0+U1sOxJzdr33eYuLm54zb2SlkGVq3DZYj8xIloLNVRAz MkdydyrRil8pc4IN/eBopYusHA5yW9erogsQem4+Jah9T2rO3dISrrGGOIQf1vq6f5odTm16Qlm W+4TuKOYkSruUZAkER1SBatov3AG0Mv9uIa9aGjS5cVl/+CIMRsbverJ8qza+IC3JhNTLnYs4/E +y+oKpVUu1Mrw9sU12A== X-Proofpoint-GUID: Y507JFtGHOzaNeyjI0M8NR9X2bcVMZbD X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a497df3 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=bKBM-sKadDDPLvLHMR0A:9 X-Proofpoint-ORIG-GUID: Y507JFtGHOzaNeyjI0M8NR9X2bcVMZbD X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201364436158500 Content-Type: text/plain; charset="utf-8" Add documentation for secure IPL Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- docs/specs/s390x-secure-ipl.rst | 55 +++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.= rst index 7a603eb956..82b21600af 100644 --- a/docs/specs/s390x-secure-ipl.rst +++ b/docs/specs/s390x-secure-ipl.rst @@ -1,5 +1,60 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL (a.k.a. secure boot) enables s390-ccw virtual machines to +leverage qcrypto libraries and z/Architecture emulation to verify the +integrity of signed kernels. The qcrypto libraries are used to perform +certificate validation and signature-verification, whereas the +z/Architecture emulation is used to ensure secure IPL data has not +been tampered with, convey data between QEMU and guest code, and set up +the relevant secure IPL data structures with verification results. + +To find out more about using this feature, see +:doc:`documentation `. + +Note that "guest code" will refer to the s390-ccw BIOS unless stated +otherwise. + +Both QEMU and guest code work in cooperation to perform secure IPL. The Se= cure +Code Loading Attributes Facility (SCLAF) is used to check the Secure Code +Loading Attribute Block (SCLAB) and ensure that secure IPL data has not +been tampered with. DIAGNOSE 'X'320' is invoked by guest code to query +the certificate store info and retrieve specific certificates from QEMU. +DIAGNOSE 'X'508' is used by guest code to leverage qcrypto libraries to +perform signature-verification in QEMU. Lastly, guest code generates and +appends an IPL Information Report Block (IIRB) at the end of the IPL +Parameter Block (IPLB), which is used by the kernel to store signed and +verified entries. + +The logical steps are as follows: + +- guest code reads data payload from disk (e.g. stage3 boot loader, kernel) +- guest code checks the validity of the SCLAB +- guest code invokes DIAG 508 subcode 1 and provides the payload +- QEMU handles DIAG 508 request by reading the payload and retrieving the + certificate store +- QEMU DIAG 508 utilizes handler qcrypto libraries to perform + signature-verification on the payload, attempting with each cert in the = store + (until success or exhausted) +- QEMU DIAG 508 returns: + + - success: index of cert used to verify payload + - failure: error code + +- guest code is expected to respond to this operation by: + + - success: retrieves cert from store via DIAG 320 using returned index + - failure: reports with warning (audit mode), aborts with error (secure = mode) + +- guest code appends IIRB at the end of the IPLB +- guest code kicks off IPL + +More information regarding the respective DIAGNOSE commands and IPL data +structures are outlined within this document. + + s390 Certificate Store and Functions ------------------------------------ =20 --=20 2.54.0 From nobody Tue Jul 7 18:26:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783201491; cv=none; d=zohomail.com; s=zohoarc; b=nosZ9PR3mm3wqgSfN4QVxsP/9xaCJWT/6yhE/1Ugk2kz0xf4zC72O+Zgub7+4kYxXZbLz7sga7z/5rMhsMJa5R/bxipKCrDiKIK7eUuO2o2Jay2tzsmImUOWRbIaSCXA4uIJjNU5neGNCp+C8uSaJsSGzGr5L1Dz8Ik6X3X1SVg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783201491; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jv18yst7qaP0DLP5c+LuJvnW5VF+SH9SY83Jw4PKyMQ=; b=ea7CFWM8HGMY/3m3vNdrqEGMAENi2O0rqIQlTxYFxxmXwgL1m7EzZooINQbtbsFsiHtrudZ+zFC0dEEQDbFAjp1udvF/OGy39wqOv/2aZGwnFzbO9d6lIYVigV+RJVWt6LPzknaB7xAB1eOocbiih1qK/qyqMagvUxxFmaDIXzQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178320149105424.875679724120914; Sat, 4 Jul 2026 14:44:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wg87E-0001TW-O3; Sat, 04 Jul 2026 17:41:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg87D-0001Pk-5D; Sat, 04 Jul 2026 17:41:35 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wg87B-0000Ls-Bj; Sat, 04 Jul 2026 17:41:34 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 664KmLJO2428170; Sat, 4 Jul 2026 21:41:09 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsb7ku-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:08 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 664LYu2x027749; Sat, 4 Jul 2026 21:41:08 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f2s7wpk4w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 04 Jul 2026 21:41:08 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 664Lf6Xi28443222 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Jul 2026 21:41:06 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 877EB58050; Sat, 4 Jul 2026 21:41:06 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A1BE458061; Sat, 4 Jul 2026 21:41:04 +0000 (GMT) Received: from fedora-workstation.ibmuc.com (unknown [9.61.17.215]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 4 Jul 2026 21:41:04 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=jv18ys t7qaP0DLP5c+LuJvnW5VF+SH9SY83Jw4PKyMQ=; b=Xl0U2IpAZrvxJQvvS0/c0O m5dBkhY7KD/9JZrmobUBj7Nnm0Aok+o3pMsO07+y/gYq/FMzXZ9dCk8BRG4lYnJy iXGe5rI/BTEl3OO7P+irgQDpJyP6NNldFTUoemPu8Nhw0KGOAjIyXUFjGVHD2zmS OkQZqmkd3meLcIbhLZdipRkf1nU4+x2aaEZ8Gm6xHb5OZZ4e7j43BO4oeH2WkIQY obkiynQyTRoXgQIYRc8Kr1Y2tF8XWr1gwVDbypL5lRwjeiegfJtwdhR9L/OH3QmR WZEpK9eireEKzabJtCth/Z7iDwbfIitFhAE/+NZbCUi3KoYhm6CwX3n4VZSpTsPg == From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v15 33/33] docs/system/s390x: Add secure IPL documentation Date: Sat, 4 Jul 2026 17:39:49 -0400 Message-ID: <20260704213950.2118823-34-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260704213950.2118823-1-zycai@linux.ibm.com> References: <20260704213950.2118823-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _P76bi5vKITBLa2qfo7OWtLPtJUwTJeM X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfX8SnPIkYTH15N bW6WSSsbHxhRaGVhW9nYTaBi8k2Xpsjn+3/GucykvaSDCbJ49lHQ8u2Qzhz308QRvZnx5XNn/fc i4pKnTj67NQH+9TeTNGaeGHjITm1n7w= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a497df4 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=q5T4S90kAAAA:8 a=xOmL8MRHFtDrr2fuNQ0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=LnBBZQxPVJ0Z7KJyRdxh:22 X-Proofpoint-GUID: _P76bi5vKITBLa2qfo7OWtLPtJUwTJeM X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA0MDIyNCBTYWx0ZWRfXw0nJOWAdta70 sk0ufL07J+HT2ox8jaPqXipWypUjWSdY3ucwCH8+zs8prwUmjYYbgpduQOACXasFh5VI5G2kSY7 UAW0/PCQ0qOSCqiEgj0U+hISmeGohv0urRYPz6G50XZboa4dSAwlBuj7o92QdRi4OKFNlWZlsXt OIr34tnvQQ3Ypd9t67JMsk5TxzwP5wlm1kPTADF/hX7v8O9UIzWX2ZK3KtmAjdnL2snlr0l0iTY pZlo6NbtlYHTDhMb0M540kEIDISIrC6TWd9UQ6I32Y76/30Pe64H5rBCu1C7oHoQZIk+tHkBaFg phtgopxGctPiq2BWqFRO+53QqfHUCptS6p56s8uuCnQURPtajYLJuESF3ah51324QqTew44acUN tVxor+t6yvZLwYJV6fgv1H1bo1vZo2hvPTrmsPhOPuO1/0Uwd3GycUvC9DrO0RYIVSi03rVe9k0 0b30pUsW+aDQ8Mtu7fg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-04_03,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607040224 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=zycai@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783201493015158500 Add documentation for secure IPL Signed-off-by: Collin Walling Signed-off-by: Zhuoying Cai Reviewed-by: Joshua Daley Reviewed-by: Matthew Rosato --- docs/system/s390x/secure-ipl.rst | 103 +++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ip= l.rst index c8fb887ac0..67de20f47a 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -1,5 +1,22 @@ .. SPDX-License-Identifier: GPL-2.0-or-later =20 +s390 Secure IPL +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Secure IPL, also known as secure boot, enables s390-ccw virtual machines to +verify the integrity of guest kernels. + +For technical details of this feature, see the +:doc:`specs document `. + +This document explains how to use secure IPL with s390x in QEMU. It covers +the command line options for providing certificates and enabling secure IP= L, +the different IPL modes (Normal, Audit, and Secure), and system requiremen= ts. + +A quickstart guide is provided to demonstrate how to generate certificates, +sign images, and start a guest in Secure Mode. + + Secure IPL Command Line Options ------------------------------- =20 @@ -79,3 +96,89 @@ Configuration: .. code-block:: shell =20 qemu-system-s390x -machine s390-ccw-virtio,secure-boot=3Don,boot-certs= .0.path=3D/.../qemu/certs,boot-certs.1.path=3D/another/path/cert.pem ... + + +Constraints +----------- + +The following constraints apply when attempting to boot an s390x guest in = secure +mode: + +- z16 or "qemu" CPU model +- certificates must be in X.509 PEM format +- only support for SCSI scheme of virtio-blk/virtio-scsi devices +- a boot device must be specified +- any unsupported devices (e.g., ECKD and VFIO) or non-eligible devices (e= .g., + network) will cause the entire boot process to terminate early, with an = error + logged to the console. + + +Secure IPL Quickstart +--------------------- + +Build QEMU with gnutls enabled +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: shell + + ./configure =E2=80=A6 --enable-gnutls + +Generate certificate (e.g. via certtool) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +A private key is required before generating a certificate. This key must b= e kept +secure and confidential. + +Use an RSA private key for signing. + +.. code-block:: shell + + certtool --generate-privkey > key.pem + +A self-signed certificate requires the organization name. Use the ``cert.i= nfo`` +template to pre-fill values and avoid interactive prompts from certtool. + +.. code-block:: shell + + cat > cert.info <