The following changes since commit fe11f459f640cd08f35c21f9d403517951bfd671:

  Merge tag 'fixes-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-08-25 06:48:55 -0700)

are available in the Git repository at:

  https://gitlab.com/efarman/qemu.git tags/s390x-20260826

for you to fetch changes up to 5c3c500cddbdea58bb76515847d1d515621dcf0b:

  pc-bios/s390-ccw.img: update s390x bios (2026-08-26 07:05:48 -0400)

----------------------------------------------------------------
New s390x features for 11.2
 - hardening fixes in css/sclp code
 - enable secure IPL
 - regenerate s390-ccw.img

----------------------------------------------------------------

Christian Borntraeger (2):
  s390x/sclp: pv: only copy the original SCCB buffer
  s390x/css: Fix css stsch detection to go beyond 8192 devices

Collin L. Walling (2):
  s390x/diag: Introduce DIAG 508 for secure IPL operations
  s390x/diag: Implement DIAG 508 subcode 1 for signature verification

Eric Farman (1):
  pc-bios/s390-ccw.img: update s390x bios

Zhuoying Cai (32):
  Add boot-certs to s390-ccw-virtio machine type option
  crypto/x509-utils: Refactor with GNUTLS fallback
  crypto/x509-utils: Add helper functions for certificate store
  hw/s390x/ipl: Create certificate store
  s390x/diag: Introduce DIAG 320 for Certificate Store Facility
  s390x/diag: Refactor address validation check from diag308_parm_check
  s390x/diag: Implement DIAG 320 subcode 1
  crypto/x509-utils: Add helper functions for DIAG 320 subcode 2
  s390x/diag: Implement DIAG 320 subcode 2
  hw/s390x: Define finite size for single entry VCEntry
  crypto/x509-utils: Add helper functions for DIAG 508 subcode 1
  s390x/diag: Generalize s390_ipl_read/write to accept void *
  s390x/ipl: Introduce IPL Information Report Block (IIRB)
  pc-bios/s390-ccw: Define memory for IPLB and convert IPLB to pointers
  hw/s390x/ipl: Add IPIB flags to IPL Parameter Block
  hw/s390x/ipl: Rework s390_ipl_map_iplb_chain for certificate storage
  s390x: Guest support for Secure-IPL Facility
  pc-bios/s390-ccw: Refactor zipl_run()
  pc-bios/s390-ccw: Rework zipl_load_segment function
  pc-bios/s390-ccw: Introduce ZiplBootMode enum for IPL mode selection
  pc-bios/s390-ccw: Add signature verification for secure IPL in audit
    mode
  pc-bios/s390-ccw: Add signed component address overlap checks
  s390x: Guest support for Secure-IPL Code Loading Attributes Facility
    (SCLAF)
  pc-bios/s390-ccw: Add additional security checks for secure boot
  Add secure-boot to s390-ccw-virtio machine type option
  hw/s390x/ipl: Set IPIB flags for secure IPL
  pc-bios/s390-ccw: Handle true secure IPL mode
  hw/s390x/ipl: Handle secure boot with multiple boot devices
  tests/functional/s390x: Add secure IPL functional test
  docs/specs: Add secure IPL documentation
  docs/system/s390x: Add secure IPL documentation
  MAINTAINERS: Add secure IPL files to S390-ccw boot group

 MAINTAINERS                               |   5 +
 crypto/meson.build                        |   2 +-
 crypto/x509-utils.c                       | 409 +++++++++++++++
 docs/specs/index.rst                      |   1 +
 docs/specs/s390x-secure-ipl.rst           | 197 ++++++++
 docs/system/s390x/secure-ipl.rst          | 184 +++++++
 docs/system/target-s390x.rst              |   1 +
 hw/s390x/cert-store.c                     | 244 +++++++++
 hw/s390x/cert-store.h                     |  38 ++
 hw/s390x/css.c                            |   3 +-
 hw/s390x/ipl.c                            | 128 ++++-
 hw/s390x/ipl.h                            |  29 +-
 hw/s390x/meson.build                      |   1 +
 hw/s390x/s390-virtio-ccw.c                |  70 +++
 hw/s390x/sclp.c                           |   4 +-
 include/crypto/x509-utils.h               | 113 +++++
 include/hw/s390x/ipl/diag308.h            |  34 ++
 include/hw/s390x/ipl/diag320.h            | 118 +++++
 include/hw/s390x/ipl/diag508.h            |  45 ++
 include/hw/s390x/ipl/qipl.h               | 113 ++++-
 include/hw/s390x/s390-virtio-ccw.h        |   5 +
 include/hw/s390x/sclp.h                   |   6 +-
 pc-bios/s390-ccw.img                      | Bin 104216 -> 112408 bytes
 pc-bios/s390-ccw/Makefile                 |   2 +-
 pc-bios/s390-ccw/bootmap.c                | 108 +++-
 pc-bios/s390-ccw/bootmap.h                |  22 +
 pc-bios/s390-ccw/iplb.h                   |   9 +-
 pc-bios/s390-ccw/jump2ipl.c               |  13 +-
 pc-bios/s390-ccw/main.c                   |  59 ++-
 pc-bios/s390-ccw/netmain.c                |   8 +-
 pc-bios/s390-ccw/s390-ccw.h               |  27 +
 pc-bios/s390-ccw/sclp.c                   |  27 +
 pc-bios/s390-ccw/sclp.h                   |   7 +
 pc-bios/s390-ccw/secure-ipl.c             | 561 +++++++++++++++++++++
 pc-bios/s390-ccw/secure-ipl.h             | 183 +++++++
 qapi/machine-s390x.json                   |  23 +
 qapi/pragma.json                          |   1 +
 qemu-options.hx                           |  10 +-
 target/s390x/cpu_features.c               |   7 +
 target/s390x/cpu_features.h               |   1 +
 target/s390x/cpu_features_def.h.inc       |   5 +
 target/s390x/cpu_models.c                 |   7 +
 target/s390x/diag.c                       | 576 +++++++++++++++++++++-
 target/s390x/gen-features.c               |   7 +
 target/s390x/kvm/kvm.c                    |  34 ++
 target/s390x/s390x-internal.h             |   4 +
 target/s390x/tcg/misc_helper.c            |  14 +
 tests/functional/s390x/meson.build        |   2 +
 tests/functional/s390x/test_secure_ipl.py | 172 +++++++
 49 files changed, 3539 insertions(+), 100 deletions(-)
 create mode 100644 docs/specs/s390x-secure-ipl.rst
 create mode 100644 docs/system/s390x/secure-ipl.rst
 create mode 100644 hw/s390x/cert-store.c
 create mode 100644 hw/s390x/cert-store.h
 create mode 100644 include/hw/s390x/ipl/diag308.h
 create mode 100644 include/hw/s390x/ipl/diag320.h
 create mode 100644 include/hw/s390x/ipl/diag508.h
 create mode 100644 pc-bios/s390-ccw/secure-ipl.c
 create mode 100644 pc-bios/s390-ccw/secure-ipl.h
 create mode 100755 tests/functional/s390x/test_secure_ipl.py

-- 
2.55.0

On 8/26/26 05:51, Eric Farman wrote:
> The following changes since commit fe11f459f640cd08f35c21f9d403517951bfd671:
>
>    Merge tag 'fixes-pr-v1' ofhttps://gitlab.com/marcandre.lureau/qemu into staging (2026-08-25 06:48:55 -0700)
>
> are available in the Git repository at:
>
>    https://gitlab.com/efarman/qemu.git tags/s390x-20260826
>
> for you to fetch changes up to 5c3c500cddbdea58bb76515847d1d515621dcf0b:
>
>    pc-bios/s390-ccw.img: update s390x bios (2026-08-26 07:05:48 -0400)
>
> ----------------------------------------------------------------
> New s390x features for 11.2
>   - hardening fixes in css/sclp code
>   - enable secure IPL
>   - regenerate s390-ccw.img

Applied, thanks.

r~