From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EBF07C43602 for ; Fri, 3 Jul 2026 02:32:22 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wfTgN-00038D-6l; Thu, 02 Jul 2026 22:31:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wfTgK-0002tQ-HY; Thu, 02 Jul 2026 22:31:08 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wfTgI-0003fw-HE; Thu, 02 Jul 2026 22:31:08 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6631IUj41452165; Fri, 3 Jul 2026 02:30:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=4AWcqHObiv46kyUkd ClquBnlZ8zgnrUmzwqTfiP3RAM=; b=jriD+vTk5tl9ntiKfH56gjc8hvoe+WOBS kAN7WYUytgpFT8NVP9XbNnLpwKICfcb+YsyDkeAFgjeu31Yoh/fJZtibRLA675Ba R5oUZjjaOD+siA02+6oE92mpmkPeXmp8ZoXE3YiwaHneDoqcpDn930zzfYJpp75b PNcMV+hh6IkSeonFaZ5MSb6JaE2nmJgzZxosWHLHt8nPY7DFkK2t7nmI/ejyjYaV RSTL6ntX8CscWTUmz7bWEZmMDzbXqPMObfugH8kfadpFaO2pKr2rhBmZOXLZI5mn 0KJAPWzz0XLhLbrXQuwPT2ro31FMD7Acnu2OMVtNpJUR+04CVKsAA== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f26qgcxr5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 03 Jul 2026 02:30:42 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6632JaXO019064; Fri, 3 Jul 2026 02:30:41 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f2uhyph73-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 03 Jul 2026 02:30:41 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6632Udhr63832362 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 3 Jul 2026 02:30:40 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CBB3B5805A; Fri, 3 Jul 2026 02:30:39 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E61D158062; Fri, 3 Jul 2026 02:30:37 +0000 (GMT) Received: from fedora-workstation.lan (unknown [9.61.151.121]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Fri, 3 Jul 2026 02:30:37 +0000 (GMT) From: Zhuoying Cai To: qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: jrossi@linux.ibm.com, cohuck@redhat.com, berrange@redhat.com, richard.henderson@linaro.org, david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, zycai@linux.ibm.com, alifm@linux.ibm.com, brueckner@linux.ibm.com, pierrick.bouvier@oss.qualcomm.com, jdaley@linux.ibm.com Subject: [PATCH v13 29/33] pc-bios/s390-ccw: Handle true secure IPL mode Date: Thu, 2 Jul 2026 22:29:27 -0400 Message-ID: <20260703022933.1805010-30-zycai@linux.ibm.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260703022933.1805010-1-zycai@linux.ibm.com> References: <20260703022933.1805010-1-zycai@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RYqgzVtv c=1 sm=1 tr=0 ts=6a471ed2 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=7NyXUy-cZM7U7AFZmwYA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAzMDAyMCBTYWx0ZWRfX6y0VjEl7LtkW RKhfzg8cnQrM3vtzE9whKEf20u4RC1yRG3E+mvMrBV/90zvGYC6sTu0QWnWvP8Hl+bD0/rvhnKw 0nEXGtH3lzPjnPYaWwHGf7RrXRGouhE= X-Proofpoint-GUID: zLstfqzTbwmdIXee0JsPJNR3xMjzX--c X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAzMDAyMCBTYWx0ZWRfX4z3ZtXDdVVOw XZ8hKssmQJSgaRNUU1TIhkW0MWHTAR65XogMtK07A1AkA8/s0dJa+RCE99Zz7TQ6B47BaFukGHe tm8accP4xPSR1NYUxUdHEtgRGky6Sm4tDuaDUBSaRtn8IA8AQ8D1Hz0QIvaosL0+wZAV+xI+ozW /GUyg42PCSZURiaSHS+HZS0uX6tGZQkx8ABhfXyWcqyogN+ctQ+n0HUVjvwNl067Z2RzfNjaXCL NTmGQGc/Qrezb9vSfWo8oXMxq+b/Y74mbqYWrshuVo+6Ec4qV9i1j3wUa/cayJVPBNub37mBCWd OORQyOl/y4i65fjhHsESv18NXUNwuHKKRQBkPxEWiBAyfvuVJc0XkSKxBojnba45vlMbiUQeQGp YAtNnMP2tbNr0RIDylzTXjJyNumR9MckXexicB+2TaP2IIp9HI+kLOmWGMJS/CJNmc261MI90nk nSsHgEKHk9G6YqEQAhg== X-Proofpoint-ORIG-GUID: zLstfqzTbwmdIXee0JsPJNR3xMjzX--c X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-03_01,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607030020 Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org When secure boot is enabled (-secure-boot on) and certificate(s) are provided, the boot operates in True Secure IPL mode. Any verification error during True Secure IPL mode will cause the entire boot process to terminate. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities. If secure boot is enabled but no certificate is provided, the boot process will also terminate, as this is not a valid secure boot configuration. Note: True Secure IPL mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai Reviewed-by: Collin Walling --- docs/system/s390x/secure-ipl.rst | 13 +++++++++++++ hw/s390x/ipl.c | 3 ++- pc-bios/s390-ccw/bootmap.c | 6 +++++- pc-bios/s390-ccw/main.c | 7 ++++++- pc-bios/s390-ccw/s390-ccw.h | 1 + pc-bios/s390-ccw/secure-ipl.h | 3 +++ 6 files changed, 30 insertions(+), 3 deletions(-) diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ipl.rst index 9e3955f8fc..c8fb887ac0 100644 --- a/docs/system/s390x/secure-ipl.rst +++ b/docs/system/s390x/secure-ipl.rst @@ -66,3 +66,16 @@ Configuration: .. code-block:: shell qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ... + +Secure Mode +^^^^^^^^^^^ + +When the ``secure-boot=on`` option is set and certificates are provided, +a secure boot is performed with error reporting enabled. The boot process aborts +if any error occurs. + +Configuration: + +.. code-block:: shell + + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ... diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 62a3c60530..a99d3e3306 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -849,7 +849,8 @@ void s390_ipl_prepare_cpu(S390CPU *cpu) * Secure IPL without specifying a boot device. * IPLB is not generated if no boot device is defined. */ - if (s390_has_certificate() && !ipl->iplb_valid) { + if ((s390_has_certificate() || s390_secure_boot_enabled()) && + !ipl->iplb_valid) { error_report("No boot device defined for Secure IPL"); exit(1); } diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 1147124bd7..cbfbbfe35c 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -742,6 +742,7 @@ static int zipl_run(ScsiBlockPtr *pte) case ZIPL_BOOT_MODE_NORMAL: rc = zipl_run_normal(&entry, tmp_sec); break; + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: rc = zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &tmp_cert_buf); break; @@ -761,7 +762,8 @@ static int zipl_run(ScsiBlockPtr *pte) /* should not return */ write_reset_psw(entry->compdat.load_psw); - if (boot_mode == ZIPL_BOOT_MODE_SECURE_AUDIT) { + if (boot_mode == ZIPL_BOOT_MODE_SECURE || + boot_mode == ZIPL_BOOT_MODE_SECURE_AUDIT) { update_cert_list(&cert_list); update_iirb(&comp_list, &cert_list); free(tmp_cert_buf); @@ -1129,6 +1131,8 @@ ZiplBootMode get_boot_mode(uint8_t hdr_flags) if (!sipl_set && iplir_set) { return ZIPL_BOOT_MODE_SECURE_AUDIT; + } else if (sipl_set && iplir_set) { + return ZIPL_BOOT_MODE_SECURE; } return ZIPL_BOOT_MODE_NORMAL; diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c index 7484429c9a..687946c471 100644 --- a/pc-bios/s390-ccw/main.c +++ b/pc-bios/s390-ccw/main.c @@ -399,15 +399,20 @@ void main(void) boot_mode = get_boot_mode(iplb->hdr_flags); switch (boot_mode) { + case ZIPL_BOOT_MODE_SECURE: case ZIPL_BOOT_MODE_SECURE_AUDIT: if (!secure_ipl_supported()) { - panic("Unable to boot in audit mode"); + panic("Unable to boot in secure/audit mode"); } vcssb_len = zipl_secure_get_vcssb(); if (vcssb_len == 0) { panic("Failed to query certificate storage information!"); } + + if (vcssb_len == VCSSB_NO_VC) { + panic("Need at least one certificate for secure boot!"); + } default: break; } diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index ca2737054d..0ea4810f1f 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -90,6 +90,7 @@ void zipl_load(void); typedef enum ZiplBootMode { ZIPL_BOOT_MODE_NORMAL = 0, ZIPL_BOOT_MODE_SECURE_AUDIT = 1, + ZIPL_BOOT_MODE_SECURE = 2, } ZiplBootMode; extern ZiplBootMode boot_mode; diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h index 18313104fa..04eac5d987 100644 --- a/pc-bios/s390-ccw/secure-ipl.h +++ b/pc-bios/s390-ccw/secure-ipl.h @@ -59,6 +59,9 @@ static inline void zipl_secure_error(const char *message) case ZIPL_BOOT_MODE_SECURE_AUDIT: printf("AUDIT MODE WARNING: %s\n", message); break; + case ZIPL_BOOT_MODE_SECURE: + panic(message); + break; default: break; } -- 2.54.0