From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 36635C5DF97 for ; Wed, 26 Aug 2026 12:55:52 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wzD90-0001SS-26; Wed, 26 Aug 2026 08:54:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzD88-0008ST-Fs; Wed, 26 Aug 2026 08:53:24 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzD82-0002rs-Gi; Wed, 26 Aug 2026 08:53:20 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67QCVrtk3977437; Wed, 26 Aug 2026 12:52:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zkh+Z1fZjJrPWsSu4 DS5vnmhr7ojtzYLLwlW1mYcLRw=; b=M3QaSwAPnqAN1Y88UaFInp6pAGg8M1zOu SPZOoYYB3c3zXZ3rNyWt/rSwJeByA2kALAm7V4r5MYM/94Dyd1hnl/Q9SOcC2XXe wH0KsYouw/+NIFUoawHKzpQ5XE8fX3w67sqYSVizPne4QwLThVYZYwcVA8Cs27+Z KjGNPSHCEWhGPaHmrZtfUTysUj9R9uTfOoPnOxFKzvI3HlXJLe5GhmXgMNDlLcSB s/eNCOjBmM8Lpqtvgdrx/bGwiiX0BTeFkcOQXAodLCa/F9/65CEz6WOSm4OpC2mi pQ9aZ+XYYC9E7mLY+fKMoSv7b8KzeYbI4N+GPucGJ2mppinrUbPnA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g73946pdk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 12:52:56 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67QCfcjo002476; Wed, 26 Aug 2026 12:52:55 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g7q3k1xy5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 12:52:55 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67QCqsDW58786178 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Aug 2026 12:52:54 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E8FDD5805B; Wed, 26 Aug 2026 12:52:53 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DE02258059; Wed, 26 Aug 2026 12:52:52 +0000 (GMT) Received: from li-479af74c-31f9-11b2-a85c-e4ddee11713b.ibm.com.com (unknown [9.61.78.161]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 26 Aug 2026 12:52:52 +0000 (GMT) From: Eric Farman To: qemu-devel@nongnu.org Cc: qemu-s390x@nongnu.org, Matthew Rosato , Cornelia Huck , Zhuoying Cai , Thomas Huth , Collin Walling , Eric Farman Subject: [PULL 30/37] hw/s390x/ipl: Set IPIB flags for secure IPL Date: Wed, 26 Aug 2026 08:52:05 -0400 Message-ID: <20260826125213.1901252-31-farman@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260826125213.1901252-1-farman@linux.ibm.com> References: <20260826125213.1901252-1-farman@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: xhG9hnAxWbPz7wfYlrMFJ5kgv31JWZaI X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI2MDEwNCBTYWx0ZWRfX+1Ru0qdLapDl srVppmo28uY9BaO6GuYBC+3PCiUYPz85QJJsaTNUANK+nhg4dbH5FEqICn6A0qTemsu4VR4c76h 3f6J8o3BUness10wziyr89ia16q52dtteFl779NQ5Uh1xmrXFVMRdwb25KyIKVLCvmBwW/L/7LZ olrutTnO47l/IM29H1R7cA80QmZZLMWI0BvXKNBCmmZsMQyWPaSQ+lXwzEQliomwoMTL9f3iEYr PSLtt24ECUzDzdms6lshNEzHO4mxrQtMRyPlN+VnXbbU8L8X/jEzB96kyyxZH+VY3eMgsqPniVG ej0PYlYnXlPWnM882pjTqOJ7RpXSTnhnP9Fjsao+9lzruwqQ8NbCnpiJKW9VI+QJqXIqEdFO8nD UVkb5oXXVQ+lqe4TQ0cAsEfU3pG0EEEyZXNugHO/gc8HCBDzg1GS7nrEZtzkib1zzgg6QBNFStJ MVWeaWA1+9YmYbnwkDQ== X-Authority-Analysis: v=2.4 cv=Y/nIdBeN c=1 sm=1 tr=0 ts=6a8ee1a8 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=20KFwNOVAAAA:8 a=MUQpW0jNMHjpGy_Q9scA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI2MDEwNCBTYWx0ZWRfX7GERS6VSHH5/ tUVGjaNmtb+XvCktSPbyzdehx8GWrpjfr7bD+qYkhzjBgADgrJI5ieu9q71ZZqnDHjUbpp/8eDc sCIEV1wwZXQVcM1eAD+oEKcAbMY1jhI= X-Proofpoint-ORIG-GUID: xhG9hnAxWbPz7wfYlrMFJ5kgv31JWZaI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-26_03,2026-08-26_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 priorityscore=1501 adultscore=0 bulkscore=0 suspectscore=0 malwarescore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608260104 Received-SPF: pass client-ip=148.163.156.1; envelope-from=farman@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org From: Zhuoying Cai If `-M secure-boot=on` is specified on the command line option, indicating true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS. Any error that occurs during true secure IPL will cause the IPL to terminate. Signed-off-by: Zhuoying Cai Reviewed-by: Thomas Huth Reviewed-by: Collin Walling Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-29-zycai@linux.ibm.com Signed-off-by: Eric Farman --- hw/s390x/ipl.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d0dbf47d74..08294af4d0 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -468,15 +468,30 @@ static bool s390_has_certificate(void) return ipl->cert_store.count > 0; } +static bool s390_secure_boot_enabled(void) +{ + return S390_CCW_MACHINE(qdev_get_machine())->secure_boot; +} + static void s390_set_secure_boot_flags(IplParameterBlock *iplb, - bool audit_mode) + bool secure_boot, bool audit_mode) { - if (!audit_mode) { + if (!secure_boot && !audit_mode) { return; } /* - * For audit mode, enable the IPL Information + * If secure-boot is enabled, then toggle the secure IPL flags (SIPL) to + * trigger secure boot in the s390 BIOS. + * + * Boot process will terminate if any error occurs during secure boot. + */ + if (secure_boot) { + iplb->hdr_flags |= DIAG308_IPIB_FLAGS_SIPL; + } + + /* + * For both secure boot and audit mode, enable the IPL Information * Report (IPLIR) flag so that the firmware generates an IPL * Information Report Block (IIRB). * @@ -545,7 +560,8 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |= DIAG308_FLAGS_LP_VALID; - s390_set_secure_boot_flags(iplb, s390_has_certificate()); + s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(), + s390_has_certificate()); return true; } @@ -699,7 +715,9 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) * The kernel does not preserve secure boot flags across a reboot. * Re-apply them here based on the current machine configuration. */ - s390_set_secure_boot_flags(&ipl->iplb, s390_has_certificate()); + s390_set_secure_boot_flags(&ipl->iplb, + s390_secure_boot_enabled(), + s390_has_certificate()); } update_machine_ipl_properties(iplb); -- 2.55.0