Re: [PATCH v4 20/28] pc-bios/s390-ccw: Add signature verification for secure IPL in audit mode

[Collin Walling <walling@linux.ibm.com>]

On 7/21/25 17:50, Zhuoying Cai wrote:
> On 7/11/25 6:50 PM, Collin Walling wrote:
>> On 7/11/25 5:10 PM, Zhuoying Cai wrote:

[...]

>>>  
>>> +typedef enum ZiplBootMode {
>>> +    ZIPL_NORMAL_MODE = 1,
>>> +    ZIPL_SECURE_AUDIT_MODE = 2,
>>> +} ZiplBootMode;
>>
>> These should be ZIPL_BOOT_MODE_*
>>
>> Also, is there a reason why the list starts at 1 and not defaulting to
>> the implicit 0?
>>
> 
> boot_mode is a global variable defined in pc-bios/s390-ccw/main.c, and
> it defaults to 0, which indicates that the boot mode hasn’t been
> determined yet.
> 
> We start the list at 1 to reserve 0 as the implicit “undefined” or “not
> yet set” value. The actual boot mode is only set later when boot_mode == 0:
>     if (boot_mode == 0) {
>         boot_mode = zipl_mode(iplb->hdr_flags);
>     }
> This allows us to distinguish between an unset state and valid boot modes.
> 

I would have thought to default the boot mode to NORMAL, but I haven't
had my eyes on the BIOS patches in a bit.  Unsure what makes sense.

For now, I'd suggest adding ZIPL_MODE_UNSPECIFIED (or something like
that) to the list.

[...]

-- 
Regards,
  Collin