Re: [PATCH v2 21/25] hw/s390x/ipl: Set IPIB flags for secure IPL

[Thomas Huth <thuth@redhat.com>]

On 09/05/2025 00.50, Zhuoying Cai wrote:
> If `-secure-boot on` is specified on the command line option, indicating
> true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report
> bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS.
> 
> Any error that occurs during true secure IPL will cause the IPL to
> terminate.
> 
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> ---
>   hw/s390x/ipl.c | 18 +++++++++++++++++-
>   1 file changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d1a972ac8d..4c827be121 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -437,6 +437,11 @@ static bool s390_has_certificate(void)
>       return ipl->cert_store.count > 0;
>   }
>   
> +static bool s390_secure_boot_enabled(void)
> +{
> +    return S390_CCW_MACHINE(qdev_get_machine())->secure_boot;
> +}
> +
>   static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>   {
>       CcwDevice *ccw_dev = NULL;
> @@ -494,6 +499,17 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>           s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>           iplb->flags |= DIAG308_FLAGS_LP_VALID;
>   
> +        /*
> +         * If -secure-boot on, then toggle the secure IPL flags to trigger
> +         * secure boot in the s390 BIOS.

"If secure-boot is enabled" ?

  Thomas


> +         * Boot process will terminate if any error occurs during secure boot.
> +         *
> +         * If SIPL is on, IPLIR must also be on.
> +         */
> +        if (s390_secure_boot_enabled()) {
> +            iplb->hdr_flags |= (DIAG308_IPIB_FLAGS_SIPL | DIAG308_IPIB_FLAGS_IPLIR);
> +        }
>           /*
>            * Secure boot in audit mode will perform
>            * if certificate(s) exist in the key store.
> @@ -503,7 +519,7 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>            *
>            * Results of secure boot will be stored in IIRB.
>            */
> -        if (s390_has_certificate()) {
> +        else if (s390_has_certificate()) {
>               iplb->hdr_flags |= DIAG308_IPIB_FLAGS_IPLIR;
>           }
>