| Message ID | 20250408155527.123341-13-zycai@linux.ibm.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Secure IPL Support for SCSI Scheme of virtio-blk/virtio-scsi Devices | expand |
...snip... > > diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h > index b8e7d1da71..2355fcecbb 100644 > --- a/include/hw/s390x/ipl/qipl.h > +++ b/include/hw/s390x/ipl/qipl.h > @@ -23,6 +23,9 @@ > #define MAX_CERTIFICATES 64 > #define CERT_MAX_SIZE (1024 * 8) > > +#define DIAG308_IPIB_FLAGS_SIPL 0x40 > +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 > + nit: We have a diag308 flag defined here https://github.com/qemu/qemu/blob/master/hw/s390x/ipl.h#L22. It would be easier if we had the flags defined in one place. > /* > * The QEMU IPL Parameters will be stored at absolute address > * 204 (0xcc) which means it is 32-bit word aligned but not > @@ -104,7 +107,8 @@ typedef struct IplBlockQemuScsi IplBlockQemuScsi; > union IplParameterBlock { > struct { > uint32_t len; > - uint8_t reserved0[3]; > + uint8_t hdr_flags; > + uint8_t reserved0[2]; > uint8_t version; > uint32_t blk0_len; > uint8_t pbt;
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index b0810c9191..59ec81181d 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -431,6 +431,13 @@ S390IPLCertificateStore *s390_ipl_get_certificate_store(void) return &ipl->cert_store; } +static bool s390_has_certificate(void) +{ + S390IPLState *ipl = get_ipl_device(); + + return ipl->cert_store.count > 0; +} + static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) { CcwDevice *ccw_dev = NULL; @@ -488,6 +495,19 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |= DIAG308_FLAGS_LP_VALID; + /* + * Secure boot in audit mode will perform + * if certificate(s) exist in the key store. + * + * IPL Information Report Block (IIRB) will exist + * for secure boot in audit mode. + * + * Results of secure boot will be stored in IIRB. + */ + if (s390_has_certificate()) { + iplb->hdr_flags |= DIAG308_IPIB_FLAGS_IPLIR; + } + return true; } diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h index b8e7d1da71..2355fcecbb 100644 --- a/include/hw/s390x/ipl/qipl.h +++ b/include/hw/s390x/ipl/qipl.h @@ -23,6 +23,9 @@ #define MAX_CERTIFICATES 64 #define CERT_MAX_SIZE (1024 * 8) +#define DIAG308_IPIB_FLAGS_SIPL 0x40 +#define DIAG308_IPIB_FLAGS_IPLIR 0x20 + /* * The QEMU IPL Parameters will be stored at absolute address * 204 (0xcc) which means it is 32-bit word aligned but not @@ -104,7 +107,8 @@ typedef struct IplBlockQemuScsi IplBlockQemuScsi; union IplParameterBlock { struct { uint32_t len; - uint8_t reserved0[3]; + uint8_t hdr_flags; + uint8_t reserved0[2]; uint8_t version; uint32_t blk0_len; uint8_t pbt;
Add IPIB flags to IPL Parameter Block to determine if IPL needs to perform securely and if IPL Information Report Block (IIRB) exists. Secure boot in audit mode will perform if certificate(s) exist in the key store. IIRB will exist and results of verification will be stored in IIRB. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- hw/s390x/ipl.c | 20 ++++++++++++++++++++ include/hw/s390x/ipl/qipl.h | 6 +++++- 2 files changed, 25 insertions(+), 1 deletion(-)