@samitouri / QOSamiQemu / commits / 2915eee92b

hw/s390x/ipl: Handle secure boot with multiple boot devices

The current approach to enable secure boot relies on providing secure-boot and boot-certs parameters of s390-ccw-virtio machine type option, which apply to all boot devices. With the possibility of multiple boot devices, secure boot expects all provided devices to be supported and eligible (e.g., virtio-blk/virtio-scsi using the SCSI scheme). If multiple boot devices are provided and include an unsupported (e.g., ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will terminate with an error logged to the console. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-31-zycai@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>

Zhuoying Cai committed Jul 30, 2026 at 17:46 UTC 2915eee92b9458c48d3afa7f6ea72b795931da00
2 files changed +38 -5
hw/s390x/ipl.c
+38 -2
@@ -504,6 +504,37 @@ static void s390_set_secure_boot_flags(IplParameterBlock *iplb,
504 iplb->len = cpu_to_be32(S390_IPLB_MAX_LEN);
505 }
506
507 +static bool s390_validate_secure_boot_device(int devtype, Error **errp)
508 +{
509 + switch (devtype) {
510 + case CCW_DEVTYPE_VFIO:
511 + error_setg(errp, "Passthrough (vfio) CCW device does not support secure boot!");
512 + return false;
513 + case CCW_DEVTYPE_VIRTIO_NET:
514 + error_setg(errp, "Virtio net boot device does not support secure boot!");
515 + return false;
516 + default:
517 + return true;
518 + }
519 +}
520 +
521 +static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype,
522 + bool secure_boot, bool audit_mode)
523 +{
524 + Error *local_error = NULL;
525 +
526 + if (!secure_boot && !audit_mode) {
527 + return;
528 + }
529 +
530 + if (!s390_validate_secure_boot_device(devtype, &local_error)) {
531 + error_report_err(local_error);
532 + exit(1);
533 + }
534 +
535 + s390_set_secure_boot_flags(iplb, secure_boot, audit_mode);
536 +}
537 +
538 static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
539 {
540 CcwDevice *ccw_dev = NULL;
@@ -560,14 +591,19 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
591 s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
592 iplb->flags |= DIAG308_FLAGS_LP_VALID;
593
563 - s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(),
564 - s390_has_certificate());
594 + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
595 + s390_has_certificate());
596
597 return true;
598 }
599
600 pbdev = s390_get_pci_device(dev_st, &devtype);
601 if (pbdev) {
602 + if (s390_secure_boot_enabled() || s390_has_certificate()) {
603 + error_report("Virtio pci boot device does not support secure boot!");
604 + exit(1);
605 + }
606 +
607 pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
608 if (pci_lp && strlen(pci_lp) > 0) {
609 lp = pci_lp;
pc-bios/s390-ccw/main.c
-3
@@ -308,9 +308,6 @@ static void ipl_ccw_device(void)
308 switch (cutype) {
309 case CU_TYPE_DASD_3990:
310 case CU_TYPE_DASD_2107:
311 - IPL_assert((boot_mode == ZIPL_BOOT_MODE_NORMAL),
312 - "Passthrough (vfio) CCW device does not support secure boot!");
313 -
311 dasd_ipl(blk_schid, cutype);
312 break;
313 case CU_TYPE_VIRTIO: