@samitouri / QOSamiQemu / commits / fd76419574

pc-bios/s390-ccw: Handle true secure IPL mode

When secure boot is enabled (-secure-boot on) and certificate(s) are provided, the boot operates in True Secure IPL mode. Any verification error during True Secure IPL mode will cause the entire boot process to terminate. Secure IPL in audit mode requires at least one certificate provided in the key store along with necessary facilities. If secure boot is enabled but no certificate is provided, the boot process will also terminate, as this is not a valid secure boot configuration. Note: True Secure IPL mode is implemented for the SCSI scheme of virtio-blk/virtio-scsi devices. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-30-zycai@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>

Zhuoying Cai committed Jul 30, 2026 at 17:46 UTC fd764195745bce2448d1ce7afcb46c2d3495ec62
6 files changed +30 -3
docs/system/s390x/secure-ipl.rst
+13
@@ -66,3 +66,16 @@ Configuration:
66 .. code-block:: shell
67
68 qemu-system-s390x -machine s390-ccw-virtio,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ...
69 +
70 +Secure Mode
71 +^^^^^^^^^^^
72 +
73 +When the ``secure-boot=on`` option is set and certificates are provided,
74 +a secure boot is performed with error reporting enabled. The boot process aborts
75 +if any error occurs.
76 +
77 +Configuration:
78 +
79 +.. code-block:: shell
80 +
81 + qemu-system-s390x -machine s390-ccw-virtio,secure-boot=on,boot-certs.0.path=/.../qemu/certs,boot-certs.1.path=/another/path/cert.pem ...
hw/s390x/ipl.c
+2 -1
@@ -851,7 +851,8 @@ void s390_ipl_prepare_cpu(S390CPU *cpu)
851 * Secure IPL without specifying a boot device.
852 * IPLB is not generated if no boot device is defined.
853 */
854 - if (s390_has_certificate() && !ipl->iplb_valid) {
854 + if ((s390_has_certificate() || s390_secure_boot_enabled()) &&
855 + !ipl->iplb_valid) {
856 error_report("No boot device defined for Secure IPL");
857 exit(1);
858 }
pc-bios/s390-ccw/bootmap.c
+5 -1
@@ -743,6 +743,7 @@ static int zipl_run(ScsiBlockPtr *pte)
743 case ZIPL_BOOT_MODE_NORMAL:
744 rc = zipl_run_normal(&entry, tmp_sec);
745 break;
746 + case ZIPL_BOOT_MODE_SECURE:
747 case ZIPL_BOOT_MODE_SECURE_AUDIT:
748 rc = zipl_run_secure(&entry, tmp_sec, &comp_list, &cert_list, &tmp_cert_buf);
749 break;
@@ -762,7 +763,8 @@ static int zipl_run(ScsiBlockPtr *pte)
763
764 write_reset_psw(entry->compdat.load_psw);
765
765 - if (boot_mode == ZIPL_BOOT_MODE_SECURE_AUDIT) {
766 + if (boot_mode == ZIPL_BOOT_MODE_SECURE ||
767 + boot_mode == ZIPL_BOOT_MODE_SECURE_AUDIT) {
768 update_cert_list(&cert_list);
769 update_iirb(&comp_list, &cert_list);
770 free(tmp_cert_buf);
@@ -1130,6 +1132,8 @@ ZiplBootMode get_boot_mode(uint8_t hdr_flags)
1132
1133 if (!sipl_set && iplir_set) {
1134 return ZIPL_BOOT_MODE_SECURE_AUDIT;
1135 + } else if (sipl_set && iplir_set) {
1136 + return ZIPL_BOOT_MODE_SECURE;
1137 }
1138
1139 return ZIPL_BOOT_MODE_NORMAL;
pc-bios/s390-ccw/main.c
+6 -1
@@ -402,15 +402,20 @@ void main(void)
402
403 boot_mode = get_boot_mode(iplb->hdr_flags);
404 switch (boot_mode) {
405 + case ZIPL_BOOT_MODE_SECURE:
406 case ZIPL_BOOT_MODE_SECURE_AUDIT:
407 if (!secure_ipl_supported()) {
407 - panic("Unable to boot in audit mode");
408 + panic("Unable to boot in secure/audit mode");
409 }
410
411 vcssb_len = zipl_secure_get_vcssb();
412 if (vcssb_len == 0) {
413 panic("Failed to query certificate storage information!");
414 }
415 +
416 + if (vcssb_len == VCSSB_NO_VC) {
417 + panic("Need at least one certificate for secure boot!");
418 + }
419 break;
420 default:
421 break;
pc-bios/s390-ccw/s390-ccw.h
+1
@@ -90,6 +90,7 @@ void zipl_load(void);
90 typedef enum ZiplBootMode {
91 ZIPL_BOOT_MODE_NORMAL = 0,
92 ZIPL_BOOT_MODE_SECURE_AUDIT = 1,
93 + ZIPL_BOOT_MODE_SECURE = 2,
94 } ZiplBootMode;
95
96 extern ZiplBootMode boot_mode;
pc-bios/s390-ccw/secure-ipl.h
+3
@@ -59,6 +59,9 @@ static inline void zipl_secure_error(const char *message)
59 case ZIPL_BOOT_MODE_SECURE_AUDIT:
60 printf("AUDIT MODE WARNING: %s\n", message);
61 break;
62 + case ZIPL_BOOT_MODE_SECURE:
63 + panic(message);
64 + break;
65 default:
66 /*
67 * Errors are intentionally ignored in non-secure boot modes.