The following changes since commit fe11f459f640cd08f35c21f9d403517951bfd671:
Merge tag 'fixes-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-08-25 06:48:55 -0700) are available in the Git repository at: https://gitlab.com/efarman/qemu.git tags/s390x-20260826 for you to fetch changes up to 5c3c500cddbdea58bb76515847d1d515621dcf0b: pc-bios/s390-ccw.img: update s390x bios (2026-08-26 07:05:48 -0400) ---------------------------------------------------------------- New s390x features for 11.2 - hardening fixes in css/sclp code - enable secure IPL - regenerate s390-ccw.img ---------------------------------------------------------------- Christian Borntraeger (2): s390x/sclp: pv: only copy the original SCCB buffer s390x/css: Fix css stsch detection to go beyond 8192 devices Collin L. Walling (2): s390x/diag: Introduce DIAG 508 for secure IPL operations s390x/diag: Implement DIAG 508 subcode 1 for signature verification Eric Farman (1): pc-bios/s390-ccw.img: update s390x bios Zhuoying Cai (32): Add boot-certs to s390-ccw-virtio machine type option crypto/x509-utils: Refactor with GNUTLS fallback crypto/x509-utils: Add helper functions for certificate store hw/s390x/ipl: Create certificate store s390x/diag: Introduce DIAG 320 for Certificate Store Facility s390x/diag: Refactor address validation check from diag308_parm_check s390x/diag: Implement DIAG 320 subcode 1 crypto/x509-utils: Add helper functions for DIAG 320 subcode 2 s390x/diag: Implement DIAG 320 subcode 2 hw/s390x: Define finite size for single entry VCEntry crypto/x509-utils: Add helper functions for DIAG 508 subcode 1 s390x/diag: Generalize s390_ipl_read/write to accept void * s390x/ipl: Introduce IPL Information Report Block (IIRB) pc-bios/s390-ccw: Define memory for IPLB and convert IPLB to pointers hw/s390x/ipl: Add IPIB flags to IPL Parameter Block hw/s390x/ipl: Rework s390_ipl_map_iplb_chain for certificate storage s390x: Guest support for Secure-IPL Facility pc-bios/s390-ccw: Refactor zipl_run() pc-bios/s390-ccw: Rework zipl_load_segment function pc-bios/s390-ccw: Introduce ZiplBootMode enum for IPL mode selection pc-bios/s390-ccw: Add signature verification for secure IPL in audit mode pc-bios/s390-ccw: Add signed component address overlap checks s390x: Guest support for Secure-IPL Code Loading Attributes Facility (SCLAF) pc-bios/s390-ccw: Add additional security checks for secure boot Add secure-boot to s390-ccw-virtio machine type option hw/s390x/ipl: Set IPIB flags for secure IPL pc-bios/s390-ccw: Handle true secure IPL mode hw/s390x/ipl: Handle secure boot with multiple boot devices tests/functional/s390x: Add secure IPL functional test docs/specs: Add secure IPL documentation docs/system/s390x: Add secure IPL documentation MAINTAINERS: Add secure IPL files to S390-ccw boot group MAINTAINERS | 5 + crypto/meson.build | 2 +- crypto/x509-utils.c | 409 +++++++++++++++ docs/specs/index.rst | 1 + docs/specs/s390x-secure-ipl.rst | 197 ++++++++ docs/system/s390x/secure-ipl.rst | 184 +++++++ docs/system/target-s390x.rst | 1 + hw/s390x/cert-store.c | 244 +++++++++ hw/s390x/cert-store.h | 38 ++ hw/s390x/css.c | 3 +- hw/s390x/ipl.c | 128 ++++- hw/s390x/ipl.h | 29 +- hw/s390x/meson.build | 1 + hw/s390x/s390-virtio-ccw.c | 70 +++ hw/s390x/sclp.c | 4 +- include/crypto/x509-utils.h | 113 +++++ include/hw/s390x/ipl/diag308.h | 34 ++ include/hw/s390x/ipl/diag320.h | 118 +++++ include/hw/s390x/ipl/diag508.h | 45 ++ include/hw/s390x/ipl/qipl.h | 113 ++++- include/hw/s390x/s390-virtio-ccw.h | 5 + include/hw/s390x/sclp.h | 6 +- pc-bios/s390-ccw.img | Bin 104216 -> 112408 bytes pc-bios/s390-ccw/Makefile | 2 +- pc-bios/s390-ccw/bootmap.c | 108 +++- pc-bios/s390-ccw/bootmap.h | 22 + pc-bios/s390-ccw/iplb.h | 9 +- pc-bios/s390-ccw/jump2ipl.c | 13 +- pc-bios/s390-ccw/main.c | 59 ++- pc-bios/s390-ccw/netmain.c | 8 +- pc-bios/s390-ccw/s390-ccw.h | 27 + pc-bios/s390-ccw/sclp.c | 27 + pc-bios/s390-ccw/sclp.h | 7 + pc-bios/s390-ccw/secure-ipl.c | 561 +++++++++++++++++++++ pc-bios/s390-ccw/secure-ipl.h | 183 +++++++ qapi/machine-s390x.json | 23 + qapi/pragma.json | 1 + qemu-options.hx | 10 +- target/s390x/cpu_features.c | 7 + target/s390x/cpu_features.h | 1 + target/s390x/cpu_features_def.h.inc | 5 + target/s390x/cpu_models.c | 7 + target/s390x/diag.c | 576 +++++++++++++++++++++- target/s390x/gen-features.c | 7 + target/s390x/kvm/kvm.c | 34 ++ target/s390x/s390x-internal.h | 4 + target/s390x/tcg/misc_helper.c | 14 + tests/functional/s390x/meson.build | 2 + tests/functional/s390x/test_secure_ipl.py | 172 +++++++ 49 files changed, 3539 insertions(+), 100 deletions(-) create mode 100644 docs/specs/s390x-secure-ipl.rst create mode 100644 docs/system/s390x/secure-ipl.rst create mode 100644 hw/s390x/cert-store.c create mode 100644 hw/s390x/cert-store.h create mode 100644 include/hw/s390x/ipl/diag308.h create mode 100644 include/hw/s390x/ipl/diag320.h create mode 100644 include/hw/s390x/ipl/diag508.h create mode 100644 pc-bios/s390-ccw/secure-ipl.c create mode 100644 pc-bios/s390-ccw/secure-ipl.h create mode 100755 tests/functional/s390x/test_secure_ipl.py -- 2.55.0
