The Linux kernel does not preserve hdr_flags in the IPLB across a reboot, causing secure IPL flags to be lost on re-IPL.
Set secure IPL flasg from s390_ipl_update_diag308() to restore the flags from the current machine configuration. Device validation is skipped here as it was already enforced during initial boot. Signed-off-by: Zhuoying Cai <[email protected]> --- hw/s390x/ipl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index f4e01b6918..f970b34126 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -737,6 +737,14 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) } else { ipl->iplb = *iplb; ipl->iplb_valid = true; + + /* + * The kernel does not preserve secure boot flags across a reboot. + * Re-apply them here based on the current machine configuration. + */ + s390_set_secure_boot_flags(&ipl->iplb, + s390_secure_boot_enabled(), + s390_has_certificate()); } update_machine_ipl_properties(iplb); -- 2.54.0
