On 7/1/26 11:47 PM, Jared Rossi wrote:
On 7/1/26 4:49 PM, Zhuoying Cai wrote:
The Linux kernel does not preserve hdr_flags in the IPLB across a
reboot, causing secure IPL flags to be lost on re-IPL.
Set secure IPL flasg from s390_ipl_update_diag308() to restore the
s/flasg/flags
flags from the current machine configuration. Device validation is
skipped here as it was already enforced during initial boot.
Signed-off-by: Zhuoying Cai <[email protected]>
---
hw/s390x/ipl.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index f4e01b6918..f970b34126 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -737,6 +737,14 @@ void s390_ipl_update_diag308(IplParameterBlock
*iplb)
} else {
ipl->iplb = *iplb;
ipl->iplb_valid = true;
+
+ /*
+ * The kernel does not preserve secure boot flags across a
reboot.
+ * Re-apply them here based on the current machine
configuration.
+ */
+ s390_set_secure_boot_flags(&ipl->iplb,
+ s390_secure_boot_enabled(),
+ s390_has_certificate());
}
update_machine_ipl_properties(iplb);
Can this be included with the initial implementation of true secure IPL,
or maybe even earlier with audit? I can't imagine any scenario where
secure IPL is intended to be cleared on reboot, so adding this as a
later feature doesn't seem to make sense.
I agree, this should be folded into an earlier patch, wherever it makes
most sense. Unless I am missing something? Everything else here lgtm. If
there is some reason this needs to stay separate, I'd provide my Rb.
