On 8/12/26 11:21 AM, Joshua Daley wrote:
In the PCI boot device case of s390_build_iplb(), call
s390_apply_secure_boot() to update the IPLB when secure boot or audit
mode are enabled.
Secure IPL is now supported for virtio-blk-pci boot devices.
Signed-off-by: Joshua Daley <[email protected]>
---
hw/s390x/ipl.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c78..b0da3cbb27 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
pbdev = s390_get_pci_device(dev_st, &devtype);
if (pbdev) {
- if (s390_secure_boot_enabled() || s390_has_certificate()) {
- error_report("Virtio pci boot device does not support secure
boot!");
- exit(1);
- }
-
pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm",
NULL);
if (pci_lp && strlen(pci_lp) > 0) {
lp = pci_lp;
@@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
iplb->flags |= DIAG308_FLAGS_LP_VALID;
+ s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
+ s390_has_certificate());
+
return true;
}
Reviewed-by: Jared Rossi <[email protected]>
