Reviewed-by: Zhuoying Cai <[email protected]>
On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
>
> Secure IPL is now supported for virtio-blk-pci boot devices.
>
> Signed-off-by: Joshua Daley <[email protected]>
> ---
> hw/s390x/ipl.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c78..b0da3cbb27 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st,
> IplParameterBlock *iplb)
>
> pbdev = s390_get_pci_device(dev_st, &devtype);
> if (pbdev) {
> - if (s390_secure_boot_enabled() || s390_has_certificate()) {
> - error_report("Virtio pci boot device does not support secure
> boot!");
> - exit(1);
> - }
> -
> pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm",
> NULL);
> if (pci_lp && strlen(pci_lp) > 0) {
> lp = pci_lp;
> @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st,
> IplParameterBlock *iplb)
> s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
> iplb->flags |= DIAG308_FLAGS_LP_VALID;
>
> + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
> + s390_has_certificate());
> +
> return true;
> }
>
