In the PCI boot device case of s390_build_iplb(), call s390_apply_secure_boot() to update the IPLB when secure boot or audit mode are enabled.
Secure IPL is now supported for virtio-blk-pci boot devices. Signed-off-by: Joshua Daley <[email protected]> Reviewed-by: Jared Rossi <[email protected]> Reviewed-by: Zhuoying Cai <[email protected]> Reviewed-by: Matthew Rosato <[email protected]> --- hw/s390x/ipl.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d59ed36c78..b0da3cbb27 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) pbdev = s390_get_pci_device(dev_st, &devtype); if (pbdev) { - if (s390_secure_boot_enabled() || s390_has_certificate()) { - error_report("Virtio pci boot device does not support secure boot!"); - exit(1); - } - pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL); if (pci_lp && strlen(pci_lp) > 0) { lp = pci_lp; @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |= DIAG308_FLAGS_LP_VALID; + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); + return true; } -- 2.34.1
