Re: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

Reviewed-by: Zhuoying Cai <[email protected]>

On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
> 
> Secure IPL is now supported for virtio-blk-pci boot devices.
> 
> Signed-off-by: Joshua Daley <[email protected]>
> ---
>  hw/s390x/ipl.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c78..b0da3cbb27 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>  
>      pbdev = s390_get_pci_device(dev_st, &devtype);
>      if (pbdev) {
> -        if (s390_secure_boot_enabled() || s390_has_certificate()) {
> -            error_report("Virtio pci boot device does not support secure boot!");
> -            exit(1);
> -        }
> -
>          pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
>          if (pci_lp && strlen(pci_lp) > 0) {
>              lp = pci_lp;
> @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>          s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>          iplb->flags |= DIAG308_FLAGS_LP_VALID;
>  
> +        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
> +                               s390_has_certificate());
> +
>          return true;
>      }
>