Re: [PATCH v12 32/35] s390x/ipl: re-apply secure boot flags on DIAG 308 reboot

[Jared Rossi <jrossi@linux.ibm.com>]

On 7/1/26 4:49 PM, Zhuoying Cai wrote:
> The Linux kernel does not preserve hdr_flags in the IPLB across a
> reboot, causing secure IPL flags to be lost on re-IPL.
>
> Set secure IPL flasg from s390_ipl_update_diag308() to restore the
s/flasg/flags

> flags from the current machine configuration.  Device validation is
> skipped here as it was already enforced during initial boot.
>
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> ---
>   hw/s390x/ipl.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index f4e01b6918..f970b34126 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -737,6 +737,14 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb)
>       } else {
>           ipl->iplb = *iplb;
>           ipl->iplb_valid = true;
> +
> +        /*
> +         * The kernel does not preserve secure boot flags across a reboot.
> +         * Re-apply them here based on the current machine configuration.
> +         */
> +        s390_set_secure_boot_flags(&ipl->iplb,
> +                                   s390_secure_boot_enabled(),
> +                                   s390_has_certificate());
>       }
>   
>       update_machine_ipl_properties(iplb);
Can this be included with the initial implementation of true secure IPL, 
or maybe even earlier with audit?  I can't imagine any scenario where 
secure IPL is intended to be cleared on reboot, so adding this as a 
later feature doesn't seem to make sense.

Regards,
Jared Rossi