Re: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

[Jared Rossi <jrossi@linux.ibm.com>]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
>
> Secure IPL is now supported for virtio-blk-pci boot devices.
>
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
> ---
>   hw/s390x/ipl.c | 8 +++-----
>   1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c78..b0da3cbb27 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>   
>       pbdev = s390_get_pci_device(dev_st, &devtype);
>       if (pbdev) {
> -        if (s390_secure_boot_enabled() || s390_has_certificate()) {
> -            error_report("Virtio pci boot device does not support secure boot!");
> -            exit(1);
> -        }
> -
>           pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
>           if (pci_lp && strlen(pci_lp) > 0) {
>               lp = pci_lp;
> @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>           s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>           iplb->flags |= DIAG308_FLAGS_LP_VALID;
>   
> +        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
> +                               s390_has_certificate());
> +
>           return true;
>       }
>   

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>