504
iplb->len = cpu_to_be32(S390_IPLB_MAX_LEN);
505
}
506
507
+static bool s390_validate_secure_boot_device(int devtype, Error **errp)
508
+{
509
+ switch (devtype) {
510
+ case CCW_DEVTYPE_VFIO:
511
+ error_setg(errp, "Passthrough (vfio) CCW device does not support secure boot!");
512
+ return false;
513
+ case CCW_DEVTYPE_VIRTIO_NET:
514
+ error_setg(errp, "Virtio net boot device does not support secure boot!");
515
+ return false;
516
+ default:
517
+ return true;
518
+ }
519
+}
520
+
521
+static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype,
522
+ bool secure_boot, bool audit_mode)
523
+{
524
+ Error *local_error = NULL;
525
+
526
+ if (!secure_boot && !audit_mode) {
527
+ return;
528
+ }
529
+
530
+ if (!s390_validate_secure_boot_device(devtype, &local_error)) {
531
+ error_report_err(local_error);
532
+ exit(1);
533
+ }
534
+
535
+ s390_set_secure_boot_flags(iplb, secure_boot, audit_mode);
536
+}
537
+
538
static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
539
{
540
CcwDevice *ccw_dev = NULL;
591
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
592
iplb->flags |= DIAG308_FLAGS_LP_VALID;
593
563
- s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(),
564
- s390_has_certificate());
594
+ s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
595
+ s390_has_certificate());
596
597
return true;
598
}
599
600
pbdev = s390_get_pci_device(dev_st, &devtype);
601
if (pbdev) {
602
+ if (s390_secure_boot_enabled() || s390_has_certificate()) {
603
+ error_report("Virtio pci boot device does not support secure boot!");
604
+ exit(1);
605
+ }
606
+
607
pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
608
if (pci_lp && strlen(pci_lp) > 0) {
609
lp = pci_lp;