Commit 3d873683e4 for qemu.org

commit 3d873683e4ef3d1d1b8f7232b83012c0f86a2f25
Author: Joshua Daley <jdaley@linux.ibm.com>
Date:   Thu Sep 3 17:58:03 2026 +0200

    hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

    In the PCI boot device case of s390_build_iplb(), call
    s390_apply_secure_boot() to update the IPLB when secure boot or audit
    mode are enabled.

    Secure IPL is now supported for virtio-blk-pci boot devices.

    Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
    Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
    Reviewed-by: Zhuoying Cai <zycai@linux.ibm.com>
    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
    Link: https://lore.kernel.org/qemu-devel/20260903155805.1881366-2-jdaley@linux.ibm.com
    Signed-off-by: Eric Farman <farman@linux.ibm.com>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c78..b0da3cbb27 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)

     pbdev = s390_get_pci_device(dev_st, &devtype);
     if (pbdev) {
-        if (s390_secure_boot_enabled() || s390_has_certificate()) {
-            error_report("Virtio pci boot device does not support secure boot!");
-            exit(1);
-        }
-
         pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
         if (pci_lp && strlen(pci_lp) > 0) {
             lp = pci_lp;
@@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
         s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
         iplb->flags |= DIAG308_FLAGS_LP_VALID;

+        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
+                               s390_has_certificate());
+
         return true;
     }