From nobody Wed Aug 26 07:25:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1786548139; cv=none; d=zohomail.com; s=zohoarc; b=AzBNqMvp0BCkBQfH5BtAk0X+TI2SViLtHV6ZWv67NTcTMo6yezq6djK0ADKzstTXNnPyRb7iTY/PRDMvyBQhi1i88A64z4kpRG7eS6yadzxdiz3SutuyJIMhGUjfEyuDwrkdkXXA50gT3kw8ApmdGVq2QVqc6+LAoYs7+FQex3g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1786548139; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XnvcytaxzBWsti3q/wFAhz65I4nqWmdC67U8fj1MKX4=; b=gwpf2JDt4gKHhZzclgnA/MPTLX5RXZSe8TltCndADBSSxD9z4psjmMEZNknKoaDufRaLooaj5/P6D0q4dZT7Gf0/kO7twICiJCLUrHiDA9BOljtRZKMdxIe69v16d6/Vnp6xjGurIjmGG7GJbTS1x3n04tif84JAdEN8GuwZZ0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1786548139809201.70822558546763; Wed, 12 Aug 2026 08:22:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wuAmD-0002jM-Qi; Wed, 12 Aug 2026 11:21:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAll-0002L4-OY; Wed, 12 Aug 2026 11:21:33 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAli-0000Lz-1G; Wed, 12 Aug 2026 11:21:28 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CE1UWK3686520; Wed, 12 Aug 2026 15:21:17 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvm9u7c9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:17 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CFBG3Q003223; Wed, 12 Aug 2026 15:21:16 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxhfy6e1c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:16 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CFLD4731457788 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 15:21:13 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F2E412004B; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C74CD20043; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav07.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id B02A7161222; Wed, 12 Aug 2026 17:21:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=XnvcytaxzBWsti3q/ wFAhz65I4nqWmdC67U8fj1MKX4=; b=TP6zddMEXld/2mOHbjD5+zsC7UMeHIfXR 6CIC3PgFiKZB9ZInGhE5MdTRtRSB0dWBDrVAyS8E94X1elrT3wVjcvu4sjIFzEwV nDaYSEKPN32VvZ/Te2HNAGCEtGI9hbVmxz6XUftZ5YWFBKsFnthMcxnUjwbcDy1U /LOh8UeooDqEwAUM+XWrhTJEeiv5sFDGaJzrOJZAzvkyqPxI5sfhfr0qHrcFIacJ FOppmrkvHGGKf+m2UoELSkZ6thjuOXtyYe0EAG+/HzIwI6XrHE31sRYNqtFZwpJj PqLOjQxFuTV55ZJ9p1KoLnoIJNJ5Yz12cddK1GV7LaVSrrzLZE13A== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder Date: Wed, 12 Aug 2026 17:21:10 +0200 Message-ID: <20260812152112.3330493-2-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812152112.3330493-1-jdaley@linux.ibm.com> References: <20260812152112.3330493-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX6NkKfJEEKSr5 VTMSQHg4FD1HWQkVNRP7cguWqoJFGRG2NCy//5Nf/yVIQyKrUvikdoHaBxcxb7XDmRj8C6jcu90 yu3lm7sL+3TvZ+vdQy/G2lhz+GxdsYCVsY0MpinbuFwEJBaHrvyZwwv8NRftCCSKNK1zxirH6Q5 gU+XbF7tCAv+L+XtQjawvXdIKsXJGgrVmtqL6OTxyXvMrhho7dwwB0vhnpAIsXst6ItAmHMC7xd mFdPsiTgQYnVadWStQUVqXYdy9CwpkVM3ZHlpPN6Er242VhXTmYfgb+N/2qggHH07jaryMmSCGo 5xzf7Q7HKF1FGGeIhrMZ1ZGu9gM8Bw5Aeb+Ed1tZHf8QfrZI7KbNghrqzU2M+6cWw0HneQMjI7m zLNu4ndilv78kZqwA7DUvRthWYf0xYEuV5hKwvouq4RhT44w3r+8QrnnrqWcnmKZLZV0PUdk1sv LE2EkM5HFL8t8Mhortg== X-Proofpoint-ORIG-GUID: nK6ilDJBIXnRYcl9fqNMVfkAFgnFS6cj X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX2hwDTZmO/dPX KTa0ycEtQwEcJqOQf8L1Lhuwf3rOs2V9bhsW1u6ljVbL46Eg1yL4XsU9YSr52QgqNNxN5iUe3aK mYVEtlhDt5uipv6hebc9Uxy8XnKhvZo= X-Authority-Analysis: v=2.4 cv=IfK3n2qa c=1 sm=1 tr=0 ts=6a7c8f6d cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=4QctWtjvTb62bRHQMjcA:9 X-Proofpoint-GUID: nK6ilDJBIXnRYcl9fqNMVfkAFgnFS6cj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_04,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120122 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=jdaley@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1786548142079158500 Content-Type: text/plain; charset="utf-8" In the PCI boot device case of s390_build_iplb(), call s390_apply_secure_boot() to update the IPLB when secure boot or audit mode are enabled. Secure IPL is now supported for virtio-blk-pci boot devices. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato Reviewed-by: Zhuoying Cai --- hw/s390x/ipl.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d59ed36c78..b0da3cbb27 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) =20 pbdev =3D s390_get_pci_device(dev_st, &devtype); if (pbdev) { - if (s390_secure_boot_enabled() || s390_has_certificate()) { - error_report("Virtio pci boot device does not support secure b= oot!"); - exit(1); - } - pci_lp =3D object_property_get_str(OBJECT(pbdev->pdev), "loadparm"= , NULL); if (pci_lp && strlen(pci_lp) > 0) { lp =3D pci_lp; @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); + return true; } =20 --=20 2.34.1 From nobody Wed Aug 26 07:25:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1786548139; cv=none; d=zohomail.com; s=zohoarc; b=FVYSYc3w+5avYbC8zdG6brlvr2zIJyzBwlnwSc93rR1XNBP57durcxvI4GHo2Av2X5NMPMMQJFyCxEl8svyS92oEedg3DFCFyPMFq9UwiYjFzHeANHRksXRDwdACJ3VI1ayDn5Dvf/QGjwDOC9CWhB+nFAQ15bYkFQ4nSor6Oko= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1786548139; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CB5iv2BxgL9xivzvafmvxSK1Er6Cd04y+IRMncQ+/I8=; b=WRa9F+YukVIanEJIrSiribyDGSdR7Y9sSbTJKQPAAow6MNUUJeMgxJqU6gRYMrY0GK891nOg/78DxgkSv+KicozxnT1RjYOkvFrImVBuufh+1qqkaG5Ew5ZN3w4FwIJdDKZ5II/eOjNpTMdLN8rekuhk+zRGWqhzl1NIJ7LBvj8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1786548139564779.1466445459819; Wed, 12 Aug 2026 08:22:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wuAm9-0002ao-Gs; Wed, 12 Aug 2026 11:21:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAll-0002L3-Oe; Wed, 12 Aug 2026 11:21:33 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAlh-0000M0-S6; Wed, 12 Aug 2026 11:21:27 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CE2P6U2587089; Wed, 12 Aug 2026 15:21:17 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fyb23uq33-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:17 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CFBI3C003241; Wed, 12 Aug 2026 15:21:16 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxhfy6e1e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:16 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CFLDUf47448326 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 15:21:13 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0B5972004E; Wed, 12 Aug 2026 15:21:13 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CC40920043; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id B2AF0161298; Wed, 12 Aug 2026 17:21:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=CB5iv2BxgL9xivzva fmvxSK1Er6Cd04y+IRMncQ+/I8=; b=CTdc1+mkvZUResJRAvA+20n9BJFljLozK 03q0UAfTNAIrRlAgqnP9gOW72FOUiVZ2Hh1+dkfcJPvIblhhuVM5QYAB08UaHhXV HYYOmEMKI27Oo9Pzf6+CPXFkj4EbjYcuMAEC5OzkZ5MOSZGWMYo/nh//IMuiJBQm cRW2jx/w7ouRw7ixdo1PJNaAjlzsZ0LvEjaPPchsKCNAy8QtTW3ZXfXf82hLB7eb iT7FvNqAM9Wh457YQDd40+tGpXWVjb/W/s8pMvmvzGuK16HyHWRajW9s1/WS9g1G B0BzxFfpum2SjoWSi3Fz8iyadx28Yedb5xcHvMNMljAhSZf41ONDQ== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v1 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor Date: Wed, 12 Aug 2026 17:21:11 +0200 Message-ID: <20260812152112.3330493-3-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812152112.3330493-1-jdaley@linux.ibm.com> References: <20260812152112.3330493-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XqfK/1F9 c=1 sm=1 tr=0 ts=6a7c8f6d cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=UZxYUTtkSsvthtqRCrcA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX1y+DlaVfZT18 9N/Y5hdXqoo9OVJ+kPvGK5Hebmi+Kfv+HNLGxte3JEaFXvBSzVILzaDgjTkKjBM1137UtC81tjT dBgY+/ZEp6Vc7yv4Ig9SY/jC0Lf9kjKTNZW5Oin28ZqfG5Q4fyH/U2S0r6i4DR/GQOtaCfuM5kv Mmgfxja5PMybDb7/Ypsrk+2gz1OqSJIgG+GVB9lfNN1opGxjxpGghbcJp1t3kWsKC5+yT1WgZui BLEqJDyMP5Pc2FEtwg6ZyK8pH6CJbTkYRdV9zyaCc+CfqoQASBHqltlcqKGakHa90YzIsOV6zWj lNekVRaXu4E2dD8XGBMT/ODsKGwl0qqOY19VEd3RdPcvEMbv2SdJmSk8SG/3KhQeNuZ0M+VyEmF WZ+mluOP5T1XHSe5QFgU2JL5i8OCGP7i1CIUWnYJ5SQPxsS4zQLLnJwFOzlN2vTJXWwMQouGDiH MBTkJH7wI9fq/GvMnpg== X-Proofpoint-ORIG-GUID: VWcc9MrdVpF2tA5tRgN_jA4i2PPVyqPS X-Proofpoint-GUID: VWcc9MrdVpF2tA5tRgN_jA4i2PPVyqPS X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX0h8cpuQTnwYD 9w7VXPC90t48Oui76qBL798RkwPA56CHqMamGCxarwgyBA1BSt2mMEgfq6tINaG2GKjaQnMQ+/u +B9pECRJAeSzlKdgeoN1UTfBLMgrDIw= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_04,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120122 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1786548140226158500 Content-Type: text/plain; charset="utf-8" Currently, if secure IPL is not supported by the hypervisor, the test will fail because "Verified component" never appears. One must inspect the console log to observe the cause of the failure. Add a check that skips the test if the host CPU model is missing the secure IPL facilities. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato Reviewed-by: Zhuoying Cai --- tests/functional/s390x/test_secure_ipl.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 06fc93e404..5af36b91d8 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -29,6 +29,22 @@ def __init__(self, *args, **kwargs): self.cert_path =3D None self.prompt =3D None =20 + def _require_host_secure_ipl_support(self, vm): + """ + Skip the test if the host CPU model does not expose the Secure IPL + facilities (sipl, sclaf, cstore). + """ + props =3D vm.cmd('query-cpu-model-expansion', + model=3D{'name': 'host'}, + type=3D'full')['model']['props'] + missing =3D [f for f in ('sipl', 'sclaf', 'cstore') + if not props.get(f)] + if missing: + self.skipTest( + f"Host CPU does not support Secure IPL: " + f"missing feature(s): {', '.join(missing)}. " + f"Secure IPL requires a z16+ host.") + def _create_certificate(self, vm): """Generate x509 certificate""" exec_command_and_wait_for_pattern(self, @@ -107,6 +123,8 @@ def setup_s390x_secure_ipl(self): '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') temp_vm.launch() =20 + self._require_host_secure_ipl_support(temp_vm) + # Initial root account setup (Fedora first boot screen) self.root_password =3D 'fedora40password' wait_for_console_pattern(self, 'Please make a selection from the a= bove', --=20 2.34.1 From nobody Wed Aug 26 07:25:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1786548139; cv=none; d=zohomail.com; s=zohoarc; b=CH7gFnV1gg8xD2DQcX5j9AmtI8NFxNXQqZtY2cAFL9Cu4B5bh8D7ux/m+VeLGaBjD0BjBoqe5a3z2IEm/7CaIK693XFvlitPuyyrgn8HMC+dRSJu6aXo4AZZub2zOiOsJKxjZW0Kv3luWJmKKO1xQ4v5H6gFb7x8eQBv5glu6ec= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1786548139; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/gE2WI+bR/jaAHNZ7AlLTpuNoPDWuJrSNr4QOXJxD40=; b=Nn/kmEQ0vg0Qw6kKn0vUBxvVO7paykhU7GiLx2a+h+wQPh6lBrRMfTwls70j1PqE42DqT6Zqdg8Xa4bYCHuO+lvSJuH94CKGS+hkE5RwMKlPId2g7AeAH8J5OH7Mhu0UzS/72tr40nrAhVu2pnylsMsox+r0GTvCK+bj8PTgqes= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1786548139942114.56296557866949; Wed, 12 Aug 2026 08:22:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wuAmE-0002l7-BN; Wed, 12 Aug 2026 11:21:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAll-0002Kt-Nv; Wed, 12 Aug 2026 11:21:33 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuAli-0000M7-6c; Wed, 12 Aug 2026 11:21:28 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CE1aGm2585425; Wed, 12 Aug 2026 15:21:18 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fyb23uq34-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:17 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CFBI1w006170; Wed, 12 Aug 2026 15:21:17 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fxfsjxmgj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 15:21:17 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CFLD5e45154580 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 15:21:13 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 112022004F; Wed, 12 Aug 2026 15:21:13 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE7122004B; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 12 Aug 2026 15:21:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id B525C1612A6; Wed, 12 Aug 2026 17:21:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=/gE2WI+bR/jaAHNZ7 AlLTpuNoPDWuJrSNr4QOXJxD40=; b=KaYxYgC+J4elRpWPwvTRljxxSZYrlQ+P1 I8W/FAiG54EZe4MEVDoGCVBtFoxwkkZ0yDt6snGT4JfR51WkIllrXxZ4bqGaKdsd /vwIp2tF4yrpWTuLcoHxVahnCwry/3pbzBBzEq2Eg894DX7O7qELPnpJxQQcMDBg difAQ5dCTugu8t6cI4kZKwrFg5wWfYy6GyR2ghxKVWXZuUQLpr3OdbXvxlWC9LDe 0rZ01+BN8UiHnq0bK49SWhzz5kgb/jjFjoKd0H0yO9XGyB87rZq8fsZcwHnjFWqD andxAQ2vsatK5N8aBqXf+WYjEkv3zlQAUVgeUyWPGf55TkaLB2hvQ== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v1 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case Date: Wed, 12 Aug 2026 17:21:12 +0200 Message-ID: <20260812152112.3330493-4-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812152112.3330493-1-jdaley@linux.ibm.com> References: <20260812152112.3330493-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XqfK/1F9 c=1 sm=1 tr=0 ts=6a7c8f6d cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=ZcxCWl5dgxcWn7WeAwEA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX1D4VewVYUF0B v1+JSkzhFenEotjrBAegt7M3XehKoLibtJ9uXw+4KefYbtLnm3oumxV71FdX6WSl+ooei3oKFTM au8fQ3GwiPN6x10ezs+4GLvt3A+QwaTtiYbt7wb24CKHY9MVHSjMtEytRqG8UN1pXTRnGxy8G66 MtPhcEpsaQxtQU2kLe77oTaEBLEMGsboKM7lfAzAZ4sQNQk1hFF8RtfUGz8pFU+tftkJxpF7jKL t9Ec9vFGazFs6uFi+1ymcUMOsNjb3Bm0ViqFYMDHKbOJavdagUUx6yE78OuhjRQbp2H3R1LtSz9 wyCYam2M/QH7nRAy4ND9mjUEe5mI8j9B+c5xbTDvewKI6434NUJzzyrcE2sv8qF1igDMJO/T4+A MQPQZq1UED0x8alD+4HRiaEvPUIDjebrvxsIcN//bowfNA7dY1I+ptfsrADylDIUXoNskGpqP+F 4KgNG2+/SZqQqI8Imtg== X-Proofpoint-ORIG-GUID: o6DRWGfBz5J10ICBp999zei-1wpZzCeI X-Proofpoint-GUID: o6DRWGfBz5J10ICBp999zei-1wpZzCeI X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDEyMiBTYWx0ZWRfX3kHOSOmTYGGw aokH1DmpF+GvdhK1xnKxtGBDwtf2hlDQOqPMC77dYbDGH2mNQtNFtehR7qCELTrX67Uujdzpik7 /Ym8CYRPPHIcwq8YOFS/XqbR2T9UOFM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_04,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120122 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1786548142079158501 Content-Type: text/plain; charset="utf-8" Split test_s390x_secure_ipl() into two subtests. Each tests with a different boot device: virtio-blk-ccw or virtio-blk-pci. Use a state var such that the setup is run only once. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi --- tests/functional/s390x/test_secure_ipl.py | 70 +++++++++++++++-------- 1 file changed, 47 insertions(+), 23 deletions(-) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 5af36b91d8..7fd4cfeaab 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -28,6 +28,7 @@ def __init__(self, *args, **kwargs): self.qcow2_path =3D None self.cert_path =3D None self.prompt =3D None + self.setup_done =3D False =20 def _require_host_secure_ipl_support(self, vm): """ @@ -150,41 +151,64 @@ def setup_s390x_secure_ipl(self): =20 # Shutdown temp vm temp_vm.shutdown() + self.setup_done =3D True =20 - @skipBigDataTest() - def test_s390x_secure_ipl(self): + def verify_s390x_secure_ipl(self, boot_dev_bus: str): """ Verify secure boot validation during s390x guest boot. =20 Expects two "Verified component" messages and confirms /sys/firmware/ipl/secure reports secure boot is active. """ - self.require_accelerator('kvm') - self.setup_s390x_secure_ipl() - - self.set_machine('s390-ccw-virtio') - - self.vm.set_console() - self.vm.add_args('-nographic', - '-machine', 's390-ccw-virtio,secure-boot=3Don,' - f'boot-certs.0.path=3D{self.cert_path}', - '-accel', 'kvm', - '-m', '1024', - '-drive', - f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', - '-device', 'virtio-blk-ccw,drive=3Ddrive1,bootind= ex=3D1') - self.vm.launch() + if boot_dev_bus not in ['ccw', 'pci']: + raise ValueError( + f"boot_dev_bus must be 'ccw' or 'pci', got {boot_dev_bus}") + + vm =3D self.get_vm(name=3Df'sipl_test_vblk_{boot_dev_bus}') + vm.set_machine('s390-ccw-virtio') + + vm.set_console() + vm.add_args('-nographic', + '-machine', 's390-ccw-virtio,secure-boot=3Don,' + f'boot-certs.0.path=3D{self.cert_path}', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{self.qc= ow2_path}', + '-device', + f'virtio-blk-{boot_dev_bus},drive=3Ddrive1,bootindex= =3D1') + vm.launch() =20 # Expect two verified components verified_output =3D "Verified component" - wait_for_console_pattern(self, verified_output) - wait_for_console_pattern(self, verified_output) + wait_for_console_pattern(self, verified_output, vm=3Dvm) + wait_for_console_pattern(self, verified_output, vm=3Dvm) =20 # Login and verify the vm is booted using secure boot - wait_for_console_pattern(self, 'localhost login:') - exec_command_and_wait_for_pattern(self, 'root', 'Password:') - exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt) - exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/sec= ure', '1') + wait_for_console_pattern(self, 'localhost login:', vm=3Dvm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= vm) + exec_command_and_wait_for_pattern( + self, self.root_password, self.prompt, vm=3Dvm) + exec_command_and_wait_for_pattern( + self, 'cat /sys/firmware/ipl/secure', '1', vm=3Dvm) + + vm.shutdown() + + @skipBigDataTest() + def test_s390x_secure_ipl_ccw(self): + """Test secure IPL with a virtio-blk-ccw boot device.""" + self.require_accelerator('kvm') + if not self.setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('ccw') + + @skipBigDataTest() + def test_s390x_secure_ipl_pci(self): + """Test secure IPL with a virtio-blk-pci boot device.""" + self.require_accelerator('kvm') + if not self.setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('pci') =20 if __name__ =3D=3D '__main__': QemuSystemTest.main() --=20 2.34.1