From nobody Sat Sep 26 21:37:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1787756347; cv=none; d=zohomail.com; s=zohoarc; b=PiOWju3LtXNTClwlsUIkJPl+5JQ0QRzO8IAj7JVQSPcU5TV67Zf133VHOcYkYCDv++6gB1B6YKWFNU44K0sgGFdxyOFX82K80NyIaky17Zq+W4s0BGUnFYBgM2ju1/m0Ff98NSbO8PTblpatyChHwHcDdUbKMSmOUAXNLXr4MPI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787756347; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7spCe3Y67e+3MfoY27xIuIU3+EB/uJwsVYFYmbA9LS0=; b=ccWAzucP/Js6/8TGNZBsM5Iai2Tc4yh5w1fQctnMUijGzLZ6Bs6s9eqOlk2dqY5FF+oai5NM57regkY09oMndf8qGw0FmUcMHhPCQu4BHh8Cwzl+nQKfMuJQGLmDfgqjwgg5P/z0+ZQEOoxPt4UPmLfh7qYHsnqzALsBUbG6Cb8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17877563475783.855045389892439; Wed, 26 Aug 2026 07:59:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wzF4w-0005IC-P3; Wed, 26 Aug 2026 10:58:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4t-00057E-PR; Wed, 26 Aug 2026 10:58:11 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4q-0000n5-VJ; Wed, 26 Aug 2026 10:58:10 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67QE1fHk3084964; Wed, 26 Aug 2026 14:58:03 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g726eqa8m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:03 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67QEuIQj020662; Wed, 26 Aug 2026 14:58:02 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g7pfwanf3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:02 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67QEvvmG47120726 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Aug 2026 14:57:57 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E4BED2005A; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AEA702004B; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 92798161693; Wed, 26 Aug 2026 16:57:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=7spCe3Y67e+3MfoY2 7xIuIU3+EB/uJwsVYFYmbA9LS0=; b=gzolVLAUCjO8HpoH1LecSl9GlMhy0pHn0 S1a6H0zP/Ai+k2+zOIvAdwLmErMXuc7+81Dp+PoFdAF1hedCrjKjdk/iDHEe7xj8 n34LgBMfCobNPFPG29OQQ1STKRs1vFQ7zqoVjYUkeo135SRTuYHq0yzPIhIakbTy YSxn8WY7BndryIizC2L6pNvr3UuOZBvvfg6kxxLTppR3Ee9p0GDStOxuZVAxHkm5 2av0Vuj6R2GJw5RltMvD14lAi9lBhZaFDQkpYenuiZvmamd89Im3TTlg3G8+Kza4 f9feHTGyvuUVQjUlNRNtk1x5OLkeFMCObjIKhCDK7YgxP/WazLXZA== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v2 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder Date: Wed, 26 Aug 2026 16:57:54 +0200 Message-ID: <20260826145756.2324598-2-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260826145756.2324598-1-jdaley@linux.ibm.com> References: <20260826145756.2324598-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=TfimcxQh c=1 sm=1 tr=0 ts=6a8efefb cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=4QctWtjvTb62bRHQMjcA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX4+eH86Z9ODz2 QSTUwzTH4J62pOI/iJZLy18pDCpQeuQGBw2P0RPTNprOhJbmCbGOHFLDImpcADevxfBoRQ4ICVb /aQzM1sL7n5q+esDDlfqHSEuRM5vgek= X-Proofpoint-GUID: XpnIA_aNDXM8NPRNrJpRrXExIE33VC_e X-Proofpoint-ORIG-GUID: XpnIA_aNDXM8NPRNrJpRrXExIE33VC_e X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX4rHY9tuAU42q MnbdPbIGF9rkn3vaB/Ty9kGYz9frSR6PHK8CMp6sUjeOZij9dBB7k7gYPOA6F90LSFZGqYATVff usyzxs+o7rw0iJ4eUbZI2B1IG8hV2sNrcSOsGjrvAAq7YRevI3XhUs4YCYPxwwvpnqfmO/PVfyS Mjrz6wPXcCnTYSQTYpa4U3amaLMCrKICYN0g3Zeia9e76sXTq70WMsjird3PUlTdoq3X3GPRwwj OY0hZq2DahcqIOh+VNElea8mByDzyYxoeSd/8ShkKMsjZ0rtxahVBo7oGgeGIV8IKF0MwlPphoY zpsuSj/hnOZjeLpX3oVxb04IuWHwwGkOL4VgG82k+Ad6wq2AIycj4N8bDOhLDdqXujOuxAgurCP Owq1QOyiVvruqLjlo4FR/px9BTOerdwkQD4GhUHpdiOP+sGVop/HWdhYQmPWVpraYv+cC7L2mVM DpOSbgjVXPeuvq0W5nQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-26_04,2026-08-26_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 priorityscore=1501 lowpriorityscore=0 clxscore=1015 phishscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608260121 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1787756349495158500 Content-Type: text/plain; charset="utf-8" In the PCI boot device case of s390_build_iplb(), call s390_apply_secure_boot() to update the IPLB when secure boot or audit mode are enabled. Secure IPL is now supported for virtio-blk-pci boot devices. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- hw/s390x/ipl.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d59ed36c78..b0da3cbb27 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) =20 pbdev =3D s390_get_pci_device(dev_st, &devtype); if (pbdev) { - if (s390_secure_boot_enabled() || s390_has_certificate()) { - error_report("Virtio pci boot device does not support secure b= oot!"); - exit(1); - } - pci_lp =3D object_property_get_str(OBJECT(pbdev->pdev), "loadparm"= , NULL); if (pci_lp && strlen(pci_lp) > 0) { lp =3D pci_lp; @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); + return true; } =20 --=20 2.34.1 From nobody Sat Sep 26 21:37:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1787756356; cv=none; d=zohomail.com; s=zohoarc; b=bLf9oYrLAfjBBQlyIY0O2rlmAXAJrM14Yd1mHydOvTj8E/moSrsZxtansGerI+S5sDWgQRZK3VJZIyly73OmIviSAXYD2X3T4RIyaCTVp8BtbdvSq/BMmFAc0ZyVqhEc1CJaK7lKqO/jC3+ieejg+QFTqsQtmby9r4AIAiNIKpM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787756356; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MAkJaYqiWnnlJyEkSy6absQ9VS0rhls4MrY208GZmAU=; b=HjVfU6Dlz0o8MddW5zB9lFiBp9N/BR0ph0RhwSXv3pbbYMxtDywZ/opfbwZt0geY/8XFqalk2K3xd8/9cPEumf6gtc9I3Wgn5rXTw+yDfTI19wTMVvCWFmGfnVLrbKPUJJx9P5iLA1oLh5I/xVTrxKqwHEdUCTRC6XxZr/azoNU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787756356111845.5186016334907; Wed, 26 Aug 2026 07:59:16 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wzF4x-0005J2-9v; Wed, 26 Aug 2026 10:58:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4t-00057F-PR; Wed, 26 Aug 2026 10:58:11 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4q-0000n3-Dw; Wed, 26 Aug 2026 10:58:09 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67QE1fkC4099728; Wed, 26 Aug 2026 14:58:03 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g716hyfyf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:03 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67QEuH4e020643; Wed, 26 Aug 2026 14:58:02 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g7pfwanf4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:02 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67QEvvow16122160 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Aug 2026 14:57:57 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EA41C2004F; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B252A2004B; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav01.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 94F7E162533; Wed, 26 Aug 2026 16:57:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=MAkJaYqiWnnlJyEkS y6absQ9VS0rhls4MrY208GZmAU=; b=NSsW4tcqtuRNX2r7tcbjP9mec5Kz/6IjK /Zcyiy3q2JEK5CAF8iKDCqSadrzwdT5GvAz2DliHQOdZCeVAq4xvc6/R8IuUjVKJ Y+/LzxdLbOIu38XyZLtqgCfE7M+mfi35PI4K5bWBKy9JGW5FQqLyJgULgdg58lhY uvXG1QuCN0kZRLC6Vxi6Quh8vZuujQ7Wh6elHbhvlbMqvAH8DrCVT5Kw/sFRTdya Hgu+mqLlrk7Nlw3uUFN23yoGpl4BQ5QWdQmEJBWlFn7eHKIesXvQOfYd2zsn7iRr QEVGpMCOriTmsaw+3GIHGypm+vWF5LEnrdJ0caaA/QItTbZgaqfTg== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v2 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor Date: Wed, 26 Aug 2026 16:57:55 +0200 Message-ID: <20260826145756.2324598-3-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260826145756.2324598-1-jdaley@linux.ibm.com> References: <20260826145756.2324598-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX2xkZCQ6LuLLB 5H7Ne1D2oAxKprAPzTWez6oQWywKuphQ3NNIrGnkwxiEIsUY0Now4xCSjffdmzotEcwn9yBqYOy AOzvWUIA05JDxYdjOSyfUwU0rD56TCM= X-Proofpoint-GUID: KzVgAT8eCumm4rL_Tgvt3r_04NUqXDCJ X-Proofpoint-ORIG-GUID: KzVgAT8eCumm4rL_Tgvt3r_04NUqXDCJ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX5zGW47hiWXVR cLhZXbQ4tgCzaKzRFgv2izhCcUojokKo0q7pv1xSH6wU5euer1OF0oDtAhPiWXX6X8RlZwTPYrl BSByjIAWVQmb/jJjI0iY24RDtxzqEvsRnhLZxX300ufQpaqH1PA4mFV/3WzFZyvClChw+jAOguH jbCkYFr+CWlQDzX40HNcaMtRx0Fj71GrJwRwJskzLkcm6hB5l3zzE9Akj7EuDaUyp0+N/4c3byP pZ7fnKAPQ6DuOFAE2WOJZbKzVPO3DGUUzOeVDzGQ88RxV0OeKqqceEJnpVPFjtIPws5RkMPOekw bmaqpaCxhmNRoHfyGvjYZ9YjLSH3Amti0q7JCR3uJGIGOCYiJOg3tpYkJxkSZbIZxjabiPsJ3Zo U6or046hMdlOsRQQZKmRKIq3L/D3a3S5M4nPAB9vMof09vjt/swJQm9grHVU6e8LQytOc1I50jw EV9iGuMZihOgrdePllQ== X-Authority-Analysis: v=2.4 cv=H7brBeYi c=1 sm=1 tr=0 ts=6a8efefb cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=UZxYUTtkSsvthtqRCrcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-26_04,2026-08-26_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 bulkscore=0 adultscore=0 priorityscore=1501 clxscore=1015 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608260121 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1787756357719158500 Content-Type: text/plain; charset="utf-8" Currently, if secure IPL is not supported by the hypervisor, the test will fail because "Verified component" never appears. One must inspect the console log to observe the cause of the failure. Add a check that skips the test if the host CPU model is missing the secure IPL facilities. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato Reviewed-by: Zhuoying Cai --- tests/functional/s390x/test_secure_ipl.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 06fc93e404..5af36b91d8 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -29,6 +29,22 @@ def __init__(self, *args, **kwargs): self.cert_path =3D None self.prompt =3D None =20 + def _require_host_secure_ipl_support(self, vm): + """ + Skip the test if the host CPU model does not expose the Secure IPL + facilities (sipl, sclaf, cstore). + """ + props =3D vm.cmd('query-cpu-model-expansion', + model=3D{'name': 'host'}, + type=3D'full')['model']['props'] + missing =3D [f for f in ('sipl', 'sclaf', 'cstore') + if not props.get(f)] + if missing: + self.skipTest( + f"Host CPU does not support Secure IPL: " + f"missing feature(s): {', '.join(missing)}. " + f"Secure IPL requires a z16+ host.") + def _create_certificate(self, vm): """Generate x509 certificate""" exec_command_and_wait_for_pattern(self, @@ -107,6 +123,8 @@ def setup_s390x_secure_ipl(self): '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') temp_vm.launch() =20 + self._require_host_secure_ipl_support(temp_vm) + # Initial root account setup (Fedora first boot screen) self.root_password =3D 'fedora40password' wait_for_console_pattern(self, 'Please make a selection from the a= bove', --=20 2.34.1 From nobody Sat Sep 26 21:37:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1787756325; cv=none; d=zohomail.com; s=zohoarc; b=bk4lgRvpgPEbc5AO2JFyvILrdyP51hVO/3Eaxq5/dDe7yn5dyTTYLDobJs/gMwmMHc6PUu7SE18R9Kj6HhQ5v8CkHiV1FHhLEypw5LuL+r2ZAho3NFA1OEYXL4fuyc6wM5s7atzBe8wlFQCzzre4GmlwTXvfTD18aA/ahiLSDuo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787756325; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zSirLVzkti+gL2dv9OsKYpKFBfJTRRRK4kOZh7oTZLg=; b=SLHcZVcjrqQqkgp7xMLCbVisEO+9jDxIeXYukcI1l4Q5Pj0e/61f9iRkaCOF5TURx3PIJuXDtmst0I9RYe712VxQgzXkwVZpSlB9NkAe96k6I7XGXUbJ//OOSrYZ6roYpt0pzARBTMOKW0Ub5cFJUBLBAnDXdknkNIFD3pQ/FCk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787756325187349.8525284924973; Wed, 26 Aug 2026 07:58:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wzF4w-0005Dg-5w; Wed, 26 Aug 2026 10:58:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4t-00057J-Po; Wed, 26 Aug 2026 10:58:11 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wzF4q-0000n9-VN; Wed, 26 Aug 2026 10:58:10 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67QE1cSx070298; Wed, 26 Aug 2026 14:58:04 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g73dxf2uk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:03 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67QEuK6p000467; Wed, 26 Aug 2026 14:58:03 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4g7rsya9e1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Aug 2026 14:58:03 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67QEvvhZ40173858 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Aug 2026 14:57:57 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EF65A20040; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B220A2004D; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Wed, 26 Aug 2026 14:57:56 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 9788116253C; Wed, 26 Aug 2026 16:57:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zSirLVzkti+gL2dv9 OsKYpKFBfJTRRRK4kOZh7oTZLg=; b=T1CBTSK5B1EK0dLRCCeXtd9JzBeP6BeEq QTpf3RfrQAdteM1wB0faW54bOvueXbWuG9dkfJII6+XoFz6Ty69JdUmzd31Ku4se slJ68IXZ1LkTnHMWL4L7P6f2EqIZ9bjScumRLr5v3gDyHc0mJt6BM3lqPUkWntxN qmjZ79SgSBorefLwq6s4KXxxcmdxpnG047fUHSe43OC67ZsPXDlw2yNsg0MYUmuU KKsIzIDhDdBEuDZWTWCEekPWU0WeI0sncZOf/CLt2s8LCHw19ifmnV9Mnbe+4/7Z 70rf8dnk62nVSf/z1hn7kflIZd3HWzT0iqSdvooXqd+P0kVZqJEOw== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v2 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case Date: Wed, 26 Aug 2026 16:57:56 +0200 Message-ID: <20260826145756.2324598-4-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260826145756.2324598-1-jdaley@linux.ibm.com> References: <20260826145756.2324598-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX2X7QoNt4nC5x 5U65YEwBuCQWCgRc31fqm3XAnB6m8JJZL4AA4P/5dYE6QW33h/mXDOdzxdR9JGZT7dKAO4Kps/+ eF4nCdDiGr0mfnzThAM+vwzRsyBLeK8= X-Authority-Analysis: v=2.4 cv=AYuB2XXG c=1 sm=1 tr=0 ts=6a8efefc cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=WP5zsaevAAAA:8 a=_wd9b3Og23xccE4cLGQA:9 a=t8Kx07QrZZTALmIZmm-o:22 X-Proofpoint-ORIG-GUID: CUVKdyvuySfQFnDR-AnHTpCHUh-WsjzI X-Proofpoint-GUID: CUVKdyvuySfQFnDR-AnHTpCHUh-WsjzI X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI2MDEyMSBTYWx0ZWRfX5Z4rxVRTCIIS YHIcsHb0CsvDYmKOXTa4Od+OrB76JU2w1Hecjv33q881vqJVFBUccLy4f5X/Fh+SCGuF7+ExsB4 Maz+SZ0AQPeNIgXJDZ3LQ86aVBUx7cOzVlXyyaZoJ8qN6m8JDwN+MFLbq5PknH18oLsSa8E3O7v 6A4MCVOrc3RH3QE9aDldtsqCHIP48l2y9bVIyPBm0QGrz+hphq9jujOiwxEpTTvRgipU+Hltn7S yOIpKrIKXluiaYYvAejx6DO/bM75oar7UltEr2Ezxzbaj7QxnY0/RCkuOfDgMxnzP+3Is5Zf+FS cNlg1UuJA9GtuUKtWQ0udSrSuFCl6neA2SYKgLM3MER+KwZSiqAl8Nu9IkmFUCEtJyR+JlLi76D fO04jf/omFraLI88lTBO+hWdvOQj+laE+POWn/i6c5e/uf3f6Ylgbi8tMjGM5EZXlM3odAzdjJq w5HJDeZBQNmjExTCzVQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-26_04,2026-08-26_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 clxscore=1015 adultscore=0 bulkscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608260121 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1787756327617158500 Content-Type: text/plain; charset="utf-8" Split test_s390x_secure_ipl() into two subtests. Each tests with a different boot device: virtio-blk-ccw or virtio-blk-pci. Use class-level variables and a temporary shared workdir such that the time-consuming setup is not run multiple times. Signed-off-by: Joshua Daley --- tests/functional/s390x/test_secure_ipl.py | 131 ++++++++++++++-------- 1 file changed, 87 insertions(+), 44 deletions(-) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 5af36b91d8..cc9bff5737 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -8,6 +8,9 @@ secure-boot enabled, and verifying cryptographic validation results. """ =20 +import os +import shutil +import tempfile from subprocess import check_call, DEVNULL =20 from qemu_test import QemuSystemTest, Asset, get_qemu_img @@ -22,12 +25,24 @@ class S390xSecureIpl(QemuSystemTest): 'Fedora-Server-KVM-40-1.14.s390x.qcow2'), '091c232a7301be14e19c76ce9a0c1cbd2be2c4157884a731e1fc4f89e7455a5f') =20 - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self.root_password =3D None - self.qcow2_path =3D None - self.cert_path =3D None - self.prompt =3D None + _shared_workdir =3D None + _root_password =3D None + _qcow2_path =3D None + _cert_path =3D None + _prompt =3D None + _setup_done =3D None + + @classmethod + def setUpClass(cls): + super().setUpClass() + cls._shared_workdir =3D tempfile.mkdtemp(prefix=3D'qemu_sipl_') + + @classmethod + def tearDownClass(cls): + if cls._shared_workdir is not None: + shutil.rmtree(cls._shared_workdir, ignore_errors=3DTrue) + cls._shared_workdir =3D None + super().tearDownClass() =20 def _require_host_secure_ipl_support(self, vm): """ @@ -62,7 +77,7 @@ def _sign_binaries(self, vm): exec_command_and_wait_for_pattern(self, 'sudo dnf install kernel-devel-$(uname -r)= -y', 'Complete!', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) exec_command_and_wait_for_pattern(self, 'ls /usr/src/kernels/$(uname -r)/scrip= ts/', 'sign-file', vm=3Dvm) @@ -71,11 +86,11 @@ def _sign_binaries(self, vm): exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' 'sha256 mykey.pem mycert.pem /lib/s390-tools/stage3.bi= n', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' 'sha256 mykey.pem mycert.pem /boot/vmlinuz-$(uname -r)= ', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) =20 def _run_zipl_secure(self, vm): """Run zipl to prepare for secure boot""" @@ -91,10 +106,11 @@ def _extract_certificate(self, vm): cert =3D "\n".join(out.decode("utf-8").splitlines()[1:]) self.log.info("%s", cert) =20 - self.cert_path =3D self.scratch_file("mycert.pem") + cert_path =3D os.path.join(S390xSecureIpl._shared_workdir, "mycert= .pem") =20 - with open(self.cert_path, 'w', encoding=3D"utf-8") as file_object: + with open(cert_path, 'w', encoding=3D"utf-8") as file_object: file_object.write(cert) + S390xSecureIpl._cert_path =3D cert_path =20 def setup_s390x_secure_ipl(self): """ @@ -109,39 +125,42 @@ def setup_s390x_secure_ipl(self): temp_vm.set_machine('s390-ccw-virtio') =20 asset_path =3D self.ASSET_F40_QCOW2.fetch() - self.qcow2_path =3D self.scratch_file('f40.qcow2') + qcow2_path =3D os.path.join(S390xSecureIpl._shared_workdir, 'f40.q= cow2') qemu_img =3D get_qemu_img(self) check_call([qemu_img, 'create', '-f', 'qcow2', '-b', asset_path, - '-F', 'qcow2', self.qcow2_path], stdout=3DDEVNULL, std= err=3DDEVNULL) + '-F', 'qcow2', qcow2_path], stdout=3DDEVNULL, stderr= =3DDEVNULL) + S390xSecureIpl._qcow2_path =3D qcow2_path =20 temp_vm.set_console() temp_vm.add_args('-nographic', '-accel', 'kvm', '-m', '1024', '-drive', - f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{qc= ow2_path}', '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') temp_vm.launch() =20 self._require_host_secure_ipl_support(temp_vm) =20 # Initial root account setup (Fedora first boot screen) - self.root_password =3D 'fedora40password' + S390xSecureIpl._root_password =3D 'fedora40password' wait_for_console_pattern(self, 'Please make a selection from the a= bove', vm=3Dtemp_vm) exec_command_and_wait_for_pattern(self, '4', 'Password:', vm=3Dtem= p_vm) - exec_command_and_wait_for_pattern(self, self.root_password, + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, 'Password (confirm):', vm=3Dtemp= _vm) - exec_command_and_wait_for_pattern(self, self.root_password, + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, 'Please make a selection from the abov= e', vm=3Dtemp_vm) =20 # Login as root - self.prompt =3D '[root@localhost ~]#' - exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', v= m=3Dtemp_vm) - exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= temp_vm) - exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt, + S390xSecureIpl._prompt =3D '[root@localhost ~]#' + exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', + vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, + S390xSecureIpl._prompt, vm=3Dtem= p_vm) =20 self._create_certificate(temp_vm) self._sign_binaries(temp_vm) @@ -150,41 +169,65 @@ def setup_s390x_secure_ipl(self): =20 # Shutdown temp vm temp_vm.shutdown() + S390xSecureIpl._setup_done =3D True =20 - @skipBigDataTest() - def test_s390x_secure_ipl(self): + def verify_s390x_secure_ipl(self, boot_dev_bus: str): """ Verify secure boot validation during s390x guest boot. =20 Expects two "Verified component" messages and confirms /sys/firmware/ipl/secure reports secure boot is active. """ - self.require_accelerator('kvm') - self.setup_s390x_secure_ipl() - - self.set_machine('s390-ccw-virtio') - - self.vm.set_console() - self.vm.add_args('-nographic', - '-machine', 's390-ccw-virtio,secure-boot=3Don,' - f'boot-certs.0.path=3D{self.cert_path}', - '-accel', 'kvm', - '-m', '1024', - '-drive', - f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', - '-device', 'virtio-blk-ccw,drive=3Ddrive1,bootind= ex=3D1') - self.vm.launch() + if boot_dev_bus not in ['ccw', 'pci']: + raise ValueError( + f"boot_dev_bus must be 'ccw' or 'pci', got {boot_dev_bus}") + + vm =3D self.get_vm(name=3Df'sipl_test_vblk_{boot_dev_bus}') + vm.set_machine('s390-ccw-virtio') + + vm.set_console() + vm.add_args('-nographic', + '-machine', 's390-ccw-virtio,secure-boot=3Don,' + f'boot-certs.0.path=3D{S390xSecureIpl._cert_path}', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,' + f'file=3D{S390xSecureIpl._qcow2_path}', + '-device', + f'virtio-blk-{boot_dev_bus},drive=3Ddrive1,bootindex= =3D1') + vm.launch() =20 # Expect two verified components verified_output =3D "Verified component" - wait_for_console_pattern(self, verified_output) - wait_for_console_pattern(self, verified_output) + wait_for_console_pattern(self, verified_output, vm=3Dvm) + wait_for_console_pattern(self, verified_output, vm=3Dvm) =20 # Login and verify the vm is booted using secure boot - wait_for_console_pattern(self, 'localhost login:') - exec_command_and_wait_for_pattern(self, 'root', 'Password:') - exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt) - exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/sec= ure', '1') + wait_for_console_pattern(self, 'localhost login:', vm=3Dvm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= vm) + exec_command_and_wait_for_pattern( + self, S390xSecureIpl._root_password, S390xSecureIpl._prompt, v= m=3Dvm) + exec_command_and_wait_for_pattern( + self, 'cat /sys/firmware/ipl/secure', '1', vm=3Dvm) + + vm.shutdown() + + @skipBigDataTest() + def test_s390x_secure_ipl_ccw(self): + """Test secure IPL with a virtio-blk-ccw boot device.""" + self.require_accelerator('kvm') + if not S390xSecureIpl._setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('ccw') + + @skipBigDataTest() + def test_s390x_secure_ipl_pci(self): + """Test secure IPL with a virtio-blk-pci boot device.""" + self.require_accelerator('kvm') + if not S390xSecureIpl._setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('pci') =20 if __name__ =3D=3D '__main__': QemuSystemTest.main() --=20 2.34.1