[v3] Extend secure IPL support to virtio-blk-pci boot devices

[PATCH v3 0/3] Extend secure IPL support to virtio-blk-pci boot devices

Joshua Daley posted 3 patches 3 weeks, 2 days ago

Diff against v1 v2
Download series mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260903155805.1881366-1-jdaley@linux.ibm.com

Maintainers: Jared Rossi <jrossi@linux.ibm.com>, Zhuoying Cai <zycai@linux.ibm.com>, Christian Borntraeger <borntraeger@linux.ibm.com>, Jason Herne <jjherne@linux.ibm.com>, Halil Pasic <pasic@linux.ibm.com>, Eric Farman <farman@linux.ibm.com>, Matthew Rosato <mjrosato@linux.ibm.com>, Cornelia Huck <cohuck@redhat.com>, Richard Henderson <richard.henderson@linaro.org>, Ilya Leoshkevich <iii@linux.ibm.com>, David Hildenbrand <david@kernel.org>

hw/s390x/ipl.c                            |   8 +-
tests/functional/s390x/test_secure_ipl.py | 157 ++++++++++++++++------
2 files changed, 116 insertions(+), 49 deletions(-)

Expand all Fold all

[PATCH v3 0/3] Extend secure IPL support to virtio-blk-pci boot devices

Posted by Joshua Daley 3 weeks, 2 days ago

Changes v2 -> v3:

- Patch 3:
   Added _host_lacks_sipl_support flag to skip vm setup if
   we've already found that the host does not support SIPL.

---

v2 cover letter:

Changes v1 -> v2:

- Added RB tags to patches 1 & 2
- Patch 3:
   The setup step is now run only once, as originally intended.
   setUpClass and tearDownClass manage a shared workdir for the
   subtests to use. Instance vars are now class-level vars.

---

v1 cover letter:

This series is based on Zhuoying Cai's series,
"[PATCH v17 00/34] Secure IPL Support for SCSI Scheme of virtio-blk/virtio-scsi Devices"
https://lore.kernel.org/qemu-devel/20260730214624.2328883-1-zycai@linux.ibm.com/

Note, the above series is based on Cornelia Huck's patch,
"[PATCH for-11.2] hw: add compat machines for 11.2"
https://lore.kernel.org/qemu-devel/20260723163806.368127-1-cohuck@redhat.com/
which requires a small fix to apply (see Eric Farman's reply).

---

To add support for secure IPL with a virtio-blk-pci boot device, we simply
write secure boot flags to the IPLB when using such a boot device.
This is achieved by calling s390_apply_secure_boot() in the PCI boot
device case of s390_build_iplb().

The secure IPL functional verification test is updated with an additional
subtest for the virtio-blk-pci boot device case. To run the FVT:

  make check-functional-s390x MTESTARGS="func-s390x-secure_ipl" \
  QEMU_TEST_ALLOW_LARGE_STORAGE=1

To test secure IPL yourself, view the "Secure IPL Quickstart" guide in:
docs/system/s390x/secure-ipl.rst

Joshua Daley (3):
  hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder
  tests/functional/s390x/test_secure_ipl: Skip test if SIPL not
    supported by hypervisor
  tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev
    case

 hw/s390x/ipl.c                            |   8 +-
 tests/functional/s390x/test_secure_ipl.py | 157 ++++++++++++++++------
 2 files changed, 116 insertions(+), 49 deletions(-)

-- 
2.34.1

Re: [PATCH v3 0/3] Extend secure IPL support to virtio-blk-pci boot devices

Posted by Eric Farman 2 weeks, 3 days ago


On 9/3/26 11:58 AM, Joshua Daley wrote:
> Changes v2 -> v3:
> 
> - Patch 3:
>     Added _host_lacks_sipl_support flag to skip vm setup if
>     we've already found that the host does not support SIPL.
> 
> ---
> 
> v2 cover letter:
> 
> Changes v1 -> v2:
> 
> - Added RB tags to patches 1 & 2
> - Patch 3:
>     The setup step is now run only once, as originally intended.
>     setUpClass and tearDownClass manage a shared workdir for the
>     subtests to use. Instance vars are now class-level vars.
> 
> ---
> 
> v1 cover letter:
> 
> This series is based on Zhuoying Cai's series,
> "[PATCH v17 00/34] Secure IPL Support for SCSI Scheme of virtio-blk/virtio-scsi Devices"
> https://lore.kernel.org/qemu-devel/20260730214624.2328883-1-zycai@linux.ibm.com/
> 
> Note, the above series is based on Cornelia Huck's patch,
> "[PATCH for-11.2] hw: add compat machines for 11.2"
> https://lore.kernel.org/qemu-devel/20260723163806.368127-1-cohuck@redhat.com/
> which requires a small fix to apply (see Eric Farman's reply).
> 
> ---
> 
> To add support for secure IPL with a virtio-blk-pci boot device, we simply
> write secure boot flags to the IPLB when using such a boot device.
> This is achieved by calling s390_apply_secure_boot() in the PCI boot
> device case of s390_build_iplb().
> 
> The secure IPL functional verification test is updated with an additional
> subtest for the virtio-blk-pci boot device case. To run the FVT:
> 
>    make check-functional-s390x MTESTARGS="func-s390x-secure_ipl" \
>    QEMU_TEST_ALLOW_LARGE_STORAGE=1
> 
> To test secure IPL yourself, view the "Secure IPL Quickstart" guide in:
> docs/system/s390x/secure-ipl.rst
> 
> Joshua Daley (3):
>    hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder
>    tests/functional/s390x/test_secure_ipl: Skip test if SIPL not
>      supported by hypervisor
>    tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev
>      case
> 
>   hw/s390x/ipl.c                            |   8 +-
>   tests/functional/s390x/test_secure_ipl.py | 157 ++++++++++++++++------
>   2 files changed, 116 insertions(+), 49 deletions(-)
> 

Applied for 11.2. Thank you!