From nobody Sat Sep 26 20:51:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1788451143; cv=none; d=zohomail.com; s=zohoarc; b=djlIr4sCU1AERCp3jsyhVOeEiaszCVHwIpdjcZ0JIOEfTI8gkthVcba3sQmw8f/OiZ7hrMWs+of9GDcTVdbX4yW1Di3mUbEEdkRvgr7T0ll0cOFaKywwbAYrkFwaoIhb6g13KwzuzEkh1JPJjRC/qgVVbSiIcEzcCxEOTGrvI2o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788451143; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=L71/X1CRqsCfDlqm8PzyUT+3FcNN+dC9zV+GOkV/qV0=; b=bM9HUIT8e9310p7Psj6FdwS870+ZXjKOmioRUM/FPaj5wwMBq12uduqcLyMcV9x1T2DVoVIzcUafceU5safIBcXUl2InTeVQP3c7QBwMOIwkQk9gU1Elu1kPpip21tR6rx0AZNa/nHdvnokqe05PxkSkD317Bbwm1fwV9zQqpLk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788451143722545.726088974642; Thu, 3 Sep 2026 08:59:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x29pS-0000uF-MA; Thu, 03 Sep 2026 11:58:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pR-0000t9-9X; Thu, 03 Sep 2026 11:58:17 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pP-0006rC-5l; Thu, 03 Sep 2026 11:58:17 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 683DVcZq1977380; Thu, 3 Sep 2026 15:58:10 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gbnue5brn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:10 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 683FuI1u007185; Thu, 3 Sep 2026 15:58:10 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gcarkgbvn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:09 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 683Fw55R42402062 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Sep 2026 15:58:05 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CA4ED20049; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9EB1720040; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 7F4E3160DFB; Thu, 03 Sep 2026 17:58:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=L71/X1CRqsCfDlqm8 PzyUT+3FcNN+dC9zV+GOkV/qV0=; b=Hqc+WzrGxIHcm0IqMbJ+TYdAL+Hhk32NK LIPZPXWkT2Dp0rcZLuIJOqbt27MfsRcQlLo2r9Aka7bgTlTSeauBvkkl7mO7o/TB 4k3g1q+EPMlrm/or3ZuOHVlLGOXaDajxENSriRbQVNg1tyJTttdtTCHakBDx+837 o4DH9FpIPyPJDIkSA0uiFsb9fm/u6+AjXxHHnghS68RHyoZS609NkFd1sb532n+D 0ndzlQl24WvvaV6Y/XbgctH+0KsLElqJUYy0cRBSK77sDQVXxLwhcWkM3C9q2Wcj 5p5nY6b5nopsSEIZNRNIRD0YTlPxx/Qbd8Aj5K3v3LXsNWiRV2S7w== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v3 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder Date: Thu, 3 Sep 2026 17:58:03 +0200 Message-ID: <20260903155805.1881366-2-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903155805.1881366-1-jdaley@linux.ibm.com> References: <20260903155805.1881366-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: b72aTVlnqmym22wVQuOZlJyA6WvKoEWN X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfX6sh9u2J71gUv i3INOV7H03xMjAc9EScTIIkP5DZVbiqmArSiiwTZ3YuZm7LVXYb6k7a7N9YyrntUrjL+mKtddIN cx1kuJqSqM/MSg4khxLPfTs3KE9ZtxTaA9AXfNMDmmltrguIxa5F6KOwmKlsjcsW2Q0aoF2dqk1 47wXpwrxCTtkm+K4zAU01KuClI6xZWWlnqUGMUTcGvImK2hkmV7YDRAz0IWP/Jz5MADiDE1OCQ3 hkcPbRQHxxbVNu7n4TSjF7szxsTVFvDGR2ye6aiKNTTEhDs61XHEgJuSuDVpmVuZvVFAbLmTSd/ MSzVs/tOwWKJQxh65DJClxrNg84pygpiAfhsk18L4U00qhYmBLtBQ3lWHOqhKJtWdKQ+vxprBKX UZz+1kQzwfi+rmlNP1JG3ugx7S8ZzpuZ6HtEng7qnekdKb0/0Xa9PeH5qtxECVUnjjC3aDEiljL vYnm/idHuetFVwVFL7A== X-Proofpoint-ORIG-GUID: b72aTVlnqmym22wVQuOZlJyA6WvKoEWN X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfXzUrZWRPFrZIx T7La1MfZATi5ANdWkoQ6qJBIeRcJ1lzwGNI395Sh7WiBJC9lVqZ1rDZigBaXnZGptmo4yWggdF2 WcV4T8bdwipDrh4zzhP49LwF8kQrF60= X-Authority-Analysis: v=2.4 cv=B92JFutM c=1 sm=1 tr=0 ts=6a999912 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=4QctWtjvTb62bRHQMjcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-03_04,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 clxscore=1015 suspectscore=0 phishscore=0 lowpriorityscore=0 bulkscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609030135 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1788451145373158500 Content-Type: text/plain; charset="utf-8" In the PCI boot device case of s390_build_iplb(), call s390_apply_secure_boot() to update the IPLB when secure boot or audit mode are enabled. Secure IPL is now supported for virtio-blk-pci boot devices. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Zhuoying Cai Reviewed-by: Matthew Rosato --- hw/s390x/ipl.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index d59ed36c783..b0da3cbb278 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPa= rameterBlock *iplb) =20 pbdev =3D s390_get_pci_device(dev_st, &devtype); if (pbdev) { - if (s390_secure_boot_enabled() || s390_has_certificate()) { - error_report("Virtio pci boot device does not support secure b= oot!"); - exit(1); - } - pci_lp =3D object_property_get_str(OBJECT(pbdev->pdev), "loadparm"= , NULL); if (pci_lp && strlen(pci_lp) > 0) { lp =3D pci_lp; @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplPar= ameterBlock *iplb) s390_ipl_convert_loadparm((char *)lp, iplb->loadparm); iplb->flags |=3D DIAG308_FLAGS_LP_VALID; =20 + s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(), + s390_has_certificate()); + return true; } =20 --=20 2.34.1 From nobody Sat Sep 26 20:51:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1788451146; cv=none; d=zohomail.com; s=zohoarc; b=E0JwR6lI5sfs8i4l6dcqDh2wdgjCDpyaFS3hJQ5jqhTHAbwKAhXv4oaBWJzYyao7cN/zt5M/wFIlGTE6OjxfiYLsK4O4WY8TrBY48AVKdF3pg/sGW6h9reomxR5NqOSAxTyHWgaVpWh+4aX9UmUniZI1BJtQ95CHT8ckz/4b1bU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788451146; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=g0sS83CVWjINxaj/6JaLK/2VH5IhLQCN7sRJZME22CM=; b=dDEYZW0X/B5nn2uTRkT/JKf5Hgou+xEXtUS5ObgzveAuGAFKHKBaqoh+s+5TXwYZpMbo2u8fwIr069QGbGrmGe03pBc1QrMtp4uAH3NCANKLEV2TItkx9WDkAQp7NV4wxcQL/4rzzavfK7ihqyCyggCOcs7g2hUbL+ntaas39NE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788451146740726.9015922663477; Thu, 3 Sep 2026 08:59:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x29pV-0000vG-2n; Thu, 03 Sep 2026 11:58:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pQ-0000t1-Rs; Thu, 03 Sep 2026 11:58:16 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pP-0006rK-5s; Thu, 03 Sep 2026 11:58:16 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 683DVVLV3109153; Thu, 3 Sep 2026 15:58:11 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gbq555tf2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:11 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 683Fufii014905; Thu, 3 Sep 2026 15:58:10 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gcb8hr9v5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:09 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 683Fw5A140501628 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Sep 2026 15:58:06 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D70D920043; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A170620040; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav05.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 81A62160DFD; Thu, 03 Sep 2026 17:58:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=g0sS83CVWjINxaj/6 JaLK/2VH5IhLQCN7sRJZME22CM=; b=LllS14Bxsop9GwKVA/qXTN/uTE35sYY3K 0WGlAkqYHUCubkyDoupZ0YLkSrdJra0WeLzVb5jYDuXLXuIPb4dG2REFPEszW5Qt g0zbjRJ5FaQgAFw8vPbmLyXepAeJAZBJLgRxTlrYnNOELVjxApk7eZYVnj22XgHM KTrzxW9KWBHi919k94X8GrEMdW6C4RhcpNW2rAzaBv2F0pT3kTILGVnKM6aZ82Wi zVBS2V6FSYO4aemdy3lcgDUAm8zK7SqGc/La9SafVDkk5RRot4c+xm/IKcl6yxGx Mhae2hSWDmunHzHLq2vW93TkFkjzjG6PZQKtGfnGO7fxqcysB2uCQ== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v3 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor Date: Thu, 3 Sep 2026 17:58:04 +0200 Message-ID: <20260903155805.1881366-3-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903155805.1881366-1-jdaley@linux.ibm.com> References: <20260903155805.1881366-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfXxh7aUov0AgAj tKsPNhZJnxCYcYzY/m1FH93UfK5I9GQAFHC56griw4MGTicH4LiHE9YAj2zZ2FPJoMfENLBJ+xa GAjyka+l7yKjpvR3zGUpMHmeGP335jU8Qrz56+SKQlMEu77VmoI8gGkyu1lHcUIssTCWQkxc/MB nXLWvCRXCl7KXK341FP1mOLAWYGdeOEnluGoCwv3f5QXA/p8cMWWpavaS5xmZbCjuFzhvImWB3E LiC/svT9KnPcZS5CclrE1q1f17RYT+JBX9/TqPrSeSGh7cViaJ0Aco/8l0MCQBJTnqBXHtaWR5R 3IYsiRZSZrekDo5M6CsOdW6NNr7vtosGTnkH4TPdM2NwwM3uoWvHVztZMtthUXdqI2y2+stl/8O ClhUwMJ8ywjgl8qGc75TxV5C8KyEPz2lMW5WHUZDd7qD72LERZE6Eey62ZWAShDMt/M9dnl+aHa 6OIHIa0SfCyWEeotU1A== X-Proofpoint-ORIG-GUID: yxgw5xX1rTWmHZ6BLWWVHkTfbwIzI3BG X-Authority-Analysis: v=2.4 cv=CNgamxrD c=1 sm=1 tr=0 ts=6a999913 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=UZxYUTtkSsvthtqRCrcA:9 X-Proofpoint-GUID: yxgw5xX1rTWmHZ6BLWWVHkTfbwIzI3BG X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfX0scRAjAxnGSV x9tCcveXwcxYdjSxVv+RGg2+X4YSJTQXdpXtBvDr3mFI9iJ2ErvwKFfeH/q7DJsSbaQRvQuTpOS Mwp6COvKA7NyYgeFA+br2Ni8eFy6hNI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-03_04,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 suspectscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 clxscore=1015 impostorscore=0 adultscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609030135 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=jdaley@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1788451147608158500 Content-Type: text/plain; charset="utf-8" Currently, if secure IPL is not supported by the hypervisor, the test will fail because "Verified component" never appears. One must inspect the console log to observe the cause of the failure. Add a check that skips the test if the host CPU model is missing the secure IPL facilities. Signed-off-by: Joshua Daley Reviewed-by: Jared Rossi Reviewed-by: Matthew Rosato Reviewed-by: Zhuoying Cai --- tests/functional/s390x/test_secure_ipl.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 06fc93e4042..5af36b91d85 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -29,6 +29,22 @@ def __init__(self, *args, **kwargs): self.cert_path =3D None self.prompt =3D None =20 + def _require_host_secure_ipl_support(self, vm): + """ + Skip the test if the host CPU model does not expose the Secure IPL + facilities (sipl, sclaf, cstore). + """ + props =3D vm.cmd('query-cpu-model-expansion', + model=3D{'name': 'host'}, + type=3D'full')['model']['props'] + missing =3D [f for f in ('sipl', 'sclaf', 'cstore') + if not props.get(f)] + if missing: + self.skipTest( + f"Host CPU does not support Secure IPL: " + f"missing feature(s): {', '.join(missing)}. " + f"Secure IPL requires a z16+ host.") + def _create_certificate(self, vm): """Generate x509 certificate""" exec_command_and_wait_for_pattern(self, @@ -107,6 +123,8 @@ def setup_s390x_secure_ipl(self): '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') temp_vm.launch() =20 + self._require_host_secure_ipl_support(temp_vm) + # Initial root account setup (Fedora first boot screen) self.root_password =3D 'fedora40password' wait_for_console_pattern(self, 'Please make a selection from the a= bove', --=20 2.34.1 From nobody Sat Sep 26 20:51:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1788451143; cv=none; d=zohomail.com; s=zohoarc; b=AcSx8VLnZzFmVdhPErGKyFLHPTlKkRBuSRMRVf/K5wjl9WrnQuaMr57Sf6gfFntVs4mxxwgSt0gRfFVhoeaZ9yNcZNT9XGKa5yHb+cfvsqJP9ntvsYKRiv2qBa5CMopMxxqZkV8DNQrVxwwYm1bT3A8XpEx0OpfbCiqVzlG3rOo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788451143; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/+uGi6TGLiKnn/WAjnkh3K2AD9CAS4uNX4S+KwKL74E=; b=FelYyX673kXaIJLM5By5tnlm1MKdzn6RKWyoqlYUWUVaXTpJN58gIBTXYEbgKv0COVxb1fFRw/umqKz46ALcGw9KCPppoafievsJU4c8X8hoTz9vliwKap+b1tWyL0mXui+SsPii9fVghlEBsYwhHhPar9ynlN027ovUThKH04M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788451143723272.3235519604791; Thu, 3 Sep 2026 08:59:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x29pU-0000uQ-3g; Thu, 03 Sep 2026 11:58:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pS-0000tp-6a; Thu, 03 Sep 2026 11:58:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x29pQ-0006rG-1R; Thu, 03 Sep 2026 11:58:17 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 683DVcgJ1977356; Thu, 3 Sep 2026 15:58:11 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gbnue5brq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:10 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 683FuW2i014385; Thu, 3 Sep 2026 15:58:10 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4gcb8hr9v6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Sep 2026 15:58:10 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 683Fw6hM30736952 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Sep 2026 15:58:06 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDD242004D; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A0AD320040; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav01.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 3 Sep 2026 15:58:05 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 56370) id 842EF160DFE; Thu, 03 Sep 2026 17:58:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=/+uGi6TGLiKnn/WAj nkh3K2AD9CAS4uNX4S+KwKL74E=; b=kLq5cyhvAAsbbqTVzNpNMnBSNnReF2CMy V0ugZfJU8YQtegkCh1GfkN0w/FMSCud7bxdcJ18B8dCZRluYTaLIppPifjRDRyTc UhQy1khKtZN+YftUQPSSDDyJr4WFtCw40cNZ3bRARgk2qhq6VRVl9TZkqF06eA+J WqSdvSFAXa2N9io0uYuKBFGufMhguOBo4VbaCoCg4zmnp39kjCvCXm5ykxm1sXU7 szIU92FUcf/kTCVekYz+5urc0jVA9Gm2DLCPz+GiLSafYY6dTSAe5NmR3J6xXZYx 5ivXx1y9DeOH5fWF++D/uAgSOBC4vrBHfxXW5zbkh8NMIVVdCRQ2Q== From: Joshua Daley To: qemu-s390x@nongnu.org Cc: qemu-devel@nongnu.org, jrossi@linux.ibm.com, zycai@linux.ibm.com, borntraeger@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, richard.henderson@linaro.org, iii@linux.ibm.com, david@kernel.org, cohuck@redhat.com, jdaley@linux.ibm.com Subject: [PATCH v3 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case Date: Thu, 3 Sep 2026 17:58:05 +0200 Message-ID: <20260903155805.1881366-4-jdaley@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903155805.1881366-1-jdaley@linux.ibm.com> References: <20260903155805.1881366-1-jdaley@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: NSdbxIW2CQqEyWinYWWfUDpYsX4M6Ufw X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfX2OxrxjQx0XOJ EIZA40pw4JyA6NpjmBNSbY3N7yyOl8fORDrG8AK1VYyrMVJB20UnnnQWv5acJRhhHPZzZjrhBYL 9L01EUB3Lx4bwtyI+HQHVGPqpRjmhVa/SFLl3KXk6LIbqCaHjhJNzCXCnfFhTAluLF7rdia8soc 3fwQyAd7c2LnNN+BcRRV+qZSCkg/+pG2Xe3OV/c+544pBy9OypuI+0/BQMPLcfeRyApDADb8mAl oKbhs/KfU5ZLA8JtNO0BiO7d15jbdUniCuELeNz1AudXXiwteTJcedBcFVrvDogdCmM09QqMSlF QelN0PoSMOJSe8Y63BOJZF9JLLOD3CSadX7CgUQ8HIVlhT5NzcPnuZG6znue8ZfBqR34uarhqKw BJ79ITmeRzRxiUxaIK/ywxFOTWzYEwvClYOqVTx6cLsamnwalG7LSvbI0g+/fiLo4c1ZdiADlMs VvXCrJmG9ihTbEEQopg== X-Proofpoint-ORIG-GUID: NSdbxIW2CQqEyWinYWWfUDpYsX4M6Ufw X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAzMDEzNSBTYWx0ZWRfX5VnKWPDxUG+S Sg88/ssoTzh0/Yrq2QeD2VCssrjWQpc3hiJ0CZzwynLBZ+T85i0708TqhqvTmYCP4TkM69Gl76o uekGropT13LysO0lnh9XpeVkOdSwBos= X-Authority-Analysis: v=2.4 cv=B92JFutM c=1 sm=1 tr=0 ts=6a999912 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=WP5zsaevAAAA:8 a=jH-0nMekS77raGL10bsA:9 a=t8Kx07QrZZTALmIZmm-o:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-03_04,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 clxscore=1015 suspectscore=0 phishscore=0 lowpriorityscore=0 bulkscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609030135 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=jdaley@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1788451145460158500 Content-Type: text/plain; charset="utf-8" Split test_s390x_secure_ipl() into two subtests. Each tests with a different boot device: virtio-blk-ccw or virtio-blk-pci. Use class-level variables and a temporary shared workdir such that the time-consuming setup is not run multiple times. Signed-off-by: Joshua Daley Reviewed-by: Matthew Rosato --- tests/functional/s390x/test_secure_ipl.py | 139 +++++++++++++++------- 1 file changed, 95 insertions(+), 44 deletions(-) diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s= 390x/test_secure_ipl.py index 5af36b91d85..461d73c0d7a 100755 --- a/tests/functional/s390x/test_secure_ipl.py +++ b/tests/functional/s390x/test_secure_ipl.py @@ -8,6 +8,9 @@ secure-boot enabled, and verifying cryptographic validation results. """ =20 +import os +import shutil +import tempfile from subprocess import check_call, DEVNULL =20 from qemu_test import QemuSystemTest, Asset, get_qemu_img @@ -22,12 +25,25 @@ class S390xSecureIpl(QemuSystemTest): 'Fedora-Server-KVM-40-1.14.s390x.qcow2'), '091c232a7301be14e19c76ce9a0c1cbd2be2c4157884a731e1fc4f89e7455a5f') =20 - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self.root_password =3D None - self.qcow2_path =3D None - self.cert_path =3D None - self.prompt =3D None + _shared_workdir =3D None + _root_password =3D None + _qcow2_path =3D None + _cert_path =3D None + _prompt =3D None + _setup_done =3D None + _host_lacks_sipl_support =3D False + + @classmethod + def setUpClass(cls): + super().setUpClass() + cls._shared_workdir =3D tempfile.mkdtemp(prefix=3D'qemu_sipl_') + + @classmethod + def tearDownClass(cls): + if cls._shared_workdir is not None: + shutil.rmtree(cls._shared_workdir, ignore_errors=3DTrue) + cls._shared_workdir =3D None + super().tearDownClass() =20 def _require_host_secure_ipl_support(self, vm): """ @@ -40,6 +56,7 @@ def _require_host_secure_ipl_support(self, vm): missing =3D [f for f in ('sipl', 'sclaf', 'cstore') if not props.get(f)] if missing: + S390xSecureIpl._host_lacks_sipl_support =3D True self.skipTest( f"Host CPU does not support Secure IPL: " f"missing feature(s): {', '.join(missing)}. " @@ -62,7 +79,7 @@ def _sign_binaries(self, vm): exec_command_and_wait_for_pattern(self, 'sudo dnf install kernel-devel-$(uname -r)= -y', 'Complete!', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) exec_command_and_wait_for_pattern(self, 'ls /usr/src/kernels/$(uname -r)/scrip= ts/', 'sign-file', vm=3Dvm) @@ -71,11 +88,11 @@ def _sign_binaries(self, vm): exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' 'sha256 mykey.pem mycert.pem /lib/s390-tools/stage3.bi= n', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file= ' 'sha256 mykey.pem mycert.pem /boot/vmlinuz-$(uname -r)= ', vm=3Dvm) - wait_for_console_pattern(self, self.prompt, vm=3Dvm) + wait_for_console_pattern(self, S390xSecureIpl._prompt, vm=3Dvm) =20 def _run_zipl_secure(self, vm): """Run zipl to prepare for secure boot""" @@ -91,10 +108,11 @@ def _extract_certificate(self, vm): cert =3D "\n".join(out.decode("utf-8").splitlines()[1:]) self.log.info("%s", cert) =20 - self.cert_path =3D self.scratch_file("mycert.pem") + cert_path =3D os.path.join(S390xSecureIpl._shared_workdir, "mycert= .pem") =20 - with open(self.cert_path, 'w', encoding=3D"utf-8") as file_object: + with open(cert_path, 'w', encoding=3D"utf-8") as file_object: file_object.write(cert) + S390xSecureIpl._cert_path =3D cert_path =20 def setup_s390x_secure_ipl(self): """ @@ -109,39 +127,42 @@ def setup_s390x_secure_ipl(self): temp_vm.set_machine('s390-ccw-virtio') =20 asset_path =3D self.ASSET_F40_QCOW2.fetch() - self.qcow2_path =3D self.scratch_file('f40.qcow2') + qcow2_path =3D os.path.join(S390xSecureIpl._shared_workdir, 'f40.q= cow2') qemu_img =3D get_qemu_img(self) check_call([qemu_img, 'create', '-f', 'qcow2', '-b', asset_path, - '-F', 'qcow2', self.qcow2_path], stdout=3DDEVNULL, std= err=3DDEVNULL) + '-F', 'qcow2', qcow2_path], stdout=3DDEVNULL, stderr= =3DDEVNULL) + S390xSecureIpl._qcow2_path =3D qcow2_path =20 temp_vm.set_console() temp_vm.add_args('-nographic', '-accel', 'kvm', '-m', '1024', '-drive', - f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', + f'id=3Ddrive0,if=3Dnone,format=3Dqcow2,file=3D{qc= ow2_path}', '-device', 'virtio-blk-ccw,drive=3Ddrive0,bootind= ex=3D1') temp_vm.launch() =20 self._require_host_secure_ipl_support(temp_vm) =20 # Initial root account setup (Fedora first boot screen) - self.root_password =3D 'fedora40password' + S390xSecureIpl._root_password =3D 'fedora40password' wait_for_console_pattern(self, 'Please make a selection from the a= bove', vm=3Dtemp_vm) exec_command_and_wait_for_pattern(self, '4', 'Password:', vm=3Dtem= p_vm) - exec_command_and_wait_for_pattern(self, self.root_password, + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, 'Password (confirm):', vm=3Dtemp= _vm) - exec_command_and_wait_for_pattern(self, self.root_password, + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, 'Please make a selection from the abov= e', vm=3Dtemp_vm) =20 # Login as root - self.prompt =3D '[root@localhost ~]#' - exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', v= m=3Dtemp_vm) - exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= temp_vm) - exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt, + S390xSecureIpl._prompt =3D '[root@localhost ~]#' + exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', + vm=3Dtemp_vm) + exec_command_and_wait_for_pattern(self, S390xSecureIpl._root_passw= ord, + S390xSecureIpl._prompt, vm=3Dtem= p_vm) =20 self._create_certificate(temp_vm) self._sign_binaries(temp_vm) @@ -150,41 +171,71 @@ def setup_s390x_secure_ipl(self): =20 # Shutdown temp vm temp_vm.shutdown() + S390xSecureIpl._setup_done =3D True =20 - @skipBigDataTest() - def test_s390x_secure_ipl(self): + def verify_s390x_secure_ipl(self, boot_dev_bus: str): """ Verify secure boot validation during s390x guest boot. =20 Expects two "Verified component" messages and confirms /sys/firmware/ipl/secure reports secure boot is active. """ - self.require_accelerator('kvm') - self.setup_s390x_secure_ipl() - - self.set_machine('s390-ccw-virtio') - - self.vm.set_console() - self.vm.add_args('-nographic', - '-machine', 's390-ccw-virtio,secure-boot=3Don,' - f'boot-certs.0.path=3D{self.cert_path}', - '-accel', 'kvm', - '-m', '1024', - '-drive', - f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,file=3D{se= lf.qcow2_path}', - '-device', 'virtio-blk-ccw,drive=3Ddrive1,bootind= ex=3D1') - self.vm.launch() + if boot_dev_bus not in ['ccw', 'pci']: + raise ValueError( + f"boot_dev_bus must be 'ccw' or 'pci', got {boot_dev_bus}") + + vm =3D self.get_vm(name=3Df'sipl_test_vblk_{boot_dev_bus}') + vm.set_machine('s390-ccw-virtio') + + vm.set_console() + vm.add_args('-nographic', + '-machine', 's390-ccw-virtio,secure-boot=3Don,' + f'boot-certs.0.path=3D{S390xSecureIpl._cert_path}', + '-accel', 'kvm', + '-m', '1024', + '-drive', + f'id=3Ddrive1,if=3Dnone,format=3Dqcow2,' + f'file=3D{S390xSecureIpl._qcow2_path}', + '-device', + f'virtio-blk-{boot_dev_bus},drive=3Ddrive1,bootindex= =3D1') + vm.launch() =20 # Expect two verified components verified_output =3D "Verified component" - wait_for_console_pattern(self, verified_output) - wait_for_console_pattern(self, verified_output) + wait_for_console_pattern(self, verified_output, vm=3Dvm) + wait_for_console_pattern(self, verified_output, vm=3Dvm) =20 # Login and verify the vm is booted using secure boot - wait_for_console_pattern(self, 'localhost login:') - exec_command_and_wait_for_pattern(self, 'root', 'Password:') - exec_command_and_wait_for_pattern(self, self.root_password, self.p= rompt) - exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/sec= ure', '1') + wait_for_console_pattern(self, 'localhost login:', vm=3Dvm) + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=3D= vm) + exec_command_and_wait_for_pattern( + self, S390xSecureIpl._root_password, S390xSecureIpl._prompt, v= m=3Dvm) + exec_command_and_wait_for_pattern( + self, 'cat /sys/firmware/ipl/secure', '1', vm=3Dvm) + + vm.shutdown() + + @skipBigDataTest() + def test_s390x_secure_ipl_ccw(self): + """Test secure IPL with a virtio-blk-ccw boot device.""" + self.require_accelerator('kvm') + if S390xSecureIpl._host_lacks_sipl_support: + self.skipTest("Host CPU does not support Secure IPL. " + "Secure IPL requires a z16+ host.") + if not S390xSecureIpl._setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('ccw') + + @skipBigDataTest() + def test_s390x_secure_ipl_pci(self): + """Test secure IPL with a virtio-blk-pci boot device.""" + self.require_accelerator('kvm') + if S390xSecureIpl._host_lacks_sipl_support: + self.skipTest("Host CPU does not support Secure IPL. " + "Secure IPL requires a z16+ host.") + if not S390xSecureIpl._setup_done: + self.setup_s390x_secure_ipl() + self.verify_s390x_secure_ipl('pci') =20 if __name__ =3D=3D '__main__': QemuSystemTest.main() --=20 2.34.1