[PATCH v2 0/3] Extend secure IPL support to virtio-blk-pci boot devices

[Joshua Daley <jdaley@linux.ibm.com>]

Changes v1 -> v2:

- Added RB tags to patches 1 & 2
- Patch 3:
   The setup step is now run only once, as originally intended.
   setUpClass and tearDownClass manage a shared workdir for the
   subtests to use. Instance vars are now class-level vars.

v1 cover letter:

This series is based on Zhuoying Cai's series,
"[PATCH v17 00/34] Secure IPL Support for SCSI Scheme of virtio-blk/virtio-scsi Devices"
https://lore.kernel.org/qemu-devel/20260730214624.2328883-1-zycai@linux.ibm.com/

Note, the above series is based on Cornelia Huck's patch,
"[PATCH for-11.2] hw: add compat machines for 11.2"
https://lore.kernel.org/qemu-devel/20260723163806.368127-1-cohuck@redhat.com/
which requires a small fix to apply (see Eric Farman's reply).

---

To add support for secure IPL with a virtio-blk-pci boot device, we simply
write secure boot flags to the IPLB when using such a boot device.
This is achieved by calling s390_apply_secure_boot() in the PCI boot
device case of s390_build_iplb().

The secure IPL functional verification test is updated with an additional
subtest for the virtio-blk-pci boot device case. To run the FVT:

  make check-functional-s390x MTESTARGS="func-s390x-secure_ipl" \
  QEMU_TEST_ALLOW_LARGE_STORAGE=1

To test secure IPL yourself, view the "Secure IPL Quickstart" guide in:
docs/system/s390x/secure-ipl.rst

Joshua Daley (3):
  hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder
  tests/functional/s390x/test_secure_ipl: Skip test if SIPL not
    supported by hypervisor
  tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev
    case

 hw/s390x/ipl.c                            |   8 +-
 tests/functional/s390x/test_secure_ipl.py | 149 +++++++++++++++-------
 2 files changed, 108 insertions(+), 49 deletions(-)

-- 
2.34.1