From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 977FEEDEBF5 for ; Tue, 3 Mar 2026 22:08:42 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vxXuL-0000ue-3p; Tue, 03 Mar 2026 17:08:01 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vxXuG-0000tz-7s; Tue, 03 Mar 2026 17:07:56 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vxXuC-0006kl-In; Tue, 03 Mar 2026 17:07:54 -0500 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 623JZ4gY2216780; Tue, 3 Mar 2026 22:07:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=odfWvJ My/fEV4p+xvP3nejRDonrT61aPRP2jlrDpL84=; b=eVtDjdLuxhoa9387cXXw5I HyyS1itC8ApRmzpflcAEZtcCpuXqJUit7y7FsfRLUh+3qLxWiqzrID+F/5UpbwcO arqTVditeICHS5dK2XxFuvnCIXkig/ZpMWbviE1jfKxe575bQqf/I7xvKrET7YNG J5Cd65CX6pzbvHPD9AwuCvDWcLtWqJo7PW+ypP3w/62o+UWkjJp0CkghtYM/daAn 2t0cUCinAhiTWEykyzUb45MGBYEV9pABE9xeXMpqYKTzS8G5SZuO8T6B0Xn8uvmD 3Bl/tJdcTYfi3QOfzNVaMLZ3sSfzjnASmc86mC7v+tz06hFK9fytkX/A/OTaC3kg == Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4ckskcw1xj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Mar 2026 22:07:47 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 623HiAZK003200; Tue, 3 Mar 2026 22:07:46 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4cmb2y4c5s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Mar 2026 22:07:46 +0000 Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 623M7id416581144 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Mar 2026 22:07:44 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A75558056; Tue, 3 Mar 2026 22:07:44 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A074758052; Tue, 3 Mar 2026 22:07:43 +0000 (GMT) Received: from [9.61.108.121] (unknown [9.61.108.121]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 3 Mar 2026 22:07:43 +0000 (GMT) Message-ID: <7582a154-7f9f-4161-bf39-8d20930a1d27@linux.ibm.com> Date: Tue, 3 Mar 2026 17:07:43 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v8 28/30] tests/functional/s390x: Add secure IPL functional test To: Thomas Huth , berrange@redhat.com, richard.henderson@linaro.org, jrossi@linux.ibm.com, qemu-s390x@nongnu.org, qemu-devel@nongnu.org Cc: david@kernel.org, walling@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com, mjrosato@linux.ibm.com, iii@linux.ibm.com, eblake@redhat.com, armbru@redhat.com, alifm@linux.ibm.com, brueckner@linux.ibm.com References: <20260212204352.1044699-1-zycai@linux.ibm.com> <20260212204352.1044699-29-zycai@linux.ibm.com> <8fe43e9c-45de-467f-89c0-241f87c5e716@redhat.com> Content-Language: en-US From: Zhuoying Cai In-Reply-To: <8fe43e9c-45de-467f-89c0-241f87c5e716@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 13dHdNdz8TKC6c6du4Dd9ND2YMvUPoWv X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzAzMDE3OCBTYWx0ZWRfX7yNBsUUfbn9x Xk3apkjzdtEZsbfQDQVw4j6u4xzcNYYArAz9s8+n/reV1cegu4jvBw4goDyTpbXwRtHa1rnU9g+ OBiyOQb5+oYM9yiFqvH9pbKNgXYCY1Wwghb/KdaRKtY7skLaMKiocmH1j2ZCT82qTGWxpXalN6U bU4jHWNghrIPqnKs/uE24ft0Y6ydoOM03GSF/MzYR2c9B2tyqMvQtSZyvgSzHRqZKG/gotgypOo 4wIOhLxZkRZbae/sddPWtI+vsi3f12b1V3agbgmd6UAJ5lP2GlDAy2dr8wJ6vACWRLE/tW0BiW5 HZRQhTo1HzpUDyxTU81EUb7UiQQxhJDuTOONYP2CbGYn5cRrtj7EiRjJ4YBavPJ3ffRd4zyD9JW of7x34Q60pXuWEYSlCMH0+/i1Ds0UsqSA+lgy/jS+U3t6DzY4gvlplv+yS0EkcFc/Xk8dMgaRZ8 I7uHmYfihNdADusrwGg== X-Authority-Analysis: v=2.4 cv=H7DWAuYi c=1 sm=1 tr=0 ts=69a75bb3 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=IkcTkHD0fZMA:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=vTr9H3xdAAAA:8 a=VnNF1IyMAAAA:8 a=WP5zsaevAAAA:8 a=3jq1zGdey7M1J0bJwMwA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=t8Kx07QrZZTALmIZmm-o:22 X-Proofpoint-ORIG-GUID: 13dHdNdz8TKC6c6du4Dd9ND2YMvUPoWv X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-03_03,2026-03-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 phishscore=0 clxscore=1015 priorityscore=1501 adultscore=0 bulkscore=0 spamscore=0 malwarescore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2603030178 Received-SPF: pass client-ip=148.163.156.1; envelope-from=zycai@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -11 X-Spam_score: -1.2 X-Spam_bar: - X-Spam_report: (-1.2 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.322, RCVD_IN_VALIDITY_SAFE_BLOCKED=1.141, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Thanks for the feedback. On 3/2/26 8:35 AM, Thomas Huth wrote: > On 12/02/2026 21.43, Zhuoying Cai wrote: >> Add functional test for secure IPL. > > Thanks for adding it! Some comments below... > >> Signed-off-by: Zhuoying Cai >> --- >> tests/functional/s390x/meson.build | 2 + >> tests/functional/s390x/test_secure_ipl.py | 142 ++++++++++++++++++++++ >> 2 files changed, 144 insertions(+) >> create mode 100644 tests/functional/s390x/test_secure_ipl.py >> >> diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/meson.build >> index 70cd36e291..cb050f3c01 100644 >> --- a/tests/functional/s390x/meson.build >> +++ b/tests/functional/s390x/meson.build >> @@ -2,6 +2,7 @@ >> >> test_s390x_timeouts = { >> 'ccw_virtio' : 420, >> + 'secure_ipl' : 280, >> } >> >> tests_s390x_system_quick = [ >> @@ -12,6 +13,7 @@ tests_s390x_system_thorough = [ >> 'ccw_virtio', >> 'pxelinux', >> 'replay', >> + 'secure_ipl', >> 'topology', >> 'tuxrun', >> ] >> diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s390x/test_secure_ipl.py >> new file mode 100644 > > chmod a+x please, so we can also run this test directly, without the meson > test harness. > >> index 0000000000..c95553e4e9 >> --- /dev/null >> +++ b/tests/functional/s390x/test_secure_ipl.py >> @@ -0,0 +1,142 @@ >> +#!/usr/bin/env python3 >> +# >> +# s390x Secure IPL functional test: validates secure-boot verification results >> +# >> +# SPDX-License-Identifier: GPL-2.0-or-later >> + >> +from qemu_test import QemuSystemTest, Asset >> +from qemu_test import exec_command_and_wait_for_pattern, exec_command >> +from qemu_test import wait_for_console_pattern, skipBigDataTest >> + >> +class S390xSecureIpl(QemuSystemTest): >> + ASSET_F40_QCOW2 = Asset( >> + ('https://archives.fedoraproject.org/pub/archive/' >> + 'fedora-secondary/releases/40/Server/s390x/images/' >> + 'Fedora-Server-KVM-40-1.14.s390x.qcow2'), >> + '091c232a7301be14e19c76ce9a0c1cbd2be2c4157884a731e1fc4f89e7455a5f') >> + >> + def __init__(self, *args, **kwargs): >> + super().__init__(*args, **kwargs) >> + self.root_password = None >> + self.qcow2_path = None >> + self.cert_path = None >> + self.prompt = None >> + >> + # Boot a temporary VM to set up secure IPL image: >> + # - Create certificate >> + # - Sign stage3 binary and kernel >> + # - Run zipl >> + # - Extract certificate >> + def setup_s390x_secure_ipl(self): >> + temp_vm = self.get_vm(name='sipl_setup') >> + temp_vm.set_machine('s390-ccw-virtio') >> + >> + self.qcow2_path = self.ASSET_F40_QCOW2.fetch() >> + >> + temp_vm.set_console() >> + temp_vm.add_args('-nographic', >> + '-accel', 'kvm', >> + '-m', '1024', >> + '-drive', >> + f'id=drive0,if=none,format=qcow2,file={self.qcow2_path}', > > Assets are stored as read-only in the cache, so this should fail? Did you > maybe copy the asset manually into your cache? > > Anyway, I think you certainly want to operate on a "copy" of your asset > instead (done with "qemu-img -b ..." to use the original asset as backing > file), so you don't alter the original asset while running the test. > I’ll create a copy and set it up instead of using the original asset. >> + '-device', 'virtio-blk-ccw,drive=drive0,bootindex=1') >> + temp_vm.launch() >> + >> + # Initial root account setup (Fedora first boot screen) >> + self.root_password = 'fedora40password' >> + wait_for_console_pattern(self, 'Please make a selection from the above', >> + vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, '4', 'Password:', vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, self.root_password, >> + 'Password (confirm):', vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, self.root_password, >> + 'Please make a selection from the above', >> + vm=temp_vm) >> + >> + # Login as root >> + self.prompt = '[root@localhost ~]#' >> + exec_command_and_wait_for_pattern(self, 'c', 'localhost login:', vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, self.root_password, self.prompt, >> + vm=temp_vm) >> + >> + # Certificate generation >> + exec_command_and_wait_for_pattern(self, >> + 'openssl version', 'OpenSSL 3.2.1 30', >> + vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, >> + 'openssl req -new -x509 -newkey rsa:2048 ' >> + '-keyout mykey.pem -outform PEM -out mycert.pem ' >> + '-days 36500 -subj "/CN=My Name/" -nodes -verbose', >> + 'Writing private key to \'mykey.pem\'', vm=temp_vm) >> + >> + # Install kernel-devel (needed for sign-file) >> + exec_command_and_wait_for_pattern(self, >> + 'sudo dnf install kernel-devel-$(uname -r) -y', >> + 'Complete!', vm=temp_vm) >> + wait_for_console_pattern(self, self.prompt, vm=temp_vm) >> + exec_command_and_wait_for_pattern(self, >> + 'ls /usr/src/kernels/$(uname -r)/scripts/', >> + 'sign-file', vm=temp_vm) >> + >> + # Sign stage3 binary and kernel >> + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file ' >> + 'sha256 mykey.pem mycert.pem /lib/s390-tools/stage3.bin', >> + vm=temp_vm) >> + wait_for_console_pattern(self, self.prompt, vm=temp_vm) >> + exec_command(self, '/usr/src/kernels/$(uname -r)/scripts/sign-file ' >> + 'sha256 mykey.pem mycert.pem /boot/vmlinuz-$(uname -r)', >> + vm=temp_vm) >> + wait_for_console_pattern(self, self.prompt, vm=temp_vm) >> + >> + # Run zipl to prepare for secure boot >> + exec_command_and_wait_for_pattern(self, 'zipl --secure 1 -VV', 'Done.', >> + vm=temp_vm) >> + >> + # Extract certificate to host >> + out = exec_command_and_wait_for_pattern(self, 'cat mycert.pem', >> + '-----END CERTIFICATE-----', >> + vm=temp_vm) >> + # strip first line to avoid console echo artifacts >> + cert = "\n".join(out.decode("utf-8").splitlines()[1:]) >> + self.log.info("%s", cert) >> + >> + self.cert_path = self.scratch_file("mycert.pem") >> + >> + with open(self.cert_path, 'w', encoding="utf-8") as file_object: >> + file_object.write(cert) >> + >> + # Shutdown temp vm >> + temp_vm.shutdown() >> + >> + @skipBigDataTest() >> + def test_s390x_secure_ipl(self): >> + self.require_accelerator('kvm') > > Could this test also be run with TCG? > > Thomas > > No, this test will not work with TCG due to the test setup. The Fedora Server qcow2 image has the root account locked by default. Under TCG, the system boots much more slowly and drops into emergency mode while the root account is still locked. As a result, the test cannot proceed because login is not possible. QEMU (TCG) log shows: Cannot open access to console, the root account is locked. See sulogin(8) man page for more details. Press Enter to continue. ... There are also repeated SELinux AVC denials (e.g., access to z90crypt), indicating the system reaches emergency state before completing normal initialization. Therefore, this test cannot run under TCG with the current image and setup. >> + self.setup_s390x_secure_ipl() >> + >> + self.set_machine('s390-ccw-virtio') >> + >> + self.vm.set_console() >> + self.vm.add_args('-nographic', >> + '-machine', 's390-ccw-virtio,secure-boot=on,' >> + f'boot-certs.0.path={self.cert_path}', >> + '-accel', 'kvm', >> + '-m', '1024', >> + '-drive', >> + f'id=drive1,if=none,format=qcow2,file={self.qcow2_path}', >> + '-device', 'virtio-blk-ccw,drive=drive1,bootindex=1') >> + self.vm.launch() >> + >> + # Expect two verified components >> + verified_output = "Verified component" >> + wait_for_console_pattern(self, verified_output) >> + wait_for_console_pattern(self, verified_output) >> + >> + # Login and verify the vm is booted using secure boot >> + wait_for_console_pattern(self, 'localhost login:') >> + exec_command_and_wait_for_pattern(self, 'root', 'Password:') >> + exec_command_and_wait_for_pattern(self, self.root_password, self.prompt) >> + exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/secure', '1') >> + >> +if __name__ == '__main__': >> + QemuSystemTest.main() >