[PATCH v1 0/3] Extend secure IPL support to virtio-blk-pci boot devices

[PATCH v1 0/3] Extend secure IPL support to virtio-blk-pci boot devices

[Joshua Daley]

This series is based on Zhuoying Cai's series,
"[PATCH v17 00/34] Secure IPL Support for SCSI Scheme of virtio-blk/virtio-scsi Devices"
https://lore.kernel.org/qemu-devel/20260730214624.2328883-1-zycai@linux.ibm.com/

Note, the above series is based on Cornelia Huck's patch,
"[PATCH for-11.2] hw: add compat machines for 11.2"
https://lore.kernel.org/qemu-devel/20260723163806.368127-1-cohuck@redhat.com/
which requires a small fix to apply (see Eric Farman's reply).

---

To add support for secure IPL with a virtio-blk-pci boot device, we simply
write secure boot flags to the IPLB when using such a boot device.
This is achieved by calling s390_apply_secure_boot() in the PCI boot
device case of s390_build_iplb().

The secure IPL functional verification test is updated with an additional
subtest for the virtio-blk-pci boot device case. To run the FVT:

  make check-functional-s390x MTESTARGS="func-s390x-secure_ipl" \
  QEMU_TEST_ALLOW_LARGE_STORAGE=1

To test secure IPL yourself, view the "Secure IPL Quickstart" guide in:
docs/system/s390x/secure-ipl.rst

Joshua Daley (3):
  hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder
  tests/functional/s390x/test_secure_ipl: Skip test if SIPL not
    supported by hypervisor
  tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev
    case

 hw/s390x/ipl.c                            |  8 +--
 tests/functional/s390x/test_secure_ipl.py | 88 +++++++++++++++++------
 2 files changed, 68 insertions(+), 28 deletions(-)

-- 
2.34.1

[PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

[Joshua Daley]

In the PCI boot device case of s390_build_iplb(), call
s390_apply_secure_boot() to update the IPLB when secure boot or audit
mode are enabled.

Secure IPL is now supported for virtio-blk-pci boot devices.

Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
---
 hw/s390x/ipl.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c78..b0da3cbb27 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
 
     pbdev = s390_get_pci_device(dev_st, &devtype);
     if (pbdev) {
-        if (s390_secure_boot_enabled() || s390_has_certificate()) {
-            error_report("Virtio pci boot device does not support secure boot!");
-            exit(1);
-        }
-
         pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
         if (pci_lp && strlen(pci_lp) > 0) {
             lp = pci_lp;
@@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
         s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
         iplb->flags |= DIAG308_FLAGS_LP_VALID;
 
+        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
+                               s390_has_certificate());
+
         return true;
     }
 
-- 
2.34.1

[PATCH v1 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor

[Joshua Daley]

Currently, if secure IPL is not supported by the hypervisor, the test
will fail because "Verified component" never appears. One must inspect
the console log to observe the cause of the failure.

Add a check that skips the test if the host CPU model is missing the
secure IPL facilities.

Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
---
 tests/functional/s390x/test_secure_ipl.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s390x/test_secure_ipl.py
index 06fc93e404..5af36b91d8 100755
--- a/tests/functional/s390x/test_secure_ipl.py
+++ b/tests/functional/s390x/test_secure_ipl.py
@@ -29,6 +29,22 @@ def __init__(self, *args, **kwargs):
         self.cert_path = None
         self.prompt = None
 
+    def _require_host_secure_ipl_support(self, vm):
+        """
+        Skip the test if the host CPU model does not expose the Secure IPL
+        facilities (sipl, sclaf, cstore).
+        """
+        props = vm.cmd('query-cpu-model-expansion',
+                       model={'name': 'host'},
+                       type='full')['model']['props']
+        missing = [f for f in ('sipl', 'sclaf', 'cstore')
+                   if not props.get(f)]
+        if missing:
+            self.skipTest(
+                f"Host CPU does not support Secure IPL: "
+                f"missing feature(s): {', '.join(missing)}. "
+                f"Secure IPL requires a z16+ host.")
+
     def _create_certificate(self, vm):
         """Generate x509 certificate"""
         exec_command_and_wait_for_pattern(self,
@@ -107,6 +123,8 @@ def setup_s390x_secure_ipl(self):
                          '-device', 'virtio-blk-ccw,drive=drive0,bootindex=1')
         temp_vm.launch()
 
+        self._require_host_secure_ipl_support(temp_vm)
+
         # Initial root account setup (Fedora first boot screen)
         self.root_password = 'fedora40password'
         wait_for_console_pattern(self, 'Please make a selection from the above',
-- 
2.34.1

[PATCH v1 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case

[Joshua Daley]

Split test_s390x_secure_ipl() into two subtests. Each tests with a
different boot device: virtio-blk-ccw or virtio-blk-pci. Use a state var
such that the setup is run only once.

Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
---
 tests/functional/s390x/test_secure_ipl.py | 70 +++++++++++++++--------
 1 file changed, 47 insertions(+), 23 deletions(-)

diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s390x/test_secure_ipl.py
index 5af36b91d8..7fd4cfeaab 100755
--- a/tests/functional/s390x/test_secure_ipl.py
+++ b/tests/functional/s390x/test_secure_ipl.py
@@ -28,6 +28,7 @@ def __init__(self, *args, **kwargs):
         self.qcow2_path = None
         self.cert_path = None
         self.prompt = None
+        self.setup_done = False
 
     def _require_host_secure_ipl_support(self, vm):
         """
@@ -150,41 +151,64 @@ def setup_s390x_secure_ipl(self):
 
         # Shutdown temp vm
         temp_vm.shutdown()
+        self.setup_done = True
 
-    @skipBigDataTest()
-    def test_s390x_secure_ipl(self):
+    def verify_s390x_secure_ipl(self, boot_dev_bus: str):
         """
         Verify secure boot validation during s390x guest boot.
 
         Expects two "Verified component" messages and confirms
         /sys/firmware/ipl/secure reports secure boot is active.
         """
-        self.require_accelerator('kvm')
-        self.setup_s390x_secure_ipl()
-
-        self.set_machine('s390-ccw-virtio')
-
-        self.vm.set_console()
-        self.vm.add_args('-nographic',
-                         '-machine', 's390-ccw-virtio,secure-boot=on,'
-                         f'boot-certs.0.path={self.cert_path}',
-                         '-accel', 'kvm',
-                         '-m', '1024',
-                         '-drive',
-                         f'id=drive1,if=none,format=qcow2,file={self.qcow2_path}',
-                         '-device', 'virtio-blk-ccw,drive=drive1,bootindex=1')
-        self.vm.launch()
+        if boot_dev_bus not in ['ccw', 'pci']:
+            raise ValueError(
+                f"boot_dev_bus must be 'ccw' or 'pci', got {boot_dev_bus}")
+
+        vm = self.get_vm(name=f'sipl_test_vblk_{boot_dev_bus}')
+        vm.set_machine('s390-ccw-virtio')
+
+        vm.set_console()
+        vm.add_args('-nographic',
+                    '-machine', 's390-ccw-virtio,secure-boot=on,'
+                    f'boot-certs.0.path={self.cert_path}',
+                    '-accel', 'kvm',
+                    '-m', '1024',
+                    '-drive',
+                    f'id=drive1,if=none,format=qcow2,file={self.qcow2_path}',
+                    '-device',
+                    f'virtio-blk-{boot_dev_bus},drive=drive1,bootindex=1')
+        vm.launch()
 
         # Expect two verified components
         verified_output = "Verified component"
-        wait_for_console_pattern(self, verified_output)
-        wait_for_console_pattern(self, verified_output)
+        wait_for_console_pattern(self, verified_output, vm=vm)
+        wait_for_console_pattern(self, verified_output, vm=vm)
 
         # Login and verify the vm is booted using secure boot
-        wait_for_console_pattern(self, 'localhost login:')
-        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
-        exec_command_and_wait_for_pattern(self, self.root_password, self.prompt)
-        exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/secure', '1')
+        wait_for_console_pattern(self, 'localhost login:', vm=vm)
+        exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=vm)
+        exec_command_and_wait_for_pattern(
+            self, self.root_password, self.prompt, vm=vm)
+        exec_command_and_wait_for_pattern(
+            self, 'cat /sys/firmware/ipl/secure', '1', vm=vm)
+
+        vm.shutdown()
+
+    @skipBigDataTest()
+    def test_s390x_secure_ipl_ccw(self):
+        """Test secure IPL with a virtio-blk-ccw boot device."""
+        self.require_accelerator('kvm')
+        if not self.setup_done:
+            self.setup_s390x_secure_ipl()
+        self.verify_s390x_secure_ipl('ccw')
+
+    @skipBigDataTest()
+    def test_s390x_secure_ipl_pci(self):
+        """Test secure IPL with a virtio-blk-pci boot device."""
+        self.require_accelerator('kvm')
+        if not self.setup_done:
+            self.setup_s390x_secure_ipl()
+        self.verify_s390x_secure_ipl('pci')
 
 if __name__ == '__main__':
     QemuSystemTest.main()
-- 
2.34.1

Re: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

[Jared Rossi]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
>
> Secure IPL is now supported for virtio-blk-pci boot devices.
>
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
> ---
>   hw/s390x/ipl.c | 8 +++-----
>   1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c78..b0da3cbb27 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>   
>       pbdev = s390_get_pci_device(dev_st, &devtype);
>       if (pbdev) {
> -        if (s390_secure_boot_enabled() || s390_has_certificate()) {
> -            error_report("Virtio pci boot device does not support secure boot!");
> -            exit(1);
> -        }
> -
>           pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
>           if (pci_lp && strlen(pci_lp) > 0) {
>               lp = pci_lp;
> @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>           s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>           iplb->flags |= DIAG308_FLAGS_LP_VALID;
>   
> +        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
> +                               s390_has_certificate());
> +
>           return true;
>       }
>   

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>

Re: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

[Zhuoying Cai]

Reviewed-by: Zhuoying Cai <zycai@linux.ibm.com>

On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
> 
> Secure IPL is now supported for virtio-blk-pci boot devices.
> 
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
> ---
>  hw/s390x/ipl.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index d59ed36c78..b0da3cbb27 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -599,11 +599,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>  
>      pbdev = s390_get_pci_device(dev_st, &devtype);
>      if (pbdev) {
> -        if (s390_secure_boot_enabled() || s390_has_certificate()) {
> -            error_report("Virtio pci boot device does not support secure boot!");
> -            exit(1);
> -        }
> -
>          pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm", NULL);
>          if (pci_lp && strlen(pci_lp) > 0) {
>              lp = pci_lp;
> @@ -625,6 +620,9 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
>          s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
>          iplb->flags |= DIAG308_FLAGS_LP_VALID;
>  
> +        s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
> +                               s390_has_certificate());
> +
>          return true;
>      }
>  

Re: [PATCH v1 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor

[Jared Rossi]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> Currently, if secure IPL is not supported by the hypervisor, the test
> will fail because "Verified component" never appears. One must inspect
> the console log to observe the cause of the failure.
>
> Add a check that skips the test if the host CPU model is missing the
> secure IPL facilities.
>
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
> ---
>   tests/functional/s390x/test_secure_ipl.py | 18 ++++++++++++++++++
>   1 file changed, 18 insertions(+)
>
> diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s390x/test_secure_ipl.py
> index 06fc93e404..5af36b91d8 100755
> --- a/tests/functional/s390x/test_secure_ipl.py
> +++ b/tests/functional/s390x/test_secure_ipl.py
> @@ -29,6 +29,22 @@ def __init__(self, *args, **kwargs):
>           self.cert_path = None
>           self.prompt = None
>   
> +    def _require_host_secure_ipl_support(self, vm):
> +        """
> +        Skip the test if the host CPU model does not expose the Secure IPL
> +        facilities (sipl, sclaf, cstore).
> +        """
> +        props = vm.cmd('query-cpu-model-expansion',
> +                       model={'name': 'host'},
> +                       type='full')['model']['props']
> +        missing = [f for f in ('sipl', 'sclaf', 'cstore')
> +                   if not props.get(f)]
> +        if missing:
> +            self.skipTest(
> +                f"Host CPU does not support Secure IPL: "
> +                f"missing feature(s): {', '.join(missing)}. "
> +                f"Secure IPL requires a z16+ host.")
> +
>       def _create_certificate(self, vm):
>           """Generate x509 certificate"""
>           exec_command_and_wait_for_pattern(self,
> @@ -107,6 +123,8 @@ def setup_s390x_secure_ipl(self):
>                            '-device', 'virtio-blk-ccw,drive=drive0,bootindex=1')
>           temp_vm.launch()
>   
> +        self._require_host_secure_ipl_support(temp_vm)
> +
>           # Initial root account setup (Fedora first boot screen)
>           self.root_password = 'fedora40password'
>           wait_for_console_pattern(self, 'Please make a selection from the above',
Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>

Re: [PATCH v1 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case

[Jared Rossi]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> Split test_s390x_secure_ipl() into two subtests. Each tests with a
> different boot device: virtio-blk-ccw or virtio-blk-pci. Use a state var
> such that the setup is run only once.
>
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
> ---
>   tests/functional/s390x/test_secure_ipl.py | 70 +++++++++++++++--------
>   1 file changed, 47 insertions(+), 23 deletions(-)
>
> diff --git a/tests/functional/s390x/test_secure_ipl.py b/tests/functional/s390x/test_secure_ipl.py
> index 5af36b91d8..7fd4cfeaab 100755
> --- a/tests/functional/s390x/test_secure_ipl.py
> +++ b/tests/functional/s390x/test_secure_ipl.py
> @@ -28,6 +28,7 @@ def __init__(self, *args, **kwargs):
>           self.qcow2_path = None
>           self.cert_path = None
>           self.prompt = None
> +        self.setup_done = False
>   
>       def _require_host_secure_ipl_support(self, vm):
>           """
> @@ -150,41 +151,64 @@ def setup_s390x_secure_ipl(self):
>   
>           # Shutdown temp vm
>           temp_vm.shutdown()
> +        self.setup_done = True
>   
> -    @skipBigDataTest()
> -    def test_s390x_secure_ipl(self):
> +    def verify_s390x_secure_ipl(self, boot_dev_bus: str):
>           """
>           Verify secure boot validation during s390x guest boot.
>   
>           Expects two "Verified component" messages and confirms
>           /sys/firmware/ipl/secure reports secure boot is active.
>           """
> -        self.require_accelerator('kvm')
> -        self.setup_s390x_secure_ipl()
> -
> -        self.set_machine('s390-ccw-virtio')
> -
> -        self.vm.set_console()
> -        self.vm.add_args('-nographic',
> -                         '-machine', 's390-ccw-virtio,secure-boot=on,'
> -                         f'boot-certs.0.path={self.cert_path}',
> -                         '-accel', 'kvm',
> -                         '-m', '1024',
> -                         '-drive',
> -                         f'id=drive1,if=none,format=qcow2,file={self.qcow2_path}',
> -                         '-device', 'virtio-blk-ccw,drive=drive1,bootindex=1')
> -        self.vm.launch()
> +        if boot_dev_bus not in ['ccw', 'pci']:
> +            raise ValueError(
> +                f"boot_dev_bus must be 'ccw' or 'pci', got {boot_dev_bus}")
> +
> +        vm = self.get_vm(name=f'sipl_test_vblk_{boot_dev_bus}')
> +        vm.set_machine('s390-ccw-virtio')
> +
> +        vm.set_console()
> +        vm.add_args('-nographic',
> +                    '-machine', 's390-ccw-virtio,secure-boot=on,'
> +                    f'boot-certs.0.path={self.cert_path}',
> +                    '-accel', 'kvm',
> +                    '-m', '1024',
> +                    '-drive',
> +                    f'id=drive1,if=none,format=qcow2,file={self.qcow2_path}',
> +                    '-device',
> +                    f'virtio-blk-{boot_dev_bus},drive=drive1,bootindex=1')
> +        vm.launch()
>   
>           # Expect two verified components
>           verified_output = "Verified component"
> -        wait_for_console_pattern(self, verified_output)
> -        wait_for_console_pattern(self, verified_output)
> +        wait_for_console_pattern(self, verified_output, vm=vm)
> +        wait_for_console_pattern(self, verified_output, vm=vm)
>   
>           # Login and verify the vm is booted using secure boot
> -        wait_for_console_pattern(self, 'localhost login:')
> -        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
> -        exec_command_and_wait_for_pattern(self, self.root_password, self.prompt)
> -        exec_command_and_wait_for_pattern(self, 'cat /sys/firmware/ipl/secure', '1')
> +        wait_for_console_pattern(self, 'localhost login:', vm=vm)
> +        exec_command_and_wait_for_pattern(self, 'root', 'Password:', vm=vm)
> +        exec_command_and_wait_for_pattern(
> +            self, self.root_password, self.prompt, vm=vm)
> +        exec_command_and_wait_for_pattern(
> +            self, 'cat /sys/firmware/ipl/secure', '1', vm=vm)
> +
> +        vm.shutdown()
> +
> +    @skipBigDataTest()
> +    def test_s390x_secure_ipl_ccw(self):
> +        """Test secure IPL with a virtio-blk-ccw boot device."""
> +        self.require_accelerator('kvm')
> +        if not self.setup_done:
> +            self.setup_s390x_secure_ipl()
> +        self.verify_s390x_secure_ipl('ccw')
> +
> +    @skipBigDataTest()
> +    def test_s390x_secure_ipl_pci(self):
> +        """Test secure IPL with a virtio-blk-pci boot device."""
> +        self.require_accelerator('kvm')
> +        if not self.setup_done:
> +            self.setup_s390x_secure_ipl()
> +        self.verify_s390x_secure_ipl('pci')
>   
>   if __name__ == '__main__':
>       QemuSystemTest.main()
Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>

Re: [PATCH v1 1/3] hw/s390x/ipl: Add secure boot support to PCI dev IPLB builder

[Matthew Rosato]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> In the PCI boot device case of s390_build_iplb(), call
> s390_apply_secure_boot() to update the IPLB when secure boot or audit
> mode are enabled.
> 
> Secure IPL is now supported for virtio-blk-pci boot devices.
> 
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>

Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>

Re: [PATCH v1 2/3] tests/functional/s390x/test_secure_ipl: Skip test if SIPL not supported by hypervisor

[Matthew Rosato]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> Currently, if secure IPL is not supported by the hypervisor, the test
> will fail because "Verified component" never appears. One must inspect
> the console log to observe the cause of the failure.
> 
> Add a check that skips the test if the host CPU model is missing the
> secure IPL facilities.
> 
> Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>

Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>

Re: [PATCH v1 3/3] tests/functional/s390x/test_secure_ipl: Add virtio-blk-pci boot dev case

[Matthew Rosato]

On 8/12/26 11:21 AM, Joshua Daley wrote:
> Split test_s390x_secure_ipl() into two subtests. Each tests with a
> different boot device: virtio-blk-ccw or virtio-blk-pci. Use a state var
> such that the setup is run only once.

[...]

> +
> +    @skipBigDataTest()
> +    def test_s390x_secure_ipl_ccw(self):
> +        """Test secure IPL with a virtio-blk-ccw boot device."""
> +        self.require_accelerator('kvm')
> +        if not self.setup_done:
> +            self.setup_s390x_secure_ipl()

AFAICT this setup_done check won't do anything.

If I run this file I will enter setup twice, once for
test_secure_ipl.S390xSecureIpl.test_s390x_secure_ipl_ccw
and again for
test_secure_ipl.S390xSecureIpl.test_s390x_secure_ipl_pci

I think it's because each test will run with it's own instance of the class.

> +        self.verify_s390x_secure_ipl('ccw')
> +
> +    @skipBigDataTest()
> +    def test_s390x_secure_ipl_pci(self):
> +        """Test secure IPL with a virtio-blk-pci boot device."""
> +        self.require_accelerator('kvm')
> +        if not self.setup_done:
> +            self.setup_s390x_secure_ipl()

Same

Unless this is really time consuming, I think the simple answer is to
just let the setup run twice and don't try to share between the 2 instances?

Thanks,
Matt