On 7/1/26 9:48 PM, Matthew Rosato wrote:
> On 7/1/26 4:49 PM, Zhuoying Cai wrote:
>> Add functional test for secure IPL.
>
> Thanks for writing a test! I (accidentally) verified that it fails
> without a s390-ccw.img that includes your changes + passes once your
> changes are built.
>
> Reviewed-by: Matthew Rosato <[email protected]>
>
Thanks for the review!
> But one question below, possibly a future enhancement...
>
> [...]
>
>> + @skipBigDataTest()
>> + def test_s390x_secure_ipl(self):
>> + """
>> + Verify secure boot validation during s390x guest boot.
>> +
>> + Expects two "Verified component" messages and confirms
>> + /sys/firmware/ipl/secure reports secure boot is active.
>> + """
>> + self.require_accelerator('kvm')
>
> I thought this would work for tcg too? If so it would be nice to be
> able to enable this test also for cross-platform testing w/ tcg..
>
Yes, it works with tcg as well. I ran the test with tcg last night and
again this morning, and it passed both times. The main issue is that it
took about 3060 seconds to complete due to the relatively slow nature of
tcg and the amount of setup performed by the test.
We could enable the test for tcg and use tcg whenever kvm is not
available, but we would need to significantly increase the timeout
compared to the kvm case. I think something around 5000 seconds would be
reasonable to avoid unexpected timeout failures. If that sounds
acceptable, I can enable it in the next version.
(Interestingly, when I tried running this test with tcg a while ago, it
did not work because account initialization failed during setup and the
guest dropped into emergency mode
<https://lore.kernel.org/qemu-devel/[email protected]/>.
It looks like something has changed since then, as the test now
completes successfully.)
> Thanks,
> Matt
>
