Repository: os-autoinst/os-autoinst-distri-opensuse
Pull request #22115: Support SEV-ES guest installation on SLE16
Author: login: Julie-CAO
Created: 2025-05-19T06:04:28Z | Merged: 2025-05-26T00:47:42Z

- Create a parameter file for SEV-ES guest
- Schedule sev-es  guest verification test in the common guest installation yaml file.
- Install virt-bridge-setup package durning host installation. We can't set it up until the bug is fixed.

Related ticket: https://progress.opensuse.org/issues/178696
https://gitlab.suse.de/qa-testsuites/openqa-job-group-yaml/-/merge_requests/274
Verification run: 
https://openqa.suse.de/tests/17778522



Diff:
diff --git a/data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml b/data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
new file mode 100755
index 000000000000..3cebe2af9537
--- /dev/null
+++ b/data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,loader.secure=no,loader.stateless=yes</guest_boot_settings>
+    <guest_secure_boot>true</guest_secure_boot>
+    <guest_xpath/>
+    <guest_installation_automation_method>autoagama</guest_installation_automation_method>
+    <guest_installation_automation_platform></guest_installation_automation_platform>
+    <guest_installation_automation_file>sles_16_plus_kvm_hvm_guest_non_encrypted_storage_x86_64.jsonnet</guest_installation_automation_file>
+    <guest_installation_method>directkernel</guest_installation_method>
+    <guest_installation_extra_args/>
+    <guest_installation_wait/>
+    <guest_installation_method_others/>
+    <guest_installation_media>http://openqa.suse.de/assets/iso/SLES-16.0-Online-x86_64-Build12345.install.iso</guest_installation_media>
+    <guest_installation_fine_grained_media>http://openqa.suse.de/assets/repo/SLES-16.0-Online-x86_64-Build12345.install/</guest_installation_fine_grained_media>
+    <guest_installation_fine_grained_repos/>
+    <guest_installation_fine_grained_kernel_args>live.password=novell console=ttyS0,115200 linuxrc.log=/dev/ttyS0 linuxrc.core=/dev/ttyS0 linuxrc.debug=4,trace</guest_installation_fine_grained_kernel_args>
+    <guest_installation_fine_grained_kernel_args_overwrite/>
+    <guest_installation_fine_grained_others/>
+    <guest_os_variant>sle15sp7</guest_os_variant>
+    <guest_storage_path/>
+    <guest_storage_type>disk</guest_storage_type>
+    <guest_storage_format>qcow2</guest_storage_format>
+    <guest_storage_label>gpt</guest_storage_label>
+    <guest_storage_size>40</guest_storage_size>
+    <guest_storage_backing_path/>
+    <guest_storage_backing_format/>
+    <guest_storage_others>driver.name=qemu,target.dev=vda,target.bus=virtio,bus=virtio,cache=none</guest_storage_others>
+    <guest_network_type>bridge</guest_network_type>
+    <guest_network_mode>bridge</guest_network_mode>
+    <guest_network_device/>
+    <guest_network_others/>
+    <guest_netaddr/>
+    <guest_ipaddr/>
+    <guest_ipaddr_static>false</guest_ipaddr_static>
+    <guest_macaddr/>
+    <guest_graphics>vnc</guest_graphics>
+    <guest_controller/>
+    <guest_input/>
+    <guest_serial>pty</guest_serial>
+    <guest_parallel/>
+    <guest_channel/>
+    <guest_console/>
+    <guest_hostdev/>
+    <guest_filesystem/>
+    <guest_sound/>
+    <guest_watchdog/>
+    <guest_video/>
+    <guest_smartcard/>
+    <guest_redirdev/>
+    <guest_memballoon/>
+    <guest_tpm/>
+    <guest_rng/>
+    <guest_panic/>
+    <guest_memdev/>
+    <guest_vsock/>
+    <guest_iommu/>
+    <guest_iothreads/>
+    <guest_seclabel/>
+    <guest_keywrap/>
+    <guest_cputune/>
+    <guest_memtune/>
+    <guest_blkiotune/>
+    <guest_memorybacking>locked=yes</guest_memorybacking>
+    <guest_features/>
+    <guest_clock/>
+    <guest_power_management/>
+    <guest_events/>
+    <guest_resource/>
+    <guest_sysinfo/>
+    <guest_qemu_command/>
+    <guest_launchsecurity>sev,policy=0x06</guest_launchsecurity>
+    <guest_autostart/>
+    <guest_transient/>
+    <guest_destroy_on_exit/>
+    <guest_autoconsole>text</guest_autoconsole>
+    <guest_noautoconsole>false</guest_noautoconsole>
+    <guest_noreboot/>
+    <guest_default_target>graphical</guest_default_target>
+    <guest_do_registration>true</guest_do_registration>
+    <guest_registration_server/>
+    <guest_registration_username/>
+    <guest_registration_password/>
+    <guest_registration_extensions/>
+</guest>
diff --git a/data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet b/data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet
index 33683e6184e4..aa4de4c811ab 100644
--- a/data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet
+++ b/data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet
@@ -35,9 +35,12 @@
   },
   software: {
       patterns: [
-         'base',
-         'kvm_server',
-         'kvm_tools'
+        'base',
+        'kvm_server',
+        'kvm_tools'
+      ],
+      packages: [
+        'virt-bridge-setup'
       ]
   },
   scripts: {
diff --git a/schedule/virt_autotest/sle16_guest_installation.yaml b/schedule/virt_autotest/sle16_guest_installation.yaml
index 397a23f0064d..55ed25bb6d6f 100644
--- a/schedule/virt_autotest/sle16_guest_installation.yaml
+++ b/schedule/virt_autotest/sle16_guest_installation.yaml
@@ -1,11 +1,20 @@
 name:          sle16-virt-guest-installation
 description:    >
-    Virtualization guest installation tests including extended feature tests schedule with agama and IPXE
+  Virtualization guest installation tests including extended feature tests schedule with agama and IPXE
 schedule:
-    - installation/ipxe_install
-    - installation/agama_reboot
-    - virt_autotest/login_console
-    - virt_autotest/prepare_non_transactional_server
-    - virt_autotest/unified_guest_installation
-    - virt_autotest/set_config_as_glue
-    - virt_autotest/uefi_guest_verification
+  - installation/ipxe_install
+  - installation/agama_reboot
+  - virt_autotest/login_console
+  - virt_autotest/prepare_non_transactional_server
+  - virt_autotest/unified_guest_installation
+  - virt_autotest/set_config_as_glue
+  - '{{uefi_guest_verification}}'
+  - '{{sev-es_guest_verification}}'
+conditional_schedule:
+  uefi_guest_verification:
+    VIRT_UEFI_GUEST_INSTALL:
+      1:
+        - virt_autotest/uefi_guest_verification
+    VIRT_SEV_ES_GUEST_INSTALL:
+      1:
+        - virt_autotest/sev_es_guest_verification


Reviews:
user: login: alice-suse
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T04:06:18Z
user: login: alice-suse
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T04:08:04Z
user: login: Julie-CAO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T06:09:42Z
user: login: Julie-CAO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T06:12:06Z
user: login: Julie-CAO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T08:01:08Z
user: login: Julie-CAO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T08:17:18Z
user: login: alice-suse
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T09:07:03Z

Review comments:
diff_hunk: @@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,,loader.secure=no,loader.stateless=yes</guest_boot_settings>
path: data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
user: login: alice-suse
body: Hi Julie,
,,loader.secure=no ? Still not enabled, although firmware used?
created_at: 2025-05-20T04:06:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -35,9 +35,12 @@
   },
   software: {
       patterns: [
-         'base',
-         'kvm_server',
-         'kvm_tools'
+        'base',
+        'kvm_server',
+        'kvm_tools'
+      ],
+      packages: [
+        'virt-bridge-setup'
path: data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet
user: login: alice-suse
body: Will it automatically run to setup br0 at reboot? If yes, maybe let's hold on. Otherwise good.
created_at: 2025-05-20T04:08:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,,loader.secure=no,loader.stateless=yes</guest_boot_settings>
path: data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
user: login: Julie-CAO
body: I saw it is "no" for all sev-es guests from sle15sp4 to sp7. I don't quite know what it means. @waynechen55 Should it be "yes"?

I am going to run a test with "yes".
created_at: 2025-05-20T06:09:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -35,9 +35,12 @@
   },
   software: {
       patterns: [
-         'base',
-         'kvm_server',
-         'kvm_tools'
+        'base',
+        'kvm_server',
+        'kvm_tools'
+      ],
+      packages: [
+        'virt-bridge-setup'
path: data/virt_autotest/host_unattended_installation_files/agama/sle16.jsonnet
user: login: Julie-CAO
body: No, it just installs the package. "br0" can be set up by running the tool seperately.
created_at: 2025-05-20T06:12:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,,loader.secure=no,loader.stateless=yes</guest_boot_settings>
path: data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
user: login: Julie-CAO
body: ```
Now the 'secure' attribute has a bit misleading documentations as it doesn't control
whether the feature is enabled/disabled in the firmware but it is used to tell to
QEMU if the provided firmware is with secure boot feature enabled/disabled so QEMU
knows how to handle the firmware and access to it. We definitely need to improve
the documentation.
```
created_at: 2025-05-20T08:01:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,,loader.secure=no,loader.stateless=yes</guest_boot_settings>
path: data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
user: login: Julie-CAO
body: My test failed with `loader.secure=yes`, https://openqa.suse.de/tests/17749946#step/unified_guest_installation/460

I think it shoud be "no" at here for sle16.
created_at: 2025-05-20T08:17:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,101 @@
+<?xml version="1.0"?>
+<guest>
+    <guest_os_name>sles</guest_os_name>
+    <guest_version>16.0</guest_version>
+    <guest_version_major>16</guest_version_major>
+    <guest_version_minor>0</guest_version_minor>
+    <guest_os_word_length>64</guest_os_word_length>
+    <guest_build/>
+    <host_hypervisor_uri/>
+    <host_virt_type>kvm</host_virt_type>
+    <guest_virt_type>hvm</guest_virt_type>
+    <guest_machine_type>q35</guest_machine_type>
+    <guest_arch>x86_64</guest_arch>
+    <guest_name/>
+    <guest_domain_name/>
+    <guest_memory>2048,maxmemory=4096</guest_memory>
+    <guest_vcpus>2,maxvcpus=4</guest_vcpus>
+    <guest_cpumodel>host-model</guest_cpumodel>
+    <guest_metadata/>
+    <guest_boot_settings>loader=/usr/share/qemu/ovmf-x86_64-sev.bin,hd,bootmenu.enable=yes,menu=on,loader.readonly=yes,loader.type=pflash,,loader.secure=no,loader.stateless=yes</guest_boot_settings>
path: data/virt_autotest/guest_params_xml_files/sles_16_64_kvm_hvm_sev_es_x86_64_agama_online_iso.xml
user: login: alice-suse
body: From the failure screenshot, it shows secure boot needs SMM feature enabled. Anyway, sorry I messed this up with "uefi and secure boot". It is fine to ignore secure boot here.
created_at: 2025-05-20T09:07:03Z
author_association: CONTRIBUTOR

PR comments:
user: login: alice-suse
created_at: 2025-05-20T04:17:15Z
body: > Verification run: https://openqa.suse.de/tests/17749691

Hi Julie,
thanks for making it work! Would be good to add a separate testsuite for sev/-es in sle16 official group :).

author_association: CONTRIBUTOR
user: login: Julie-CAO
created_at: 2025-05-20T06:14:15Z
body: > > Verification run: https://openqa.suse.de/tests/17749691
> 
> Hi Julie, thanks for making it work! Would be good to add a separate testsuite for sev/-es in sle16 official group :).

Yes, another MR will follow.
author_association: CONTRIBUTOR
user: login: guoxuguang
created_at: 2025-05-20T06:27:13Z
body: LGTM. 
author_association: CONTRIBUTOR
user: login: Julie-CAO
created_at: 2025-05-20T06:56:22Z
body: > > > Verification run: https://openqa.suse.de/tests/17749691
> > 
> > 
> > Hi Julie, thanks for making it work! Would be good to add a separate testsuite for sev/-es in sle16 official group :).
> 
> Yes, another MR will follow.

The MR to enable sev-es guest test in the job group, https://gitlab.suse.de/qa-testsuites/openqa-job-group-yaml/-/merge_requests/274
author_association: CONTRIBUTOR
user: login: alice-suse
created_at: 2025-05-21T07:02:06Z
body: LGTM
author_association: CONTRIBUTOR
user: login: Julie-CAO
created_at: 2025-05-21T08:14:02Z
body: O3 seems not to be accessible yet. The CI check still failed, we have to skip these checks.
```
Run openqa-cli schedule --monitor --host "${OPENQA_HOST:-https://openqa.opensuse.org}/" --apikey "$OPENQA_API_KEY" --apisecret "$OPENQA_API_SECRET" --param-file SCENARIO_DEFINITIONS_YAML=scenario-definitions.yaml DISTRI=openSUSE VERSION=Tumbleweed FLAVOR=github ARCH=x86_64 HDD_1=opensuse-Tumbleweed-x86_64--textmode@64bit.qcow2 UEFI_PFLASH_VARS=opensuse-Tumbleweed-x86_64--textmode@64bit-uefi-vars.qcow2 BUILD="$GH_REPO.git#$GH_REF" _GROUP_ID="${OPENQA_SCHEDULE_GROUP_ID:-118}" CASEDIR="$GITHUB_SERVER_URL/$GH_REPO.git#$GH_REF"
Connect timeout
```
author_association: CONTRIBUTOR
user: login: guoxuguang
created_at: 2025-05-21T08:43:29Z
body: > O3 seems not to be accessible yet. The CI check still failed, we have to skip these checks.
> 
> ```
> Run openqa-cli schedule --monitor --host "${OPENQA_HOST:-https://openqa.opensuse.org}/" --apikey "$OPENQA_API_KEY" --apisecret "$OPENQA_API_SECRET" --param-file SCENARIO_DEFINITIONS_YAML=scenario-definitions.yaml DISTRI=openSUSE VERSION=Tumbleweed FLAVOR=github ARCH=x86_64 HDD_1=opensuse-Tumbleweed-x86_64--textmode@64bit.qcow2 UEFI_PFLASH_VARS=opensuse-Tumbleweed-x86_64--textmode@64bit-uefi-vars.qcow2 BUILD="$GH_REPO.git#$GH_REF" _GROUP_ID="${OPENQA_SCHEDULE_GROUP_ID:-118}" CASEDIR="$GITHUB_SERVER_URL/$GH_REPO.git#$GH_REF"
> Connect timeout
> ```

Yes, I have the same CI check failure.  
author_association: CONTRIBUTOR
user: login: alice-suse
created_at: 2025-05-21T08:43:31Z
body: > O3 seems not to be accessible yet. The CI check still failed, we have to skip these checks.
> 
> ```
> Run openqa-cli schedule --monitor --host "${OPENQA_HOST:-https://openqa.opensuse.org}/" --apikey "$OPENQA_API_KEY" --apisecret "$OPENQA_API_SECRET" --param-file SCENARIO_DEFINITIONS_YAML=scenario-definitions.yaml DISTRI=openSUSE VERSION=Tumbleweed FLAVOR=github ARCH=x86_64 HDD_1=opensuse-Tumbleweed-x86_64--textmode@64bit.qcow2 UEFI_PFLASH_VARS=opensuse-Tumbleweed-x86_64--textmode@64bit-uefi-vars.qcow2 BUILD="$GH_REPO.git#$GH_REF" _GROUP_ID="${OPENQA_SCHEDULE_GROUP_ID:-118}" CASEDIR="$GITHUB_SERVER_URL/$GH_REPO.git#$GH_REF"
> Connect timeout
> ```

Let's wait for IT fix. Latest info in slack
```
The file system check has slowed down during the last night, new estimation for completion is ~4PM today.
Affected customer-facing systems:
[openqa.opensuse.org](http://openqa.opensuse.org/)
```
author_association: CONTRIBUTOR
user: login: Julie-CAO
created_at: 2025-05-23T13:24:21Z
body: My CI checks passed. The PR is ready to merge. @alice-suse 
author_association: CONTRIBUTOR