Adding support for lockdown feature by PavamanSubramaniyam · Pull Request #3167 · avocado-framework-tests/avocado-misc-tests

PavamanSubramaniyam · 2026-05-18T05:53:42Z

Executing pci hotplug tests with the lockdown mode enabled

abdhaleegit · 2026-05-18T05:57:56Z

@PavamanSubramaniyam is this similar test #3166

PavamanSubramaniyam · 2026-05-18T06:00:21Z

avocado run --max-parallel-tasks=1 pci_hotplug.py -m pci_hotplug.py.data/pci_hotplug.yaml

JOB ID : 374c12be3a8ebca4900aba574327914d9e3f4110
JOB LOG : /root/avocado-fvt-wrapper/results/job-2026-05-17T09.09-374c12b/job.log
(1/2) pci_hotplug.py:PCIHotPlugTest.test;run-49d6: STARTED
(1/2) pci_hotplug.py:PCIHotPlugTest.test;run-49d6: PASS (862.16 s)
(2/2) pci_hotplug.py:PCIHotPlugTest.test_pcihotplug_with_lockdown;run-49d6: STARTED
(2/2) pci_hotplug.py:PCIHotPlugTest.test_pcihotplug_with_lockdown;run-49d6: PASS (859.38 s)
RESULTS : PASS 2 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
JOB HTML : /root/avocado-fvt-wrapper/results/job-2026-05-17T09.09-374c12b/results.html
JOB TIME : 1739.12 s

I have updated the full results logs to the corresponding Jira.

PavamanSubramaniyam · 2026-05-18T06:05:13Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

abdhaleegit · 2026-05-19T05:41:21Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

@Naresh-ibm does lockdown feature test is different when run with hotplug instead dlpar ?

PraveenPenguin · 2026-05-19T17:20:36Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

@Naresh-ibm does lockdown feature test is different when run with hotplug instead dlpar ?

@maramsmurthy ^^

maramsmurthy · 2026-05-30T11:08:36Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

@Naresh-ibm does lockdown feature test is different when run with hotplug instead dlpar ?

@maramsmurthy ^^

@PraveenPenguin and @Naresh-ibm
we can make use of utils we pushed into internal avocado repo
Internal repo PR: https://github.ibm.com/ltctest/avocado/pull/16

Actual avocado PR : avocado-framework/avocado#6306
Awaiting for maintainers reply.

@PavamanSubramaniyam Try to make use of internal repos linux utils.

PavamanSubramaniyam · 2026-06-03T07:24:43Z

Currently I have incorporated the code in test script itself to make sure these additional tests are incorporated in the CR flow. May be in the future we can think of utilizing the common code in utils.

For now we are making sure these tests don't affect other tests in the CR flow and incorporating the feature only in the test script file.

Naresh-ibm · 2026-06-03T10:03:23Z

@PavamanSubramaniyam can you please accommodate these changes
create a separate yaml for lockdown feature
take from yaml, yes/No | True/False with (lockdown_enable)
check if lockdown if already enabled and lockdown_enable = True/ Yes, if yes, skip the test to run (you can cancel from setup itself)

Naresh-ibm · 2026-06-30T10:43:30Z

@PavamanSubramaniyam we have dependency of other automation works on this PR. can you please address this on priority

PavamanSubramaniyam · 2026-07-09T08:36:02Z

I have addressed the review comments and sent the changes as suggested.

Naresh-ibm · 2026-07-10T14:48:25Z

+                self.fail("following devices failed: %s" % ", ".join(err_pci))
+        elif self.lockdown_enable is False:
+            self.cancel("lockdown mode will not be enabled")
+


@PavamanSubramaniyam as suggested all validation should go to setup and onlt one existing test is enough. actual test code is duplicating here. So please move the initial lock_down mode check, set, should be done in the setup itself.

please change above things, and rest looks good

I have addressed the changes as discussed.

abdhaleegit · 2026-07-10T16:15:43Z

+        return None
+
+    def set_lockdown_mode(self, mode):
+        '''


Normal practice, all above function should go in setup, the function defination should be before .. function call.. these method can also go utils.. take a call if not immediate ?

I will keep these practices in mind while incorporating these suggestions for all the future PRs. Currently we will keep the code limited to this test script and will plan to send the changes to utils in future.

Executing pci hotplug tests with the lockdown mode enabled Signed-off-by: Pavaman Subramaniyam <pavsubra@linux.vnet.ibm.com>

PavamanSubramaniyam · 2026-07-27T08:22:16Z

Attaching the executed test results for without lockdown feature being enabled:

cat /sys/kernel/security/lockdown
[none] integrity confidentiality
avocado run --max-parallel-tasks=1 pci_hotplug.py -m pci_hotplug.py.data/pci_hotplug.yaml
JOB ID : 2e8bae5ad2a6a6a757132135bb42d4e41162b5dc
JOB LOG : /root/avocado-fvt-wrapper/results/job-2026-07-24T07.25-2e8bae5/job.log
(1/1) pci_hotplug.py:PCIHotPlugTest.test;run-49d6: STARTED
(1/1) pci_hotplug.py:PCIHotPlugTest.test;run-49d6: PASS (868.00 s)
RESULTS : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
JOB HTML : /root/avocado-fvt-wrapper/results/job-2026-07-24T07.25-2e8bae5/results.html
JOB TIME : 883.14 s

cat /sys/kernel/security/lockdown
[none] integrity confidentiality

PavamanSubramaniyam · 2026-07-27T08:24:19Z

Attaching the executed test results with lockdown feature being enabled:

cat /sys/kernel/security/lockdown
[none] integrity confidentiality
avocado run --max-parallel-tasks=1 pci_hotplug.py -m pci_hotplug.py.data/pci_hotplug_with_lockdown.yaml
JOB ID : dfc30ae791b528879a91e21884263f205c3bdd99
JOB LOG : /root/avocado-fvt-wrapper/results/job-2026-07-24T07.49-dfc30ae/job.log
(1/1) pci_hotplug.py:PCIHotPlugTest.test;run-7d16: STARTED
(1/1) pci_hotplug.py:PCIHotPlugTest.test;run-7d16: PASS (873.57 s)
RESULTS : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
JOB HTML : /root/avocado-fvt-wrapper/results/job-2026-07-24T07.49-dfc30ae/results.html
JOB TIME : 888.73 s
cat /sys/kernel/security/lockdown
none [integrity] confidentiality

PavamanSubramaniyam · 2026-07-27T08:24:50Z

I have attached the complete details results tar files to the corresponding Jira.

Naresh-ibm · 2026-07-28T11:47:50Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

@Naresh-ibm does lockdown feature test is different when run with hotplug instead dlpar ?

@abdhaleegit we need to run both the runs, i,e enabling the lockdown and without enabling the lockdown. they both are different tests.
Same thing with dlpar too i,e with lockdown and without lockdown

Naresh-ibm · 2026-07-28T11:48:52Z

No, 3166 is for dlpar but my tests are for PCI Hotplug. Can you pull in @Naresh-ibm for the 3166 and for this PR to cross verify if there is overlap in work being done.

@Naresh-ibm does lockdown feature test is different when run with hotplug instead dlpar ?

@maramsmurthy ^^

@PraveenPenguin and @Naresh-ibm we can make use of utils we pushed into internal avocado repo Internal repo PR: https://github.ibm.com/ltctest/avocado/pull/16

Actual avocado PR : avocado-framework/avocado#6306 Awaiting for maintainers reply.

@PavamanSubramaniyam Try to make use of internal repos linux utils.

we have declined this internal utils, and incorporated with different yaml file. so we are good to go on this

Naresh-ibm

LGTM

PavamanSubramaniyam force-pushed the pci_hotplug_with_lockdown branch from a322b4e to 47d287d Compare May 18, 2026 05:57

abdhaleegit requested a review from Naresh-ibm May 19, 2026 05:41

Naresh-ibm self-assigned this Jun 3, 2026

PavamanSubramaniyam force-pushed the pci_hotplug_with_lockdown branch 5 times, most recently from afe7b34 to 051f74d Compare July 9, 2026 08:23

abdhaleegit self-requested a review July 10, 2026 08:59

Naresh-ibm requested changes Jul 10, 2026

View reviewed changes

abdhaleegit requested changes Jul 10, 2026

View reviewed changes

PavamanSubramaniyam force-pushed the pci_hotplug_with_lockdown branch from 051f74d to d498cd6 Compare July 25, 2026 12:16

Adding support for lockdown feature

ac639f7

Executing pci hotplug tests with the lockdown mode enabled Signed-off-by: Pavaman Subramaniyam <pavsubra@linux.vnet.ibm.com>

PavamanSubramaniyam force-pushed the pci_hotplug_with_lockdown branch from d498cd6 to ac639f7 Compare July 25, 2026 12:24

Naresh-ibm approved these changes Jul 28, 2026

View reviewed changes

Naresh-ibm merged commit 319aac6 into avocado-framework-tests:master Jul 28, 2026
5 checks passed

Uh oh!

Conversation

PavamanSubramaniyam commented May 18, 2026

Uh oh!

abdhaleegit commented May 18, 2026

Uh oh!

PavamanSubramaniyam commented May 18, 2026

avocado run --max-parallel-tasks=1 pci_hotplug.py -m pci_hotplug.py.data/pci_hotplug.yaml

Uh oh!

PavamanSubramaniyam commented May 18, 2026

Uh oh!

abdhaleegit commented May 19, 2026

Uh oh!

PraveenPenguin commented May 19, 2026

Uh oh!

maramsmurthy commented May 30, 2026

Uh oh!

PavamanSubramaniyam commented Jun 3, 2026

Uh oh!

Naresh-ibm commented Jun 3, 2026

Uh oh!

Naresh-ibm commented Jun 30, 2026

Uh oh!

PavamanSubramaniyam commented Jul 9, 2026

Uh oh!

Naresh-ibm Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

Naresh-ibm Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

PavamanSubramaniyam Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

abdhaleegit Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

PavamanSubramaniyam Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

PavamanSubramaniyam commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PavamanSubramaniyam commented Jul 27, 2026

Uh oh!

PavamanSubramaniyam commented Jul 27, 2026

Uh oh!

Naresh-ibm commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Naresh-ibm commented Jul 28, 2026

Uh oh!

Naresh-ibm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PavamanSubramaniyam commented Jul 27, 2026 •

edited

Loading

Naresh-ibm commented Jul 28, 2026 •

edited

Loading