Re: [libvirt] [PATCH 4/5] qemu: Enable secure boot

On 07/27/16 10:43, Michal Privoznik wrote: > In qemu, enabling this feature boils down to adding the following > onto the command line: > > -global driver=cfi.pflash01,property=secure,value=on > > However, there are some constraints resulting from the > implementation. For instance, System Management Mode (SMM) is > required to be enabled, the machine type must be q35-2.5 or

> later, and the guest should be x86_64. While technically it is > possible to have 32 bit guests with secure boot, some non-trivial > CPU flags tuning is required (for instance lm and nx flags must > be prohibited). Given complexity of our CPU driver, this is not > trivial. Therefore I've chosen to forbid 32 bit guests for now. > If there's ever need, we can refine the check later. > > Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; > --- > src/qemu/qemu_command.c | 7 ++++++ > src/qemu/qemu_domain.c | 27 ++++++++++++++++++++ > .../qemuxml2argv-bios-nvram-secure.args | 29 ++++++++++++++++++++++ > tests/qemuxml2argvtest.c | 7 ++++++ > 4 files changed, 70 insertions(+) > create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-bios-nvram-secure.args This patch looks almost complete to me (it causes all necessary QEMU options to appear, directly or indirectly (= via requiring SMM)). However, can you also enforce that the Q35 machtype has version 2.5 or later? Technically, "pc-q35-2.4" exists too, and it's not good enough (according to the instructions I wrote up in OvmfPkg/README earlier). I certainly never tested it. Thanks, Laszlo