This test is intended to simulate the use of an OVMF firmware image installed under a non-standard path. In order to make such a configuration work, the user would have to provide additional information. Right now it doesn't matter, because the configuration is rejected anyway, but the behavior is going to change slightly in the future. Prepare by making the configuration more complete and realistic. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- .../firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err | 2 +- .../firmware-auto-efi-loader-path-nonstandard.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err index e551fafd03..3f90a88791 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err +++ b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err @@ -1 +1 @@ -loader attribute 'type' cannot be specified when firmware autoselection is enabled +loader attribute 'readonly' cannot be specified when firmware autoselection is enabled diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.xml b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.xml index 5cf67730fd..daec5989d5 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.xml +++ b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.xml @@ -5,7 +5,7 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <loader>/path/to/OVMF_CODE.fd</loader> + <loader readonly='yes' type='pflash'>/path/to/OVMF_CODE.fd</loader> </os> <features> <acpi/> -- 2.39.2

These cover the same scenarios as the matching test cases for autoselection. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- ...al-efi-no-enrolled-keys.x86_64-latest.args | 38 +++++++++++++++++++ .../firmware-manual-efi-no-enrolled-keys.xml | 20 ++++++++++ ...e-manual-efi-no-secboot.x86_64-latest.args | 37 ++++++++++++++++++ .../firmware-manual-efi-no-secboot.xml | 19 ++++++++++ ...ware-manual-efi-secboot.x86_64-latest.args | 38 +++++++++++++++++++ .../firmware-manual-efi-secboot.xml | 20 ++++++++++ tests/qemuxml2argvtest.c | 3 ++ ...ual-efi-no-enrolled-keys.x86_64-latest.xml | 37 ++++++++++++++++++ ...re-manual-efi-no-secboot.x86_64-latest.xml | 36 ++++++++++++++++++ ...mware-manual-efi-secboot.x86_64-latest.xml | 37 ++++++++++++++++++ tests/qemuxml2xmltest.c | 3 ++ 11 files changed, 288 insertions(+) create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.xml create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-secboot.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml create mode 100644 tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.args new file mode 100644 index 0000000000..a1481d834f --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.args @@ -0,0 +1,38 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ +-machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \ +-accel tcg \ +-cpu qemu64 \ +-global driver=cfi.pflash01,property=secure,value=on \ +-m 1024 \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-global ICH9-LPC.noreboot=off \ +-watchdog-action reset \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.xml b/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.xml new file mode 100644 index 0000000000..bc715f704b --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-no-enrolled-keys.xml @@ -0,0 +1,20 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> + </os> + <features> + <acpi/> + <smm state='on'/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.x86_64-latest.args new file mode 100644 index 0000000000..5e5359ab71 --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.x86_64-latest.args @@ -0,0 +1,37 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ +-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \ +-accel tcg \ +-cpu qemu64 \ +-m 1024 \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-global ICH9-LPC.noreboot=off \ +-watchdog-action reset \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml b/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml new file mode 100644 index 0000000000..463a431c44 --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-secboot.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-secboot.x86_64-latest.args new file mode 100644 index 0000000000..a1481d834f --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-secboot.x86_64-latest.args @@ -0,0 +1,38 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ +-machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \ +-accel tcg \ +-cpu qemu64 \ +-global driver=cfi.pflash01,property=secure,value=on \ +-m 1024 \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-global ICH9-LPC.noreboot=off \ +-watchdog-action reset \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml b/tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml new file mode 100644 index 0000000000..1850c2b241 --- /dev/null +++ b/tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml @@ -0,0 +1,20 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram> + </os> + <features> + <acpi/> + <smm state='on'/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 3175f59c48..23e48b251c 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1089,6 +1089,9 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit"); DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-loader-no-path"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-no-enrolled-keys"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-no-secboot"); DO_TEST_CAPS_LATEST("firmware-manual-efi-stateless"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-nvram-template-stateless"); diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml new file mode 100644 index 0000000000..4caa7950ce --- /dev/null +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml @@ -0,0 +1,37 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <smm state='on'/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml new file mode 100644 index 0000000000..ff7793a377 --- /dev/null +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml @@ -0,0 +1,36 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml new file mode 100644 index 0000000000..aa90d3e2f2 --- /dev/null +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml @@ -0,0 +1,37 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <smm state='on'/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 73bcfcc8b7..7ada880da2 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -925,6 +925,9 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-manual-efi-rw"); DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit"); DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-no-enrolled-keys"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-no-secboot"); DO_TEST_CAPS_LATEST("firmware-manual-efi-stateless"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-iscsi"); -- 2.39.2

Right now we have checks in place that ensure that explicit paths are not provided when firmware autoselection has been enabled, but that's going to change soon. To prepare for that, take into account user-provided paths during firmware autoselection if present, and discard all firmware descriptors that don't contain matching information. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- src/qemu/qemu_firmware.c | 64 +++++++++++++++++++++++++++++++++------- 1 file changed, 54 insertions(+), 10 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 9de4166772..172be05d06 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -945,6 +945,55 @@ qemuFirmwareMatchesMachineArch(const qemuFirmware *fw, } +/** + * qemuFirmwareMatchesPaths: + * @fw: firmware definition + * @loader: loader definition + * @kernelPath: path to kernel image + * + * Checks whether @fw is compatible with the information provided as + * part of the domain definition. + * + * Returns: true if @fw is compatible with @loader and @kernelPath, + * false otherwise + */ +static bool +qemuFirmwareMatchesPaths(const qemuFirmware *fw, + const virDomainLoaderDef *loader, + const char *kernelPath) +{ + const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash; + const qemuFirmwareMappingKernel *kernel = &fw->mapping.data.kernel; + const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory; + + switch (fw->mapping.device) { + case QEMU_FIRMWARE_DEVICE_FLASH: + if (loader && loader->path && + STRNEQ(loader->path, flash->executable.filename)) + return false; + if (loader && loader->nvramTemplate && + STRNEQ(loader->nvramTemplate, flash->nvram_template.filename)) + return false; + break; + case QEMU_FIRMWARE_DEVICE_MEMORY: + if (loader && loader->path && + STRNEQ(loader->path, memory->filename)) + return false; + break; + case QEMU_FIRMWARE_DEVICE_KERNEL: + if (kernelPath && + STRNEQ(kernelPath, kernel->filename)) + return false; + break; + case QEMU_FIRMWARE_DEVICE_NONE: + case QEMU_FIRMWARE_DEVICE_LAST: + return false; + } + + return true; +} + + static qemuFirmwareOSInterface qemuFirmwareOSInterfaceTypeFromOsDefFirmware(virDomainOsDefFirmware fw) { @@ -1047,16 +1096,6 @@ qemuFirmwareMatchDomain(const virDomainDef *def, if (want == QEMU_FIRMWARE_OS_INTERFACE_NONE && loader) { want = qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(loader->type); - - if (fw->mapping.device != QEMU_FIRMWARE_DEVICE_FLASH || - STRNEQ(loader->path, fw->mapping.data.flash.executable.filename)) { - VIR_DEBUG("Not matching FW interface %s or loader " - "path '%s' for user provided path '%s'", - qemuFirmwareDeviceTypeToString(fw->mapping.device), - fw->mapping.data.flash.executable.filename, - loader->path); - return false; - } } for (i = 0; i < fw->ninterfaces; i++) { @@ -1069,6 +1108,11 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } + if (!qemuFirmwareMatchesPaths(fw, def->os.loader, def->os.kernel)) { + VIR_DEBUG("No matching path in '%s'", path); + return false; + } + if (!qemuFirmwareMatchesMachineArch(fw, def->os.machine, def->os.arch)) { VIR_DEBUG("No matching machine type in '%s'", path); return false; -- 2.39.2

Right now there are a few scenarios in which we skip ahead, and removing these exceptions will make for more consistent and predictable behavior. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- src/qemu/qemu_firmware.c | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index f7d7f78578..e2c371d8a2 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1631,7 +1631,6 @@ int qemuFirmwareFillDomain(virQEMUDriver *driver, virDomainDef *def) { - g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); virDomainLoaderDef *loader = def->os.loader; virStorageSource *nvram = loader ? loader->nvram : NULL; bool autoSelection = (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_NONE); @@ -1673,33 +1672,6 @@ qemuFirmwareFillDomain(virQEMUDriver *driver, return 0; } - /* For UEFI with firmware autoselection disabled, even if some of - * the information is missing we might still be able to avoid - * having to look at firmware descriptors */ - if (!autoSelection && - virDomainDefHasOldStyleROUEFI(def) && - loader->path) { - - /* For stateless firmwares, the firmware path is all we need */ - if (loader->stateless == VIR_TRISTATE_BOOL_YES) - return 0; - - /* If the path to the NVRAM file is already provided and it - * points to a non-local source, we don't need to look up any - * other information */ - if (loader->nvram && !virStorageSourceIsLocalStorage(loader->nvram)) - return 0; - - /* If we have the path to both the firmware itself and the - * corresponding NVRAM template we might still need to - * generate a path to the domain-specific NVRAM file, but - * otherwise we're good to go */ - if (loader->nvramTemplate) { - qemuFirmwareEnsureNVRAM(def, cfg, loader->format); - return 0; - } - } - /* Look for the information we need in firmware descriptors */ if ((ret = qemuFirmwareFillDomainModern(driver, def)) < 0) return -1; -- 2.39.2

The combination of explicit firmware paths, which we now produce in all cases, and firmware autoselection knobs is explicitly rejected by libvirt 8.6.0 and newer. Right now we produce inherently migratable XML in all cases, since we always strip those bits, but that's going to change soon. To prepare for that, make sure that we always skip the problematic elements and attributes when preparing a migratable XML. The destination will simply receive a fully specified firmware configuration, which is indistinguishable from one that was manually provided by the user and is thus accepted by any old version of libvirt, regardless of whether or not firmware autoselection was used on the source host. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- src/conf/domain_conf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 9ef50c818b..9f49c6e62d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -27382,6 +27382,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, const char *type = NULL; int n; size_t i; + bool migratable = !!(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE); virCheckFlags(VIR_DOMAIN_DEF_FORMAT_COMMON_FLAGS | VIR_DOMAIN_DEF_FORMAT_STATUS | @@ -27476,7 +27477,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, } virBufferAddLit(buf, "<os"); - if (def->os.firmware) + if (def->os.firmware && !migratable) virBufferAsprintf(buf, " firmware='%s'", virDomainOsDefFirmwareTypeToString(def->os.firmware)); virBufferAddLit(buf, ">\n"); @@ -27499,7 +27500,7 @@ virDomainDefFormatInternalSetRootName(virDomainDef *def, virBufferAsprintf(buf, ">%s</type>\n", virDomainOSTypeToString(def->os.type)); - if (def->os.firmwareFeatures) { + if (def->os.firmwareFeatures && !migratable) { virBufferAddLit(buf, "<firmware>\n"); virBufferAdjustIndent(buf, 2); -- 2.39.2

Even when the user is not taking advantage of firmware autoselection and instead manually providing all the necessary information, in most cases they're still going to use firmware builds that are provided by the OS vendor, are installed in standard paths and come with a corresponding firmware descriptor. Similarly, even when the user is not guiding the autoselection process by specifying the desired status of certain features and instead is relying on the system-level descriptor priority being set up correctly, libvirt will still ultimately decide to use a specific descriptor, which includes information about the firmware's features. In both these cases, take the additional information that were obtained from the firmware descriptor and reflect them back into the domain XML, where they can be conveniently inspected by the user and management applications alike. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- src/qemu/qemu_firmware.c | 86 ++++++++++++++++++- ...ware-auto-bios-stateless.x86_64-latest.xml | 4 + .../firmware-auto-bios.x86_64-latest.xml | 4 + ...rmware-auto-efi-aarch64.aarch64-latest.xml | 4 + ...-efi-format-loader-qcow2.x86_64-latest.xml | 4 + ...o-efi-format-loader-raw.aarch64-latest.xml | 4 + ...-nvram-qcow2-network-nbd.x86_64-latest.xml | 3 + ...-format-nvram-qcow2-path.x86_64-latest.xml | 4 + ...o-efi-format-nvram-qcow2.x86_64-latest.xml | 4 + ...auto-efi-loader-insecure.x86_64-latest.xml | 4 + ...are-auto-efi-loader-path.x86_64-latest.xml | 4 + ...e-auto-efi-loader-secure.x86_64-latest.xml | 4 + ...uto-efi-no-enrolled-keys.x86_64-latest.xml | 1 + ...ware-auto-efi-no-secboot.x86_64-latest.xml | 1 + ...ware-auto-efi-nvram-file.x86_64-latest.xml | 4 + ...-efi-nvram-network-iscsi.x86_64-latest.xml | 3 + ...to-efi-nvram-network-nbd.x86_64-latest.xml | 3 + .../firmware-auto-efi-nvram.x86_64-latest.xml | 4 + ...irmware-auto-efi-secboot.x86_64-latest.xml | 1 + ...irmware-auto-efi-smm-off.x86_64-latest.xml | 4 + ...mware-auto-efi-stateless.x86_64-latest.xml | 4 + .../firmware-auto-efi.x86_64-latest.xml | 4 + ...manual-efi-acpi-aarch64.aarch64-latest.xml | 6 +- ...ware-manual-efi-acpi-q35.x86_64-latest.xml | 6 +- ...manual-efi-loader-secure.x86_64-latest.xml | 6 +- ...ual-efi-no-enrolled-keys.x86_64-latest.xml | 6 +- ...re-manual-efi-no-secboot.x86_64-latest.xml | 6 +- ...nual-efi-noacpi-aarch64.aarch64-latest.xml | 6 +- ...re-manual-efi-nvram-file.x86_64-latest.xml | 6 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 5 +- ...al-efi-nvram-network-nbd.x86_64-latest.xml | 5 +- ...anual-efi-nvram-template.x86_64-latest.xml | 6 +- ...mware-manual-efi-secboot.x86_64-latest.xml | 6 +- .../firmware-manual-efi.x86_64-latest.xml | 6 +- .../pvpanic-pci-aarch64.aarch64-latest.xml | 4 + ...-pci-no-address-aarch64.aarch64-latest.xml | 4 + .../virtio-iommu-aarch64.aarch64-latest.xml | 4 + 37 files changed, 225 insertions(+), 15 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index d906d8bc86..7a0b04eb1a 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1011,6 +1011,25 @@ qemuFirmwareOSInterfaceTypeFromOsDefFirmware(virDomainOsDefFirmware fw) } +static virDomainOsDefFirmware +qemuFirmwareOSInterfaceTypeToOsDefFirmware(qemuFirmwareOSInterface interface) +{ + switch (interface) { + case QEMU_FIRMWARE_OS_INTERFACE_BIOS: + return VIR_DOMAIN_OS_DEF_FIRMWARE_BIOS; + case QEMU_FIRMWARE_OS_INTERFACE_UEFI: + return VIR_DOMAIN_OS_DEF_FIRMWARE_EFI; + case QEMU_FIRMWARE_OS_INTERFACE_UBOOT: + case QEMU_FIRMWARE_OS_INTERFACE_OPENFIRMWARE: + case QEMU_FIRMWARE_OS_INTERFACE_NONE: + case QEMU_FIRMWARE_OS_INTERFACE_LAST: + break; + } + + return VIR_DOMAIN_OS_DEF_FIRMWARE_NONE; +} + + static qemuFirmwareOSInterface qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type) { @@ -1071,6 +1090,46 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def, } + +/** + * qemuFirmwareSetOsFeatures: + * @def: domain definition + * @secureBoot: whether the 'secure-boot' feature is enabled + * @enrolledKeys: whether the 'enrolled-keys' feature is enabled + * + * Set firmware features for @def to match those declared by the JSON + * descriptor that was found to match autoselection requirements. + */ +static void +qemuFirmwareSetOsFeatures(virDomainDef *def, + bool secureBoot, + bool enrolledKeys) +{ + int *features = def->os.firmwareFeatures; + virDomainLoaderDef *loader = def->os.loader; + + if (!features) { + features = g_new0(int, VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_LAST); + def->os.firmwareFeatures = features; + } + + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] = virTristateBoolFromBool(secureBoot); + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] = virTristateBoolFromBool(enrolledKeys); + + /* If the NVRAM template is blank at this point and we're not dealing + * with a stateless firmware image, then it means that the NVRAM file + * is not local. In this scenario we can't really make any assumptions + * about its contents, so it's preferable to leave the state of the + * enrolled-keys feature unspecified */ + if (loader && + loader->type == VIR_DOMAIN_LOADER_TYPE_PFLASH && + loader->stateless != VIR_TRISTATE_BOOL_YES && + !loader->nvramTemplate) { + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] = VIR_TRISTATE_BOOL_ABSENT; + } +} + + #define VIR_QEMU_FIRMWARE_AMD_SEV_ES_POLICY (1 << 2) @@ -1294,6 +1353,8 @@ qemuFirmwareEnableFeaturesModern(virQEMUDriverConfig *cfg, const qemuFirmwareMappingMemory *memory = &fw->mapping.data.memory; virDomainLoaderDef *loader = NULL; virStorageFileFormat format; + bool hasSecureBoot = false; + bool hasEnrolledKeys = false; size_t i; switch (fw->mapping.device) { @@ -1366,20 +1427,39 @@ qemuFirmwareEnableFeaturesModern(virQEMUDriverConfig *cfg, def->os.loader->secure = VIR_TRISTATE_BOOL_YES; break; - case QEMU_FIRMWARE_FEATURE_NONE: + case QEMU_FIRMWARE_FEATURE_SECURE_BOOT: + hasSecureBoot = true; + break; + + case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: + hasEnrolledKeys = true; + break; + case QEMU_FIRMWARE_FEATURE_ACPI_S3: case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_AMD_SEV: case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES: - case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: - case QEMU_FIRMWARE_FEATURE_SECURE_BOOT: case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: + case QEMU_FIRMWARE_FEATURE_NONE: case QEMU_FIRMWARE_FEATURE_LAST: break; } } + if (!def->os.firmware) { + /* If a firmware type for autoselection was not already present, + * pick the first reasonable one from the descriptor list */ + for (i = 0; i < fw->ninterfaces; i++) { + def->os.firmware = qemuFirmwareOSInterfaceTypeToOsDefFirmware(fw->interfaces[i]); + if (def->os.firmware) + break; + } + } + if (def->os.firmware) { + qemuFirmwareSetOsFeatures(def, hasSecureBoot, hasEnrolledKeys); + } + return 0; } diff --git a/tests/qemuxml2xmloutdata/firmware-auto-bios-stateless.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-bios-stateless.x86_64-latest.xml index d1ecd8593f..e69f8c01d0 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-bios-stateless.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-bios-stateless.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='bios'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader type='rom' stateless='yes'>/usr/share/seabios/bios-256k.bin</loader> <boot dev='hd'/> </os> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-bios.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-bios.x86_64-latest.xml index 68e14d3e4b..ffff5a79e2 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-bios.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-bios.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='bios'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader type='rom'>/usr/share/seabios/bios-256k.bin</loader> <boot dev='hd'/> </os> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-aarch64.aarch64-latest.xml index 6da924793b..5779eca7a0 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-aarch64.aarch64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/AAVMF/AAVMF_CODE.qcow2</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-qcow2.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-qcow2.x86_64-latest.xml index 9f0f3509f2..310ee6ec73 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-qcow2.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-qcow2.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/OVMF/OVMF_CODE.qcow2</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw.aarch64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw.aarch64-latest.xml index 8ab29edf42..8eb6086e40 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw.aarch64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-network-nbd.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-network-nbd.x86_64-latest.xml index 42b044d83f..7ea870bbcd 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-network-nbd.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-network-nbd.x86_64-latest.xml @@ -6,6 +6,9 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/OVMF/OVMF_CODE.qcow2</loader> <nvram type='network' format='qcow2'> <source protocol='nbd' name='bar'> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-path.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-path.x86_64-latest.xml index 6b53262dc7..6cf33b0c76 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-path.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2-path.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/OVMF/OVMF_CODE.qcow2</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.qcow2' format='qcow2'>/path/to/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2.x86_64-latest.xml index 9f0f3509f2..310ee6ec73 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-nvram-qcow2.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/OVMF/OVMF_CODE.qcow2</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-insecure.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-insecure.x86_64-latest.xml index 55da8ee12f..7717677c4b 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-insecure.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-insecure.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='no' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-path.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-path.x86_64-latest.xml index 3977ddc0c7..6f4bf4b5bb 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-path.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-path.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure.x86_64-latest.xml index 1b1b9352c1..90c5040ca6 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml index 78b3b81506..e5caf31c4e 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml @@ -8,6 +8,7 @@ <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <firmware> <feature enabled='no' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-no-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-no-secboot.x86_64-latest.xml index 57e63a079c..6f4bf4b5bb 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-no-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-no-secboot.x86_64-latest.xml @@ -7,6 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <firmware> + <feature enabled='no' name='enrolled-keys'/> <feature enabled='no' name='secure-boot'/> </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-file.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-file.x86_64-latest.xml index 8117f02f15..1418ddbfcd 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-file.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-file.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd' type='file'> <source file='/path/to/guest_VARS.fd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-iscsi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-iscsi.x86_64-latest.xml index d3ef57f682..ec672780bb 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-iscsi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-iscsi.x86_64-latest.xml @@ -6,6 +6,9 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram type='network'> <source protocol='iscsi' name='iqn.2013-07.com.example:iscsi-nopool'> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-nbd.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-nbd.x86_64-latest.xml index 6d0d112dd1..3f59dc4d61 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-nbd.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram-network-nbd.x86_64-latest.xml @@ -6,6 +6,9 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram type='network'> <source protocol='nbd' name='bar'> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram.x86_64-latest.xml index d293cd3371..b7dc8fa140 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-nvram.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-secboot.x86_64-latest.xml index 6dcc5ea88d..90c5040ca6 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-secboot.x86_64-latest.xml @@ -7,6 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <firmware> + <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-smm-off.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-smm-off.x86_64-latest.xml index 40d8b8815b..4ab4d9587c 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-smm-off.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-smm-off.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-stateless.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-stateless.x86_64-latest.xml index 7939dc666b..b1aa817a56 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-stateless.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-stateless.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' stateless='yes'>/usr/share/OVMF/OVMF.sev.fd</loader> <boot dev='hd'/> </os> diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi.x86_64-latest.xml index 1b1b9352c1..90c5040ca6 100644 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi.x86_64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-aarch64.aarch64-latest.xml index 34257e4f80..318ffdf93c 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-aarch64.aarch64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-q35.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-q35.x86_64-latest.xml index ff7793a377..ac58a278f9 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-q35.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-acpi-q35.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-secure.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-secure.x86_64-latest.xml index aa90d3e2f2..69b6d91e99 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-secure.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-secure.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml index 4caa7950ce..2e287b8cd1 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml index ff7793a377..ac58a278f9 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-no-secboot.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-noacpi-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-noacpi-aarch64.aarch64-latest.xml index 1f642cd179..2b4dff8800 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-noacpi-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-noacpi-aarch64.aarch64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-file.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-file.x86_64-latest.xml index cdb5d2b31a..1418ddbfcd 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-file.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-file.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd' type='file'> <source file='/path/to/guest_VARS.fd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-iscsi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-iscsi.x86_64-latest.xml index 5a2e8715a0..ec672780bb 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-iscsi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-iscsi.x86_64-latest.xml @@ -4,8 +4,11 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram type='network'> <source protocol='iscsi' name='iqn.2013-07.com.example:iscsi-nopool'> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-nbd.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-nbd.x86_64-latest.xml index 208257bb5b..3f59dc4d61 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-nbd.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-network-nbd.x86_64-latest.xml @@ -4,8 +4,11 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram type='network'> <source protocol='nbd' name='bar'> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template.x86_64-latest.xml index 3b79af418a..dc4b8bb97f 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml index aa90d3e2f2..69b6d91e99 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi.x86_64-latest.xml index ff6460d7b0..11d7623e7c 100644 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi.x86_64-latest.xml @@ -4,8 +4,12 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-i440fx-4.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/pvpanic-pci-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/pvpanic-pci-aarch64.aarch64-latest.xml index 50321aedd6..2a83ace748 100644 --- a/tests/qemuxml2xmloutdata/pvpanic-pci-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/pvpanic-pci-aarch64.aarch64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-6.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/AAVMF/AAVMF_CODE.qcow2</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/pvpanic-pci-no-address-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/pvpanic-pci-no-address-aarch64.aarch64-latest.xml index 9a25573614..d5ed9b23fe 100644 --- a/tests/qemuxml2xmloutdata/pvpanic-pci-no-address-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/pvpanic-pci-no-address-aarch64.aarch64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-6.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/AAVMF/AAVMF_CODE.qcow2</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/virtio-iommu-aarch64.aarch64-latest.xml b/tests/qemuxml2xmloutdata/virtio-iommu-aarch64.aarch64-latest.xml index d560259d87..589295e602 100644 --- a/tests/qemuxml2xmloutdata/virtio-iommu-aarch64.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/virtio-iommu-aarch64.aarch64-latest.xml @@ -6,6 +6,10 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-6.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> <loader readonly='yes' type='pflash' format='qcow2'>/usr/share/AAVMF/AAVMF_CODE.qcow2</loader> <nvram template='/usr/share/AAVMF/AAVMF_VARS.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram> <boot dev='hd'/> -- 2.39.2

The reason why it was in postparse in the first place was so that we could could automatically enable the secure-boot feature in some cases, but that no longer happens so we can finally move it to the proper location. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com&gt; --- src/conf/domain_postparse.c | 10 ---------- src/conf/domain_validate.c | 8 ++++++++ 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/src/conf/domain_postparse.c b/src/conf/domain_postparse.c index 79862a72cd..2832705d0f 100644 --- a/src/conf/domain_postparse.c +++ b/src/conf/domain_postparse.c @@ -93,16 +93,6 @@ virDomainDefPostParseMemory(virDomainDef *def, static int virDomainDefPostParseOs(virDomainDef *def) { - if (def->os.firmwareFeatures && - def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES) { - - if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) { - virReportError(VIR_ERR_XML_DETAIL, "%s", - _("firmware feature 'enrolled-keys' cannot be enabled when firmware feature 'secure-boot' is disabled")); - return -1; - } - } - if (!def->os.loader) return 0; diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 6991cf1dd3..f208c0c531 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1606,6 +1606,14 @@ virDomainDefOSValidate(const virDomainDef *def, return -1; } + if (def->os.firmwareFeatures && + def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES && + def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) { + virReportError(VIR_ERR_XML_DETAIL, "%s", + _("firmware feature 'enrolled-keys' cannot be enabled when firmware feature 'secure-boot' is disabled")); + return -1; + } + if (!loader) return 0; -- 2.39.2