10:51 a.m.
Sync with the edk2-20240524-4.fc39 package from Fedora.
The only notable change is that the inteltdx variant now declares
support for Secure Boot and is a ROM image instead of a stateless
pflash one.
The latter causes it to be considered eligible for the
configuration described by the firmware-auto-efi-rw test cases,
which now passes instead of failing.
Of course that doesn't make any sense, because a ROM image by
definition cannot be read/write. So this indicates the presence
of a bug in our firmware selection algorithm, which we're going
to address with an upcoming commit.
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
---
.../firmware/60-edk2-ovmf-x64-inteltdx.json | 10 +++---
.../firmware/60-edk2-ovmf-x64-inteltdx.json | 10 +++---
tests/qemufirmwaretest.c | 2 +-
...e-auto-efi-rw.x86_64-latest.abi-update.err | 1 -
.../firmware-auto-efi-rw.x86_64-latest.args | 34 +++++++++++++++++++
.../firmware-auto-efi-rw.x86_64-latest.err | 1 -
.../firmware-auto-efi-rw.x86_64-latest.xml | 6 +++-
tests/qemuxmlconftest.c | 3 +-
8 files changed, 49 insertions(+), 18 deletions(-)
delete mode 100644
tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.abi-update.err
create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.args
delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.err
diff --git
a/tests/qemufirmwaredata/out/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
index 35a625b3ec..d002ec7386 100644
--- a/tests/qemufirmwaredata/out/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
+++ b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
@@ -3,12 +3,8 @@
"uefi"
],
"mapping": {
- "device": "flash",
- "mode": "stateless",
- "executable": {
- "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
- "format": "raw"
- }
+ "device": "memory",
+ "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd"
},
"targets": [
{
@@ -19,6 +15,8 @@
}
],
"features": [
+ "enrolled-keys",
+ "secure-boot",
"verbose-dynamic"
]
}
diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
b/tests/qemufirmwaredata/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
index 44993ab1f3..445eb70e03 100644
--- a/tests/qemufirmwaredata/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
+++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
@@ -4,12 +4,8 @@
"uefi"
],
"mapping": {
- "device": "flash",
- "mode": "stateless",
- "executable": {
- "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
- "format": "raw"
- }
+ "device": "memory",
+ "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd"
},
"targets": [
{
@@ -20,7 +16,9 @@
}
],
"features": [
+ "enrolled-keys",
"intel-tdx",
+ "secure-boot",
"verbose-dynamic"
],
"tags": [
diff --git a/tests/qemufirmwaretest.c b/tests/qemufirmwaretest.c
index c967f86d68..a5e7e2ec65 100644
--- a/tests/qemufirmwaretest.c
+++ b/tests/qemufirmwaretest.c
@@ -317,7 +317,7 @@ mymain(void)
"/usr/share/edk2/ovmf/OVMF_CODE.fd:/usr/share/edk2/ovmf/OVMF_VARS.fd:"
"/usr/share/edk2/ovmf/OVMF.secboot.fd:NULL:"
"/usr/share/edk2/ovmf/OVMF.amdsev.fd:NULL:"
- "/usr/share/edk2/ovmf/OVMF.inteltdx.fd:NULL",
+ "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd:NULL",
VIR_DOMAIN_OS_DEF_FIRMWARE_BIOS,
VIR_DOMAIN_OS_DEF_FIRMWARE_EFI);
DO_SUPPORTED_TEST("pc-q35-3.1", VIR_ARCH_I686, false,
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.abi-update.err
b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.abi-update.err
deleted file mode 100644
index 3edb2b3451..0000000000
--- a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.abi-update.err
+++ /dev/null
@@ -1 +0,0 @@
-operation failed: Unable to find 'efi' firmware that is compatible with the
current configuration
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.args
b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.args
new file mode 100644
index 0000000000..753ad2d4b5
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.args
@@ -0,0 +1,34 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/var/lib/libvirt/qemu/domain--1-guest \
+USER=test \
+LOGNAME=test \
+XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
+XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
+XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
+/usr/bin/qemu-system-x86_64 \
+-name guest=guest,debug-threads=on \
+-S \
+-object
'{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}'
\
+-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=on \
+-accel kvm \
+-cpu qemu64 \
+-bios /usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd \
+-m size=1048576k \
+-object
'{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}'
\
+-overcommit mem-lock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot strict=on \
+-audiodev
'{"id":"audio1","driver":"none"}' \
+-global ICH9-LPC.noreboot=off \
+-watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
+-msg timestamp=on
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.err
b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.err
deleted file mode 100644
index 3edb2b3451..0000000000
--- a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.err
+++ /dev/null
@@ -1 +0,0 @@
-operation failed: Unable to find 'efi' firmware that is compatible with the
current configuration
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.xml
b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.xml
index c2d0c33a0b..fe05e33b69 100644
--- a/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.xml
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-rw.x86_64-latest.xml
@@ -6,7 +6,11 @@
<vcpu placement='static'>1</vcpu>
<os firmware='efi'>
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
- <loader readonly='no'/>
+ <firmware>
+ <feature enabled='yes' name='enrolled-keys'/>
+ <feature enabled='yes' name='secure-boot'/>
+ </firmware>
+ <loader readonly='no'
type='rom'>/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd</loader>
<boot dev='hd'/>
</os>
<features>
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index 4f2966109d..351c7c59eb 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -1420,8 +1420,7 @@ mymain(void)
DO_TEST_CAPS_LATEST("firmware-auto-efi");
DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi");
DO_TEST_CAPS_LATEST("firmware-auto-efi-stateless");
- DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-rw");
- DO_TEST_CAPS_LATEST_ABI_UPDATE_PARSE_ERROR("firmware-auto-efi-rw");
+ DO_TEST_CAPS_LATEST("firmware-auto-efi-rw");
DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-secure");
DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-loader-secure");
DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-insecure");
--
2.45.2