Add XML configuration tests covering the main s390x Secure IPL scenarios: secure-boot enabled with one or multiple certificates, audit mode (secure-boot disabled but certs provided), and the following expected error cases: - secure-boot enabled without any boot certificates - enrolled-keys used on s390x (unsupported) - boot-certs specified on a non-s390x architecture - secure-boot or boot-certs on QEMU older than 11.2.0 Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> --- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 +++++++++++++++++ .../s390-boot-certs-only.s390x-latest.xml | 30 ++++++++++++++++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++++++++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 +++++++++++++++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++++++++++++++++ .../s390-secure-boot-audit-mode.xml | 18 ++++++++++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 +++++++++++++++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 +++++++++++++++++++ .../s390-secure-boot-multi-certs.xml | 19 +++++++++++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++++++++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++++++++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 +++++++++++ .../s390-secure-boot.s390x-11.1.0.err | 1 + .../s390-secure-boot.s390x-latest.args | 32 +++++++++++++++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++++++++++++++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++++++++++ tests/qemuxmlconftest.c | 13 +++++++ 24 files changed, 398 insertions(+) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args new file mode 100644 index 0000000000..fb79aafc4a --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml new file mode 100644 index 0000000000..febd55cbc1 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-boot-certs-only.xml b/tests/qemuxmlconfdata/s390-boot-certs-only.xml new file mode 100644 index 0000000000..9e9bfa41e1 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-boot-certs-only.xml @@ -0,0 +1,15 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args new file mode 100644 index 0000000000..7c8a8838ce --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=off,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml new file mode 100644 index 0000000000..9f298e7b59 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml new file mode 100644 index 0000000000..b4c89e8f5c --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml @@ -0,0 +1,18 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='no' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args new file mode 100644 index 0000000000..8a53b5ce17 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=on,boot-certs.0.path=/path/to/cert.pem,boot-certs.1.path=/path/to/cert2.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml new file mode 100644 index 0000000000..df841f8a67 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml @@ -0,0 +1,34 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml new file mode 100644 index 0000000000..ab2541aadc --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + <path>/path/to/cert2.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err new file mode 100644 index 0000000000..02192e334d --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: secure-boot machine property is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err new file mode 100644 index 0000000000..8de77af577 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err @@ -0,0 +1 @@ +unsupported configuration: secure-boot requires boot certificates to be provided diff --git a/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml new file mode 100644 index 0000000000..4d20a5744d --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml @@ -0,0 +1,15 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1801</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err new file mode 100644 index 0000000000..268c15ef81 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is only supported for s390x CCW machine types diff --git a/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml new file mode 100644 index 0000000000..b4c5bc59c8 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml @@ -0,0 +1,15 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid> + <memory>1048576</memory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err new file mode 100644 index 0000000000..a2b7d96189 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err @@ -0,0 +1 @@ +firmware feature 'enrolled-keys' is not supported on s390x diff --git a/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml new file mode 100644 index 0000000000..56c2a7456b --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + <feature enabled='yes' name='enrolled-keys'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err b/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err new file mode 100644 index 0000000000..34dfdc6727 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err @@ -0,0 +1 @@ +unsupported configuration: boot-certs is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args new file mode 100644 index 0000000000..17c0c09f99 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,secure-boot=on,boot-certs.0.path=/path/to/cert.pem \ +-accel tcg \ +-cpu qemu \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml new file mode 100644 index 0000000000..32ed103bc2 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-secure-boot.xml b/tests/qemuxmlconfdata/s390-secure-boot.xml new file mode 100644 index 0000000000..f46fc6e863 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-secure-boot.xml @@ -0,0 +1,18 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>4194304</memory> + <vcpu>4</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> + <firmware> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <boot-certs> + <path>/path/to/cert.pem</path> + </boot-certs> + </os> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 555c029f58..f91611a177 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -3115,6 +3115,19 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("launch-security-s390-pv", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-multi-certs", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-secure-boot-audit-mode", "s390x"); + DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("s390-secure-boot-no-certs", "s390x"); + DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("s390-secure-boot-with-enrolled-keys", "s390x"); + DO_TEST_CAPS_LATEST_PARSE_ERROR("s390-secure-boot-none-s390"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-no-certs", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-multi-certs", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-secure-boot-audit-mode", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_LATEST("s390-boot-certs-only", "s390x"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-boot-certs-only", "s390x", "11.1.0"); + DO_TEST_CAPS_ARCH_LATEST_FULL("launch-security-tdx", "x86_64", ARG_CAPS_VARIANT, "+inteltdx", ARG_END); -- 2.56.0