It offers very little savings (dropping it actually reduces the numbers of lines in the file slightly) and gets in the way of upcoming changes. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/conf/schemas/domaincommon.rng | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index c7346526ef..400e7eec22 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -341,7 +341,9 @@ </attribute> </optional> <optional> - <ref name="pflashFormat"/> + <attribute name="format"> + <ref name="pflashFormatTypes"/> + </attribute> </optional> <optional> <ref name="absFilePath"/> @@ -361,7 +363,9 @@ </attribute> </optional> <optional> - <ref name="pflashFormat"/> + <attribute name="format"> + <ref name="pflashFormatTypes"/> + </attribute> </optional> <optional> <choice> @@ -8027,12 +8031,6 @@ </choice> </define> - <define name="pflashFormat"> - <attribute name="format"> - <ref name="pflashFormatTypes"/> - </attribute> - </define> - <!-- Optional HyperV Enlightenment features --> <define name="hyperv"> <element name="hyperv"> -- 2.52.0

Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/conf/schemas/domaincommon.rng | 1 + 1 file changed, 1 insertion(+) diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index c799bf04b7..ea5f8dac85 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -8035,6 +8035,7 @@ <choice> <value>raw</value> <value>qcow2</value> + <value>json</value> </choice> </define> -- 2.52.0

We will need to handle storage files using JSON format soon. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/conf/storage_source_conf.c | 2 +- src/conf/storage_source_conf.h | 1 + src/qemu/qemu_block.c | 2 ++ tests/storagepoolcapsschemadata/poolcaps-fs.xml | 5 +++++ tests/storagepoolcapsschemadata/poolcaps-full.xml | 5 +++++ .../out/qcow2-qcow2_qcow2-qcow2_qcow2-auto | 2 +- .../virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-auto | 2 +- tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-raw | 2 +- tests/virstoragetestdata/out/qcow2-symlinks | 2 +- .../out/qcow2datafile-qcow2_qcow2-datafile | 2 +- 10 files changed, 19 insertions(+), 6 deletions(-) diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c index 087de1eaf2..e62707ba9b 100644 --- a/src/conf/storage_source_conf.c +++ b/src/conf/storage_source_conf.c @@ -57,7 +57,7 @@ VIR_ENUM_IMPL(virStorageFileFormat, "none", "raw", "dir", "bochs", "cloop", "dmg", "iso", - "vpc", "vdi", + "vpc", "vdi", "json", /* Not direct file formats, but used for various drivers */ "fat", "vhd", "ploop", /* Formats with backing file below here */ diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h index fc868b31af..0682da27f0 100644 --- a/src/conf/storage_source_conf.h +++ b/src/conf/storage_source_conf.h @@ -63,6 +63,7 @@ typedef enum { VIR_STORAGE_FILE_ISO, VIR_STORAGE_FILE_VPC, VIR_STORAGE_FILE_VDI, + VIR_STORAGE_FILE_JSON, /* Not direct file formats, but used for various drivers */ VIR_STORAGE_FILE_FAT, diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index a7062d3e96..66384a8159 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -1322,6 +1322,7 @@ qemuBlockStorageSourceGetBlockdevFormatProps(virStorageSource *src) case VIR_STORAGE_FILE_COW: case VIR_STORAGE_FILE_ISO: case VIR_STORAGE_FILE_DIR: + case VIR_STORAGE_FILE_JSON: virReportError(VIR_ERR_INTERNAL_ERROR, _("mishandled storage format '%1$s'"), virStorageFileFormatTypeToString(src->format)); @@ -2317,6 +2318,7 @@ qemuBlockStorageSourceCreateGetFormatProps(virStorageSource *src, case VIR_STORAGE_FILE_COW: case VIR_STORAGE_FILE_ISO: case VIR_STORAGE_FILE_DIR: + case VIR_STORAGE_FILE_JSON: return 0; case VIR_STORAGE_FILE_AUTO_SAFE: diff --git a/tests/storagepoolcapsschemadata/poolcaps-fs.xml b/tests/storagepoolcapsschemadata/poolcaps-fs.xml index eee75af746..1f59d33aef 100644 --- a/tests/storagepoolcapsschemadata/poolcaps-fs.xml +++ b/tests/storagepoolcapsschemadata/poolcaps-fs.xml @@ -12,6 +12,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -55,6 +56,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -88,6 +90,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -167,6 +170,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -193,6 +197,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> diff --git a/tests/storagepoolcapsschemadata/poolcaps-full.xml b/tests/storagepoolcapsschemadata/poolcaps-full.xml index 805950a937..a4f532cbb8 100644 --- a/tests/storagepoolcapsschemadata/poolcaps-full.xml +++ b/tests/storagepoolcapsschemadata/poolcaps-full.xml @@ -12,6 +12,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -55,6 +56,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -88,6 +90,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -167,6 +170,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> @@ -193,6 +197,7 @@ <value>iso</value> <value>vpc</value> <value>vdi</value> + <value>json</value> <value>fat</value> <value>vhd</value> <value>ploop</value> diff --git a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_qcow2-auto b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_qcow2-auto index 79943f432e..c9db352af8 100644 --- a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_qcow2-auto +++ b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_qcow2-auto @@ -1,6 +1,6 @@ path:ABS_SRCDIR/virstoragetestdata/images/qcow2_qcow2-qcow2_qcow2-auto.qcow2 backingStoreRaw: qcow2_qcow2-auto.qcow2 -backingStoreRawFormat: qcow2(14) +backingStoreRawFormat: qcow2(15) dataFileRaw: <null> capacity: 1024 encryption: 0 diff --git a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-auto b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-auto index 02e2c5a966..713df6086d 100644 --- a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-auto +++ b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-auto @@ -1,6 +1,6 @@ path:ABS_SRCDIR/virstoragetestdata/images/qcow2_qcow2-qcow2_raw-auto.qcow2 backingStoreRaw: qcow2_raw-auto.qcow2 -backingStoreRawFormat: qcow2(14) +backingStoreRawFormat: qcow2(15) dataFileRaw: <null> capacity: 1024 encryption: 0 diff --git a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-raw b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-raw index 843a013ef5..fb741133df 100644 --- a/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-raw +++ b/tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2_raw-raw @@ -1,6 +1,6 @@ path:ABS_BUILDDIR/virstoragedata/wrap backingStoreRaw: ABS_BUILDDIR/virstoragedata/qcow2 -backingStoreRawFormat: qcow2(14) +backingStoreRawFormat: qcow2(15) dataFileRaw: <null> capacity: 1024 encryption: 0 diff --git a/tests/virstoragetestdata/out/qcow2-symlinks b/tests/virstoragetestdata/out/qcow2-symlinks index c74cf6be53..8cc5d43e8f 100644 --- a/tests/virstoragetestdata/out/qcow2-symlinks +++ b/tests/virstoragetestdata/out/qcow2-symlinks @@ -1,6 +1,6 @@ path:ABS_SRCDIR/virstoragetestdata/images/sub/link2 backingStoreRaw: ../sub/link1 -backingStoreRawFormat: qcow2(14) +backingStoreRawFormat: qcow2(15) dataFileRaw: <null> capacity: 1024 encryption: 0 diff --git a/tests/virstoragetestdata/out/qcow2datafile-qcow2_qcow2-datafile b/tests/virstoragetestdata/out/qcow2datafile-qcow2_qcow2-datafile index a200ba98fa..51dacec39c 100644 --- a/tests/virstoragetestdata/out/qcow2datafile-qcow2_qcow2-datafile +++ b/tests/virstoragetestdata/out/qcow2datafile-qcow2_qcow2-datafile @@ -1,6 +1,6 @@ path:ABS_SRCDIR/virstoragetestdata/images/qcow2datafile-datafile.qcow2 backingStoreRaw: datafile.qcow2 -backingStoreRawFormat: qcow2(14) +backingStoreRawFormat: qcow2(15) dataFileRaw: raw capacity: 1024 encryption: 0 -- 2.52.0

Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/conf/domain_conf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 25494cb01a..6fad82c026 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -17766,7 +17766,8 @@ virDomainLoaderDefParseXMLNvram(virDomainLoaderDef *loader, if (loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE && loader->nvramTemplateFormat != VIR_STORAGE_FILE_RAW && - loader->nvramTemplateFormat != VIR_STORAGE_FILE_QCOW2) { + loader->nvramTemplateFormat != VIR_STORAGE_FILE_QCOW2 && + loader->nvramTemplateFormat != VIR_STORAGE_FILE_JSON) { virReportError(VIR_ERR_XML_ERROR, _("Unsupported nvram template format '%1$s'"), virStorageFileFormatTypeToString(loader->nvramTemplateFormat)); @@ -17782,7 +17783,8 @@ virDomainLoaderDefParseXMLNvram(virDomainLoaderDef *loader, if (src->format != VIR_STORAGE_FILE_NONE && src->format != VIR_STORAGE_FILE_RAW && - src->format != VIR_STORAGE_FILE_QCOW2) { + src->format != VIR_STORAGE_FILE_QCOW2 && + src->format != VIR_STORAGE_FILE_JSON) { virReportError(VIR_ERR_XML_ERROR, _("Unsupported nvram format '%1$s'"), virStorageFileFormatTypeToString(src->format)); -- 2.52.0

Not very useful for now, but sets the stage for further changes. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index e3471d9adb..5f5550424f 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -95,7 +95,7 @@ struct _qemuFirmwareMappingFlash { typedef struct _qemuFirmwareMappingMemory qemuFirmwareMappingMemory; struct _qemuFirmwareMappingMemory { - char *filename; + qemuFirmwareFile executable; }; @@ -217,7 +217,7 @@ qemuFirmwareMappingFlashFreeContent(qemuFirmwareMappingFlash *flash) static void qemuFirmwareMappingMemoryFreeContent(qemuFirmwareMappingMemory *memory) { - g_free(memory->filename); + qemuFirmwareFileFreeContent(&memory->executable); } @@ -412,7 +412,8 @@ qemuFirmwareMappingMemoryParse(const char *path, return -1; } - memory->filename = g_strdup(filename); + memory->executable.filename = g_strdup(filename); + memory->executable.format = g_strdup("raw"); return 0; } @@ -698,7 +699,7 @@ qemuFirmwareMappingMemoryFormat(virJSONValue *mapping, { if (virJSONValueObjectAppendString(mapping, "filename", - memory->filename) < 0) + memory->executable.filename) < 0) return -1; return 0; @@ -890,7 +891,7 @@ qemuFirmwareMatchesPaths(const qemuFirmware *fw, break; case QEMU_FIRMWARE_DEVICE_MEMORY: if (loader && loader->path && - !virFileComparePaths(loader->path, memory->filename)) + !virFileComparePaths(loader->path, memory->executable.filename)) return false; break; case QEMU_FIRMWARE_DEVICE_NONE: @@ -1481,7 +1482,7 @@ qemuFirmwareEnableFeaturesModern(virDomainDef *def, loader->format = VIR_STORAGE_FILE_RAW; VIR_FREE(loader->path); - loader->path = g_strdup(memory->filename); + loader->path = g_strdup(memory->executable.filename); VIR_DEBUG("decided on loader '%s'", loader->path); @@ -2078,7 +2079,7 @@ qemuFirmwareGetSupported(const char *machine, break; case QEMU_FIRMWARE_DEVICE_MEMORY: - fwpath = memory->filename; + fwpath = memory->executable.filename; break; case QEMU_FIRMWARE_DEVICE_NONE: -- 2.52.0

This was not necessary until now since ROMs couldn't have an associate NVRAM template, but that's a possibility now and we have to account for it. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index bf6090fac0..770c886136 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -2194,6 +2194,7 @@ qemuFirmwareGetSupported(const char *machine, case QEMU_FIRMWARE_DEVICE_MEMORY: fwpath = memory->executable.filename; + nvrampath = memory->nvram_template.filename; break; case QEMU_FIRMWARE_DEVICE_NONE: -- 2.52.0

Now that we expect NVRAM to be used together with ROM firmware builds, we need to ensure that the corresponding configuration is always populated correctly. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index fc78433100..1b97cdb316 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1076,9 +1076,6 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def, if (!loader) return; - if (loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH) - return; - if (loader->readonly != VIR_TRISTATE_BOOL_YES) return; -- 2.52.0

The two checks are semantically different, so it makes sense to perform them separately. We will soon extend the first one. While at it, start printing out the value of isConfidential. We could print the value of each firmware feature it's derived from, but that would make things unnecessarily verbose; at the same time, knowing that libvirt believes that the firmware build is targeting the confidential use case can be useful for debugging so it's worth including it. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 309ec3f349..68563b8083 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1726,16 +1726,23 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, * VMs also don't support EFI variable storage in NVRAM, instead * the secureboot state is hardcoded to enabled. */ - if ((!isConfidential && - (supportsSecureBoot != requiresSMM)) || - (hasEnrolledKeys && !supportsSecureBoot)) { + if (!isConfidential && + supportsSecureBoot != requiresSMM) { VIR_WARN("Firmware description '%s' has invalid set of features: " - "%s = %d, %s = %d, %s = %d", + "%s = %d, %s = %d (isConfidential = %d)", filename, qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_REQUIRES_SMM), requiresSMM, qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_SECURE_BOOT), supportsSecureBoot, + isConfidential); + } + if (hasEnrolledKeys && !supportsSecureBoot) { + VIR_WARN("Firmware description '%s' has invalid set of features: " + "%s = %d, %s = %d", + filename, + qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_SECURE_BOOT), + supportsSecureBoot, qemuFirmwareFeatureTypeToString(QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS), hasEnrolledKeys); } -- 2.52.0

This test case demonstrates how to manually configure an x86_64 guest to use the uefi-vars device. It currently fails because the QEMU driver does not yet allow the use of JSON for NVRAM. That will change in a future commit. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- ...-manual-efi-qemuvars-q35.x86_64-latest.err | 1 + ...-manual-efi-qemuvars-q35.x86_64-latest.xml | 36 +++++++++++++++++++ .../firmware-manual-efi-qemuvars-q35.xml | 19 ++++++++++ tests/qemuxmlconftest.c | 2 ++ 4 files changed, 58 insertions(+) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.xml diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.err new file mode 100644 index 0000000000..e5f67f8d09 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.err @@ -0,0 +1 @@ +unsupported configuration: Unsupported nvram format 'json' diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml new file mode 100644 index 0000000000..a16c404eaf --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml @@ -0,0 +1,36 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <loader type='rom'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram format='json'>/path/to/guest.json</nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.xml new file mode 100644 index 0000000000..07b744d490 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.xml @@ -0,0 +1,19 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <loader type='rom'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram format='json'>/path/to/guest.json</nvram> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 89b8ad1a35..1e20957656 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1560,6 +1560,8 @@ mymain(void) ARG_CAPS_VARIANT, "+inteltdx", ARG_END); + DO_TEST_CAPS_LATEST_FAILURE("firmware-manual-efi-qemuvars-q35"); + /* Make sure all combinations of ACPI and UEFI behave as expected */ DO_TEST_CAPS_ARCH_LATEST("firmware-manual-efi-acpi-aarch64", "aarch64"); DO_TEST_CAPS_LATEST("firmware-manual-efi-acpi-q35"); -- 2.52.0

This test case demonstrates how to manually configure an x86_64 guest to use the uefi-vars device, with the backing file for the NVRAM residing on a remote location accessed via NBD. It currently fails because the QEMU driver does not yet allow the use of JSON for NVRAM. That will change in a future commit. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- ...muvars-nvram-network-nbd.x86_64-latest.err | 1 + ...muvars-nvram-network-nbd.x86_64-latest.xml | 40 +++++++++++++++++++ ...-manual-efi-qemuvars-nvram-network-nbd.xml | 23 +++++++++++ tests/qemuxmlconftest.c | 1 + 4 files changed, 65 insertions(+) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.xml diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.err new file mode 100644 index 0000000000..e5f67f8d09 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.err @@ -0,0 +1 @@ +unsupported configuration: Unsupported nvram format 'json' diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.xml new file mode 100644 index 0000000000..14f2800174 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.x86_64-latest.xml @@ -0,0 +1,40 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <loader type='rom'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram type='network' format='json'> + <source protocol='nbd' name='bar'> + <host name='example.org' port='6000'/> + </source> + </nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.xml new file mode 100644 index 0000000000..202fe89815 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-nvram-network-nbd.xml @@ -0,0 +1,23 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> + <loader type='rom'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram format='json' type='network'> + <source protocol='nbd' name='bar'> + <host name='example.org' port='6000'/> + </source> + </nvram> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index fa768df1a2..ec3c53cf67 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1562,6 +1562,7 @@ mymain(void) DO_TEST_CAPS_LATEST_FAILURE("firmware-manual-efi-qemuvars-q35"); DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("firmware-manual-efi-qemuvars-aarch64", "aarch64"); + DO_TEST_CAPS_LATEST_FAILURE("firmware-manual-efi-qemuvars-nvram-network-nbd"); /* Make sure all combinations of ACPI and UEFI behave as expected */ DO_TEST_CAPS_ARCH_LATEST("firmware-manual-efi-acpi-aarch64", "aarch64"); -- 2.52.0

This test case demonstrates how to force libvirt to use the uefi-vars device for an x86_64 guest, despite that not being the default firmware build for the architecture at this point in time. It currently fails because the QEMU driver does not yet allow the use of JSON for NVRAM. That will change in a future commit. In addition to the latest version, the test case is also executed against QEMU 8.2.0 specifically. This version of the test case is intended to fail, because the uefi-vars device was not yet available in that version of QEMU. The exact error message will change down the line. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- ...uto-efi-format-nvram-json.x86_64-8.2.0.err | 1 + ...uto-efi-format-nvram-json.x86_64-8.2.0.xml | 35 +++++++++++++++++++ ...to-efi-format-nvram-json.x86_64-latest.err | 1 + ...to-efi-format-nvram-json.x86_64-latest.xml | 35 +++++++++++++++++++ .../firmware-auto-efi-format-nvram-json.xml | 18 ++++++++++ tests/qemuxmlconftest.c | 2 ++ 6 files changed, 92 insertions(+) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.xml diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err new file mode 100644 index 0000000000..e5f67f8d09 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err @@ -0,0 +1 @@ +unsupported configuration: Unsupported nvram format 'json' diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml new file mode 100644 index 0000000000..cc7fdfad79 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml @@ -0,0 +1,35 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os firmware='efi'> + <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> + <nvram format='json'/> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err new file mode 100644 index 0000000000..e5f67f8d09 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err @@ -0,0 +1 @@ +unsupported configuration: Unsupported nvram format 'json' diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml new file mode 100644 index 0000000000..cc7fdfad79 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml @@ -0,0 +1,35 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os firmware='efi'> + <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> + <nvram format='json'/> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pcie-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.xml new file mode 100644 index 0000000000..8c7a268910 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.xml @@ -0,0 +1,18 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os firmware='efi'> + <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> + <nvram format='json'/> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 85c35af515..a109ae99d6 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1630,6 +1630,8 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvramtemplate-qcow2"); DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch"); DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-mismatch-nvramtemplate"); + DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-json"); + DO_TEST_CAPS_VER_FAILURE("firmware-auto-efi-format-nvram-json", "8.2.0"); /* This test passes, but the outcome is not the desired one: the * generic edk2 build gets selected instead of the AMD SEV one */ -- 2.52.0

The use of JSON format for NVRAM requires the uefi-vars device to be present. The firmware-auto-efi-format-nvram-json test case starts failing in a different way after this change. The new error message is the correct one. The variant of the firmware-auto-efi-enrolled-keys-aarch64 test case that is run against QEMU 8.2.0 does not see the same change, for now. That is because libvirt does not yet recognize that enabling Secure Boot on aarch64 requires using the uefi-vars device. After some upcoming changes, this test case will start behaving the same as the one mentioned above too. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_validate.c | 8 +++++ ...uto-efi-format-nvram-json.x86_64-8.2.0.err | 2 +- ...uto-efi-format-nvram-json.x86_64-8.2.0.xml | 35 ------------------- tests/qemuxmlconftest.c | 2 +- 4 files changed, 10 insertions(+), 37 deletions(-) delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index da08fd17cd..40676bef39 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -728,6 +728,14 @@ qemuValidateDomainDefNvram(const virDomainDef *def, return -1; } + if (src->format == VIR_STORAGE_FILE_JSON) { + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_UEFI_VARS)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("The uefi-vars device is not supported by this QEMU binary")); + return -1; + } + } + if (src->sliceStorage) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("slices are not supported with NVRAM")); diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err index e5f67f8d09..e64c2b21aa 100644 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.err @@ -1 +1 @@ -unsupported configuration: Unsupported nvram format 'json' +unsupported configuration: The uefi-vars device is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml deleted file mode 100644 index cc7fdfad79..0000000000 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-8.2.0.xml +++ /dev/null @@ -1,35 +0,0 @@ -<domain type='kvm'> - <name>guest</name> - <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> - <memory unit='KiB'>1048576</memory> - <currentMemory unit='KiB'>1048576</currentMemory> - <vcpu placement='static'>1</vcpu> - <os firmware='efi'> - <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> - <nvram format='json'/> - <boot dev='hd'/> - </os> - <features> - <acpi/> - </features> - <cpu mode='custom' match='exact' check='none'> - <model fallback='forbid'>qemu64</model> - </cpu> - <clock offset='utc'/> - <on_poweroff>destroy</on_poweroff> - <on_reboot>restart</on_reboot> - <on_crash>destroy</on_crash> - <devices> - <emulator>/usr/bin/qemu-system-x86_64</emulator> - <controller type='usb' index='0' model='none'/> - <controller type='sata' index='0'> - <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> - </controller> - <controller type='pci' index='0' model='pcie-root'/> - <input type='mouse' bus='ps2'/> - <input type='keyboard' bus='ps2'/> - <audio id='1' type='none'/> - <watchdog model='itco' action='reset'/> - <memballoon model='none'/> - </devices> -</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index a109ae99d6..500cbbd45b 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1631,7 +1631,7 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch"); DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-mismatch-nvramtemplate"); DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-json"); - DO_TEST_CAPS_VER_FAILURE("firmware-auto-efi-format-nvram-json", "8.2.0"); + DO_TEST_CAPS_VER_PARSE_ERROR("firmware-auto-efi-format-nvram-json", "8.2.0"); /* This test passes, but the outcome is not the desired one: the * generic edk2 build gets selected instead of the AMD SEV one */ -- 2.52.0

The file extension needs to match the format. In the case of JSON, we're ditching the _VARS part of the filename too. Having that in there made a lot of sense in the beginning, when OVMF_CODE.fd and OVMF_VARS.fd were used for the executable and NVRAM template respectively, and a similar pattern was used for AAVMF (aka edk2 on aarch64) as well. These days, the aarch64 build of edk2 has ditched the pattern, so the only remaining holdout is the x86_64 build; the uefi-vars build doesn't use _CODE and _VARS on any architecture. It's a good time to get rid of this vestigial part of the filename. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 962d6cdee7..0504eef727 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1073,7 +1073,7 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def, g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); virDomainLoaderDef *loader = def->os.loader; virStorageFileFormat nvramFormat = VIR_STORAGE_FILE_NONE; - const char *ext = NULL; + const char *suffix = NULL; if (!loader) return; @@ -1134,16 +1134,18 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def, if (abiUpdate && loader->nvramTemplate && virStringHasSuffix(loader->nvramTemplate, ".raw")) - ext = ".raw"; + suffix = "_VARS.raw"; else - ext = ".fd"; + suffix = "_VARS.fd"; } if (loader->nvram->format == VIR_STORAGE_FILE_QCOW2) - ext = ".qcow2"; + suffix = "_VARS.qcow2"; + if (loader->nvram->format == VIR_STORAGE_FILE_JSON) + suffix = ".json"; - loader->nvram->path = g_strdup_printf("%s/%s_VARS%s", + loader->nvram->path = g_strdup_printf("%s/%s%s", cfg->nvramDir, def->name, - NULLSTR_EMPTY(ext)); + NULLSTR_EMPTY(suffix)); } -- 2.52.0

NVRAM files in JSON format can only be used together with the uefi-vars QEMU device, and the firmware descriptor is required to advertise the host-uefi-vars feature in that case. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_firmware.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index f56a4977cf..ce90f95d0a 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1217,6 +1217,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def, bool supportsTDX = false; bool supportsSecureBoot = false; bool hasEnrolledKeys = false; + bool usesUefiVarsDevice = false; int reqSecureBoot; int reqEnrolledKeys; @@ -1305,6 +1306,9 @@ qemuFirmwareMatchDomain(const virDomainDef *def, break; case QEMU_FIRMWARE_FEATURE_HOST_UEFI_VARS: + usesUefiVarsDevice = true; + break; + case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: case QEMU_FIRMWARE_FEATURE_NONE: @@ -1533,6 +1537,11 @@ qemuFirmwareMatchDomain(const virDomainDef *def, virStorageFileFormatTypeToString(loader->nvram->format)); return false; } + + if (!usesUefiVarsDevice) { + VIR_DEBUG("Discarding loader with nvram template format 'json' and no 'host-uefi-vars' feature"); + return false; + } } else { if (loader && loader->nvram && (loader->nvram->path || loader->nvram->format)) { -- 2.52.0

Now that everything else is in place, we can finally add the firmware descriptors for the edk2 builds that use the uefi-vars QEMU device and JSON format NVRAM templates. Several existing test cases are affected by this. The firmware-auto-efi-format-nvram-json test case can now succeed, since the only thing preventing it from doing so was that a suitable firmware build could not be found. The firmware-manual-efi-qemuvars-aarch64 test case also succeeds, because libvirt now picks a UEFI firmware for it and that satisfies the requirement for using ACPI on the architecture. Finally, the firmware-auto-efi-enrolled-keys-aarch64 test case succeeds in its default variant, but its QEMU 8.2.0 variant starts failing in a different way than before. Since libvirt now picks the firmware build that requires use of the uefi-vars QEMU device, and QEMU 8.2.0 is too old to have it, we get the corresponding error message. Note that the firmware-auto-efi-format-nvram-json test case, in its QEMU 8.2.0 variant, had already started failing with the very same error message several commits earlier. https://issues.redhat.com/browse/RHEL-82645 DONOTMERGE: The firmware descriptors have not been added to the Fedora edk2 package yet. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- ...70-edk2-ovmf-qemuvars-x64-sb-enrolled.json | 35 +++++++++++++++++++ .../70-edk2-qemuvars-aarch64-sb-enrolled.json | 33 +++++++++++++++++ tests/qemufirmwaretest.c | 10 ++++-- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 2 +- ...-enrolled-keys-aarch64.aarch64-latest.args | 31 ++++++++++++++++ ...i-enrolled-keys-aarch64.aarch64-latest.err | 1 - ...i-enrolled-keys-aarch64.aarch64-latest.xml | 4 ++- ...o-efi-format-nvram-json.x86_64-latest.args | 34 ++++++++++++++++++ ...to-efi-format-nvram-json.x86_64-latest.err | 1 - ...to-efi-format-nvram-json.x86_64-latest.xml | 7 +++- ...l-efi-qemuvars-aarch64.aarch64-latest.args | 32 +++++++++++++++++ ...al-efi-qemuvars-aarch64.aarch64-latest.err | 1 - ...l-efi-qemuvars-aarch64.aarch64-latest.xml} | 11 ++++-- ...-manual-efi-qemuvars-q35.x86_64-latest.xml | 10 ++++-- tests/qemuxmlconftest.c | 8 ++--- 15 files changed, 202 insertions(+), 18 deletions(-) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.args delete mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.err rename tests/qemuxmlconfdata/{firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.xml => firmware-manual-efi-qemuvars-aarch64.aarch64-latest.xml} (64%) diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json b/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json new file mode 100644 index 0000000000..991c4340f8 --- /dev/null +++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json @@ -0,0 +1,35 @@ +{ + "description": "OVMF for qemuvars, SB enabled, MS certs enrolled", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "memory", + "mode" : "split", + "executable": { + "filename": "/usr/share/edk2/ovmf/OVMF.qemuvars.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/edk2/ovmf/OVMF_VARS.qemuvars.json", + "format": "json" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "enrolled-keys", + "secure-boot", + "host-uefi-vars", + "verbose-dynamic" + ], + "tags": [ + ] +} diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json b/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json new file mode 100644 index 0000000000..d03ff9e27b --- /dev/null +++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json @@ -0,0 +1,33 @@ +{ + "description": "UEFI firmware for ARM64 virtual machines", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "memory", + "mode" : "split", + "executable": { + "filename": "/usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/edk2/aarch64/vars-template-qemuvars.json", + "format": "json" + } + }, + "targets": [ + { + "architecture": "aarch64", + "machines": [ + "virt-*" + ] + } + ], + "features": [ + "enrolled-keys", + "secure-boot", + "host-uefi-vars" + ], + "tags": [ + ] +} diff --git a/tests/qemufirmwaretest.c b/tests/qemufirmwaretest.c index a4fb5c9b9c..6a537981e8 100644 --- a/tests/qemufirmwaretest.c +++ b/tests/qemufirmwaretest.c @@ -101,6 +101,8 @@ testFWPrecedence(const void *opaque G_GNUC_UNUSED) SYSCONFDIR "/qemu/firmware/59-combined.json", PREFIX "/share/qemu/firmware/60-edk2-ovmf-x64-amdsev.json", PREFIX "/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json", + PREFIX "/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json", + PREFIX "/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json", PREFIX "/share/qemu/firmware/90-combined.json", PREFIX "/share/qemu/firmware/91-bios.json", PREFIX "/share/qemu/firmware/93-invalid.json", @@ -280,6 +282,8 @@ mymain(void) DO_PARSE_TEST("usr/share/qemu/firmware/53-edk2-aarch64-verbose-raw.json"); DO_PARSE_TEST("usr/share/qemu/firmware/60-edk2-ovmf-x64-amdsev.json"); DO_PARSE_TEST("usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json"); + DO_PARSE_TEST("usr/share/qemu/firmware/70-edk2-ovmf-qemuvars-x64-sb-enrolled.json"); + DO_PARSE_TEST("usr/share/qemu/firmware/70-edk2-qemuvars-aarch64-sb-enrolled.json"); DO_PARSE_TEST("usr/share/qemu/firmware/90-combined.json"); DO_PARSE_TEST("usr/share/qemu/firmware/91-bios.json"); DO_PARSE_FAILURE_TEST("usr/share/qemu/firmware/93-invalid.json"); @@ -319,7 +323,8 @@ mymain(void) "/usr/share/edk2/ovmf/OVMF_CODE.fd:/usr/share/edk2/ovmf/OVMF_VARS.fd:" "/usr/share/edk2/ovmf/OVMF.combined.fd:NULL:" "/usr/share/edk2/ovmf/OVMF.amdsev.fd:NULL:" - "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd:NULL", + "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd:NULL:" + "/usr/share/edk2/ovmf/OVMF.qemuvars.fd:/usr/share/edk2/ovmf/OVMF_VARS.qemuvars.json", VIR_DOMAIN_OS_DEF_FIRMWARE_BIOS, VIR_DOMAIN_OS_DEF_FIRMWARE_EFI); DO_SUPPORTED_TEST("pc-q35-3.1", VIR_ARCH_I686, false, @@ -332,7 +337,8 @@ mymain(void) "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.qcow2:/usr/share/edk2/aarch64/vars-template-pflash.qcow2:" "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw:" "/usr/share/edk2/aarch64/QEMU_EFI-pflash.qcow2:/usr/share/edk2/aarch64/vars-template-pflash.qcow2:" - "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw", + "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw:" + "/usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd:/usr/share/edk2/aarch64/vars-template-qemuvars.json", VIR_DOMAIN_OS_DEF_FIRMWARE_EFI); DO_SUPPORTED_TEST("virt", VIR_ARCH_RISCV64, false, "/usr/share/edk2/riscv/RISCV_VIRT_CODE.qcow2:/usr/share/edk2/riscv/RISCV_VIRT_VARS.qcow2", diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err index 3edb2b3451..e64c2b21aa 100644 --- a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.err @@ -1 +1 @@ -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration +unsupported configuration: The uefi-vars device is not supported by this QEMU binary diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args new file mode 100644 index 0000000000..d12949dbf2 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.args @@ -0,0 +1,31 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-aarch64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine virt-4.0,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \ +-accel kvm \ +-bios /usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.err deleted file mode 100644 index 3edb2b3451..0000000000 --- a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.err +++ /dev/null @@ -1 +0,0 @@ -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml index e1b1417cbc..46ba916116 100644 --- a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-latest.xml @@ -8,8 +8,10 @@ <type arch='aarch64' machine='virt-4.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> </firmware> - <loader format='raw'/> + <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd</loader> + <nvram template='/usr/share/edk2/aarch64/vars-template-qemuvars.json' templateFormat='json' format='json'>/var/lib/libvirt/qemu/nvram/guest.json</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.args new file mode 100644 index 0000000000..9a899c2a65 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.args @@ -0,0 +1,34 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine pc-q35-8.2,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=on \ +-accel kvm \ +-cpu qemu64 \ +-bios /usr/share/edk2/ovmf/OVMF.qemuvars.fd \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-global ICH9-LPC.noreboot=off \ +-watchdog-action reset \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err deleted file mode 100644 index 3edb2b3451..0000000000 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.err +++ /dev/null @@ -1 +0,0 @@ -operation failed: Unable to find 'efi' firmware that is compatible with the current configuration diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml index cc7fdfad79..aaa4e37e7b 100644 --- a/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-auto-efi-format-nvram-json.x86_64-latest.xml @@ -6,7 +6,12 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> - <nvram format='json'/> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.qemuvars.json' templateFormat='json' format='json'>/var/lib/libvirt/qemu/nvram/guest.json</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.args new file mode 100644 index 0000000000..575ffdb42b --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-aarch64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \ +-accel tcg \ +-cpu cortex-a15 \ +-bios /usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.err b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.err deleted file mode 100644 index 4fe79bdacf..0000000000 --- a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.err +++ /dev/null @@ -1 +0,0 @@ -unsupported configuration: ACPI requires UEFI on this architecture diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.xml similarity index 64% rename from tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.xml rename to tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.xml index e1b1417cbc..5d6d2dac9a 100644 --- a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64-8.2.0.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-aarch64.aarch64-latest.xml @@ -1,4 +1,4 @@ -<domain type='kvm'> +<domain type='qemu'> <name>guest</name> <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> <memory unit='KiB'>1048576</memory> @@ -8,14 +8,19 @@ <type arch='aarch64' machine='virt-4.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> </firmware> - <loader format='raw'/> + <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/aarch64/QEMU_EFI.qemuvars.fd</loader> + <nvram template='/usr/share/edk2/aarch64/vars-template-qemuvars.json' templateFormat='json' format='json'>/path/to/guest.json</nvram> <boot dev='hd'/> </os> <features> <acpi/> - <gic version='3'/> + <gic version='2'/> </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>cortex-a15</model> + </cpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml index 16cdac6c51..197530e5df 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-qemuvars-q35.x86_64-latest.xml @@ -4,10 +4,14 @@ <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> - <os> + <os firmware='efi'> <type arch='x86_64' machine='pc-q35-10.0'>hvm</type> - <loader type='rom' format='raw'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> - <nvram format='json'>/path/to/guest.json</nvram> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='rom' format='raw'>/usr/share/edk2/ovmf/OVMF.qemuvars.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.qemuvars.json' templateFormat='json' format='json'>/path/to/guest.json</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 886e676d9e..e4d9fd2c07 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1561,7 +1561,7 @@ mymain(void) ARG_END); DO_TEST_CAPS_LATEST("firmware-manual-efi-qemuvars-q35"); - DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("firmware-manual-efi-qemuvars-aarch64", "aarch64"); + DO_TEST_CAPS_ARCH_LATEST("firmware-manual-efi-qemuvars-aarch64", "aarch64"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-qemuvars-nvram-network-nbd"); /* Make sure all combinations of ACPI and UEFI behave as expected */ @@ -1598,8 +1598,8 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-auto-efi-secboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-no-secboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-enrolled-keys"); - DO_TEST_CAPS_ARCH_LATEST_FAILURE("firmware-auto-efi-enrolled-keys-aarch64", "aarch64"); - DO_TEST_CAPS_ARCH_VER_FAILURE("firmware-auto-efi-enrolled-keys-aarch64", "aarch64", "8.2.0"); + DO_TEST_CAPS_ARCH_LATEST("firmware-auto-efi-enrolled-keys-aarch64", "aarch64"); + DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("firmware-auto-efi-enrolled-keys-aarch64", "aarch64", "8.2.0"); DO_TEST_CAPS_LATEST("firmware-auto-efi-no-enrolled-keys"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-enrolled-keys-no-secboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-smm-off"); @@ -1630,7 +1630,7 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvramtemplate-qcow2"); DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch"); DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-mismatch-nvramtemplate"); - DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-format-nvram-json"); + DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-json"); DO_TEST_CAPS_VER_PARSE_ERROR("firmware-auto-efi-format-nvram-json", "8.2.0"); /* This test passes, but the outcome is not the desired one: the -- 2.52.0

Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- NEWS.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 6ca49a4c1b..f4915cd8d9 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,16 @@ v12.0.0 (unreleased) * **New features** + * qemu: Add support for uefi-vars device and firmware builds using it + + This is particularly noteworthy for people running aarch64 VMs, as it makes + it finally possible to use Secure Boot on the architecture. + + No special steps are needed to take advantage of this: assuming that you + have installed a recent version of QEMU, as well as a build of edk2 that + includes the necessary binaries, you can just `enable Secure Boot + <kbase/secureboot.html>`__ as you normally would. + * **Improvements** * qemu: Improvements and fixes to firmware selection -- 2.52.0