From d1c5d166a891a2abf408a5879b95bded23b45825 Mon Sep 17 00:00:00 2001 Message-Id: From: Pavel Hrdina Date: Fri, 21 May 2021 14:16:12 +0200 Subject: [PATCH] qemu: implement support for firmware auto-selection feature filtering Signed-off-by: Pavel Hrdina Reviewed-by: Michal Privoznik (cherry picked from commit c91fa273062ec388385bf8cc081117c78c2f7af5) Conflicts: tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args - missing upstream commits: d96fb5cb31b870e1539bd8ee95fb27dbe461a357 43c9c0859f2d53321ccc646ab905beec0740490b 88957116c9d3cb4705380c3702c9d4315fb500bb tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml - missing upstream commits: e88367095f3cad2cf80a687fd599dfaeb3073841 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1929357 Signed-off-by: Pavel Hrdina Message-Id: Reviewed-by: Michal Privoznik --- src/qemu/qemu_firmware.c | 40 +++++++++++++++ ...re-efi-no-enrolled-keys.x86_64-latest.args | 47 ++++++++++++++++++ .../os-firmware-efi-no-enrolled-keys.xml | 49 +++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + ...are-efi-no-enrolled-keys.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + 6 files changed, 139 insertions(+) create mode 100644 tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml create mode 120000 tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 8ef515ca57..e875e355c7 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -952,6 +952,10 @@ qemuFirmwareMatchDomain(const virDomainDef *def, bool supportsS4 = false; bool requiresSMM = false; bool supportsSEV = false; + bool supportsSecureBoot = false; + bool hasEnrolledKeys = false; + int reqSecureBoot; + int reqEnrolledKeys; want = qemuFirmwareOSInterfaceTypeFromOsDefFirmware(def->os.firmware); @@ -1001,7 +1005,13 @@ qemuFirmwareMatchDomain(const virDomainDef *def, break; case QEMU_FIRMWARE_FEATURE_SECURE_BOOT: + supportsSecureBoot = true; + break; + case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: + hasEnrolledKeys = true; + break; + case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: case QEMU_FIRMWARE_FEATURE_NONE: @@ -1022,6 +1032,36 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } + if (def->os.firmwareFeatures) { + reqSecureBoot = def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT]; + if (reqSecureBoot != VIR_TRISTATE_BOOL_ABSENT) { + if (reqSecureBoot == VIR_TRISTATE_BOOL_YES && !supportsSecureBoot) { + VIR_DEBUG("User requested Secure Boot, firmware '%s' doesn't support it", + path); + return false; + } + + if (reqSecureBoot == VIR_TRISTATE_BOOL_NO && supportsSecureBoot) { + VIR_DEBUG("User refused Secure Boot, firmware '%s' supports it", path); + return false; + } + } + + reqEnrolledKeys = def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS]; + if (reqEnrolledKeys != VIR_TRISTATE_BOOL_ABSENT) { + if (reqEnrolledKeys == VIR_TRISTATE_BOOL_YES && !hasEnrolledKeys) { + VIR_DEBUG("User requested Enrolled keys, firmware '%s' doesn't have them", + path); + return false; + } + + if (reqEnrolledKeys == VIR_TRISTATE_BOOL_NO && hasEnrolledKeys) { + VIR_DEBUG("User refused Enrolled keys, firmware '%s' has them", path); + return false; + } + } + } + if (def->os.loader && def->os.loader->secure == VIR_TRISTATE_BOOL_YES && !requiresSMM) { diff --git a/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args new file mode 100644 index 0000000000..c3c838fb1a --- /dev/null +++ b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args @@ -0,0 +1,47 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/tmp/lib/domain--1-fedora \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/tmp/lib/domain--1-fedora/.local/share \ +XDG_CACHE_HOME=/tmp/lib/domain--1-fedora/.cache \ +XDG_CONFIG_HOME=/tmp/lib/domain--1-fedora/.config \ +QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-x86_64 \ +-name guest=fedora,debug-threads=on \ +-S \ +-object secret,id=masterKey0,format=raw,\ +file=/tmp/lib/domain--1-fedora/master-key.aes \ +-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd",\ +"node-name":"libvirt-pflash0-storage","auto-read-only":true,\ +"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,\ +"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"file",\ +"filename":"/var/lib/libvirt/qemu/nvram/fedora_VARS.fd",\ +"node-name":"libvirt-pflash1-storage","auto-read-only":true,\ +"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,\ +"driver":"raw","file":"libvirt-pflash1-storage"}' \ +-machine pc-q35-4.0,accel=kvm,usb=off,dump-guest-core=off,\ +pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format \ +-cpu qemu64 \ +-m 8 \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server,nowait \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device pcie-root-port,port=0x8,chassis=1,id=pci.1,bus=pcie.0,multifunction=on,\ +addr=0x1 \ +-device pcie-root-port,port=0x9,chassis=2,id=pci.2,bus=pcie.0,addr=0x1.0x1 \ +-device qemu-xhci,id=usb,bus=pci.1,addr=0x0 \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\ +resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml new file mode 100644 index 0000000000..7f8f57a859 --- /dev/null +++ b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml @@ -0,0 +1,49 @@ + + fedora + 63840878-0deb-4095-97e6-fc444d9bc9fa + 8192 + 8192 + 1 + + hvm + + + + + + + + + + + + qemu64 + + + destroy + restart + destroy + + /usr/bin/qemu-system-x86_64 + + + + +
+ + + + +
+ + +
+ + +
+ + + + + + diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index bc04bea692..5e16d7fd31 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -3094,6 +3094,7 @@ mymain(void) DO_TEST_CAPS_LATEST("os-firmware-bios"); DO_TEST_CAPS_LATEST("os-firmware-efi"); DO_TEST_CAPS_LATEST("os-firmware-efi-secboot"); + DO_TEST_CAPS_LATEST("os-firmware-efi-no-enrolled-keys"); DO_TEST_CAPS_LATEST_PARSE_ERROR("os-firmware-invalid-type"); DO_TEST_CAPS_ARCH_LATEST("aarch64-os-firmware-efi", "aarch64"); diff --git a/tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml new file mode 120000 index 0000000000..902ccb783b --- /dev/null +++ b/tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml @@ -0,0 +1 @@ +../qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml \ No newline at end of file diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 461b5bc68f..9e5747290a 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -1122,6 +1122,7 @@ mymain(void) DO_TEST_CAPS_LATEST("os-firmware-bios"); DO_TEST_CAPS_LATEST("os-firmware-efi"); DO_TEST_CAPS_LATEST("os-firmware-efi-secboot"); + DO_TEST_CAPS_LATEST("os-firmware-efi-no-enrolled-keys"); DO_TEST("aarch64-aavmf-virtio-mmio", QEMU_CAPS_DEVICE_VIRTIO_MMIO, -- 2.31.1