Make UEFI testing the default, add Secure Boot testing

This essentially inverts the x86_64 machines so that '64bit' is
UEFI and instead of a variant 'uefi' machine we have a variant
'bios' machine that is BIOS. The point is to make UEFI testing
the default. We also enable Secure Boot in the UEFI testing,
and add a test of UEFI fallback booting on various products.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

main.pm

@@ -310,10 +310,6 @@ sub load_postinstall_tests() {
     }
     autotest::loadtest $storagepost if ($storagepost);
 
-    if (get_var("UEFI") && !get_var("NO_UEFI_POST") && !get_var("START_AFTER_TEST")) {
-        autotest::loadtest "tests/uefi_postinstall.pm";
-    }
-
     # console avc / crash check
     # it makes no sense to run this after logging in on most post-
     # install tests (hence ! BOOTFROM) and we do not want it
@@ -362,6 +358,10 @@ sub load_postinstall_tests() {
         }
     }
 
+    if (get_var("UEFI") && !get_var("NO_UEFI_POST") && !get_var("START_AFTER_TEST")) {
+        autotest::loadtest "tests/uefi_postinstall.pm";
+    }
+
     # we should shut down before uploading disk images
     if (get_var("STORE_HDD_1") || get_var("STORE_HDD_2") || get_var("PUBLISH_HDD_1")) {
         autotest::loadtest "tests/_console_shutdown.pm";

needles/console/bootloader_uefi-20240320.json

@@ -0,0 +1,20 @@
+{
+  "area": [
+    {
+      "width": 74,
+      "type": "match",
+      "height": 16,
+      "xpos": 465,
+      "ypos": 577
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "ENV-DISTRI-fedora",
+    "ENV-FLAVOR-server_boot",
+    "ENV-FLAVOR-workstation_live",
+    "ENV-UEFI-1",
+    "bootloader_uefi",
+    "bootloader"
+  ]
+}

needles/gnome/apps/sysmon/sysmon_fsystems_shown-silverblue-20240321.json

@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 0,
+      "ypos": 109,
+      "height": 53,
+      "type": "match",
+      "width": 148
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "sysmon_fsystems_shown"
+  ]
+}

templates-updates.fif.json

@@ -5,7 +5,7 @@
             "distri": "fedora",
             "flavor": "updates-container",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -16,7 +16,7 @@
             "distri": "fedora",
             "flavor": "updates-container",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -27,7 +27,7 @@
             "distri": "fedora",
             "flavor": "updates-container",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -48,7 +48,7 @@
             "distri": "fedora",
             "flavor": "updates-kde",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_kde_4_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_kde_5_%ARCH%.qcow2",
                 "DESKTOP": "kde",
                 "NUMDISKS": "2",
                 "RETRY": "1"
@@ -60,7 +60,7 @@
             "distri": "fedora",
             "flavor": "updates-server",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -71,7 +71,7 @@
             "distri": "fedora",
             "flavor": "updates-server",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -82,7 +82,7 @@
             "distri": "fedora",
             "flavor": "updates-server-upgrade",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -113,7 +113,7 @@
             "distri": "fedora",
             "flavor": "updates-server",
             "settings": {
-                "+HDD_1": "disk_f%VERSION%_server_3_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_server_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -182,7 +182,7 @@
             "flavor": "updates-workstation",
             "settings": {
                 "DESKTOP": "gnome",
-                "+HDD_1": "disk_f%VERSION%_desktop_4_%ARCH%.qcow2",
+                "+HDD_1": "disk_f%VERSION%_desktop_5_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "RETRY": "1"
             },
@@ -206,8 +206,8 @@
             "machine": "64bit",
             "product": "fedora-updates-everything-boot-iso-x86_64-*"
         },
-        "fedora-updates-everything-boot-iso-x86_64-*-uefi": {
+        "fedora-updates-everything-boot-iso-x86_64-*-bios": {
-            "machine": "uefi",
+            "machine": "bios",
             "product": "fedora-updates-everything-boot-iso-x86_64-*"
         },
         "fedora-updates-kde-x86_64-*-64bit": {
@@ -238,24 +238,24 @@
             "machine": "64bit",
             "product": "fedora-updates-kde-live-iso-x86_64-*"
         },
-        "fedora-updates-kde-live-iso-x86_64-*-uefi": {
+        "fedora-updates-kde-live-iso-x86_64-*-bios": {
-            "machine": "uefi",
+            "machine": "bios",
             "product": "fedora-updates-kde-live-iso-x86_64-*"
         },
         "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-64bit": {
             "machine": "64bit",
             "product": "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*"
         },
-        "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-uefi": {
+        "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-bios": {
-            "machine": "uefi",
+            "machine": "bios",
             "product": "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*"
         },
         "fedora-updates-workstation-live-iso-x86_64-*-64bit": {
             "machine": "64bit",
             "product": "fedora-updates-workstation-live-iso-x86_64-*"
         },
-        "fedora-updates-workstation-live-iso-x86_64-*-uefi": {
+        "fedora-updates-workstation-live-iso-x86_64-*-bios": {
-            "machine": "uefi",
+            "machine": "bios",
             "product": "fedora-updates-workstation-live-iso-x86_64-*"
         },
         "fedora-updates-workstation-upgrade-x86_64-*-64bit": {
@@ -367,10 +367,10 @@
         },
         "install_default_update_live": {
             "profiles": {
+                "fedora-updates-kde-live-iso-x86_64-*-bios": 5,
                 "fedora-updates-kde-live-iso-x86_64-*-64bit": 5,
-                "fedora-updates-kde-live-iso-x86_64-*-uefi": 5,
+                "fedora-updates-workstation-live-iso-x86_64-*-bios": 5,
-                "fedora-updates-workstation-live-iso-x86_64-*-64bit": 5,
+                "fedora-updates-workstation-live-iso-x86_64-*-64bit": 5
-                "fedora-updates-workstation-live-iso-x86_64-*-uefi": 5
             },
             "settings": {
                 "+START_AFTER_TEST": "live_build@%ARCH_BASE_MACHINE%",
@@ -381,8 +381,8 @@
         },
         "install_default_update_netinst": {
             "profiles": {
-                "fedora-updates-everything-boot-iso-x86_64-*-64bit": 5,
+                "fedora-updates-everything-boot-iso-x86_64-*-bios": 5,
-                "fedora-updates-everything-boot-iso-x86_64-*-uefi": 5
+                "fedora-updates-everything-boot-iso-x86_64-*-64bit": 5
             },
             "settings": {
                 "+START_AFTER_TEST": "installer_build@%ARCH_BASE_MACHINE%",
@@ -410,7 +410,7 @@
         },
         "install_default_ostree": {
             "profiles": {
-                "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-uefi": 5
+                "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-bios": 5
             },
             "settings": {
                 "INSTALL": "1",
@@ -425,7 +425,7 @@
             },
             "settings": {
                 "BOOTFROM": "c",
-                "HDD_1": "disk_f%VERSION%_minimal_3_%ARCH%.qcow2",
+                "HDD_1": "disk_f%VERSION%_minimal_4_%ARCH%.qcow2",
                 "NUMDISKS": "2",
                 "POSTINSTALL": "_installer_build",
                 "ROOT_PASSWORD": "weakpassword",
@@ -442,7 +442,7 @@
                 "+LIVE": "",
                 "BOOTFROM": "c",
                 "GRUB_POSTINSTALL": "selinux=0",
-                "HDD_1": "disk_f%VERSION%_minimal_3_%ARCH%.qcow2",
+                "HDD_1": "disk_f%VERSION%_minimal_4_%ARCH%.qcow2",
                 "HDDSIZEGB_3": "25",
                 "MAX_JOB_TIME": "10800",
                 "+NUMDISKS": "3",
@@ -459,7 +459,7 @@
                 "+DESKTOP": "",
                 "+CANNED": "",
                 "BOOTFROM": "c",
-                "HDD_1": "disk_f%VERSION%_minimal_3_%ARCH%.qcow2",
+                "HDD_1": "disk_f%VERSION%_minimal_4_%ARCH%.qcow2",
                 "HDDSIZEGB_3": "30",
                 "MAX_JOB_TIME": "12600",
                 "+NUMDISKS": "3",

tests/_coreos_install.pm

@@ -8,6 +8,10 @@ sub run {
     assert_screen "user_console", 300;
     type_string "sudo su\n";
     assert_script_run "coreos-installer install /dev/vda --ignition-url https://www.happyassassin.net/temp/openqa.ign", 600;
+    # the CoreOS installer does not write an efibootmgr entry, so to
+    # ensure we boot from hard disk on next boot, wipe the entry for
+    # the optical drive
+    assert_script_run('efibootmgr -b $(efibootmgr | grep CD-ROM | head -1 | cut -f1 | sed -e "s,[^0-9],,g") -B') if (get_var("UEFI"));
     type_string "reboot\n";
 }
 

tests/_secure_boot_fallback.pm

@@ -0,0 +1,30 @@
+use base "installedtest";
+use strict;
+use testapi;
+use utils;
+
+sub run {
+    my $self = shift;
+    if (not(check_screen "root_console", 0)) {
+        $self->root_console(tty => 4);
+    }
+    # now try deleting the "Fedora" boot entry and rebooting, to check the fallback path
+    assert_script_run('efibootmgr -b $(efibootmgr | grep Fedora | head -1 | cut -f1 | sed -e "s,[^0-9],,g") -B');
+    # check that worked
+    validate_script_output('efibootmgr', sub { $_ !~ m/.*Fedora.*/s });
+    type_string("reboot\n");
+    boot_to_login_screen;
+    $self->root_console(tty => 3);
+    # Fedora entry should have been recreated
+    validate_script_output('efibootmgr', sub { m/Fedora/ });
+    # SB should still be enabled
+    validate_script_output('mokutil --sb-state', sub { m/SecureBoot enabled/ });
+}
+
+sub test_flags {
+    return {fatal => 1};
+}
+
+1;
+
+# vim: set sw=4 et:

tests/uefi_postinstall.pm

@@ -13,6 +13,10 @@ sub run {
     console_loadkeys_us;
     # this test shows if the system is booted with efi
     assert_script_run '[ -d /sys/firmware/efi/ ]';
+    # if Secure Boot should be enabled, check it is; if it isn't,
+    # that *probably* indicates a test system issue not a distro bug,
+    # but we want to know either way
+    validate_script_output('mokutil --sb-state', sub { m/SecureBoot enabled/ }) if (get_var("UEFI_SECURE"));
 }
 
 sub test_flags {