External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-06 13:20:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
6d78280bb4
libvirt/tests/qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml

42 lines
1.4 KiB
XML
Raw Normal View History

tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<domain type='kvm'>
tests: Unify input files for firmware tests Most of the differences, such as those in the domain name or amount of memory, are fairly harmless, but they still make it more cumbersome than necessary to directly compare different input (and output) files. More importantly, the use of unversioned machine types in some of the test cases results in the descriptor-based autoselection logic being effectively skipped, because the compatible machine types as listed in them are only the versioned variants. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-02-08 18:28:05 +00:00
<name>guest</name>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
tests: Unify input files for firmware tests Most of the differences, such as those in the domain name or amount of memory, are fairly harmless, but they still make it more cumbersome than necessary to directly compare different input (and output) files. More importantly, the use of unversioned machine types in some of the test cases results in the descriptor-based autoselection logic being effectively skipped, because the compatible machine types as listed in them are only the versioned variants. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-02-08 18:28:05 +00:00
<memory unit='KiB'>1048576</memory>
<currentMemory unit='KiB'>1048576</currentMemory>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<vcpu placement='static'>1</vcpu>
qemu: Don't drop firmware type/features information Now that we no longer reject configurations that include both this information and explicit firmware details, as long of course as everything is internally consistent, and that we've ensured that we produce maximally compatible XML on migration, we can stop stripping this information at the end of the firmware selection process. There are several advantages to keeping this information around: * if the user wants to change the firmware configuration for an existing VM, they can simply drop the <loader> and <nvram> elements, tweak the firmware autoselection parameters and let libvirt pick a firmware that matches on the new requirements; * management applications can inspect the XML and easily figure out firmware-related information without having to reverse-engineer them based on some opaque paths. Overall, this change makes things more transparent and easier to understand. The improvement is so significant that, in a follow-up commit, we're going to ensure that this information is available in even more cases. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-14 22:08:29 +00:00
<os firmware='efi'>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
qemu: Don't drop firmware type/features information Now that we no longer reject configurations that include both this information and explicit firmware details, as long of course as everything is internally consistent, and that we've ensured that we produce maximally compatible XML on migration, we can stop stripping this information at the end of the firmware selection process. There are several advantages to keeping this information around: * if the user wants to change the firmware configuration for an existing VM, they can simply drop the <loader> and <nvram> elements, tweak the firmware autoselection parameters and let libvirt pick a firmware that matches on the new requirements; * management applications can inspect the XML and easily figure out firmware-related information without having to reverse-engineer them based on some opaque paths. Overall, this change makes things more transparent and easier to understand. The improvement is so significant that, in a follow-up commit, we're going to ensure that this information is available in even more cases. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-14 22:08:29 +00:00
<firmware>
<feature enabled='no' name='enrolled-keys'/>
qemu: Automatically add firmware type/features information Even when the user is not taking advantage of firmware autoselection and instead manually providing all the necessary information, in most cases they're still going to use firmware builds that are provided by the OS vendor, are installed in standard paths and come with a corresponding firmware descriptor. Similarly, even when the user is not guiding the autoselection process by specifying the desired status of certain features and instead is relying on the system-level descriptor priority being set up correctly, libvirt will still ultimately decide to use a specific descriptor, which includes information about the firmware's features. In both these cases, take the additional information that were obtained from the firmware descriptor and reflect them back into the domain XML, where they can be conveniently inspected by the user and management applications alike. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-15 16:53:02 +00:00
<feature enabled='yes' name='secure-boot'/>
qemu: Don't drop firmware type/features information Now that we no longer reject configurations that include both this information and explicit firmware details, as long of course as everything is internally consistent, and that we've ensured that we produce maximally compatible XML on migration, we can stop stripping this information at the end of the firmware selection process. There are several advantages to keeping this information around: * if the user wants to change the firmware configuration for an existing VM, they can simply drop the <loader> and <nvram> elements, tweak the firmware autoselection parameters and let libvirt pick a firmware that matches on the new requirements; * management applications can inspect the XML and easily figure out firmware-related information without having to reverse-engineer them based on some opaque paths. Overall, this change makes things more transparent and easier to understand. The improvement is so significant that, in a follow-up commit, we're going to ensure that this information is available in even more cases. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-14 22:08:29 +00:00
</firmware>
tests: Fix firmware descriptor masking test Right now we're checking that firmware descriptor masking works as intended by creating an empty file matching 60-ovmf-sb.json in name. However, that firmware descriptors contains the details for a perfectly valid and quite common situation: Secure Boot being supported by the firmware build, but being effectively disabled by the lack of certificates in the NVRAM template. Unmask that firmware descriptor, and instead create a dummy one that has higher priority than all other OVMF builds and points to paths that are obviously incorrect, which should make it easy to notice it getting accidentally unmasked in the future. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-15 19:51:51 +00:00
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
qemu: Move firmware selection from startup to postparse Currently, firmware selection is performed as part of the domain startup process. This mostly works fine, but there's a significant downside to this approach: since the process is affected by factors outside of libvirt's control, specifically the contents of the various JSON firmware descriptors and their names, it's pretty much impossible to guarantee that the outcome is always going to be the same. It would only take an edk2 update, or a change made by the local admin, to render a domain unbootable or downgrade its boot security. To avoid this, move firmware selection to the postparse phase. This way it will only be performed once, when the domain is first defined; subsequent boots will not need to go through the process again, as all the paths that were picked during firmware selection are recorded in the domain XML. Care is taken to ensure that existing domains are handled correctly, even if their firmware configuration can't be successfully resolved. Failure to complete the firmware selection process is only considered fatal when defining a new domain; in all other cases the error will be reported during startup, as is already the case today. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-01-24 16:01:48 +00:00
<nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<boot dev='hd'/>
</os>
<features>
<acpi/>
tests: Fix firmware descriptor masking test Right now we're checking that firmware descriptor masking works as intended by creating an empty file matching 60-ovmf-sb.json in name. However, that firmware descriptors contains the details for a perfectly valid and quite common situation: Secure Boot being supported by the firmware build, but being effectively disabled by the lack of certificates in the NVRAM template. Unmask that firmware descriptor, and instead create a dummy one that has higher priority than all other OVMF builds and points to paths that are obviously incorrect, which should make it easy to notice it getting accidentally unmasked in the future. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-03-15 19:51:51 +00:00
<smm state='on'/>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
</features>
<cpu mode='custom' match='exact' check='none'>
<model fallback='forbid'>qemu64</model>
</cpu>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<controller type='usb' index='0' model='none'/>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
</controller>
<controller type='pci' index='0' model='pcie-root'/>
<input type='mouse' bus='ps2'/>
<input type='keyboard' bus='ps2'/>
<audio id='1' type='none'/>
qemu: Add implicit watchdog for q35 machine types The iTCO watchdog is part of the q35 machine type since its inception, we just did not add it implicitly. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2137346 Signed-off-by: Martin Kletzander <mkletzan@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-01-20 10:22:22 +00:00
<watchdog model='itco' action='reset'/>
tests: Use minimal hardware for firmware tests When testing firmware selection, we don't really care about any of the hardware assigned to the VM, and in fact it's better to keep it as minimal as possible to make sure that the focus remains on the firmware bits. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-09 13:02:19 +00:00
<memballoon model='none'/>
</devices>
</domain>
Reference in New Issue Copy Permalink