From nobody Sun Oct  5 01:47:30 2025
Delivered-To: importer@patchew.org
Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates
 8.43.85.245 as permitted sender) client-ip=8.43.85.245;
 envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org;
Authentication-Results: mx.zohomail.com;
	dkim=fail;
	spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as
 permitted sender)  smtp.mailfrom=devel-bounces@lists.libvirt.org;
	dmarc=pass(p=reject dis=none)  header.from=lists.libvirt.org
ARC-Seal: i=1; a=rsa-sha256; t=1757513479; cv=none;
	d=zohomail.com; s=zohoarc;
	b=Z8ybheS3NOxLXYJtgxgf2+Z/GZycs8G7Bz81dmN3hngQWaT1XN2maNDn0sEWdJCpFNKK28DwAFUToF0vsbV83CwzxPbj0lf5uXEfiOcN2QyoiLxsqJX+aZ/GCleASL9cBxBGiheBRUB9GR5KUbt0F5THt5OWFfnUcQKyL31pc8w=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com;
 s=zohoarc;
	t=1757513479;
 h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc;
	bh=hwa+KA8MjE3ZH30ICZVGH7kkSb97XKv4mkdqhN026rI=;
	b=CIGrh4oul8PFeKfB1bEoWpIX8exyq3Q20p12LHNJrVy1MeS3JaRoq4ZpqV6jgbZCgzAMPV1I8XFWkvZXPSEPFGcdW/M6oWKav5QOU6ynKQOFJT7D6cxAbQXZsZ0QRpJsWYiKNGBdgSypHW/lm//c2IQeZW/dxzTtVQ199U7YIYg=
ARC-Authentication-Results: i=1; mx.zohomail.com;
	dkim=fail;
	spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as
 permitted sender)  smtp.mailfrom=devel-bounces@lists.libvirt.org;
	dmarc=pass header.from=<devel@lists.libvirt.org> (p=reject dis=none)
Return-Path: <devel-bounces@lists.libvirt.org>
Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by
 mx.zohomail.com
	with SMTPS id 1757513479902604.5763137849362;
 Wed, 10 Sep 2025 07:11:19 -0700 (PDT)
Received: by lists.libvirt.org (Postfix, from userid 993)
	id C5B5C41CA3; Wed, 10 Sep 2025 10:11:18 -0400 (EDT)
Received: from [172.19.199.3] (lists.libvirt.org [8.43.85.245])
	by lists.libvirt.org (Postfix) with ESMTP id E749A44013;
	Wed, 10 Sep 2025 09:59:20 -0400 (EDT)
Received: by lists.libvirt.org (Postfix, from userid 993)
	id 7A73D43F0E; Wed, 10 Sep 2025 09:59:13 -0400 (EDT)
Received: from us-smtp-delivery-124.mimecast.com
 (us-smtp-delivery-124.mimecast.com [170.10.133.124])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest
 SHA256)
	(No client certificate requested)
	by lists.libvirt.org (Postfix) with ESMTPS id C8F3C43E1D
	for <devel@lists.libvirt.org>; Wed, 10 Sep 2025 09:57:58 -0400 (EDT)
Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com
 (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by
 relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,
 cipher=TLS_AES_256_GCM_SHA384) id us-mta-676-yERaGdxTMpeinz23oROdvw-1; Wed,
 10 Sep 2025 09:57:57 -0400
Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com
 (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest
 SHA256)
	(No client certificate requested)
	by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS
 id A1A4C1800295
	for <devel@lists.libvirt.org>; Wed, 10 Sep 2025 13:57:56 +0000 (UTC)
Received: from harajuku.usersys.redhat.com.homenet.telecomitalia.it (unknown
 [10.45.226.29])
	by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with
 ESMTPS id D662B1800451
	for <devel@lists.libvirt.org>; Wed, 10 Sep 2025 13:57:55 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.5 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED,
	MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,
	RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,
	RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable
	autolearn_force=no version=4.0.1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1757512678;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references;
	bh=hwa+KA8MjE3ZH30ICZVGH7kkSb97XKv4mkdqhN026rI=;
	b=gh7xZDqBX8v9baKdBV6i/B8eWv3Aq6l7qlZvlF1Iz0FjaHm/rX/CAB7554hjbqEhAZdOg0
	9OhnFM/lUfpRWU4rDDvK+JDJSS30sF+eWL40/HVe/ru/ZFO8y5NYw8erMKI2HuriNbTZYT
	lUMEx1Qrkl5Os9lycBdMSVsm9QPEllU=
X-MC-Unique: yERaGdxTMpeinz23oROdvw-1
X-Mimecast-MFC-AGG-ID: yERaGdxTMpeinz23oROdvw_1757512676
To: devel@lists.libvirt.org
Subject: [PATCH v3 4/9] tests: Add tests for SEV firmware selection
Date: Wed, 10 Sep 2025 15:57:42 +0200
Message-ID: <20250910135747.803614-5-abologna@redhat.com>
In-Reply-To: <20250910135747.803614-1-abologna@redhat.com>
References: <20250910135747.803614-1-abologna@redhat.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111
X-Mimecast-Spam-Score: 0
X-Mimecast-MFC-PROC-ID: mX0BLmccWQFuc8YZEGGuyDn4-8D3aA9zMY8AxdcW-o0_1757512676
X-Mimecast-Originator: redhat.com
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: 77LDSXFTAKBLXNYQGDW6ITH63SSEFIYI
X-Message-ID-Hash: 77LDSXFTAKBLXNYQGDW6ITH63SSEFIYI
X-MailFrom: abologna@redhat.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop;
 banned-address; header-match-devel.lists.libvirt.org-0; emergency;
 member-moderation; nonmember-moderation; administrivia; implicit-dest;
 max-recipients; max-size; news-moderation; no-subject; digests;
 suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
List-Id: Development discussions about the libvirt library & tools
 <devel.lists.libvirt.org>
Archived-At: 
 <https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/77LDSXFTAKBLXNYQGDW6ITH63SSEFIYI/>
List-Archive: 
 <https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/>
List-Help: <mailto:devel-request@lists.libvirt.org?subject=help>
List-Owner: <mailto:devel-owner@lists.libvirt.org>
List-Post: <mailto:devel@lists.libvirt.org>
List-Subscribe: <mailto:devel-join@lists.libvirt.org>
List-Unsubscribe: <mailto:devel-leave@lists.libvirt.org>
From: Andrea Bolognani via Devel <devel@lists.libvirt.org>
Reply-To: Andrea Bolognani <abologna@redhat.com>
X-ZohoMail-DKIM: fail (Header signature does not verify)
X-ZM-MESSAGEID: 1757513481565116600
Content-Type: text/plain; charset="utf-8"; x-default="true"

One of the new test cases demonstrates how firmware
autoselection doesn't currently work correctly for domains
using SEV-SNP: the descriptor for a suitable firmware exists,
and yet it doesn't get picked up.

Another test cases shows that, while firmware autoselection
succeeds for non-SNP SEV domains, the results are not the
expected ones: the generic (stateful) edk2 build is used
instead of the SEV-specific (stateless) one.

Finally, one test case provides coverage for the uncommon
scenario of stateful firmware being explicitly requested by
the user.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
---
 ...-auto-efi-sev-snp.x86_64-latest+amdsev.err |  1 +
 ...-auto-efi-sev-snp.x86_64-latest+amdsev.xml | 38 ++++++++++++++++
 .../firmware-auto-efi-sev-snp.xml             | 20 +++++++++
 ...efi-sev-stateful.x86_64-latest+amdsev.args | 37 ++++++++++++++++
 ...-efi-sev-stateful.x86_64-latest+amdsev.xml | 43 +++++++++++++++++++
 .../firmware-auto-efi-sev-stateful.xml        | 21 +++++++++
 ...are-auto-efi-sev.x86_64-latest+amdsev.args | 37 ++++++++++++++++
 ...ware-auto-efi-sev.x86_64-latest+amdsev.xml | 43 +++++++++++++++++++
 .../qemuxmlconfdata/firmware-auto-efi-sev.xml | 20 +++++++++
 tests/qemuxmlconftest.c                       | 15 +++++++
 10 files changed, 275 insertions(+)
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-=
latest+amdsev.err
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-=
latest+amdsev.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x8=
6_64-latest+amdsev.args
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x8=
6_64-latest+amdsev.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-late=
st+amdsev.args
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-late=
st+amdsev.xml
 create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-sev.xml

diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+=
amdsev.err b/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+=
amdsev.err
new file mode 100644
index 0000000000..3edb2b3451
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+amdsev.=
err
@@ -0,0 +1 @@
+operation failed: Unable to find 'efi' firmware that is compatible with th=
e current configuration
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+=
amdsev.xml b/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+=
amdsev.xml
new file mode 100644
index 0000000000..81ac7888ea
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.x86_64-latest+amdsev.=
xml
@@ -0,0 +1,38 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <currentMemory unit=3D'KiB'>1048576</currentMemory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+    <loader format=3D'raw'/>
+    <boot dev=3D'hd'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <cpu mode=3D'custom' match=3D'exact' check=3D'none'>
+    <model fallback=3D'forbid'>qemu64</model>
+  </cpu>
+  <clock offset=3D'utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' index=3D'0' model=3D'none'/>
+    <controller type=3D'sata' index=3D'0'>
+      <address type=3D'pci' domain=3D'0x0000' bus=3D'0x00' slot=3D'0x1f' f=
unction=3D'0x2'/>
+    </controller>
+    <controller type=3D'pci' index=3D'0' model=3D'pcie-root'/>
+    <input type=3D'mouse' bus=3D'ps2'/>
+    <input type=3D'keyboard' bus=3D'ps2'/>
+    <audio id=3D'1' type=3D'none'/>
+    <watchdog model=3D'itco' action=3D'reset'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev-snp'>
+    <policy>0x00030000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.xml b/tests/qe=
muxmlconfdata/firmware-auto-efi-sev-snp.xml
new file mode 100644
index 0000000000..4bb363d07a
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-snp.xml
@@ -0,0 +1,20 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' model=3D'none'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev-snp'>
+    <policy>0x30000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86_64-la=
test+amdsev.args b/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86=
_64-latest+amdsev.args
new file mode 100644
index 0000000000..550ac52b8a
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86_64-latest+am=
dsev.args
@@ -0,0 +1,37 @@
+LC_ALL=3DC \
+PATH=3D/bin \
+HOME=3D/var/lib/libvirt/qemu/domain--1-guest \
+USER=3Dtest \
+LOGNAME=3Dtest \
+XDG_DATA_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.local/share \
+XDG_CACHE_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.cache \
+XDG_CONFIG_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.config \
+/usr/bin/qemu-system-x86_64 \
+-name guest=3Dguest,debug-threads=3Don \
+-S \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/va=
r/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
+-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd"=
,"node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unm=
ap"}' \
+-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver"=
:"raw","file":"libvirt-pflash0-storage"}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_=
VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
+-machine pc-q35-10.0,usb=3Doff,dump-guest-core=3Doff,memory-backend=3Dpc.r=
am,confidential-guest-support=3Dlsec0,pflash0=3Dlibvirt-pflash0-format,pfla=
sh1=3Dlibvirt-pflash1-storage,acpi=3Don \
+-accel kvm \
+-cpu qemu64 \
+-m size=3D1048576k \
+-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}=
' \
+-overcommit mem-lock=3Doff \
+-smp 1,sockets=3D1,cores=3D1,threads=3D1 \
+-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=3Dcharmonitor,fd=3D1729,server=3Don,wait=3Doff \
+-mon chardev=3Dcharmonitor,id=3Dmonitor,mode=3Dcontrol \
+-rtc base=3Dutc \
+-no-shutdown \
+-boot strict=3Don \
+-audiodev '{"id":"audio1","driver":"none"}' \
+-global ICH9-LPC.noreboot=3Doff \
+-watchdog-action reset \
+-object '{"qom-type":"sev-guest","id":"lsec0","cbitpos":51,"reduced-phys-b=
its":1,"policy":196608}' \
+-sandbox on,obsolete=3Ddeny,elevateprivileges=3Ddeny,spawn=3Ddeny,resource=
control=3Ddeny \
+-msg timestamp=3Don
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86_64-la=
test+amdsev.xml b/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86_=
64-latest+amdsev.xml
new file mode 100644
index 0000000000..b9a9ba8aa8
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.x86_64-latest+am=
dsev.xml
@@ -0,0 +1,43 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <currentMemory unit=3D'KiB'>1048576</currentMemory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+    <firmware>
+      <feature enabled=3D'no' name=3D'enrolled-keys'/>
+      <feature enabled=3D'no' name=3D'secure-boot'/>
+    </firmware>
+    <loader readonly=3D'yes' type=3D'pflash' stateless=3D'no' format=3D'ra=
w'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
+    <nvram template=3D'/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat=
=3D'raw' format=3D'raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
+    <boot dev=3D'hd'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <cpu mode=3D'custom' match=3D'exact' check=3D'none'>
+    <model fallback=3D'forbid'>qemu64</model>
+  </cpu>
+  <clock offset=3D'utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' index=3D'0' model=3D'none'/>
+    <controller type=3D'sata' index=3D'0'>
+      <address type=3D'pci' domain=3D'0x0000' bus=3D'0x00' slot=3D'0x1f' f=
unction=3D'0x2'/>
+    </controller>
+    <controller type=3D'pci' index=3D'0' model=3D'pcie-root'/>
+    <input type=3D'mouse' bus=3D'ps2'/>
+    <input type=3D'keyboard' bus=3D'ps2'/>
+    <audio id=3D'1' type=3D'none'/>
+    <watchdog model=3D'itco' action=3D'reset'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev'>
+    <policy>0x30000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.xml b/tes=
ts/qemuxmlconfdata/firmware-auto-efi-sev-stateful.xml
new file mode 100644
index 0000000000..d6195f60e2
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev-stateful.xml
@@ -0,0 +1,21 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+    <loader stateless=3D'no'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' model=3D'none'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev'>
+    <policy>0x30000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amds=
ev.args b/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amdsev.=
args
new file mode 100644
index 0000000000..550ac52b8a
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amdsev.args
@@ -0,0 +1,37 @@
+LC_ALL=3DC \
+PATH=3D/bin \
+HOME=3D/var/lib/libvirt/qemu/domain--1-guest \
+USER=3Dtest \
+LOGNAME=3Dtest \
+XDG_DATA_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.local/share \
+XDG_CACHE_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.cache \
+XDG_CONFIG_HOME=3D/var/lib/libvirt/qemu/domain--1-guest/.config \
+/usr/bin/qemu-system-x86_64 \
+-name guest=3Dguest,debug-threads=3Don \
+-S \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/va=
r/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
+-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd"=
,"node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unm=
ap"}' \
+-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver"=
:"raw","file":"libvirt-pflash0-storage"}' \
+-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_=
VARS.fd","node-name":"libvirt-pflash1-storage","read-only":false}' \
+-machine pc-q35-10.0,usb=3Doff,dump-guest-core=3Doff,memory-backend=3Dpc.r=
am,confidential-guest-support=3Dlsec0,pflash0=3Dlibvirt-pflash0-format,pfla=
sh1=3Dlibvirt-pflash1-storage,acpi=3Don \
+-accel kvm \
+-cpu qemu64 \
+-m size=3D1048576k \
+-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}=
' \
+-overcommit mem-lock=3Doff \
+-smp 1,sockets=3D1,cores=3D1,threads=3D1 \
+-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=3Dcharmonitor,fd=3D1729,server=3Don,wait=3Doff \
+-mon chardev=3Dcharmonitor,id=3Dmonitor,mode=3Dcontrol \
+-rtc base=3Dutc \
+-no-shutdown \
+-boot strict=3Don \
+-audiodev '{"id":"audio1","driver":"none"}' \
+-global ICH9-LPC.noreboot=3Doff \
+-watchdog-action reset \
+-object '{"qom-type":"sev-guest","id":"lsec0","cbitpos":51,"reduced-phys-b=
its":1,"policy":196608}' \
+-sandbox on,obsolete=3Ddeny,elevateprivileges=3Ddeny,spawn=3Ddeny,resource=
control=3Ddeny \
+-msg timestamp=3Don
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amds=
ev.xml b/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amdsev.x=
ml
new file mode 100644
index 0000000000..cbfdcdeee3
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev.x86_64-latest+amdsev.xml
@@ -0,0 +1,43 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <currentMemory unit=3D'KiB'>1048576</currentMemory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+    <firmware>
+      <feature enabled=3D'no' name=3D'enrolled-keys'/>
+      <feature enabled=3D'no' name=3D'secure-boot'/>
+    </firmware>
+    <loader readonly=3D'yes' type=3D'pflash' format=3D'raw'>/usr/share/edk=
2/ovmf/OVMF_CODE.fd</loader>
+    <nvram template=3D'/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat=
=3D'raw' format=3D'raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
+    <boot dev=3D'hd'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <cpu mode=3D'custom' match=3D'exact' check=3D'none'>
+    <model fallback=3D'forbid'>qemu64</model>
+  </cpu>
+  <clock offset=3D'utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' index=3D'0' model=3D'none'/>
+    <controller type=3D'sata' index=3D'0'>
+      <address type=3D'pci' domain=3D'0x0000' bus=3D'0x00' slot=3D'0x1f' f=
unction=3D'0x2'/>
+    </controller>
+    <controller type=3D'pci' index=3D'0' model=3D'pcie-root'/>
+    <input type=3D'mouse' bus=3D'ps2'/>
+    <input type=3D'keyboard' bus=3D'ps2'/>
+    <audio id=3D'1' type=3D'none'/>
+    <watchdog model=3D'itco' action=3D'reset'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev'>
+    <policy>0x30000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-sev.xml b/tests/qemuxm=
lconfdata/firmware-auto-efi-sev.xml
new file mode 100644
index 0000000000..69e0c2bd51
--- /dev/null
+++ b/tests/qemuxmlconfdata/firmware-auto-efi-sev.xml
@@ -0,0 +1,20 @@
+<domain type=3D'kvm'>
+  <name>guest</name>
+  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
+  <memory unit=3D'KiB'>1048576</memory>
+  <vcpu placement=3D'static'>1</vcpu>
+  <os firmware=3D'efi'>
+    <type arch=3D'x86_64' machine=3D'pc-q35-10.0'>hvm</type>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type=3D'usb' model=3D'none'/>
+    <memballoon model=3D'none'/>
+  </devices>
+  <launchSecurity type=3D'sev'>
+    <policy>0x30000</policy>
+  </launchSecurity>
+</domain>
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index 171a6f1c78..4d1d3e5f60 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -1477,6 +1477,21 @@ mymain(void)
     DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE("firmware-auto-efi-format-loader-r=
aw", "aarch64");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch");
=20
+    DO_TEST_CAPS_ARCH_LATEST_FULL("firmware-auto-efi-sev", "x86_64",
+                                  ARG_CAPS_VARIANT, "+amdsev",
+                                  ARG_END);
+    DO_TEST_CAPS_ARCH_LATEST_FULL("firmware-auto-efi-sev-snp", "x86_64",
+                                  ARG_FLAGS, FLAG_EXPECT_FAILURE,
+                                  ARG_CAPS_VARIANT, "+amdsev",
+                                  ARG_END);
+
+    /* Use of stateful firmware for SEV is uncommon, since it
+     * conflicts with boot measurements, but it's still possible for
+     * the user to explicitly request it */
+    DO_TEST_CAPS_ARCH_LATEST_FULL("firmware-auto-efi-sev-stateful", "x86_6=
4",
+                                  ARG_CAPS_VARIANT, "+amdsev",
+                                  ARG_END);
+
     DO_TEST_CAPS_LATEST("clock-utc");
     DO_TEST_CAPS_LATEST("clock-localtime");
     DO_TEST_CAPS_LATEST("clock-localtime-basis-localtime");
--=20
2.51.0