From nobody Tue Mar 3 04:54:29 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1771872611; cv=none; d=zohomail.com; s=zohoarc; b=jQ4iJIMb/b22Uk5NlmLXwAwr1Zeks2USfkPma+E6VVVN6I4mnyo8EIrAUtb2Jtd9mW80dT7QuiB/19kw3ZKnJaHgz4j3byQx/IF4iwU8WZP5EPW9pe+ckVI6EHRgoRqxmB9IgaGIs76ozDUQGonDN/RYKDuL4yP4X+Em02mKabk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1771872611; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc; bh=69a0TVAVHcW3pvYYFr3HLNSYOQzT9hbp5inyQXrBvkQ=; b=Qy/BA1aaHBkJNHA+pTt89xBb6LHD2QfVY7J2b8dFLeUGBRKvacoS5p0NVmjiWZx6f7eBbQ7Kirl7hCaijDeBIySHRDgLoWOVxm8gI3s4wwe/SvpoZMB1FpP4AggPbv/CiyvzHRcnetZhKXP0b+YwdgAFVtyuveOlJYSHg+Pllxs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1771872611776644.82613059497; Mon, 23 Feb 2026 10:50:11 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 0136441BFA; Mon, 23 Feb 2026 13:50:12 -0500 (EST) Received: from [172.19.199.9] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 192A941B2E; Mon, 23 Feb 2026 13:35:37 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id A74B341D4C; Mon, 23 Feb 2026 13:35:27 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 2A74841AC6 for ; Mon, 23 Feb 2026 13:32:02 -0500 (EST) Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-246-rmMvdcjpNMW48rMufgZ7eg-1; Mon, 23 Feb 2026 13:31:58 -0500 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 298EE1828AA7 for ; Mon, 23 Feb 2026 18:31:54 +0000 (UTC) Received: from kinshicho.usersys.redhat.com (unknown [10.44.32.20]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 0935B1955D71 for ; Mon, 23 Feb 2026 18:31:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HELO_MISC_IP,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1771871521; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=69a0TVAVHcW3pvYYFr3HLNSYOQzT9hbp5inyQXrBvkQ=; b=aXwW5XU0YnBByJi//T9UBXZVW8+vzreAtjqEfmH0Exe39QcLfbN2LGz/60nnLvw64yiJKV ZoQdjsd+xlPRB59o087swVxIBqGxiHCRxa4J1AV7/IL/fgCLd/KqSKrITN0et7ahFgEWXT sXyjztAtHbUFE7iVFB5SfWUmeZHaLMQ= X-MC-Unique: rmMvdcjpNMW48rMufgZ7eg-1 X-Mimecast-MFC-AGG-ID: rmMvdcjpNMW48rMufgZ7eg_1771871514 To: devel@lists.libvirt.org Subject: [PATCH v4 15/36] tests: Add firmware-auto-efi-enrolled-keys-aarch64 Date: Mon, 23 Feb 2026 19:30:58 +0100 Message-ID: <20260223183119.501349-16-abologna@redhat.com> In-Reply-To: <20260223183119.501349-1-abologna@redhat.com> References: <20260223183119.501349-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 7J6LS-39nuhlcpTUzs2jqkzpvhbedkIezC-pciyLfmY_1771871514 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 6MN3ER4HHIFZIQH4BI2CEDFJWDWNIADQ X-Message-ID-Hash: 6MN3ER4HHIFZIQH4BI2CEDFJWDWNIADQ X-MailFrom: abologna@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Andrea Bolognani via Devel Reply-To: Andrea Bolognani X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1771872618074158500 This test case demonstrates how to automatically configure an aarch64 guest so that Secure Boot support is available and only signed operating systems are allowed to boot. It currently fails because there is no firmware descriptor that describes a suitable firmware build yet. That will change in a future commit. In addition to the latest version, the test case is also executed against QEMU 8.2.0 specifically. This version of the test case is intended to fail, because the uefi-vars device that we need to support Secure Boot on aarch64 was not yet available in that version of QEMU. The exact error message will change down the line. Signed-off-by: Andrea Bolognani Reviewed-by: Michal Privoznik Acked-by: Gerd Hoffmann Reviewed-by: Daniel P. Berrang=C3=A9 --- ...fi-enrolled-keys-aarch64.aarch64-8.2.0.err | 1 + ...fi-enrolled-keys-aarch64.aarch64-8.2.0.xml | 30 +++++++++++++++++++ ...i-enrolled-keys-aarch64.aarch64-latest.err | 1 + ...i-enrolled-keys-aarch64.aarch64-latest.xml | 30 +++++++++++++++++++ ...irmware-auto-efi-enrolled-keys-aarch64.xml | 20 +++++++++++++ tests/qemuxmlconftest.c | 2 ++ 6 files changed, 84 insertions(+) create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-8.2.0.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-8.2.0.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-latest.err create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.xml diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.= aarch64-8.2.0.err b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-8.2.0.err new file mode 100644 index 0000000000..3edb2b3451 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64= -8.2.0.err @@ -0,0 +1 @@ +operation failed: Unable to find 'efi' firmware that is compatible with th= e current configuration diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.= aarch64-8.2.0.xml b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-a= arch64.aarch64-8.2.0.xml new file mode 100644 index 0000000000..5213a41b90 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64= -8.2.0.xml @@ -0,0 +1,30 @@ + + guest + 63840878-0deb-4095-97e6-fc444d9bc9fa + 1048576 + 1048576 + 1 + + hvm + + + + + + + + + + + + destroy + restart + destroy + + /usr/bin/qemu-system-aarch64 + + + + diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.= aarch64-latest.err b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-= aarch64.aarch64-latest.err new file mode 100644 index 0000000000..3edb2b3451 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64= -latest.err @@ -0,0 +1 @@ +operation failed: Unable to find 'efi' firmware that is compatible with th= e current configuration diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.= aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-= aarch64.aarch64-latest.xml new file mode 100644 index 0000000000..908a8435f9 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.aarch64= -latest.xml @@ -0,0 +1,30 @@ + + guest + 63840878-0deb-4095-97e6-fc444d9bc9fa + 1048576 + 1048576 + 1 + + hvm + + + + + + + + + + + + destroy + restart + destroy + + /usr/bin/qemu-system-aarch64 + + + + diff --git a/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.= xml b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml new file mode 100644 index 0000000000..6cd382d0fa --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-efi-enrolled-keys-aarch64.xml @@ -0,0 +1,20 @@ + + guest + 63840878-0deb-4095-97e6-fc444d9bc9fa + 1048576 + 1 + + hvm + + + + + + + + + /usr/bin/qemu-system-aarch64 + + + + diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 24168b98af..ca00dc96f0 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1657,6 +1657,8 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-auto-efi-secboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-no-secboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-enrolled-keys"); + DO_TEST_CAPS_ARCH_LATEST_FAILURE("firmware-auto-efi-enrolled-keys-aarc= h64", "aarch64"); + DO_TEST_CAPS_ARCH_VER_FAILURE("firmware-auto-efi-enrolled-keys-aarch64= ", "aarch64", "8.2.0"); DO_TEST_CAPS_LATEST("firmware-auto-efi-no-enrolled-keys"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-enrolled-keys-no-se= cboot"); DO_TEST_CAPS_LATEST("firmware-auto-efi-smm-off"); --=20 2.53.0