[virt-tools-list] [virt-manager PATCH 0/3] add support for UEFI secure boot features

Discussion:

Pavel Hrdina

2017-05-31 15:36:02 UTC

Pavel Hrdina (3):
virt-install: add support for SMM feature
virt-install: add support for loader secure attribute
virtinst: if required by UEFI enable SMM feature and set q35 machine
type

man/virt-install.pod | 11 +-
tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml | 126 +++++++++++++++++++++
.../compare/virt-install-boot-loader-secure.xml | 29 +++++
.../compare/virt-install-boot-uefi.xml | 61 ++++++++++
.../compare/virt-install-features-smm.xml | 29 +++++
tests/clitest.py | 21 ++++
tests/utils.py | 2 +
virt-install | 10 ++
virtManager/domain.py | 1 +
virtinst/cli.py | 17 +++
virtinst/domainfeatures.py | 2 +
virtinst/guest.py | 23 ++++
virtinst/osxml.py | 1 +
virtinst/support.py | 2 +
14 files changed, 333 insertions(+), 2 deletions(-)
create mode 100644 tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-uefi.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-features-smm.xml

--
2.13.0

Pavel Hrdina

2017-05-31 15:36:03 UTC

Permalink

Signed-off-by: Pavel Hrdina <***@redhat.com>
---
man/virt-install.pod | 6 +++++
.../compare/virt-install-features-smm.xml | 29 ++++++++++++++++++++++
tests/clitest.py | 9 +++++++
virt-install | 10 ++++++++
virtinst/cli.py | 8 ++++++
virtinst/domainfeatures.py | 2 ++
virtinst/support.py | 1 +
7 files changed, 65 insertions(+)
create mode 100644 tests/cli-test-xml/compare/virt-install-features-smm.xml

diff --git a/man/virt-install.pod b/man/virt-install.pod
index 7bc528ed..fa88fbda 100644
--- a/man/virt-install.pod
+++ b/man/virt-install.pod
@@ -280,6 +280,12 @@ Notify the guest that the host supports paravirtual spinlocks for example by exp
This is relevant only for ARM architectures. Possible values are "host" or
version number.

+=item B<--features smm=on>
+
+This enables System Management Mode of hypervisor. Some UEFI firmwares may
+require this feature to be present. (QEMU supports SMM only with q35 machine
+type.)
+
=back

Use --features=? to see a list of all available sub options. Complete details at L<http://libvirt.org/formatdomain.html#elementsFeatures>
diff --git a/tests/cli-test-xml/compare/virt-install-features-smm.xml b/tests/cli-test-xml/compare/virt-install-features-smm.xml
new file mode 100644
index 00000000..2f78ad88
--- /dev/null
+++ b/tests/cli-test-xml/compare/virt-install-features-smm.xml
@@ -0,0 +1,29 @@
+<domain type="test">
+ <name>foobar</name>
+ <uuid>00000000-1111-2222-3333-444444444444</uuid>
+ <memory>65536</memory>
+ <currentMemory>65536</currentMemory>
+ <vcpu>1</vcpu>
+ <os>
+ <type arch="i686" machine="q35">hvm</type>
+ <boot dev="hd"/>
+ </os>
+ <features>
+ <pae/>
+ <smm state="on"/>
+ </features>
+ <clock offset="utc"/>
+ <pm>
+ <suspend-to-mem enabled="no"/>
+ <suspend-to-disk enabled="no"/>
+ </pm>
+ <devices>
+ <emulator>/usr/bin/test-hv</emulator>
+ <controller type="usb" index="0" model="none"/>
+ <interface type="user">
+ <mac address="00:11:22:33:44:55"/>
+ </interface>
+ <input type="mouse" bus="ps2"/>
+ <console type="pty"/>
+ </devices>
+</domain>
diff --git a/tests/clitest.py b/tests/clitest.py
index e329e670..04438ea3 100644
--- a/tests/clitest.py
+++ b/tests/clitest.py
@@ -552,6 +552,15 @@ c.add_compare(""" \
""", "spice-gl", compare_check=support.SUPPORT_CONN_VMPORT)

+############################
+# Features install options #
+############################
+
+c = vinst.add_category("features", "--nographics --noautoconsole --import --disk none --controller usb,model=none")
+c.add_compare("--features smm=on", "features-smm")
+c.add_invalid("--features smm=on --machine pc")
+
+
######################################
# Memory hot(un)plug install options #
######################################
diff --git a/virt-install b/virt-install
index 0e490446..4b0eec7c 100755
--- a/virt-install
+++ b/virt-install
@@ -634,6 +634,16 @@ def build_guest_instance(conn, options):
logging.warning("Couldn't configure UEFI: %s", e)
logging.warning("Your aarch64 VM may not boot successfully.")

+ # Check usability of SMM feature
+ if guest.features.smm:
+ if not guest.os.is_x86():
+ fail(_("SMM feature is valid only for x86 architecture."))
+
+ if guest.os.machine is None:
+ guest.os.machine = "q35"
+ elif not guest.os.is_q35():
+ fail(_("SMM feature is valid only for q35 machine type"))
+
# Various little validations about option collisions. Need to do
# this after setting guest.installer at least
check_option_collisions(options, guest)
diff --git a/virtinst/cli.py b/virtinst/cli.py
index 52f91063..57e6404d 100644
--- a/virtinst/cli.py
+++ b/virtinst/cli.py
@@ -1680,6 +1680,12 @@ class ParserFeatures(VirtCLIParser):
cli_arg_name = "features"
objclass = DomainFeatures

+ def set_smm_cb(self, inst, val, virtarg):
+ if not inst.conn.check_support(inst.conn.SUPPORT_DOMAIN_FEATURE_SMM):
+ raise RuntimeError("smm is not supported by libvirt")
+ inst.smm = val
+ return val
+
_register_virt_parser(ParserFeatures)
ParserFeatures.add_arg("acpi", "acpi", is_onoff=True)
ParserFeatures.add_arg("apic", "apic", is_onoff=True)
@@ -1704,6 +1710,8 @@ ParserFeatures.add_arg("pvspinlock", "pvspinlock", is_onoff=True)

ParserFeatures.add_arg("gic_version", "gic_version")

+ParserFeatures.add_arg("smm", "smm", is_onoff=True, cb=ParserFeatures.set_smm_cb)
+

###################
# --clock parsing #
diff --git a/virtinst/domainfeatures.py b/virtinst/domainfeatures.py
index 270f63a5..e4f3165b 100644
--- a/virtinst/domainfeatures.py
+++ b/virtinst/domainfeatures.py
@@ -54,3 +54,5 @@ class DomainFeatures(XMLBuilder):
default_name="default", default_cb=lambda s: False)
kvm_hidden = XMLProperty("./kvm/hidden/@state", is_onoff=True)
pvspinlock = XMLProperty("./pvspinlock/@state", is_onoff=True)
+
+ smm = XMLProperty("./smm/@state", is_onoff=True)
diff --git a/virtinst/support.py b/virtinst/support.py
index 1899125f..9d81a03f 100644
--- a/virtinst/support.py
+++ b/virtinst/support.py
@@ -361,6 +361,7 @@ SUPPORT_DOMAIN_MEMORY_STATS = _make(
SUPPORT_DOMAIN_STATE = _make(function="virDomain.state", run_args=())
SUPPORT_DOMAIN_OPEN_GRAPHICS = _make(function="virDomain.openGraphicsFD",
version="1.2.8", hv_version={"qemu": 0})
+SUPPORT_DOMAIN_FEATURE_SMM = _make(version="2.1.0")

###############

--
2.13.0

Pavel Hrdina

2017-05-31 15:36:04 UTC

Permalink

Signed-off-by: Pavel Hrdina <***@redhat.com>
---
man/virt-install.pod | 5 ++--
.../compare/virt-install-boot-loader-secure.xml | 29 ++++++++++++++++++++++
tests/clitest.py | 8 ++++++
virtinst/cli.py | 9 +++++++
virtinst/osxml.py | 1 +
virtinst/support.py | 1 +
6 files changed, 51 insertions(+), 2 deletions(-)
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml

diff --git a/man/virt-install.pod b/man/virt-install.pod
index fa88fbda..73990f2b 100644
--- a/man/virt-install.pod
+++ b/man/virt-install.pod
@@ -519,13 +519,14 @@ correct UEFI parameters, libvirt needs to be advertising known UEFI binaries
via domcapabilities XML, so this will likely only work if using properly
configured distro packages.

-=item B<--boot loader=/.../OVMF_CODE.fd,loader_ro=yes,loader_type=pflash,nvram_template=/.../OVMF_VARS.fd>
+=item B<--boot loader=/.../OVMF_CODE.fd,loader_ro=yes,loader_type=pflash,nvram_template=/.../OVMF_VARS.fd,loader_secure=no>

Specify that the virtual machine use the custom OVMF binary as boot firmware,
mapped as a virtual flash chip. In addition, request that libvirt instantiate
the VM-specific UEFI varstore from the custom "/.../OVMF_VARS.fd" varstore
template. This is the recommended UEFI setup, and should be used if
---boot uefi doesn't know about your UEFI binaries.
+--boot uefi doesn't know about your UEFI binaries. If your UEFI firmware
+supports Secure boot feature you can enable it via loader_secure.

=back

diff --git a/tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml b/tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml
new file mode 100644
index 00000000..67053c19
--- /dev/null
+++ b/tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml
@@ -0,0 +1,29 @@
+<domain type="test">
+ <name>foobar</name>
+ <uuid>00000000-1111-2222-3333-444444444444</uuid>
+ <memory>65536</memory>
+ <currentMemory>65536</currentMemory>
+ <vcpu>1</vcpu>
+ <os>
+ <type arch="i686">hvm</type>
+ <loader secure="yes">/path/to/loader</loader>
+ <boot dev="hd"/>
+ </os>
+ <features>
+ <pae/>
+ </features>
+ <clock offset="utc"/>
+ <pm>
+ <suspend-to-mem enabled="no"/>
+ <suspend-to-disk enabled="no"/>
+ </pm>
+ <devices>
+ <emulator>/usr/bin/test-hv</emulator>
+ <controller type="usb" index="0" model="none"/>
+ <interface type="user">
+ <mac address="00:11:22:33:44:55"/>
+ </interface>
+ <input type="mouse" bus="ps2"/>
+ <console type="pty"/>
+ </devices>
+</domain>
diff --git a/tests/clitest.py b/tests/clitest.py
index 04438ea3..ae330538 100644
--- a/tests/clitest.py
+++ b/tests/clitest.py
@@ -561,6 +561,14 @@ c.add_compare("--features smm=on", "features-smm")
c.add_invalid("--features smm=on --machine pc")

+########################
+# Boot install options #
+########################
+
+c = vinst.add_category("boot", "--nographics --noautoconsole --import --disk none --controller usb,model=none")
+c.add_compare("--boot loader=/path/to/loader,loader_secure=yes", "boot-loader-secure")
+
+
######################################
# Memory hot(un)plug install options #
######################################
diff --git a/virtinst/cli.py b/virtinst/cli.py
index 57e6404d..6faef2b0 100644
--- a/virtinst/cli.py
+++ b/virtinst/cli.py
@@ -1587,6 +1587,13 @@ class ParserBoot(VirtCLIParser):
inst.os.smbios_mode = val
self.optdict["smbios_mode"] = val

+ def set_loader_secure_cb(self, inst, val, virtarg):
+ if not inst.conn.check_support(inst.conn.SUPPORT_DOMAIN_LOADER_SECURE):
+ raise RuntimeError("secure attribute for loader is not supported "
+ "by libvirt.")
+ inst.os.loader_secure = val
+ return val
+
def noset_cb(self, inst, val, virtarg):
pass

@@ -1623,6 +1630,8 @@ ParserBoot.add_arg("os.dtb", "dtb")
ParserBoot.add_arg("os.loader", "loader")
ParserBoot.add_arg("os.loader_ro", "loader_ro", is_onoff=True)
ParserBoot.add_arg("os.loader_type", "loader_type")
+ParserBoot.add_arg("os.loader_secure", "loader_secure", is_onoff=True,
+ cb=ParserBoot.set_loader_secure_cb)
ParserBoot.add_arg("os.nvram", "nvram")
ParserBoot.add_arg("os.nvram_template", "nvram_template")
ParserBoot.add_arg("os.kernel_args", "kernel_args",
diff --git a/virtinst/osxml.py b/virtinst/osxml.py
index 54e118b4..368ef57a 100644
--- a/virtinst/osxml.py
+++ b/virtinst/osxml.py
@@ -116,6 +116,7 @@ class OSXML(XMLBuilder):
loader = XMLProperty("./loader")
loader_ro = XMLProperty("./loader/@readonly", is_yesno=True)
loader_type = XMLProperty("./loader/@type")
+ loader_secure = XMLProperty("./loader/@secure", is_yesno=True)
smbios_mode = XMLProperty("./smbios/@mode")
nvram = XMLProperty("./nvram")
nvram_template = XMLProperty("./nvram/@template")
diff --git a/virtinst/support.py b/virtinst/support.py
index 9d81a03f..958080be 100644
--- a/virtinst/support.py
+++ b/virtinst/support.py
@@ -362,6 +362,7 @@ SUPPORT_DOMAIN_STATE = _make(function="virDomain.state", run_args=())
SUPPORT_DOMAIN_OPEN_GRAPHICS = _make(function="virDomain.openGraphicsFD",
version="1.2.8", hv_version={"qemu": 0})
SUPPORT_DOMAIN_FEATURE_SMM = _make(version="2.1.0")
+SUPPORT_DOMAIN_LOADER_SECURE = _make(version="2.1.0")

###############

--
2.13.0

Pavel Hrdina

2017-05-31 15:36:05 UTC

Permalink

If we detect that the UEFI image is build to require SMM feature we
should configure the guest to enable SMM feature and set q35 machine
type. Without this user wouldn't be able to boot the guest.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1387479

Signed-off-by: Pavel Hrdina <***@redhat.com>
---
tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml | 126 +++++++++++++++++++++
.../compare/virt-install-boot-uefi.xml | 61 ++++++++++
tests/clitest.py | 4 +
tests/utils.py | 2 +
virtManager/domain.py | 1 +
virtinst/guest.py | 23 ++++
6 files changed, 217 insertions(+)
create mode 100644 tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-uefi.xml

diff --git a/tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml b/tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml
new file mode 100644
index 00000000..780ada61
--- /dev/null
+++ b/tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml
@@ -0,0 +1,126 @@
+<domainCapabilities>
+ <path>/home/phrdina/work/qemu/x86_64-softmmu/qemu-system-x86_64</path>
+ <domain>kvm</domain>
+ <machine>pc-q35-2.9</machine>
+ <arch>x86_64</arch>
+ <vcpu max='288'/>
+ <os supported='yes'>
+ <loader supported='yes'>
+ <value>/usr/share/ovmf/OVMF_CODE.secboot.fd</value>
+ <enum name='type'>
+ <value>rom</value>
+ <value>pflash</value>
+ </enum>
+ <enum name='readonly'>
+ <value>yes</value>
+ <value>no</value>
+ </enum>
+ </loader>
+ </os>
+ <cpu>
+ <mode name='host-passthrough' supported='yes'/>
+ <mode name='host-model' supported='yes'>
+ <model fallback='forbid'>Skylake-Client</model>
+ <vendor>Intel</vendor>
+ <feature policy='require' name='ss'/>
+ <feature policy='require' name='vmx'/>
+ <feature policy='require' name='hypervisor'/>
+ <feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='clflushopt'/>
+ <feature policy='require' name='xsaves'/>
+ <feature policy='require' name='pdpe1gb'/>
+ <feature policy='require' name='invtsc'/>
+ </mode>
+ <mode name='custom' supported='yes'>
+ <model usable='yes'>qemu64</model>
+ <model usable='yes'>qemu32</model>
+ <model usable='no'>phenom</model>
+ <model usable='yes'>pentium3</model>
+ <model usable='yes'>pentium2</model>
+ <model usable='yes'>pentium</model>
+ <model usable='yes'>n270</model>
+ <model usable='yes'>kvm64</model>
+ <model usable='yes'>kvm32</model>
+ <model usable='yes'>coreduo</model>
+ <model usable='yes'>core2duo</model>
+ <model usable='no'>athlon</model>
+ <model usable='yes'>Westmere</model>
+ <model usable='yes'>Skylake-Client</model>
+ <model usable='yes'>SandyBridge</model>
+ <model usable='yes'>Penryn</model>
+ <model usable='no'>Opteron_G5</model>
+ <model usable='no'>Opteron_G4</model>
+ <model usable='no'>Opteron_G3</model>
+ <model usable='yes'>Opteron_G2</model>
+ <model usable='yes'>Opteron_G1</model>
+ <model usable='yes'>Nehalem</model>
+ <model usable='yes'>IvyBridge</model>
+ <model usable='yes'>Haswell</model>
+ <model usable='yes'>Haswell-noTSX</model>
+ <model usable='yes'>Conroe</model>
+ <model usable='yes'>Broadwell</model>
+ <model usable='yes'>Broadwell-noTSX</model>
+ <model usable='yes'>486</model>
+ </mode>
+ </cpu>
+ <devices>
+ <disk supported='yes'>
+ <enum name='diskDevice'>
+ <value>disk</value>
+ <value>cdrom</value>
+ <value>floppy</value>
+ <value>lun</value>
+ </enum>
+ <enum name='bus'>
+ <value>fdc</value>
+ <value>scsi</value>
+ <value>virtio</value>
+ <value>usb</value>
+ <value>sata</value>
+ </enum>
+ </disk>
+ <graphics supported='yes'>
+ <enum name='type'>
+ <value>sdl</value>
+ <value>vnc</value>
+ <value>spice</value>
+ </enum>
+ </graphics>
+ <video supported='yes'>
+ <enum name='modelType'>
+ <value>vga</value>
+ <value>cirrus</value>
+ <value>vmvga</value>
+ <value>qxl</value>
+ <value>virtio</value>
+ </enum>
+ </video>
+ <hostdev supported='yes'>
+ <enum name='mode'>
+ <value>subsystem</value>
+ </enum>
+ <enum name='startupPolicy'>
+ <value>default</value>
+ <value>mandatory</value>
+ <value>requisite</value>
+ <value>optional</value>
+ </enum>
+ <enum name='subsysType'>
+ <value>usb</value>
+ <value>pci</value>
+ <value>scsi</value>
+ </enum>
+ <enum name='capsType'/>
+ <enum name='pciBackend'>
+ <value>default</value>
+ <value>kvm</value>
+ <value>vfio</value>
+ </enum>
+ </hostdev>
+ </devices>
+ <features>
+ <gic supported='no'/>
+ </features>
+</domainCapabilities>
+
+
diff --git a/tests/cli-test-xml/compare/virt-install-boot-uefi.xml b/tests/cli-test-xml/compare/virt-install-boot-uefi.xml
new file mode 100644
index 00000000..e0f2089f
--- /dev/null
+++ b/tests/cli-test-xml/compare/virt-install-boot-uefi.xml
@@ -0,0 +1,61 @@
+<domain type="kvm">
+ <name>foobar</name>
+ <uuid>00000000-1111-2222-3333-444444444444</uuid>
+ <memory>65536</memory>
+ <currentMemory>65536</currentMemory>
+ <vcpu>1</vcpu>
+ <os>
+ <type arch="x86_64" machine="q35">hvm</type>
+ <loader readonly="yes" type="pflash">/usr/share/ovmf/OVMF_CODE.secboot.fd</loader>
+ <boot dev="hd"/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <smm state="on"/>
+ <vmport state="off"/>
+ </features>
+ <cpu mode="custom" match="exact">
+ <model>Opteron_G4</model>
+ </cpu>
+ <clock offset="utc">
+ <timer name="rtc" tickpolicy="catchup"/>
+ <timer name="pit" tickpolicy="delay"/>
+ <timer name="hpet" present="no"/>
+ </clock>
+ <pm>
+ <suspend-to-mem enabled="no"/>
+ <suspend-to-disk enabled="no"/>
+ </pm>
+ <devices>
+ <emulator>/usr/bin/qemu-kvm</emulator>
+ <controller type="usb" index="0" model="ich9-ehci1"/>
+ <controller type="usb" index="0" model="ich9-uhci1">
+ <master startport="0"/>
+ </controller>
+ <controller type="usb" index="0" model="ich9-uhci2">
+ <master startport="2"/>
+ </controller>
+ <controller type="usb" index="0" model="ich9-uhci3">
+ <master startport="4"/>
+ </controller>
+ <interface type="bridge">
+ <source bridge="eth0"/>
+ <mac address="00:11:22:33:44:55"/>
+ </interface>
+ <input type="mouse" bus="ps2"/>
+ <graphics type="spice" port="-1" tlsPort="-1" autoport="yes">
+ <image compression="off"/>
+ </graphics>
+ <console type="pty"/>
+ <channel type="spicevmc">
+ <target type="virtio" name="com.redhat.spice.0"/>
+ </channel>
+ <sound model="ich6"/>
+ <video>
+ <model type="qxl"/>
+ </video>
+ <redirdev bus="usb" type="spicevmc"/>
+ <redirdev bus="usb" type="spicevmc"/>
+ </devices>
+</domain>
diff --git a/tests/clitest.py b/tests/clitest.py
index ae330538..08d32c68 100644
--- a/tests/clitest.py
+++ b/tests/clitest.py
@@ -71,6 +71,7 @@ test_files = {
'URI-TEST-DEFAULT': utils.uri_test_default,
'URI-TEST-REMOTE': utils.uri_test_remote,
'URI-KVM': utils.uri_kvm,
+ 'URI-KVM-Q35': utils.uri_kvm_q35,
'URI-KVM-SESSION': utils.uri_kvm_session,
'URI-KVM-REMOTE': utils.uri_kvm + ",remote",
'URI-KVM-NODOMCAPS': utils.uri_kvm_nodomcaps,
@@ -782,6 +783,9 @@ c.add_invalid("--disk none --boot network --machine foobar") # Unknown machine
c.add_invalid("--nodisks --boot network --arch mips --virt-type kvm") # Invalid domain type for arch
c.add_invalid("--nodisks --boot network --paravirt --arch mips") # Invalid arch/virt combo

+c = vinst.add_category("kvm-q35", "--connect %(URI-KVM-Q35)s --noautoconsole", compare_check=support.SUPPORT_CONN_VMPORT)
+c.add_compare("--boot uefi --disk none", "boot-uefi")
+

######################
# LXC specific tests #
diff --git a/tests/utils.py b/tests/utils.py
index 0b8fc365..9947f3b0 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -37,10 +37,12 @@ uri_test_remote = uri_test + ",remote"

_uri_qemu = "%s,qemu" % uri_test
_uri_kvm_domcaps = (_uri_qemu + _domcapsprefix + "kvm-x86_64-domcaps.xml")
+_uri_kvm_domcaps_q35 = (_uri_qemu + _domcapsprefix + "kvm-x86_64-domcaps-q35.xml")
_uri_kvm_aarch64_domcaps = (_uri_qemu + _domcapsprefix + "kvm-aarch64-domcaps.xml")
uri_kvm_nodomcaps = (_uri_qemu + _capsprefix + "kvm-x86_64.xml")
uri_kvm_rhel = (_uri_kvm_domcaps + _capsprefix + "kvm-x86_64-rhel7.xml")
uri_kvm = (_uri_kvm_domcaps + _capsprefix + "kvm-x86_64.xml")
+uri_kvm_q35 = (_uri_kvm_domcaps_q35 + _capsprefix + "kvm-x86_64.xml")
uri_kvm_session = uri_kvm + ",session"

uri_kvm_armv7l = (_uri_kvm_domcaps + _capsprefix + "kvm-armv7l.xml")
diff --git a/virtManager/domain.py b/virtManager/domain.py
index 6b94455d..6fb10266 100644
--- a/virtManager/domain.py
+++ b/virtManager/domain.py
@@ -698,6 +698,7 @@ class vmmDomain(vmmLibvirtObject):
guest.os.loader = loader
guest.os.loader_type = "pflash"
guest.os.loader_ro = True
+ guest.check_uefi_smm()

if nvram != _SENTINEL:
guest.os.nvram = nvram
diff --git a/virtinst/guest.py b/virtinst/guest.py
index aa956449..d6dd5aa6 100644
--- a/virtinst/guest.py
+++ b/virtinst/guest.py
@@ -561,6 +561,29 @@ class Guest(XMLBuilder):
self.os.loader_type = "pflash"
self.os.loader = path

+ self.check_uefi_smm()
+
+
+ def check_uefi_smm(self):
+ """
+ If the firmware name contains "secboot" it is probably build
+ with SMM feature required so we need to enable that feature,
+ otherwise the firmware may fail to load. True secure boot is
+ currently supported only on x86 architecture and with q35 with
+ SMM feature enabled so change the machine to q35 as well.
+ """
+
+ if not self.os.is_x86():
+ return
+
+ if "secboot" not in self.os.loader:
+ return
+
+ if not self.conn.check_support(self.conn.SUPPORT_DOMAIN_FEATURE_SMM):
+ return
+
+ self.features.smm = True
+ self.os.machine = "q35"

###################
# Device defaults #

--
2.13.0

Cole Robinson

2017-05-31 17:36:53 UTC

Permalink

Post by Pavel Hrdina
virt-install: add support for SMM feature
virt-install: add support for loader secure attribute
virtinst: if required by UEFI enable SMM feature and set q35 machine
type
man/virt-install.pod | 11 +-
tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml | 126 +++++++++++++++++++++
.../compare/virt-install-boot-loader-secure.xml | 29 +++++
.../compare/virt-install-boot-uefi.xml | 61 ++++++++++
.../compare/virt-install-features-smm.xml | 29 +++++
tests/clitest.py | 21 ++++
tests/utils.py | 2 +
virt-install | 10 ++
virtManager/domain.py | 1 +
virtinst/cli.py | 17 +++
virtinst/domainfeatures.py | 2 +
virtinst/guest.py | 23 ++++
virtinst/osxml.py | 1 +
virtinst/support.py | 2 +
14 files changed, 333 insertions(+), 2 deletions(-)
create mode 100644 tests/capabilities-xml/kvm-x86_64-domcaps-q35.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-loader-secure.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-boot-uefi.xml
create mode 100644 tests/cli-test-xml/compare/virt-install-features-smm.xml

Nice patches, ACK

- Cole

Pavel Hrdina

2017-06-01 08:07:27 UTC

Permalink

Post by Cole Robinson

Nice patches, ACK

Thanks, pushed.

Pavel