Dear Maintainer,

Currently, Linux kernel in the autopkgtest-virt-qemu runs in
unsecure (unlocked) mode. If it is booted in UEFI secure boot,
the kernel is locked down. It should help exposing unnoticed bugs
in the UEFI secure boot.

To enable secure boot of a QEMU guest, e.g. for i386, one has to

1. Install grub-efi-ia32 grub-efi-ia32-signed and shim-signed to the testbed.
2. Use OVMF_CODE_4M.ms.fd and OVMF_VARS_4M.ms.fd as UEFI (OVMF) ROM.
3. Start qemu-system-i386 with
   -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on

With the above procedure, the kernel in QEMU guest is locked down
(I verified it with dmesg).

Best regards, Ryutaroh Matsumoto

With secure boot capable OVMF installed,
I verified that the attached modification to autopkgtest-virt-qemu
starts Linux kernel in a testbed in the locked down mode.

Specifically,
autopkgtest -B -u debci bash -- qemu /var/lib/debci/qemu/sid-amd64.img --secure-boot --debug --show-boot shows

[    0.000000] Kernel is locked down from EFI Secure Boot; see https://wiki.debian.org/SecureBoot
[    0.000000] secureboot: Secure boot enabled

Ryutaroh

None of those filenames are available in Debian's ovmf package
at the moment. I've adapted it to what's available in Debian at
<https://salsa.debian.org/ci-team/autopkgtest/-/merge_requests/94>:

* OVMF_CODE_4M.secboot.fd and OVMF_VARS_4M.fd for x86_64
* nothing available for i386 yet (blocked by #973571)

Thanks,
    smcv