Re: [libvirt] On the content of 'nvram' section in /etc/libvirt/qemu.conf
On 4/16/19 12:50 PM, Kashyap Chamarthy wrote:
I learnt from Dan Berrangé that the 'nvram' section in
`/etc/libvirt/qemu.conf` will now go away in light of all the work done
in QEMU ('firmware.json', et al) and libvirt (the firmware
auto-selection).
But for my own education, can anyone confirm that the current content of
'nvram' is out of date in terms of mapping of OVMF binaries to their
corresponding variable store ("VARS") files?
Let's see what I mean.
On my Fedora 29 box, in `/etc/libvirt/qemu.conf`, I see the following
mapping of OVMF binaries to their correspoindg "VARS" file under the
'nvram' section:
#nvram = [
# "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd",
# "/usr/share/OVMF/OVMF_CODE.secboot.fd:/usr/share/OVMF/OVMF_VARS.fd",
# "/usr/share/AAVMF/AAVMF_CODE.fd:/usr/share/AAVMF/AAVMF_VARS.fd",
# "/usr/share/AAVMF/AAVMF32_CODE.fd:/usr/share/AAVMF/AAVMF32_VARS.fd"
#]
Now let's enumerate the content of 'edk2-ovmf' package:
$> rpm -ql edk2-ovmf
/usr/share/OVMF
/usr/share/OVMF/OVMF_CODE.fd
/usr/share/OVMF/OVMF_CODE.secboot.fd
/usr/share/OVMF/OVMF_VARS.fd
/usr/share/OVMF/OVMF_VARS.secboot.fd
/usr/share/OVMF/UefiShell.iso
/usr/share/doc/edk2-ovmf
/usr/share/doc/edk2-ovmf/README
/usr/share/doc/edk2-ovmf/ovmf-whitepaper-c770f8c.txt
/usr/share/edk2
/usr/share/edk2/ovmf
/usr/share/edk2/ovmf/EnrollDefaultKeys.efi
/usr/share/edk2/ovmf/OVMF_CODE.fd
/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd
/usr/share/edk2/ovmf/OVMF_VARS.fd
/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd
/usr/share/edk2/ovmf/Shell.efi
/usr/share/edk2/ovmf/UefiShell.iso
/usr/share/licenses/edk2-ovmf
/usr/share/licenses/edk2-ovmf/LICENSE.openssl
/usr/share/licenses/edk2-ovmf/License.txt
There is the /usr/share/edk2/ovmf/OVMF_VARS.secboot.fd file (which comes
with the default UEFI keys enrolled).
So, the mapping of OVMF binary to VARS file in the earlier mentioned
'nvram' section should have been:
/usr/share/OVMF/OVMF_CODE.secboot.fd:/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd
Yes?
Unfortunately the qemu.conf comment is not authoritatize. I believe
that's the default value hardcoded in libvirt, but it can also be
changed with a build time flag, which we do for fedora. The spec file
has this change:
%if 0%{?fedora}
# Nightly edk2.git-ovmf-x64
LOADERS="/usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd:/usr/share/edk2.git/ovmf-x64/OVMF_VARS-pure-efi.fd"
# Nightly edk2.git-ovmf-ia32
LOADERS="$LOADERS:/usr/share/edk2.git/ovmf-ia32/OVMF_CODE-pure-efi.fd:/usr/share/edk2.git/ovmf-ia32/OVMF_VARS-pure-efi.fd"
# Nightly edk2.git-aarch64
LOADERS="$LOADERS:/usr/share/edk2.git/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2.git/aarch64/vars-template-pflash.raw"
# Nightly edk2.git-arm
LOADERS="$LOADERS:/usr/share/edk2.git/arm/QEMU_EFI-pflash.raw:/usr/share/edk2.git/arm/vars-template-pflash.raw"
# Fedora edk2-ovmf
LOADERS="$LOADERS:/usr/share/edk2/ovmf/OVMF_CODE.fd:/usr/share/edk2/ovmf/OVMF_VARS.fd"
# Fedora edk2-ovmf-ia32
LOADERS="$LOADERS:/usr/share/edk2/ovmf-ia32/OVMF_CODE.fd:/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd"
# Fedora edk2-aarch64
LOADERS="$LOADERS:/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw"
# Fedora edk2-arm
LOADERS="$LOADERS:/usr/share/edk2/arm/QEMU_EFI-pflash.raw:/usr/share/edk2/arm/vars-template-pflash.raw"
%define arg_loader_nvram --with-loader-nvram="$LOADERS"
%endif
So that's 8 pairs that we look for in fedora. That default commented out
value is probably what we use on RHEL with standard RHEL packaging
- Cole