[libvirt PATCH 14/21] qemu: Don't overwrite NVRAM template for legacy firmware
Just because we have found a matching entry, it doesn't mean
that we should discard the information explicitly provided in
the domain XML.
https://bugzilla.redhat.com/show_bug.cgi?id=2196178
https://gitlab.com/libvirt/libvirt/-/issues/500
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
---
src/qemu/qemu_firmware.c | 26 +++++++++++++++++--
...efi-secboot-legacy-paths.x86_64-latest.xml | 2 +-
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
index b1d342563b..a9437b5b95 100644
--- a/src/qemu/qemu_firmware.c
+++ b/src/qemu/qemu_firmware.c
@@ -1609,8 +1609,30 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
loader->readonly = VIR_TRISTATE_BOOL_YES;
- VIR_FREE(loader->nvramTemplate);
- loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
+ /* Only use the default template path if one hasn't been
+ * provided by the user.
+ *
+ * In addition to fully-custom templates, which are a valid
+ * use case, we could simply be in a situation where
+ * qemu.conf contains
+ *
+ * nvram = [
+ * "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.fd",
+ * "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.secboot.fd"
+ * ]
+ *
+ * and the domain has been configured as
+ *
+ * <os>
+ * <loader readonly='yes'
type='pflash'>/path/to/OVMF_CODE.secboot.fd</loader>
+ * <nvram template='/path/to/OVMF/OVMF_VARS.secboot.fd'>
+ * </os>
+ *
+ * In this case, the global default is to have Secure Boot
+ * disabled, but the domain configuration explicitly enables
+ * it, and we shouldn't overrule this choice */
+ if (!loader->nvramTemplate)
+ loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
qemuFirmwareEnsureNVRAM(def, cfg, VIR_STORAGE_FILE_RAW);
diff --git
a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
index b8c2dfef66..9027123558 100644
--- a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
+++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
@@ -7,7 +7,7 @@
<os>
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
<loader readonly='yes' secure='yes'
type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
- <nvram
template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
+ <nvram
template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
<boot dev='hd'/>
</os>
<features>
--
2.41.0