[PATCH 3/3] qemu: Label restore path outside of secdriver transactions