On 2/18/26 13:05, Andrea Bolognani via Devel wrote: > This series makes it possible to use Secure Boot with aarch64 VMs. > > https://issues.redhat.com/browse/RHEL-82645 > > Note that, while I consider the entire series to be ready for review, > there is one patch that is marked as DONOTMERGE: that's because it > imports into the tree firmware descriptor that are not yet part of > the Fedora edk2 package. > > Changes from [v2]: > > * changes to the schema for JSON firmware descriptors have been > queued for merge in QEMU, so the corresponding patch is no longer > marked as DONOTMERGE; > > * improve documentation; > > * rebase on top of master, addressing conflicts that I have caused > with some recent changes related to this work. > > Changes from [v1]: > > * rewrite based on review feedback: the <nvram> element is no > longer used, and a dedicated <varstore> element is introduced > instead; > > * additional test coverage, as well as fixes and improvements > related to firmware selection and its documentation, are present > as well. > > [v2] > https://lists.libvirt.org/archives/list/[email protected]/thread/WVWT3BX3J5HM4FKRG3IW7HAW6JMU2VOH/ > [v1] > https://lists.libvirt.org/archives/list/[email protected]/thread/TGLFMPRXCATRPA6MPHH5KYXY5XCTSRDT/ > > Andrea Bolognani (38): > qemu_firmware: Only set format for custom loader if path is present > conf: Move type=rom default for loader to drivers > qemu_firmware: Improve matching when loader.type is absent > tests: Rename custom JSON firmware descriptors > tests: Update JSON firmware descriptor for BIOS > schema: Add varstore element > conf: Parse and format varstore element > conf: Update validation to consider varstore element > qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS > qemu: Validate presence of uefi-vars device > tests: Add firmware-manual-efi-varstore-q35 > tests: Add firmware-manual-efi-varstore-aarch64 > tests: Add firmware-auto-efi-varstore-q35 > tests: Add firmware-auto-efi-varstore-aarch64 > tests: Add firmware-auto-efi-enrolled-keys-aarch64 > qemu_firmware: Parse host-uefi-vars firmware feature > qemu_firmware: Split sanity check > qemu_firmware: Consider host-uefi-vars feature in sanity check > qemu_firmware: Support extended syntax for ROM firmware descriptors > qemu_firmware: Report NVRAM template path for ROMs > schema: Add varstore element for domcaps > conf: Include varstore element in domcaps > qemu: Fill in varstore element in domcaps > qemu_firmware: Use of NVRAM implies stateful firmware > qemu_firmware: Allow matching stateful ROMs > qemu_firmware: Fill in varstore information > qemu: Introduce varstoreDir > qemu_firmware: Generate varstore path when necessary > DONOTMERGE: tests: Add firmware descriptors for uefi-vars builds > qemu_command: Use uefi-vars device where appropriate > qemu: Introduce qemuPrepareNVRAMFileCommon() > qemu: Create and delete varstore file > security: Mark ROMs as read only when using AppArmor > security: Handle varstore file > include: Mention varstore where applicable > virsh: Update for varstore handling > docs: Update for varstore and improve > news: Document support for uefi-vars device and firmwares
> 179 files changed, 1314 insertions(+), 380 deletions(-) Reviewed-by: Michal Privoznik <[email protected]> Michal
