From nobody Fri Jan 9 08:48:45 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1766968416; cv=none; d=zohomail.com; s=zohoarc; b=X1a0uFzDvREo49niizncvpgHDyUFhWjvQsL6pYbv59+qZLJYrFzwmhY/xscCgPw/uD7CddFOs4cAJjpEgUR8DtNevE6leulMhYnsZy2u8uSHwl0emXpUK6QVi+Is95Q0+CrUAteKbfR+B8zFGfZtsEN3ghWGdlPGlzstbvOjK4s= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766968416; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc; bh=70xxvB7TdSZrQEt6K7qRWtEMvLGfn509RAKBmc/qt+E=; b=lUFMBt/yJA9lx1wsEbAEnSKIlSCfb5n4ymMD9jWN0s9xZWM68EWNI06k+ERX223dzdExZ+J2OuoL5oDVxOI3P6C+Pfb/imfxt5M8N3muxZbKvSrc0aplk2z+fZ6OMaXAHziy2r9uBZq7LdIkTjbmXFjw15hTrGXVvFWi0eYoSAw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1766968416169580.5231563968241; Sun, 28 Dec 2025 16:33:36 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id EED433FA58; Sun, 28 Dec 2025 19:33:17 -0500 (EST) Received: from [172.19.199.83] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 838CC43E74; Sun, 28 Dec 2025 19:24:29 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 79F8B417EB; Sun, 28 Dec 2025 18:35:01 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6F80D417F0 for ; Sun, 28 Dec 2025 18:35:00 -0500 (EST) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-167-0hk0KwYQOD6EsHomapvCPw-1; Sun, 28 Dec 2025 18:34:58 -0500 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B4A98180028B for ; Sun, 28 Dec 2025 23:34:57 +0000 (UTC) Received: from harajuku.usersys.redhat.com.homenet.telecomitalia.it (unknown [10.45.224.19]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 01A2030001B9 for ; Sun, 28 Dec 2025 23:34:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1766964900; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=70xxvB7TdSZrQEt6K7qRWtEMvLGfn509RAKBmc/qt+E=; b=Oefd02v5LlEJOHzNLFrYq/N2Vk3L+64f5tKmt3jP2G/mUHFRrdxAH8Oee0Hdw81FP6WaGS duJF3x3PR3WcKuh/mr0fSY54NcqtHFsfrcrzRG1h7A/kUqEADISYcEgoH5RD40Ql2GxBUj ycGG8Fm5wqOFzqSz+ATMcBe0urAO+yo= X-MC-Unique: 0hk0KwYQOD6EsHomapvCPw-1 X-Mimecast-MFC-AGG-ID: 0hk0KwYQOD6EsHomapvCPw_1766964897 To: devel@lists.libvirt.org Subject: [PATCH 35/36] qemu_firmware: Allow matching both UEFI and BIOS for ROM loader Date: Mon, 29 Dec 2025 00:34:11 +0100 Message-ID: <20251228233412.1709869-36-abologna@redhat.com> In-Reply-To: <20251228233412.1709869-1-abologna@redhat.com> References: <20251228233412.1709869-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: Owg8Ot91MnG6OQg0dTTiL-fF1ldH6U1VA5WBdwCarJA_1766964897 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 46SASCLQRJMHUCMPSMFPF23YSAKOC4M3 X-Message-ID-Hash: 46SASCLQRJMHUCMPSMFPF23YSAKOC4M3 X-MailFrom: abologna@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Andrea Bolognani via Devel Reply-To: Andrea Bolognani X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1766968416593158500 Content-Type: text/plain; charset="utf-8"; x-default="true" Currently we apply a 1:1 mapping between loader type and firmware type: ROM can only match BIOS and pflash can only match UEFI. That was accurate at the time when the check was introduced, but is no longer the case today: the Intel TDX build of edk2, for example, is loaded as a ROM but it still provides an UEFI implementation to the guest. Tweak the matching logic so that a ROM loader is allowed to match both BIOS and UEFI firmware descriptors. The firmware-manual-efi-tdx test case benefits from this change, as all the missing information is now correctly filled in. This will also solve an issue reported to the list, where firmware builds targeting the confidential VM use case on aarch64 would not be usable at all, due to the way UEFI and ACPI are depending on each other on the architecture. Signed-off-by: Andrea Bolognani --- src/qemu/qemu_firmware.c | 43 +++++++++++-------- ...-manual-efi-tdx.x86_64-latest+inteltdx.xml | 6 ++- 2 files changed, 30 insertions(+), 19 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 7953b297bc..52205b72f8 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -937,23 +937,6 @@ qemuFirmwareOSInterfaceTypeToOsDefFirmware(qemuFirmwar= eOSInterface interface) } =20 =20 -static qemuFirmwareOSInterface -qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type) -{ - switch (type) { - case VIR_DOMAIN_LOADER_TYPE_ROM: - return QEMU_FIRMWARE_OS_INTERFACE_BIOS; - case VIR_DOMAIN_LOADER_TYPE_PFLASH: - return QEMU_FIRMWARE_OS_INTERFACE_UEFI; - case VIR_DOMAIN_LOADER_TYPE_NONE: - case VIR_DOMAIN_LOADER_TYPE_LAST: - break; - } - - return QEMU_FIRMWARE_OS_INTERFACE_NONE; -} - - /** * qemuFirmwareEnsureNVRAM: * @def: domain definition @@ -1100,6 +1083,8 @@ qemuFirmwareMatchDomain(const virDomainDef *def, const virDomainLoaderDef *loader =3D def->os.loader; size_t i; qemuFirmwareOSInterface want; + bool wantUEFI =3D false; + bool wantBIOS =3D false; bool supportsS3 =3D false; bool supportsS4 =3D false; bool requiresSMM =3D false; @@ -1115,12 +1100,34 @@ qemuFirmwareMatchDomain(const virDomainDef *def, want =3D qemuFirmwareOSInterfaceTypeFromOsDefFirmware(def->os.firmware= ); =20 if (want =3D=3D QEMU_FIRMWARE_OS_INTERFACE_NONE && loader) { - want =3D qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(loader->ty= pe); + /* If an explicit request for a specific type of firmware is + * not present, we can still infer this information from + * other factors. Specifically, the pflash loader type is + * only used for UEFI, while the rom loader type can be used + * both for UEFI and BIOS */ + switch (loader->type) { + case VIR_DOMAIN_LOADER_TYPE_PFLASH: + wantUEFI =3D true; + break; + case VIR_DOMAIN_LOADER_TYPE_ROM: + wantUEFI =3D true; + wantBIOS =3D true; + break; + case VIR_DOMAIN_LOADER_TYPE_NONE: + case VIR_DOMAIN_LOADER_TYPE_LAST: + default: + break; + } } =20 for (i =3D 0; i < fw->ninterfaces; i++) { if (fw->interfaces[i] =3D=3D want) break; + + if ((fw->interfaces[i] =3D=3D QEMU_FIRMWARE_OS_INTERFACE_UEFI && w= antUEFI) || + (fw->interfaces[i] =3D=3D QEMU_FIRMWARE_OS_INTERFACE_BIOS && w= antBIOS)) { + break; + } } =20 if (i =3D=3D fw->ninterfaces) { diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+in= teltdx.xml b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+in= teltdx.xml index cdb92dcf1d..5b87857425 100644 --- a/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.= xml +++ b/tests/qemuxmlconfdata/firmware-manual-efi-tdx.x86_64-latest+inteltdx.= xml @@ -4,8 +4,12 @@ 1048576 1048576 1 - + hvm + + + + /usr/share/edk2/o= vmf/OVMF.inteltdx.secboot.fd --=20 2.52.0