Re: [PATCH 2/2] docs/interop/firmware: Introduce extended syntax for FirmwareMappingMemory

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Jan 06, 2026 at 12:28:38PM +0100, Gerd Hoffmann wrote:
>   Hi,
> 
> > > Maybe have separate json files describing the variable store template
> > > only, and expect libvirt searching for one in case the firmware
> > > descriptor has the 'host-uefi-vars' feature flag set?
> > 
> > Or just have the host-uefi-vars feature flag alone, and then libvirt
> > can just invoke virt-firmware in whatever way it needs to create the
> > json templates and not worry about providing any pre-defined json
> > files.  All the default microsoft CAs are ultimately embedded in
> > virt-firmware and spat out when given the right args.
> 
> Makes sense too, given that the long-term plan is to do that anyway to
> allow distro-specific varstore setups.  So doing that right from the
> start, only without the certificate configuration part which comes
> later, looks like good approach too.
> 
> BTW: virt-firmware-rs.rpm has a utility (virt-fw-vars-setup) which can
> do exactly that without pulling in python as dependency.
> 
> Question is how we enable/disable secure boot then ... 
> 
> One option would be to special-case the enrolled-keys feature for the
> host-uefi-vars.  A little bit hackish, but with the advantage that the
> switch would be transparent for libvirt users, existing xml syntax
> continues to work.

Currently the libvirt XML features are matched to firmware descriptor
features, but that's just an internal implementation detail for libvirt.
We can have our impl match XML features to virt-fw-var-setup flags
instead where appropriate for the firmware.

> 
> Another option would be to add xml syntax for varstore setup, which will
> be needed anyway in the future for the custom certificate setup.
> 
> take care,
>   Gerd
> 

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|