Add QemuFirmwareVariables=

This allows configuring the path to the qemu firmware variables to
use. This allows users to configure their own variables using
https://pypi.org/project/virt-firmware/ before passing it to mkosi.

This also fixes a bug where we didn't pass the variables file to
qemu if the firmware doesn't support secure boot.

diff --git a/mkosi/config.py b/mkosi/config.py
index 3882028b3cb65b5b6a9926c47380dc5f4369ff0c..015c3203ae91275ee03de9f8f0ceda4f67a2ebbd 100644 (file)
--- a/mkosi/config.py
+++ b/mkosi/config.py
@@ -1003,6 +1003,7 @@ class MkosiConfig:
     qemu_swtpm: ConfigFeature
     qemu_cdrom: bool
     qemu_firmware: QemuFirmware
+    qemu_firmware_variables: Optional[Path]
     qemu_kernel: Optional[Path]
     qemu_drives: list[QemuDrive]
     qemu_args: list[str]
@@ -2036,6 +2037,13 @@ SETTINGS = (
         help="Set qemu firmware to use",
         choices=QemuFirmware.values(),
     ),
+    MkosiConfigSetting(
+        dest="qemu_firmware_variables",
+        metavar="PATH",
+        section="Host",
+        parse=config_make_path_parser(),
+        help="Set the path to the qemu firmware variables file to use",
+    ),
     MkosiConfigSetting(
         dest="qemu_kernel",
         metavar="PATH",
@@ -3103,6 +3111,7 @@ def summary(config: MkosiConfig) -> str:
                 QEMU Use Swtpm: {config.qemu_swtpm}
                QEMU Use CD-ROM: {yes_no(config.qemu_cdrom)}
                  QEMU Firmware: {config.qemu_firmware}
+       QEMU Firmware Variables: {none_to_none(config.qemu_firmware_variables)}
           QEMU Extra Arguments: {line_join_list(config.qemu_args)}
 """
 

diff --git a/mkosi/qemu.py b/mkosi/qemu.py
index 53d2f42185b247eddb16382b0e350b08ad443b68..d95140ed79bd999967f24e728f3197efe20fb228 100644 (file)
--- a/mkosi/qemu.py
+++ b/mkosi/qemu.py
@@ -598,16 +598,17 @@ def run_qemu(args: MkosiArgs, config: MkosiConfig, qemu_device_fds: Mapping[Qemu
     notifications: dict[str, str] = {}
 
     with contextlib.ExitStack() as stack:
-        if firmware == QemuFirmware.uefi and ovmf_supports_sb:
+        if firmware == QemuFirmware.uefi:
             ovmf_vars = stack.enter_context(tempfile.NamedTemporaryFile(prefix="mkosi-ovmf-vars"))
-            shutil.copy2(find_ovmf_vars(config), Path(ovmf_vars.name))
+            shutil.copy2(config.qemu_firmware_variables or find_ovmf_vars(config), Path(ovmf_vars.name))
             # Make sure qemu can access the ephemeral vars.
             os.chown(ovmf_vars.name, INVOKING_USER.uid, INVOKING_USER.gid)
-            cmdline += [
-                "-global", "ICH9-LPC.disable_s3=1",
-                "-global", "driver=cfi.pflash01,property=secure,value=on",
-                "-drive", f"file={ovmf_vars.name},if=pflash,format=raw",
-            ]
+            cmdline += ["-drive", f"file={ovmf_vars.name},if=pflash,format=raw"]
+            if ovmf_supports_sb:
+                cmdline += [
+                    "-global", "ICH9-LPC.disable_s3=1",
+                    "-global", "driver=cfi.pflash01,property=secure,value=on",
+                ]
 
         if config.qemu_cdrom and config.output_format in (OutputFormat.disk, OutputFormat.esp):
             # CD-ROM devices have sector size 2048 so we transform disk images into ones with sector size 2048.

diff --git a/mkosi/resources/mkosi.md b/mkosi/resources/mkosi.md
index 6ae670dbc0f0c3679187e0bb049a24d6d7fc2689..bb70e18da8ea14329a61d4f9c23ac5a2e1137261 100644 (file)
--- a/mkosi/resources/mkosi.md
+++ b/mkosi/resources/mkosi.md
@@ -1295,13 +1295,25 @@ boolean argument: either `1`, `yes`, or `true` to enable, or `0`, `no`,
 
 `QemuFirmware=`, `--qemu-firmware=`
 
-: When used with the `qemu` verb, this option which firmware to use.
-  Takes one of `uefi`, `bios`, `linux`, or `auto`. Defaults to `auto`.
-  When set to `uefi`, the OVMF firmware is used. When set to `bios`, the
-  default SeaBIOS firmware is used. When set to `linux`, direct kernel
-  boot is used. See the `QemuKernel=` option for more details on which
-  kernel image is used with direct kernel boot. When set to `auto`,
-  `linux` is used if a cpio image is being booted, `uefi` otherwise.
+: When used with the `qemu` verb, this option specifies which firmware
+  to use. Takes one of `uefi`, `bios`, `linux`, or `auto`. Defaults to
+  `auto`. When set to `uefi`, the OVMF firmware is used. When set to
+  `bios`, the default SeaBIOS firmware is used. When set to `linux`,
+  direct kernel boot is used. See the `QemuKernel=` option for more
+  details on which kernel image is used with direct kernel boot. When
+  set to `auto`, `linux` is used if a cpio image is being booted, `uefi`
+  otherwise.
+
+`QemuFirmwareVariables=`, `--qemu-firmware-variables=`
+
+: When used with the `qemu` verb, this option specifies the path to the
+  the firmware variables file to use. Currently, this option is only
+  taken into account when the `uefi` firmware is used. If not specified,
+  mkosi will search for the default variables file and use that instead.
+
+: `virt-fw-vars` from the
+  [virt-firmware](https://gitlab.com/kraxel/virt-firmware) project can
+  be used to customize OVMF variable files.
 
 `QemuKernel=`, `--qemu-kernel=`
 

diff --git a/tests/test_json.py b/tests/test_json.py
index a759b31ad87ae4a1990619118a6656d38e60dba6..64736e1885fef13e072750d763e3a1c8bf04b6d8 100644 (file)
--- a/tests/test_json.py
+++ b/tests/test_json.py
@@ -208,6 +208,7 @@ def test_config() -> None:
                 }
             ],
             "QemuFirmware": "linux",
+            "QemuFirmwareVariables": "/foo/bar",
             "QemuGui": true,
             "QemuKernel": null,
             "QemuKvm": "auto",
@@ -348,6 +349,7 @@ def test_config() -> None:
         qemu_cdrom = False,
         qemu_drives = [QemuDrive("abc", 200, Path("/foo/bar"), "abc,qed"), QemuDrive("abc", 200, None, "")],
         qemu_firmware = QemuFirmware.linux,
+        qemu_firmware_variables = Path("/foo/bar"),
         qemu_gui = True,
         qemu_kernel = None,
         qemu_kvm = ConfigFeature.auto,