From 73c5ae55c7c3a5b26cc16ad85ecd57fc1d410b33 Mon Sep 17 00:00:00 2001
From: Andrea Bolognani <abologna@redhat.com>
Date: Mon, 20 Jun 2022 17:44:31 +0200
Subject: [PATCH] conf: Reject features when using manual firmware selection

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
---
 src/conf/domain_validate.c                    |  7 +++++++
 ...ware-manual-efi-features.x86_64-latest.err |  1 +
 .../firmware-manual-efi-features.xml          | 21 +++++++++++++++++++
 tests/qemuxml2argvtest.c                      |  1 +
 4 files changed, 30 insertions(+)
 create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-features.x86_64-latest.err
 create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-features.xml

diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 355668b042..c977c39144 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -1655,6 +1655,13 @@ virDomainDefOSValidate(const virDomainDef *def,
             return -1;
         }
     } else {
+        if (def->os.firmwareFeatures) {
+            virReportError(VIR_ERR_XML_DETAIL, "%s",
+                           _("cannot use feature-based firmware autoselection "
+                             "when firmware autoselection is disabled"));
+            return -1;
+        }
+
         if (!loader)
             return 0;
 
diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-features.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-manual-efi-features.x86_64-latest.err
new file mode 100644
index 0000000000..98412de1e1
--- /dev/null
+++ b/tests/qemuxml2argvdata/firmware-manual-efi-features.x86_64-latest.err
@@ -0,0 +1 @@
+cannot use feature-based firmware autoselection when firmware autoselection is disabled
diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-features.xml b/tests/qemuxml2argvdata/firmware-manual-efi-features.xml
new file mode 100644
index 0000000000..69cc71eb2a
--- /dev/null
+++ b/tests/qemuxml2argvdata/firmware-manual-efi-features.xml
@@ -0,0 +1,21 @@
+<domain type='qemu'>
+  <name>test</name>
+  <uuid>362d1fc1-df7d-193e-5c18-49a71bd1da66</uuid>
+  <memory unit='KiB'>1048576</memory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='pc'>hvm</type>
+    <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
+    <firmware>
+      <feature enabled='no' name='enrolled-keys'/>
+    </firmware>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type='usb' model='none'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 473e00ffa7..4ca1131377 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1192,6 +1192,7 @@ mymain(void)
             QEMU_CAPS_DEVICE_ISA_SERIAL);
     DO_TEST_NOCAPS("firmware-manual-efi");
     DO_TEST_PARSE_ERROR_NOCAPS("firmware-manual-efi-no-path");
+    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-features");
     DO_TEST_CAPS_LATEST("firmware-manual-bios-rw");
     DO_TEST_CAPS_LATEST("firmware-manual-bios-rw-implicit");
     DO_TEST("firmware-manual-efi-secure",