Skip to content

Commit

Permalink
Refactor Secure Boot Support and Firmware Handling
Browse files Browse the repository at this point in the history
- Renamed firmware-related attributes to align with VMware conventions.
- Added the `loader` attribute to determine if SB is enabled.
  • Loading branch information
nofaralfasi committed Nov 7, 2024
1 parent e491682 commit a561fed
Show file tree
Hide file tree
Showing 3 changed files with 47 additions and 21 deletions.
18 changes: 12 additions & 6 deletions lib/fog/libvirt/models/compute/server.rb
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ class Server < Fog::Compute::Server

attribute :cpus
attribute :cputime
attribute :os_firmware
attribute :os_firmware_features
attribute :firmware
attribute :firmware_features
attribute :secure_boot
attribute :loader_attributes
attribute :os_type
attribute :memory_size
attribute :max_memory_size
Expand Down Expand Up @@ -291,8 +293,7 @@ def to_xml
xml.vcpu(cpus)
os_tags = {}

# Set firmware only if it's EFI, BIOS don't need to be set
os_tags[:firmware] = "efi" if os_firmware == "efi"
os_tags[:firmware] = firmware if firmware == 'efi'

xml.os(**os_tags) do
type = xml.type(os_type, :arch => arch)
Expand All @@ -302,9 +303,13 @@ def to_xml
xml.boot(:dev => dev)
end

if os_firmware == "efi"
loader_attributes&.each do |key, value|
xml.loader(key => value)
end

if firmware == "efi" && firmware_features&.any?
xml.firmware do
os_firmware_features.each_pair do |key, value|
firmware_features.each_pair do |key, value|
xml.feature(:name => key, :enabled => value)
end
end
Expand Down Expand Up @@ -555,6 +560,7 @@ def defaults
:guest_agent => true,
:video => {:type => "cirrus", :vram => 9216, :heads => 1},
:virtio_rng => {},
:firmware_features => { "secure-boot" => "no" },
}
end

Expand Down
22 changes: 21 additions & 1 deletion lib/fog/libvirt/requests/compute/list_domains.rb
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,24 @@ def boot_order xml
xml_elements(xml, "domain/os/boot", "dev")
end

def firmware(xml)
firmware_from_loader = xml_elements(xml, "domain/os/loader", "type").first

case firmware_from_loader
when 'pflash'
'efi'
when 'rom'
'bios'
else
xml_elements(xml, "domain/os", "firmware").first || 'bios'
end
end

# we rely on the fact that the secure attribute is only present when secure boot is enabled
def secure_boot_enabled?(xml)
xml_elements(xml, "domain/os/loader", "secure").first == 'yes'
end

def domain_interfaces xml
ifs = xml_elements(xml, "domain/devices/interface")
ifs.map { |i|
Expand Down Expand Up @@ -78,7 +96,9 @@ def domain_to_attributes(dom)
:boot_order => boot_order(dom.xml_desc),
:nics => domain_interfaces(dom.xml_desc),
:volumes_path => domain_volumes(dom.xml_desc),
:state => states[dom.info.state]
:state => states[dom.info.state],
:firmware => firmware(dom.xml_desc),
:secure_boot => secure_boot_enabled?(dom.xml_desc),
}
rescue ::Libvirt::RetrieveError, ::Libvirt::Error
# Catch libvirt exceptions to avoid race conditions involving
Expand Down
28 changes: 14 additions & 14 deletions tests/libvirt/models/compute/server_tests.rb
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,10 @@
attributes = [ :id,
:cpus,
:cputime,
:os_firmware,
:os_firmware_features,
:firmware,
:firmware_features,
:secure_boot,
:loader_attributes,
:os_type,
:memory_size,
:max_memory_size,
Expand Down Expand Up @@ -92,31 +94,28 @@
test("with efi firmware") do
server = Fog::Libvirt::Compute::Server.new(
{
:os_firmware => "efi",
:os_firmware_features => {
"secure-boot" => "no",
"enrolled-keys" => "no"
},
:firmware => "efi",
:nics => [],
:volumes => []
}
)
xml = server.to_xml

os_firmware = xml.include?('<os firmware="efi">')
secure_boot = !xml.include?('<feature name="secure-boot" enabled="no" />')
enrolled_keys = !xml.include?('<feature name="enrolled-keys" enabled="no" />')
secure_boot = xml.include?('<feature name="secure-boot" enabled="no"/>')
loader_attributes = !xml.include?('<loader secure="yes"/>')

os_firmware && secure_boot && enrolled_keys
os_firmware && secure_boot && loader_attributes
end
test("with secure boot") do
test("with secure boot enabled") do
server = Fog::Libvirt::Compute::Server.new(
{
:os_firmware => "efi",
:os_firmware_features => {
:firmware => "efi",
:firmware_features => {
"secure-boot" => "yes",
"enrolled-keys" => "yes"
},
:loader_attributes => { "secure" => "yes" },
:nics => [],
:volumes => []
}
Expand All @@ -126,8 +125,9 @@
os_firmware = xml.include?('<os firmware="efi">')
secure_boot = xml.include?('<feature name="secure-boot" enabled="yes"/>')
enrolled_keys = xml.include?('<feature name="enrolled-keys" enabled="yes"/>')
loader_attributes = xml.include?('<loader secure="yes"/>')

os_firmware && secure_boot && enrolled_keys
os_firmware && secure_boot && enrolled_keys && loader_attributes
end
end
end

0 comments on commit a561fed

Please sign in to comment.