Skip to content

Merge feature/uefi_expiry to master#7073

Merged
changlei-li merged 18 commits into
masterfrom
feature/uefi_expiry
May 18, 2026
Merged

Merge feature/uefi_expiry to master#7073
changlei-li merged 18 commits into
masterfrom
feature/uefi_expiry

Conversation

@chunjiez
Copy link
Copy Markdown
Collaborator

@chunjiez chunjiez commented May 15, 2026

This feature does,

  1. detect whether a VM, snapshot, or template still uses the Microsoft 2011 UEFI certificates
  2. expose a simple state that admins can use in XenCenter, CLI, and API to identify affected objects
  3. allow admins to mark eligible VMs so XenServer updates their certificates automatically on the next boot
  4. allow admins to unmark a pending update before the VM is rebooted
  5. support Windows and Linux UEFI VMs (irrespective if VM has he secure boot function enabled or not) that still carry the affected Microsoft 2011 certificates

Stephen Cheng and others added 18 commits April 16, 2026 10:09
CP-311907: Add VM.secureboot_certificates_state field
a68be09 
Add a new DynamicRO field to track Secure Boot certificate status per VM.
The field indicates whether UEFI Secure Boot certificates need updating.

- Define enum (ok, update_available, update_on_boot) and field in datamodel
- Check certificate state via varstore-nvram-certcheck on import and
  DB upgrade for UEFI Secure Boot VMs
- Skip control domains, default templates, and non-Secure Boot VMs
  in the DB upgrade rule

Signed-off-by: Stephen Cheng <stephen.cheng@citrix.com>
CP-311908: Add versioned VM.set_NVRAM_EFI_variables with update param…
9eb495d 
…eter

Add a new versioned parameter 'update' to VM.set_NVRAM_EFI_variables,
allowing varstored to indicate whether Secure Boot certificates were
changed during an NVRAM write. This enables xapi to maintain the
VM.secureboot_certificates_state field accurately.

The 'update' parameter is an enum with three values:
- 'yes': certificates were updated, set state to 'ok'
- 'no': certificates unchanged, keep current state as-is
- 'unspecified': (default for v1 callers) run certcheck to determine state

Signed-off-by: Stephen Cheng <stephen.cheng@citrix.com>
@chunjiez
VM.secureboot_certificates_state is lost during import
4960bc4 
Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>
Fixup: Always recompute the certificates state on import
9e0da60 
Also fix other comments during review

Signed-off-by: Stephen Cheng <stephen.cheng@citrix.com>
@stephenchengCloud
Feature UEFI expiry: Implement VM.secureboot_certificates_state track…
89ccd39 
…ing (#7015)

## Background

Microsoft Secure Boot certificates from 2011 are reaching end-of-life,
and legacy VMs may still contain only the old certificate set. This PR
implements the xapi side of the out-of-band mechanism to track and
update per-VM UEFI Secure Boot variables safely, as described in the
[design doc](#7006).

## Changes

Sorry for the large PR, but the changes form a single feature.
The two main commits are:

### 1. CP-311907: Add `VM.secureboot_certificates_state` field

Add a new `DynamicRO` field to track Secure Boot certificate status per
VM. The field indicates whether UEFI Secure Boot certificates need
updating.

- Invoke `varstore-nvram-certcheck` to determine certificate state from
the NVRAM EFI-variables blob
- On DB upgrade: compute state for existing UEFI Secure Boot VMs,
skipping control domains and default templates
- On import: compute state for VMs imported
- On clone/snapshot: copy the state to the new VM

### 2. CP-311908: Add versioned `update` parameter to
`VM.set_NVRAM_EFI_variables`

Add a versioned `update` parameter (enum: `yes`/`no`/`unspecified`) so
varstored can report whether certificates were changed during an NVRAM
write. This avoids invoking the certcheck binary on every NVRAM write.

- `update=yes`: certificates were updated → set state to `ok`
- `update=no`: certificates not changed → preserve current state
- `update=unspecified` (default for legacy v1 callers): run certcheck to
determine state
- Register `set_NVRAM_v2` RPC in xapi-guard, mapping the string
parameter to the enum


## Testing

Tested the following scenarios with the updated varstored:

- State transitions: `ok` → `update_available` → `update_on_boot` → `ok`
verified correct
- VM reboot with certificate update: varstored sends `update=yes`, state
transitions to `ok`
- VM reboot without certificate update: varstored sends `update=no`,
state is preserved
- Cross-host live migration (old host → new host, new host → new host):
`secureboot_certificates_state` is correctly preserved
@chunjiez
CP-311905: VM.update_secureboot_certificates_on_boot interface
87ca912 
Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>
@chunjiez
CP-311905: VM.update_secureboot_certificates_on_boot interface
df2db1c 
Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>
@chunjiez
CP-311905: VM.update_secureboot_certificates_on_boot idempotent
f669faa 
Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>
@chunjiez
CP-311905: fix make test failure
e0f27de 
Signed-off-by: Chunjie Zhu <chunjie.zhu@cloud.com>
@chunjiez
CP-311905: VM.update_secureboot_certificates_on_boot interface (#7020)
0fb6909 
Admin marks a VM for update: update_available -> update_on_boot

tgroup.opam update is to fix "make test" failure
Merge branch 'master' into private/stephenche/sync_uefi_expiry_with_m…
1bd9cc5 
…aster
@stephenchengCloud
Private/stephenche/sync uefi expiry with master (#7051)
181bbaf 
Sync with the latest master branch
CA-427271: update non secureboot vm certificate state
4b53b2b 
Signed-off-by: Chunjie Zhu <chunjie.zhu@citrix.com>
@robhoes
CA-427271: update non secureboot vm certificate state (#7059)
4045fbd 
According to design doc, we treat non-secure-boot VM same as secure-boot
VM, that is to say, the certificate and certificate state should be
updated for non-secure-boot VM.
Merge remote-tracking branch 'origin' into private/chunjiez/uefi_expiry
83c3fb3
@chunjiez
sync with master (#7063)
ce1ef11
update datamodel version and tgroup opam
01aeb97 
Signed-off-by: Chunjie Zhu <chunjie.zhu@citrix.com>
@chunjiez
tgroup package miss synopsis field (#7072)
d071caa
@changlei-li changlei-li added this pull request to the merge queue May 18, 2026
Merged via the queue into master with commit 7420c67 May 18, 2026
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@minglumlu minglumlu minglumlu approved these changes

@stephenchengCloud stephenchengCloud stephenchengCloud approved these changes

@changlei-li changlei-li changlei-li approved these changes

@robhoes robhoes Awaiting requested review from robhoes

@lindig lindig Awaiting requested review from lindig

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@chunjiez @minglumlu @stephenchengCloud @changlei-li @robhoes