[pve-devel] [PATCH qemu-server 2/2] fix #6985: ovmf: auto-enroll Microsoft UEFI CA 2023 for Windows

[Fiona Ebner]

Am 14.11.25 um 2:18 AM schrieb Thomas Lamprecht:
> Am 11.11.25 um 14:57 schrieb Fiona Ebner:
> needs a rebase (or I fumbled something).

Probably because of the sev->cvm rename as part of the TDX series. Will do!

>> @@ -235,4 +265,33 @@ sub print_ovmf_commandline {
>>      return ($cmd, $machine_flags);
>>  }
>>  
>> +sub ensure_ms_2023_cert_enrolled {
>> +    my ($storecfg, $vmid, $efidisk_str) = @_;
>> +
>> +    my $efidisk = parse_drive('efidisk0', $efidisk_str);
>> +    return if !$efidisk->{'pre-enrolled-keys'};
>> +    return if $efidisk->{'ms-cert'} && $efidisk->{'ms-cert'} eq '2023';
>> +
>> +    print "efidisk0: enrolling Microsoft UEFI CA 2023\n";
>> +
>> +    my $new_qsd = !PVE::QemuServer::Helpers::qsd_running_locally($vmid);
>> +    PVE::QemuServer::QSD::start($vmid) if $new_qsd;
>> +
>> +    eval {
>> +        my $efi_vars_path =
>> +            PVE::QemuServer::QSD::add_fuse_export($vmid, $efidisk, 'efidisk0-enroll');
>> +        PVE::Tools::run_command(
>> +            ['virt-fw-vars', '--inplace', $efi_vars_path, '--distro-keys', 'ms-uefi']);
>> +        PVE::QemuServer::QSD::remove_fuse_export($vmid, 'efidisk0-enroll');
>> +    };
>> +    my $err = $@;
>> +
>> +    PVE::QemuServer::QSD::quit($vmid) if $new_qsd;
> 
> if other request start using this QSD after it was started here they might get
> interrupted? Albeit currently this is probably rather theoretically due to QSD
> being per-vmid and we the operations QSD is used as of now are not really being
> able to run concurently for a single VM FWICT.
> 
> Might be still good to at least add a comment for this for the case that QSD gets
> adopted more.

Yes, we will need to be careful down the line. A clean option is using
different QSD IDs for different tasks (the ID for a QSD can be any
string and does not need to be a VMID). Currently, we only use QSD for
EFI enrollment here and for TPM which are both part of the same start
task. I will add a comment to note this and that
ensure_ms_2023_cert_enrolled() may currently only be called as part of
VM start.