SMM is not enabled when TPM is enabled in VMware source client

Related to: harvester/harvester#7984

Signed-off-by: Volker Theile <[email protected]>

Author: votdev

pkg/source/openstack/client.go

@@ -27,6 +27,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/pointer"
 	kubevirt "kubevirt.io/api/core/v1"
 
 	migration "github.com/harvester/vm-import-controller/pkg/apis/migration.harvesterhci.io/v1beta1"
@@ -409,8 +410,6 @@ func (c *Client) IsPoweredOff(vm *migration.VirtualMachineImport) (bool, error)
 }
 
 func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*kubevirt.VirtualMachine, error) {
-	var boolFalse = false
-	var boolTrue = true
 	vmObj, err := c.findVM(vm.Spec.VirtualMachineName)
 	if err != nil {
 		return nil, fmt.Errorf("error finding VM in GenerateVirtualMachine: %v", err)
@@ -471,7 +470,7 @@ func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*ku
 					},
 					Features: &kubevirt.Features{
 						ACPI: kubevirt.FeatureState{
-							Enabled: &boolTrue,
+							Enabled: pointer.Bool(true),
 						},
 					},
 				},
@@ -524,20 +523,20 @@ func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*ku
 		firmware := &kubevirt.Firmware{
 			Bootloader: &kubevirt.Bootloader{
 				EFI: &kubevirt.EFI{
-					SecureBoot: &boolFalse,
+					SecureBoot: pointer.Bool(false),
 				},
 			},
 		}
 		if secureboot {
-			firmware.Bootloader.EFI.SecureBoot = &boolTrue
+			firmware.Bootloader.EFI.SecureBoot = pointer.Bool(true)
 			vmSpec.Template.Spec.Domain.Features.SMM = &kubevirt.FeatureState{
-				Enabled: &boolTrue,
+				Enabled: pointer.Bool(true),
 			}
 		}
 		vmSpec.Template.Spec.Domain.Firmware = firmware
 		if tpm {
 			vmSpec.Template.Spec.Domain.Features.SMM = &kubevirt.FeatureState{
-				Enabled: &boolTrue,
+				Enabled: pointer.Bool(true),
 			}
 			vmSpec.Template.Spec.Domain.Devices.TPM = &kubevirt.TPMDevice{}
 		}

pkg/source/vmware/client.go

@@ -21,6 +21,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/pointer"
 	kubevirt "kubevirt.io/api/core/v1"
 
 	migration "github.com/harvester/vm-import-controller/pkg/apis/migration.harvesterhci.io/v1beta1"
@@ -293,9 +294,6 @@ func (c *Client) IsPoweredOff(vm *migration.VirtualMachineImport) (bool, error)
 }
 
 func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*kubevirt.VirtualMachine, error) {
-	var boolFalse = false
-	var boolTrue = true
-
 	vmObj, err := c.findVM(vm.Spec.Folder, vm.Spec.VirtualMachineName)
 	if err != nil {
 		return nil, fmt.Errorf("error quering vm in GenerateVirtualMachine: %v", err)
@@ -344,7 +342,7 @@ func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*ku
 					},
 					Features: &kubevirt.Features{
 						ACPI: kubevirt.FeatureState{
-							Enabled: &boolTrue,
+							Enabled: pointer.Bool(true),
 						},
 					},
 				},
@@ -394,27 +392,29 @@ func (c *Client) GenerateVirtualMachine(vm *migration.VirtualMachineImport) (*ku
 	}
 
 	// setup bios/efi, secureboot and tpm settings
-
 	if o.Config.Firmware == "efi" {
 		firmware := &kubevirt.Firmware{
 			Bootloader: &kubevirt.Bootloader{
 				EFI: &kubevirt.EFI{
-					SecureBoot: &boolFalse,
+					SecureBoot: pointer.Bool(false),
 				},
 			},
 		}
-		if *o.Config.BootOptions.EfiSecureBootEnabled {
-			firmware.Bootloader.EFI.SecureBoot = &boolTrue
+		if pointer.BoolDeref(o.Config.BootOptions.EfiSecureBootEnabled, false) {
+			firmware.Bootloader.EFI.SecureBoot = pointer.Bool(true)
 			vmSpec.Template.Spec.Domain.Features.SMM = &kubevirt.FeatureState{
-				Enabled: &boolTrue,
+				Enabled: pointer.Bool(true),
 			}
 		}
 		vmSpec.Template.Spec.Domain.Firmware = firmware
-		if *o.Summary.Config.TpmPresent {
-
+		if pointer.BoolDeref(o.Summary.Config.TpmPresent, false) {
+			vmSpec.Template.Spec.Domain.Features.SMM = &kubevirt.FeatureState{
+				Enabled: pointer.Bool(true),
+			}
 			vmSpec.Template.Spec.Domain.Devices.TPM = &kubevirt.TPMDevice{}
 		}
 	}
+
 	vmSpec.Template.Spec.Networks = networkConfig
 	vmSpec.Template.Spec.Domain.Devices.Interfaces = interfaces
 	newVM.Spec = vmSpec

pkg/source/vmware/client_test.go

@@ -10,9 +10,12 @@ import (
 
 	"github.com/ory/dockertest/v3"
 	"github.com/stretchr/testify/require"
+	"github.com/vmware/govmomi/find"
 	"github.com/vmware/govmomi/vim25/mo"
+	"github.com/vmware/govmomi/vim25/types"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/pointer"
 
 	migration "github.com/harvester/vm-import-controller/pkg/apis/migration.harvesterhci.io/v1beta1"
 	"github.com/harvester/vm-import-controller/pkg/server"
@@ -27,10 +30,11 @@ func TestMain(t *testing.M) {
 		log.Fatalf("error connecting to dockerd: %v", err)
 	}
 
+	// https://hub.docker.com/r/vmware/vcsim
 	runOpts := &dockertest.RunOptions{
 		Name:       "vcsim",
 		Repository: "vmware/vcsim",
-		Tag:        "v0.29.0",
+		Tag:        "v0.49.0",
 	}
 
 	vcsimMock, err := pool.RunWithOptions(runOpts)
@@ -202,7 +206,7 @@ func Test_ExportVirtualMachine(t *testing.T) {
 	}
 
 	err = c.ExportVirtualMachine(vm)
-	assert.NoError(err, "expected no error during vm export")
+	assert.NoError(err, "expected no error during VM export")
 	t.Log(vm.Status)
 }
 
@@ -247,14 +251,91 @@ func Test_GenerateVirtualMachine(t *testing.T) {
 	}
 
 	newVM, err := c.GenerateVirtualMachine(vm)
-	assert.NoError(err, "expected no error during vm export")
+	assert.NoError(err, "expected no error during VM CR generation")
 	assert.Len(newVM.Spec.Template.Spec.Networks, 1, "should have found the default pod network")
 	assert.Len(newVM.Spec.Template.Spec.Domain.Devices.Interfaces, 1, "should have found a network map")
 	assert.Equal(newVM.Spec.Template.Spec.Domain.Memory.Guest.String(), "32M", "expected VM to have 32M memory")
 	assert.NotEmpty(newVM.Spec.Template.Spec.Domain.Resources.Limits, "expect to find resource requests to be present")
 
 }
 
+func Test_GenerateVirtualMachine_secureboot(t *testing.T) {
+	assert := require.New(t)
+	ctx := context.TODO()
+	endpoint := fmt.Sprintf("https://localhost:%s/sdk", vcsimPort)
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"username": []byte("user"),
+			"password": []byte("pass"),
+		},
+	}
+	vm := &migration.VirtualMachineImport{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "demo",
+			Namespace: "default",
+		},
+		Spec: migration.VirtualMachineImportSpec{
+			SourceCluster:      corev1.ObjectReference{},
+			VirtualMachineName: "test01",
+			Mapping: []migration.NetworkMapping{
+				{
+					SourceNetwork:      "DVSwitch: fea97929-4b2d-5972-b146-930c6d0b4014",
+					DestinationNetwork: "default/vlan",
+				},
+			},
+		},
+	}
+
+	c, err := NewClient(ctx, endpoint, "DC0", secret)
+	assert.NoError(err, "expected no error during creation of client")
+	err = c.Verify()
+	assert.NoError(err, "expected no error during verification of client")
+
+	// https://github.com/vmware/govmomi/blob/main/vcsim/README.md#default-vcenter-inventory
+	f := find.NewFinder(c.Client.Client, true)
+
+	dc, err := f.Datacenter(ctx, c.dc)
+	assert.NoError(err, "expected no error during datacenter lookup")
+
+	f.SetDatacenter(dc)
+
+	ds, err := f.DefaultDatastore(ctx)
+	assert.NoError(err, "expected no error during datastore lookup")
+
+	pool, err := f.ResourcePool(ctx, "DC0_H0/Resources")
+	assert.NoError(err, "expected no error during resource pool lookup")
+
+	folder, err := dc.Folders(ctx)
+	assert.NoError(err, "expected no error during folder lookup")
+
+	vmConfigSpec := types.VirtualMachineConfigSpec{
+		Name:     vm.Spec.VirtualMachineName,
+		GuestId:  string(types.VirtualMachineGuestOsIdentifierOtherGuest64),
+		Firmware: string(types.GuestOsDescriptorFirmwareTypeEfi),
+		BootOptions: &types.VirtualMachineBootOptions{
+			EfiSecureBootEnabled: pointer.Bool(true),
+		},
+		Files: &types.VirtualMachineFileInfo{
+			VmPathName: fmt.Sprintf("[%s] %s", ds.Name(), vm.Spec.VirtualMachineName),
+		},
+	}
+
+	task, err := folder.VmFolder.CreateVM(ctx, vmConfigSpec, pool, nil)
+	assert.NoError(err, "expected no error when creating VM")
+
+	_, err = task.WaitForResult(ctx, nil)
+	assert.NoError(err, "expected no error when waiting for task to complete: %v")
+
+	newVM, err := c.GenerateVirtualMachine(vm)
+	assert.NoError(err, "expected no error during VM CR generation")
+	assert.True(*newVM.Spec.Template.Spec.Domain.Firmware.Bootloader.EFI.SecureBoot, "expected VM to have secure boot enabled")
+	assert.True(*newVM.Spec.Template.Spec.Domain.Features.SMM.Enabled, "expected VM to have SMM enabled")
+}
+
 func Test_identifyNetworkCards(t *testing.T) {
 	ctx := context.TODO()
 	endpoint := fmt.Sprintf("https://localhost:%s/sdk", vcsimPort)
@@ -277,7 +358,7 @@ func Test_identifyNetworkCards(t *testing.T) {
 	assert.NoError(err, "expected no error during verification of client")
 
 	vmObj, err := c.findVM("", "DC0_H0_VM0")
-	assert.NoError(err, "expected no error during vm lookup")
+	assert.NoError(err, "expected no error during VM lookup")
 
 	var o mo.VirtualMachine