(wip) Add boot mode support

Author: ArrayBolt3

qubes/vm/appvm.py

@@ -40,6 +40,21 @@ def template_changed_update_storage(self):
             self.storage.init_volume(volume_name, config)
 
 
+def template_changed_update_bootmode(self):
+    """Update boot mode configuration for TemplateVM changes"""
+    if self.template.features.get("boot-mode.appvm-default", None) is None:
+        self.template.features["boot-mode.appvm-default"] = "default"
+    active_boot_mode = self.template.features["boot-mode.appvm-default"]
+    try:
+        _ = self.features.check_with_template(
+            f"boot-mode.{active_boot_mode}.kernelopts"
+        )
+        self.features["boot-mode.active"] = active_boot_mode
+    except KeyError:
+        self.template.features["boot-mode.appvm-default"] = "default"
+        self.features["boot-mode.active"] = "default"
+
+
 class AppVM(
     qubes.vm.mix.dvmtemplate.DVMTemplateMixin, qubes.vm.qubesvm.QubesVM
 ):
@@ -149,8 +164,10 @@ def on_property_pre_set_template(
     @qubes.events.handler("property-set:template")
     def on_property_set_template(self, event, name, newvalue, oldvalue=None):
         """Adjust root (and possibly other snap_on_start=True) volume
-        on template change.
+        on template change. Also switch active boot mode to match that set by
+        the template.
         """  # pylint: disable=unused-argument
         template_changed_update_storage(self)
+        template_changed_update_bootmode(self)
         for vm in self.dispvms:
             vm.on_property_set_template(event, name, newvalue, oldvalue)

qubes/vm/qubesvm.py

@@ -216,6 +216,27 @@ def _setter_kbd_layout(self, prop, value):
     return value
 
 
+def _bootmode_kernelopts(self):
+    """
+    Return the kernel options specified by the currently active boot mode,
+    with a leading space. Force the VM's boot mode to 'default' if the active
+    boot mode does not exist. If the active boot mode is (or ends up set to)
+    'default', return an empty string.
+    """
+    if self.features.get("boot-mode.active", None) is None:
+        self.features["boot-mode.active"] = "default"
+    if self.features["boot-mode.active"] == "default":
+        return ""
+    active_boot_mode = self.features["boot-mode.active"]
+    try:
+        return self.features.check_with_template(
+            f"boot-mode.{active_boot_mode}.kernelopts"
+        )
+    except KeyError:
+        self.features["boot-mode.active"] = "default"
+        return ""
+
+
 def _default_virt_mode(self):
     if list(self.devices["pci"].get_assigned_devices()):
         return "hvm"
@@ -659,6 +680,15 @@ class QubesVM(qubes.vm.mix.net.NetVMMixin, qubes.vm.BaseVM):
     #
     # properties loaded from XML
     #
+    bootmode_kernelopts = qubes.property(
+        "bootmode_kernelopts",
+        type=str,
+        load_stage=4,
+        default=_bootmode_kernelopts,
+        doc="Additional kernel command line segment passed to domain, set by "
+        "the domain's active boot mode."
+    )
+
     guivm = qubes.VMProperty(
         "guivm",
         load_stage=4,

templates/libvirt/xen.xml

@@ -62,15 +62,19 @@
             {% endif %}
             {% if vm.kernel %}
                 {% if vm.features.check_with_template('no-default-kernelopts', False) -%}
-                <cmdline>{{ vm.kernelopts }}</cmdline>
+                <cmdline>{{ vm.kernelopts }}{{ vm.bootmode_kernelopts }}</cmdline>
                 {% elif vm.features.check_with_template('apparmor', '0') == '1' -%}
-                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }} apparmor=1 security=apparmor</cmdline>
+                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }} apparmor=1 security=apparmor{{ vm.bootmode_kernelopts }}</cmdline>
                 {% elif vm.features.check_with_template('selinux', '0') == '1' -%}
-                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }} selinux=1 security=selinux</cmdline>
+                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }} selinux=1 security=selinux{{ vm.bootmode_kernelopts }}</cmdline>
                 {% else -%}
-                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }}</cmdline>
+                <cmdline>{{ vm.kernelopts_common }}{{ vm.kernelopts }}{{ vm.bootmode_kernelopts }}</cmdline>
                 {% endif -%}
             {% endif %}
+            <!--
+                 Support for appending vm.bootmode_kernelopts to the kernel
+                 commandline for in-VM kernels should be added here.
+            -->
         {% endblock %}
     </os>