vagrant-xapi 0.0.1 → 1.0.0

data/lib/vagrant-xapi/services/template_cache.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+require "digest"
+
+require_relative "base"
+require_relative "lock"
+require_relative "lookup"
+require_relative "box_source"
+require_relative "image_upload"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # Imports each box exactly once per SR as an XAPI template and finds it
+      # again on later runs. Import happens under a pool-wide lock, so two
+      # processes (or users) never import the same box twice. A failed or
+      # interrupted import leaves nothing behind.
+      class TemplateCache
+        include Helpers
+
+        # @param converter [#call, nil] converter.call(src, dst) converts a
+        #   qcow2 image to VHD (qemu-img); raises Services::Error if missing.
+        # @param salt [String, nil] extra input for the cache key: a new value
+        #   makes the same box import again as a new template (for tests)
+        def initialize(ctx, digest_cache:, converter: nil, lock_wait: 7200, task_timeout: 3600, lock_poll: 2,
+                       salt: nil)
+          @ctx = ctx
+          @client = ctx.client
+          @salt = salt.to_s.empty? ? nil : salt.to_s
+          @lookup = Lookup.new(ctx)
+          @digest_cache = digest_cache
+          @converter = converter
+          @lock_wait = lock_wait
+          @task_timeout = task_timeout
+          @lock_poll = lock_poll
+        end
+
+        def self.template_name(source)
+          "vagrant-xapi: #{source.name} #{source.version}".strip
+        end
+
+        # @return [String] template VM ref
+        # The template is shared by everyone who uses the box, so nothing of
+        # one user's configuration (e.g. firmware) is baked into it; firmware
+        # is set per VM.
+        def ensure_template(source, sr_ref)
+          sr_uuid = @client.call("SR.get_uuid", sr_ref)
+          @ctx.ui&.detail(:computing_digest) unless source.kind == :xva_url
+          digest = source.digest(@digest_cache)
+          digest = Digest::SHA256.hexdigest("#{@salt}:#{digest}") if @salt
+
+          found = find(source, digest, sr_uuid)
+          return found if found
+
+          # The holder keeps the lock alive with heartbeats, so the TTL only
+          # decides how fast the lock of a crashed process is taken over.
+          lock = Lock.new(@ctx, "template.#{digest}.#{sr_uuid}", ttl: 900, wait: @lock_wait,
+                                                                   poll: @lock_poll)
+          lock.synchronize do
+            found = find(source, digest, sr_uuid)
+            return found if found
+
+            @ctx.ui&.info(:importing_box, box: source.name, version: source.version,
+                                          content: source.description)
+            import(source, sr_ref, sr_uuid, digest)
+          end
+        end
+
+        # @return [String, nil]
+        def find(source, digest, sr_uuid)
+          candidates = @client.call("VM.get_by_name_label", self.class.template_name(source))
+          hit = candidates.find { |ref| matches?(ref, digest, sr_uuid) }
+          return hit if hit
+
+          # The box may have been renamed; search by digest.
+          all_templates.each do |ref, rec|
+            oc = rec["other_config"] || {}
+            return ref if oc[Marking::BOX_DIGEST] == digest && oc[Marking::SR] == sr_uuid
+          end
+          nil
+        end
+
+        # Templates carrying our marking: { ref => record }
+        def all_templates
+          recs = begin
+            @client.call("VM.get_all_records_where", 'field "is_a_template"="true"')
+          rescue Api::XapiError
+            @client.call("VM.get_all_records").select { |_r, v| v["is_a_template"] }
+          end
+          recs.select { |_r, v| v["is_a_template"] && !v["is_a_snapshot"] && (v["other_config"] || {})[Marking::BOX_DIGEST] }
+        end
+
+        private
+
+        def matches?(ref, digest, sr_uuid)
+          rec = @client.call("VM.get_record", ref)
+          oc = rec["other_config"] || {}
+          rec["is_a_template"] && oc[Marking::BOX_DIGEST] == digest && oc[Marking::SR] == sr_uuid
+        end
+
+        def import(source, sr_ref, sr_uuid, digest)
+          created = { vms: [], vdis: [] }
+          begin
+            vm = case source.kind
+                 when :xva then import_xva(source, sr_ref, created)
+                 when :xva_url then import_xva_url(source, sr_ref, created)
+                 else import_disks(source, sr_ref, created)
+                 end
+            raise Api::TaskCancelled, "import" if @ctx.cancelled?
+
+            finish_template(vm, source, sr_uuid, digest)
+            vm
+          rescue Exception # rubocop:disable Lint/RescueException
+            cleanup(created)
+            raise
+          end
+        end
+
+        def import_xva(source, sr_ref, created)
+          result = @client.http.upload(
+            "/import", { "sr_id" => sr_ref }, source.xva_path,
+            host: @lookup.transfer_host_for_sr(sr_ref),
+            progress: @ctx.progress_proc(:uploading, file: File.basename(source.xva_path)),
+            task_label: "vagrant-xapi import #{source.name}",
+            cancel: @ctx.cancel
+          )
+          @ctx.ui&.clear_progress
+          refs = result ? result.refs : []
+          created[:vms].concat(refs)
+          raise Error.new(:import_no_vm, box: source.name) if refs.empty?
+
+          refs.first
+        end
+
+        def import_xva_url(source, sr_ref, created)
+          @ctx.ui&.warn(:insecure_xva_url, url: source.xva_url) if source.xva_url.start_with?("http://")
+          result = @ctx.run_task("VM.import", source.xva_url, sr_ref, false, false,
+                                 label: "import #{source.name}", progress_key: :host_downloading)
+          refs = result.refs
+          created[:vms].concat(refs)
+          raise Error.new(:import_no_vm, box: source.name) if refs.empty?
+
+          refs.first
+        end
+
+        def import_disks(source, sr_ref, created)
+          vdis = source.disks.each_with_index.map do |disk, i|
+            vdi = create_vdi(sr_ref, "#{source.name} #{source.version} disk #{i}", disk.virtual_size,
+                             description: "vagrant-xapi box image")
+            created[:vdis] << vdi
+            vdi = upload_disk(vdi, disk) # may be a new VDI after a VHD fallback
+            created[:vdis] << vdi
+            vdi
+          end
+
+          base = @lookup.other_install_media_template
+          vm = @client.call("VM.clone", base, self.class.template_name(source))
+          created[:vms] << vm
+          # "Other install media" would create an empty disk on provision.
+          remove_oc("VM", vm, "disks")
+          remove_oc("VM", vm, "install-methods")
+
+          vdis.each_with_index do |vdi, i|
+            @client.call("VBD.create", vbd_record(vm, vdi, i))
+          end
+          @client.call("VM.set_HVM_boot_policy", vm, "BIOS order")
+          @client.call("VM.set_HVM_boot_params", vm, { "order" => "cd", "firmware" => "bios" })
+          raise_memory(vm)
+          vm
+        end
+
+        # "Other install media" starts with 256 MiB: too little for a current
+        # distribution, and under UEFI GRUB cannot even load the initramfs
+        # ("error: out of memory"). A box with a disk image carries no memory
+        # setting, so its template gets this unless it already has more; a
+        # Vagrantfile still sets `memory` per VM.
+        DISK_IMAGE_MEMORY = 1024 * 1024 * 1024
+
+        def raise_memory(vm)
+          rec = @client.call("VM.get_record", vm)
+          return if rec["memory_static_max"].to_i >= DISK_IMAGE_MEMORY
+
+          static_min = [rec["memory_static_min"].to_i, DISK_IMAGE_MEMORY].min
+          @client.call("VM.set_memory_limits", vm, static_min, DISK_IMAGE_MEMORY, DISK_IMAGE_MEMORY,
+                       DISK_IMAGE_MEMORY)
+        end
+
+        def upload_disk(vdi, disk)
+          ImageUpload.new(@ctx, converter: @converter)
+                     .upload(vdi, disk.path, disk.format, label: "vagrant-xapi import_raw_vdi")
+        end
+
+        def vbd_record(vm, vdi, index)
+          {
+            "VM" => vm,
+            "VDI" => vdi,
+            "userdevice" => index.to_s,
+            "bootable" => index.zero?,
+            "mode" => "RW",
+            "type" => "Disk",
+            "unpluggable" => false,
+            "empty" => false,
+            "other_config" => {},
+            "qos_algorithm_type" => "",
+            "qos_algorithm_params" => {}
+          }
+        end
+
+        def finish_template(vm, source, sr_uuid, digest)
+          @client.call("VM.set_is_a_template", vm, true) unless @client.call("VM.get_is_a_template", vm)
+          convert_pv_to_hvm(vm)
+          @client.call("VM.set_name_label", vm, self.class.template_name(source))
+          @client.call("VM.set_name_description", vm,
+                       "Box #{source.name} #{source.version} (#{source.provider}), imported by vagrant-xapi")
+          template_uuid = @client.call("VM.get_uuid", vm)
+          disk_vdis(vm).each do |vdi|
+            set_oc("VDI", vdi, Marking::OF_TEMPLATE, template_uuid)
+          end
+          {
+            Marking::BOX => source.name,
+            Marking::BOX_VERSION => source.version,
+            Marking::BOX_PROVIDER => source.provider,
+            Marking::BOX_DIGEST => digest,
+            Marking::SR => sr_uuid
+          }.each { |k, v| set_oc("VM", vm, k, v) }
+        end
+
+        # PV guests are not supported; boxes of the old plugin that used
+        # pygrub are switched to HVM.
+        def convert_pv_to_hvm(vm)
+          rec = @client.call("VM.get_record", vm)
+          return unless rec["HVM_boot_policy"].to_s.empty?
+
+          @ctx.ui&.warn(:pv_box_converted)
+          @client.call("VM.set_PV_bootloader", vm, "")
+          @client.call("VM.set_HVM_boot_policy", vm, "BIOS order")
+          params = (rec["HVM_boot_params"] || {}).merge("order" => "cd")
+          @client.call("VM.set_HVM_boot_params", vm, params)
+        end
+
+        def cleanup(created)
+          created[:vms].uniq.each do |vm|
+            begin
+              disk_vdis(vm).each { |vdi| created[:vdis] << vdi }
+            rescue Api::Error
+              nil
+            end
+            begin
+              @client.call("VM.destroy", vm)
+            rescue Api::Error => e
+              @ctx.logger&.warn("cleanup of half-imported VM failed: #{e.message}")
+            end
+          end
+          created[:vdis].uniq.each do |vdi|
+            @client.call("VDI.destroy", vdi)
+          rescue Api::Error => e
+            @ctx.logger&.warn("cleanup of half-imported VDI failed: #{e.message}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/services/tunnels.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "open3"
+require "pathname"
+
+require_relative "base"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # Port forwarding through SSH tunnels from the local machine, like
+      # vagrant-libvirt: one background `ssh -N -L host_ip:host:guest_ip:guest`
+      # per forwarded port. PIDs are kept in the machine's data_dir.
+      #
+      # Processes are started with an argv array, never through a shell.
+      class Tunnels
+        # host is the port to listen on. configured_host is the host port in
+        # the Vagrantfile; the two differ when Vagrant auto-corrected a
+        # collision at boot (auto_correct: true).
+        Forward = Struct.new(:id, :host_ip, :host, :guest_ip, :guest, :configured_host, :auto_correct,
+                             keyword_init: true) do
+          def configured_port
+            (configured_host || host).to_i
+          end
+        end
+
+        # @param ssh [Hash] :host, :port, :username, :private_key_path (Array),
+        #   :proxy_command (String, nil)
+        def initialize(data_dir, ssh_binary: "ssh", spawner: nil, logger: nil)
+          @data_dir = Pathname.new(data_dir.to_s)
+          @ssh_binary = ssh_binary
+          @spawner = spawner || ->(argv, opts) { Process.spawn(*argv, **opts) }
+          @logger = logger
+        end
+
+        def state_file
+          @data_dir.join("forwarded_ports.json")
+        end
+
+        def log_file
+          @data_dir.join("tunnels.log")
+        end
+
+        # @return [Array<Hash>] running tunnels
+        # Tunnels whose PID is alive and still an ssh process (after a reboot
+        # a saved PID can belong to something else).
+        def running
+          read.select { |t| alive?(t["pid"]) && ssh_process?(t["pid"].to_i) }
+        end
+
+        # host port => guest port, for `vagrant port`
+        def forwarded_ports
+          running.to_h { |t| [t["host"].to_i, t["guest"].to_i] }
+        end
+
+        # What sync does: running tunnels that serve one of the forwards
+        # exactly stay up (keep), the other running tunnels are stopped
+        # (stop), and forwards without such a tunnel are started (start).
+        # Pass the forwards through with_saved_ports first, so a port that
+        # was auto-corrected at boot counts as unchanged.
+        Plan = Struct.new(:keep, :stop, :start, keyword_init: true) do
+          def noop?
+            stop.empty? && start.empty?
+          end
+        end
+
+        def plan(forwards)
+          live = running
+          keep = live.select { |t| forwards.any? { |f| serves?(t, f) } }
+          start = forwards.reject { |f| keep.any? { |t| serves?(t, f) } }
+          Plan.new(keep: keep, stop: live - keep, start: start)
+        end
+
+        # The forwards with the host port Vagrant auto-corrected when they
+        # were last started, so a running VM keeps that port. Only for a
+        # forward that still has auto_correct and the same host port in the
+        # Vagrantfile; any other forward keeps the Vagrantfile's port.
+        def with_saved_ports(forwards)
+          saved = read
+          forwards.map do |fwd|
+            next fwd unless fwd.auto_correct
+
+            last = saved.find { |t| t["id"] == fwd.id.to_s && t["configured_host"].to_i == fwd.configured_port }
+            last ? fwd.dup.tap { |f| f.host = last["host"].to_i } : fwd
+          end
+        end
+
+        # Stops every tunnel, then starts one per forward.
+        def start(forwards, ssh)
+          stop
+          sync(Plan.new(keep: [], stop: [], start: forwards), ssh)
+        end
+
+        # Carries out a plan: tunnels in plan.keep are not touched. When a
+        # new tunnel dies at once, the others stay up and tunnel_failed is
+        # raised. Returns the started tunnels.
+        def sync(plan, ssh)
+          plan.stop.each { |t| kill(t["pid"].to_i) }
+          FileUtils.mkdir_p(@data_dir)
+          if plan.start.empty?
+            write(plan.keep)
+            return []
+          end
+
+          started = plan.start.map { |fwd| spawn(fwd, ssh) }
+          write(plan.keep + started)
+          sleep 1
+          dead = started.reject { |t| alive?(t["pid"]) }
+          return started if dead.empty?
+
+          write(plan.keep + (started - dead))
+          raise Error.new(:tunnel_failed, ports: dead.map { |t| t["host"] }.join(", "), log: log_file.to_s)
+        end
+
+        def stop
+          read.each { |t| kill(t["pid"].to_i) }
+          FileUtils.rm_f(state_file)
+        end
+
+        def command(fwd, ssh)
+          argv = [
+            @ssh_binary, "-N", "-T",
+            "-L", "#{bracket(fwd.host_ip)}:#{fwd.host}:#{bracket(fwd.guest_ip)}:#{fwd.guest}",
+            "-p", ssh[:port].to_s,
+            "-l", ssh[:username].to_s,
+            "-o", "ExitOnForwardFailure=yes",
+            "-o", "ServerAliveInterval=30",
+            "-o", "ServerAliveCountMax=3",
+            "-o", "ControlMaster=no",
+            "-o", "LogLevel=ERROR",
+            "-o", "BatchMode=yes",
+            # Same as Vagrant's own default for guests.
+            "-o", "StrictHostKeyChecking=no",
+            "-o", "UserKnownHostsFile=/dev/null"
+          ]
+          keys = Array(ssh[:private_key_path])
+          argv += ["-o", "IdentitiesOnly=yes"] unless keys.empty?
+          keys.each { |k| argv += ["-i", k.to_s] }
+          argv += ["-o", "ProxyCommand=#{ssh[:proxy_command]}"] if ssh[:proxy_command]
+          argv << ssh[:host].to_s
+          argv
+        end
+
+        private
+
+        def serves?(tunnel, fwd)
+          tunnel["id"] == fwd.id.to_s && tunnel["host_ip"] == fwd.host_ip && tunnel["host"].to_i == fwd.host &&
+            tunnel["guest_ip"] == fwd.guest_ip && tunnel["guest"].to_i == fwd.guest
+        end
+
+        def spawn(fwd, ssh)
+          pid = @spawner.call(command(fwd, ssh), in: File::NULL, out: File::NULL,
+                                                 err: [log_file.to_s, "a"], pgroup: true)
+          Process.detach(pid) if pid.is_a?(Integer) && pid.positive?
+          {
+            "pid" => pid, "id" => fwd.id.to_s, "host_ip" => fwd.host_ip, "host" => fwd.host,
+            "configured_host" => fwd.configured_port, "guest_ip" => fwd.guest_ip, "guest" => fwd.guest
+          }
+        end
+
+        def kill(pid)
+          return unless pid.positive? && alive?(pid) && ssh_process?(pid)
+
+          Process.kill("TERM", pid)
+        rescue Errno::ESRCH, Errno::EPERM
+          nil
+        end
+
+        # ssh needs IPv6 addresses in brackets inside a -L spec.
+        def bracket(address)
+          s = address.to_s
+          s.include?(":") && !s.start_with?("[") ? "[#{s}]" : s
+        end
+
+        def read
+          return [] unless state_file.file?
+
+          JSON.parse(state_file.read)
+        rescue JSON::ParserError
+          []
+        end
+
+        def write(list)
+          File.write(state_file, JSON.pretty_generate(list))
+        end
+
+        def alive?(pid)
+          pid = pid.to_i
+          return false unless pid.positive?
+
+          Process.kill(0, pid)
+          true
+        rescue Errno::ESRCH
+          false
+        rescue Errno::EPERM
+          true
+        end
+
+        # Guard against PID reuse: on Linux check that it is still ssh.
+        def ssh_process?(pid)
+          cmdline = "/proc/#{pid}/cmdline"
+          return File.read(cmdline).split("\0").first.to_s.end_with?("ssh") if File.exist?(cmdline)
+
+          # macOS and BSD: ask ps (argv array, no shell).
+          out, = Open3.capture2("ps", "-o", "comm=", "-p", pid.to_s)
+          return true if out.strip.empty? # cannot tell; keep it
+
+          out.strip.end_with?("ssh")
+        rescue StandardError
+          true
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/services/vm_builder.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "lookup"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # What the VM should look like. nil means "keep what the template has".
+      VmSpec = Struct.new(
+        :name_label, :description, :cpus, :cores_per_socket, :memory, :memory_dynamic_min,
+        :firmware, :secure_boot, :vtpm, :affinity_host, :tags, :platform, :other_config,
+        :marking, keyword_init: true
+      )
+
+      # Creates VMs from templates and (re)applies CPU, memory, firmware and
+      # the other settings from the provider config.
+      class VmBuilder
+        include Helpers
+
+        MIB = 1024 * 1024
+
+        def initialize(ctx)
+          @ctx = ctx
+          @client = ctx.client
+          @lookup = Lookup.new(ctx)
+        end
+
+        # @param clone_mode [Symbol] :fast (VM.clone) or :full (VM.copy to sr)
+        # @return [String] VM ref
+        def create(template, spec, clone_mode:, sr_ref:)
+          vm = nil
+          @ctx.ui&.info(:creating_vm, name: spec.name_label)
+          result = if clone_mode.to_sym == :full
+                     @ctx.run_task("VM.copy", template, spec.name_label, sr_ref,
+                                   label: "copy template", progress_key: :copying)
+                   else
+                     @ctx.run_task("VM.clone", template, spec.name_label, label: "clone template")
+                   end
+          vm = result.ref
+          raise Error.new(:clone_failed) if vm.nil?
+
+          @ctx.run_task("VM.provision", vm, label: "provision")
+          @client.call("VM.set_is_a_template", vm, false) if @client.call("VM.get_is_a_template", vm)
+          mark(vm, template, spec)
+          apply(vm, spec)
+          vm
+        rescue Exception # rubocop:disable Lint/RescueException
+          destroy_partial(vm) if vm
+          raise
+        end
+
+        # Applies the VmSpec to a halted VM (also used by reload).
+        def apply(vm, spec)
+          rec = @client.call("VM.get_record", vm)
+          check_cores_per_socket!(rec, spec)
+          clear_cores_per_socket(vm, rec, spec)
+          apply_cpus(vm, rec, spec)
+          apply_memory(vm, rec, spec)
+          apply_firmware(vm, rec, spec)
+          apply_platform(vm, rec, spec)
+          apply_vtpm(vm, rec, spec)
+          apply_affinity(vm, spec)
+          apply_tags(vm, rec, spec)
+          (spec.other_config || {}).each { |k, v| set_oc("VM", vm, k.to_s, v) }
+          @client.call("VM.set_name_description", vm, spec.description) if spec.description
+        end
+
+        private
+
+        def mark(vm, template, spec)
+          oc = @client.call("VM.get_other_config", vm)
+          Marking::TEMPLATE_KEYS.each { |k| remove_oc("VM", vm, k) if oc.key?(k) }
+          (spec.marking || {}).each { |k, v| set_oc("VM", vm, k, v) }
+          set_oc("VM", vm, Marking::TEMPLATE_UUID, @client.call("VM.get_uuid", template))
+          @client.call("VM.add_tags", vm, Marking::TAG)
+
+          vm_uuid = @client.call("VM.get_uuid", vm)
+          disk_vdis(vm).each_with_index do |vdi, i|
+            remove_oc("VDI", vdi, Marking::OF_TEMPLATE)
+            set_oc("VDI", vdi, Marking::OWNER_VM, vm_uuid)
+            @client.call("VDI.set_name_label", vdi, "#{spec.name_label} disk #{i}")
+          end
+        end
+
+        def apply_cpus(vm, rec, spec)
+          return if spec.cpus.nil?
+
+          want = spec.cpus.to_i
+          max = rec["VCPUs_max"].to_i
+          if want > max
+            @client.call("VM.set_VCPUs_max", vm, want)
+            @client.call("VM.set_VCPUs_at_startup", vm, want)
+          elsif want < max || rec["VCPUs_at_startup"].to_i != want
+            @client.call("VM.set_VCPUs_at_startup", vm, want)
+            @client.call("VM.set_VCPUs_max", vm, want)
+          end
+        end
+
+        # Without cpus, cores_per_socket must fit the template's CPU count
+        # (with cpus, Config#validate already checks it).
+        def check_cores_per_socket!(rec, spec)
+          return unless spec.cores_per_socket && spec.cpus.nil?
+
+          vcpus = rec["VCPUs_max"].to_i
+          return if vcpus.positive? && (vcpus % spec.cores_per_socket.to_i).zero?
+
+          raise Error.new(:cores_per_socket_mismatch, cores: spec.cores_per_socket, cpus: vcpus)
+        end
+
+        # platform:cores-per-socket must divide VCPUs_max. Remove it before the
+        # CPU count changes; apply_platform sets the new value afterwards. A
+        # template value that does not divide the new count is dropped.
+        def clear_cores_per_socket(vm, rec, spec)
+          current = (rec["platform"] || {})["cores-per-socket"]
+          return if current.nil?
+
+          cores = current.to_i
+          divides = cores.positive? && spec.cpus && (spec.cpus.to_i % cores).zero?
+          return unless spec.cores_per_socket || (spec.cpus && !divides)
+
+          begin
+            @client.call("VM.remove_from_platform", vm, "cores-per-socket")
+          rescue Api::XapiError
+            nil
+          end
+        end
+
+        def apply_memory(vm, rec, spec)
+          return if spec.memory.nil? && spec.memory_dynamic_min.nil?
+
+          static_max = spec.memory ? spec.memory.to_i * MIB : rec["memory_static_max"].to_i
+          dyn_min = spec.memory_dynamic_min ? spec.memory_dynamic_min.to_i * MIB : static_max
+          dyn_min = static_max if dyn_min > static_max
+          static_min = [rec["memory_static_min"].to_i, dyn_min].min
+          static_min = dyn_min if static_min <= 0
+          @client.call("VM.set_memory_limits", vm, static_min, static_max, dyn_min, static_max)
+        end
+
+        def apply_firmware(vm, rec, spec)
+          return if spec.firmware.nil?
+
+          params = (rec["HVM_boot_params"] || {}).dup
+          params["firmware"] = spec.firmware.to_s
+          params["order"] ||= "cd"
+          @client.call("VM.set_HVM_boot_params", vm, params)
+          @client.call("VM.set_HVM_boot_policy", vm, "BIOS order") if rec["HVM_boot_policy"].to_s.empty?
+        end
+
+        def apply_platform(vm, _rec, spec)
+          platform = {}
+          platform["cores-per-socket"] = spec.cores_per_socket.to_s if spec.cores_per_socket
+          platform["secureboot"] = spec.secure_boot ? "true" : "false" unless spec.secure_boot.nil?
+          (spec.platform || {}).each { |k, v| platform[k.to_s] = v.to_s }
+          platform.each do |k, v|
+            begin
+              @client.call("VM.remove_from_platform", vm, k)
+            rescue Api::XapiError
+              nil
+            end
+            @client.call("VM.add_to_platform", vm, k, v)
+          end
+        end
+
+        def apply_vtpm(vm, rec, spec)
+          return remove_vtpm(vm, rec) unless spec.vtpm
+
+          raise Error.new(:vtpm_unsupported) unless @client.feature?(:vtpm)
+
+          existing = begin
+            @client.call("VM.get_VTPMs", vm)
+          rescue Api::XapiError
+            []
+          end
+          return unless existing.empty?
+
+          @client.call("VTPM.create", vm, false)
+          set_oc("VM", vm, Marking::VTPM, "true")
+        end
+
+        # With `vtpm` off, removes the vTPM the plugin created, with its
+        # contents. One that came with the box or an adopted VM stays: keys
+        # sealed in it may protect the guest's disks.
+        def remove_vtpm(vm, rec)
+          return unless (rec["other_config"] || {})[Marking::VTPM] == "true"
+
+          @client.call("VM.get_VTPMs", vm).each { |vtpm| @client.call("VTPM.destroy", vtpm) }
+          remove_oc("VM", vm, Marking::VTPM)
+        end
+
+        def apply_affinity(vm, spec)
+          host = spec.affinity_host ? @lookup.host(spec.affinity_host) : NULL_REF
+          @client.call("VM.set_affinity", vm, host)
+        end
+
+        def apply_tags(vm, rec, spec)
+          current = rec["tags"] || []
+          ([Marking::TAG] + Array(spec.tags).map(&:to_s)).uniq.each do |tag|
+            @client.call("VM.add_tags", vm, tag) unless current.include?(tag)
+          end
+        end
+
+        def destroy_partial(vm)
+          vdis = disk_vdis(vm)
+          @client.call("VM.destroy", vm)
+          vdis.each do |vdi|
+            ignore_missing { @client.call("VDI.destroy", vdi) }
+          end
+        rescue Api::Error => e
+          @ctx.logger&.warn("cleanup of half-created VM failed: #{e.message}")
+        end
+      end
+    end
+  end
+end