'Checks whether the given instance requires Secure Boot.
Secure Boot feature will be enabled by setting the "os_secure_boot"
image property or the "os:secure_boot" flavor extra spec to required.
:raises exception.InstanceUnacceptable: if the given image_meta has
no os_type property set, or if the image property value and the
flavor extra spec value are conflicting, or if Secure Boot is
required, but the instance\'s VM generation is 1.'

def _requires_secure_boot(self, instance, image_meta, vm_gen):

    img_secure_boot = image_meta.properties.get('os_secure_boot')
    flavor_secure_boot = instance.flavor.extra_specs.get(constants.FLAVOR_SPEC_SECURE_BOOT)
    requires_sb = False
    conflicting_values = False
    if (flavor_secure_boot == fields.SecureBoot.REQUIRED):
        requires_sb = True
        if (img_secure_boot == fields.SecureBoot.DISABLED):
            conflicting_values = True
    elif (img_secure_boot == fields.SecureBoot.REQUIRED):
        requires_sb = True
        if (flavor_secure_boot == fields.SecureBoot.DISABLED):
            conflicting_values = True
    if conflicting_values:
        reason = (_('Conflicting    image    metadata    property    and    flavor    extra_specs    values:    os_secure_boot    (%(image_secure_boot)s)    /    os:secure_boot    (%(flavor_secure_boot)s)') % {'image_secure_boot': img_secure_boot, 'flavor_secure_boot': flavor_secure_boot})
        raise exception.InstanceUnacceptable(instance_id=instance.uuid, reason=reason)
    if requires_sb:
        if (vm_gen != constants.VM_GEN_2):
            reason = _('Secure    boot    requires    generation    2    VM.')
            raise exception.InstanceUnacceptable(instance_id=instance.uuid, reason=reason)
        os_type = image_meta.properties.get('os_type')
        if (not os_type):
            reason = _('For    secure    boot,    os_type    must    be    specified    in    image    properties.')
            raise exception.InstanceUnacceptable(instance_id=instance.uuid, reason=reason)
    return requires_sb
