From nobody Fri Oct 18 08:46:15 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1719309050569511.02664790587005; Tue, 25 Jun 2024 02:50:50 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 5F58713B5; Tue, 25 Jun 2024 05:50:49 -0400 (EDT) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 26DDE13C1; Tue, 25 Jun 2024 05:49:30 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 0E7E213DD; Tue, 25 Jun 2024 05:49:24 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id A2090138A for ; Tue, 25 Jun 2024 05:49:06 -0400 (EDT) Received: from mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-36-LExE5v7BNkaOtggAeAIfpg-1; Tue, 25 Jun 2024 05:49:04 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C807F195608F for ; Tue, 25 Jun 2024 09:49:03 +0000 (UTC) Received: from maggie.brq.redhat.com (unknown [10.43.3.102]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1233B3000221 for ; Tue, 25 Jun 2024 09:49:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: *** X-Spam-Status: No, score=3.0 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,RCVD_IN_SBL_CSS,SPF_HELO_NONE autolearn=no autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1719308946; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=J18SblDKHc9GFcsMyzodhEw0s2IykRPAUzvbkmiYewE=; b=Gw5v0/J0nOtsb5kAfyuXhvK0ZpILWzac2ua4cj24Mv0fvF0j6lEDGnTP9j5RrJFSA/m9GB sXtEHcX81VM0ngjYQfqo+AIujBWh1XMSXnl6RUSI31FLDHopYi1ElEy8wHqmTm8gZx0tE5 sIrL7sd2rGXjSijy7WTS/frWuGxZs38= X-MC-Unique: LExE5v7BNkaOtggAeAIfpg-1 From: Michal Privoznik To: devel@lists.libvirt.org Subject: [PATCH 6/8] qemu_validate: Use domaincaps to validate supported launchSecurity type Date: Tue, 25 Jun 2024 11:48:51 +0200 Message-ID: <4d603f5c189d73d0aca0310a5e072a1f5e5f4eb2.1719308850.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 5V6KNYA64TOFFYCYXFJXFGJCWQ6TGYE6 X-Message-ID-Hash: 5V6KNYA64TOFFYCYXFJXFGJCWQ6TGYE6 X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1719309052346100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Now that the logic for detecting supported launchSecurity types has been moved to domain capabilities generation, we can just use it when validating launchSecurity type. Just like we do for device models and so on. Signed-off-by: Michal Privoznik --- src/qemu/qemu_validate.c | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 3cfcceafc9..b392428f48 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -1310,14 +1310,20 @@ qemuValidateDomainDef(const virDomainDef *def, return -1; =20 if (def->sec) { + virDomainCapsLaunchSecurity launchSecurity =3D { }; + + virQEMUCapsFillDomainLaunchSecurity(qemuCaps, &launchSecurity); + + if (!VIR_DOMAIN_CAPS_ENUM_IS_SET(launchSecurity.sectype, + def->sec->sectype)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("'%1$s' launch security is not supported with= this QEMU binary"), + virDomainLaunchSecurityTypeToString(def->sec->s= ectype)); + return -1; + } + switch (def->sec->sectype) { case VIR_DOMAIN_LAUNCH_SECURITY_SEV: - if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("SEV launch security is not supported wit= h this QEMU binary")); - return -1; - } - if (def->sec->data.sev.common.kernel_hashes !=3D VIR_TRISTATE_= BOOL_ABSENT && !virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST_KERNEL_HASHE= S)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", @@ -1327,20 +1333,9 @@ qemuValidateDomainDef(const virDomainDef *def, break; =20 case VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP: - if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_SNP_GUEST)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("SEV SNP launch security is not supported= with this QEMU binary")); - return -1; - } break; =20 case VIR_DOMAIN_LAUNCH_SECURITY_PV: - if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GU= EST_SUPPORT) || - !virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("S390 PV launch security is not supported= with this QEMU binary")); - return -1; - } if (!virQEMUCapsGetKVMSupportsSecureGuest(qemuCaps)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("S390 PV launch security is not supported= by this host or kernel")); --=20 2.44.2