External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-03 11:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: validate: Reject virStorageSource features we don't want to support with nvram

Browse Source 
Signed-off-by: Prerna Saxena <prerna.saxena@nutanix.com>
Signed-off-by: Florian Schmidt <flosch@nutanix.com>
Signed-off-by: Rohit Kumar <rohit.kumar3@nutanix.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Tested-by: Rohit Kumar <rohit.kumar3@nutanix.com>
This commit is contained in:
Rohit Kumar 2022-05-04 09:51:12 -07:00 committed by Peter Krempa
parent c3c586baa1
commit bca731d0f5
1 changed files with 85 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

110
src/qemu/qemu_validate.c
View File

@ -601,35 +601,95 @@ qemuValidateDomainDefPM(const virDomainDef *def,
static int
qemuValidateDomainDefBoot(const virDomainDef *def)
qemuValidateDomainDefNvram(const virDomainDef *def,
virQEMUCaps *qemuCaps)
{
if (def->os.loader &&
def->os.loader->secure == VIR_TRISTATE_BOOL_YES) {
/* These are the QEMU implementation limitations. But we
* have to live with them for now. */
virStorageSource *src = def->os.loader->nvram;
if (!qemuDomainIsQ35(def)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot is supported with q35 machine types only"));
return -1;
if (!src)
return 0;
switch (src->type) {
case VIR_STORAGE_TYPE_FILE:
case VIR_STORAGE_TYPE_BLOCK:
case VIR_STORAGE_TYPE_NETWORK:
break;
case VIR_STORAGE_TYPE_DIR:
case VIR_STORAGE_TYPE_VOLUME:
case VIR_STORAGE_TYPE_NVME:
case VIR_STORAGE_TYPE_VHOST_USER:
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("unsupported nvram disk type '%s'"),
virStorageTypeToString(src->type));
return -1;
case VIR_STORAGE_TYPE_NONE:
case VIR_STORAGE_TYPE_LAST:
virReportEnumRangeError(virStorageType, src->type);
return -1;
}
if (src->sliceStorage) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("slices are not supported with NVRAM"));
return -1;
}
if (src->pr) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("persistent reservations are not supported with NVRAM"));
return -1;
}
if (src->backingStore) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("backingStore is not supported with NVRAM"));
return -1;
}
if (qemuDomainValidateStorageSource(src, qemuCaps, false) < 0)
return -1;
return 0;
}
static int
qemuValidateDomainDefBoot(const virDomainDef *def,
virQEMUCaps *qemuCaps)
{
if (def->os.loader) {
if (def->os.loader->secure == VIR_TRISTATE_BOOL_YES) {
/* These are the QEMU implementation limitations. But we
* have to live with them for now. */
if (!qemuDomainIsQ35(def)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot is supported with q35 machine types only"));
return -1;
}
/* Now, technically it is possible to have secure boot on
* 32bits too, but that would require some -cpu xxx magic
* too. Not worth it unless we are explicitly asked. */
if (def->os.arch != VIR_ARCH_X86_64) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot is supported for x86_64 architecture only"));
return -1;
}
/* SMM will be enabled by qemuFirmwareFillDomain() if needed. */
if (def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_NONE &&
def->features[VIR_DOMAIN_FEATURE_SMM] != VIR_TRISTATE_SWITCH_ON) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot requires SMM feature enabled"));
return -1;
}
}
/* Now, technically it is possible to have secure boot on
* 32bits too, but that would require some -cpu xxx magic
* too. Not worth it unless we are explicitly asked. */
if (def->os.arch != VIR_ARCH_X86_64) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot is supported for x86_64 architecture only"));
if (qemuValidateDomainDefNvram(def, qemuCaps) < 0)
return -1;
}
/* SMM will be enabled by qemuFirmwareFillDomain() if needed. */
if (def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_NONE &&
def->features[VIR_DOMAIN_FEATURE_SMM] != VIR_TRISTATE_SWITCH_ON) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Secure boot requires SMM feature enabled"));
return -1;
}
}
return 0;
@ -1210,7 +1270,7 @@ qemuValidateDomainDef(const virDomainDef *def,
if (qemuValidateDomainDefPM(def, qemuCaps) < 0)
return -1;
if (qemuValidateDomainDefBoot(def) < 0)
if (qemuValidateDomainDefBoot(def, qemuCaps) < 0)
return -1;
if (qemuValidateDomainVCpuTopology(def, qemuCaps) < 0)