conf: Move validation check out of postparse

The reason why it was in postparse in the first place was so
that we could could automatically enable the secure-boot feature
in some cases, but that no longer happens so we can finally move
it to the proper location.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/conf/domain_postparse.c b/src/conf/domain_postparse.c
index 79862a72cd2d1e391c98fcac252e09b101ccae5b..2832705d0fdd817fff43a3f176de4105b6b3a47f 100644 (file)
--- a/src/conf/domain_postparse.c
+++ b/src/conf/domain_postparse.c
@@ -93,16 +93,6 @@ virDomainDefPostParseMemory(virDomainDef *def,
 static int
 virDomainDefPostParseOs(virDomainDef *def)
 {
-    if (def->os.firmwareFeatures &&
-        def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES) {
-
-        if (def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) {
-            virReportError(VIR_ERR_XML_DETAIL, "%s",
-                           _("firmware feature 'enrolled-keys' cannot be enabled when firmware feature 'secure-boot' is disabled"));
-            return -1;
-        }
-    }
-
     if (!def->os.loader)
         return 0;
 

diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 6991cf1dd3d8fc18849885ef33a2364e75157808..f208c0c5319d2a237e71f9288f457ba44d9ae7eb 100644 (file)
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -1606,6 +1606,14 @@ virDomainDefOSValidate(const virDomainDef *def,
             return -1;
         }
 
+        if (def->os.firmwareFeatures &&
+            def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] == VIR_TRISTATE_BOOL_YES &&
+            def->os.firmwareFeatures[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] == VIR_TRISTATE_BOOL_NO) {
+            virReportError(VIR_ERR_XML_DETAIL, "%s",
+                           _("firmware feature 'enrolled-keys' cannot be enabled when firmware feature 'secure-boot' is disabled"));
+            return -1;
+        }
+
         if (!loader)
             return 0;