Re: [PATCH v2 10/32] hw/core: report security status in query-machines

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Oct 23, 2025 at 02:17:42PM +0200, Markus Armbruster wrote:
> Daniel P. Berrangé <berrange@redhat.com> writes:
> 
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >  hw/core/machine-qmp-cmds.c | 1 +
> >  qapi/machine.json          | 8 +++++++-
> >  2 files changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
> > index 6aca1a626e..4d9906f64a 100644
> > --- a/hw/core/machine-qmp-cmds.c
> > +++ b/hw/core/machine-qmp-cmds.c
> > @@ -100,6 +100,7 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
> >          if (mc->default_ram_id) {
> >              info->default_ram_id = g_strdup(mc->default_ram_id);
> >          }
> > +        info->secure = object_class_is_secure(OBJECT_CLASS(mc));
> >  
> >          if (compat_props && mc->compat_props) {
> >              int i;
> > diff --git a/qapi/machine.json b/qapi/machine.json
> > index 038eab281c..bb2b308ccd 100644
> > --- a/qapi/machine.json
> > +++ b/qapi/machine.json
> > @@ -194,6 +194,11 @@
> >  #     present when `query-machines` argument @compat-props is true.
> >  #     (since 9.1)
> >  #
> > +# @secure: If true, the machine is declared to provide a security
> > +#     boundary from the guest; if false the machine is either
> > +#     not providing a security boundary, or its status is undefined.
> > +#     (since 10.2)
> > +#
> >  # Features:
> >  #
> >  # @unstable: Member @compat-props is experimental.
> > @@ -207,7 +212,8 @@
> >              'deprecated': 'bool', '*default-cpu-type': 'str',
> >              '*default-ram-id': 'str', 'acpi': 'bool',
> >              '*compat-props': { 'type': ['CompatProperty'],
> > -                               'features': ['unstable'] } } }
> > +                               'features': ['unstable'] },
> > +            'secure': 'bool' } }
> >  
> >  ##
> >  # @query-machines:
> 
> Isn't this redundant with qom-list-types?
> 
> {"execute": "qom-list-types", "arguments": {"implements": "machine"}}

Well if the mgmt app is already using 'query-machines' for other reasons,
and doesn't currently use 'qom-list-types', then it is useful to have
the info reported in the former too.  Also I viewed the 'secure' flag
as being conceptually twinned with the 'deprecated' flag which is also
here in 'query-machines'.


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|