From e4e3375a8d7d40ef817030ddcf4c41160dff8c64 Mon Sep 17 00:00:00 2001
From: Keith Adler <kadler@cloudflare.com>
Date: Tue, 14 Apr 2026 14:47:24 -0500
Subject: [PATCH] vmm: move fw_cfg validation into PayloadConfig::validate()

Move FwCfgMissingKernel/Cmdline/Initramfs error variants from
ValidationError into PayloadConfigError. Change FwCfgConfig::validate()
to take &PayloadConfig instead of &VmConfig and return
PayloadConfigError. Wire the call through PayloadConfig::validate()
so both CLI and JSON API paths are covered.

Signed-off-by: Keith Adler <kadler@cloudflare.com>
---
 vmm/src/config.rs    | 21 ++++-----------------
 vmm/src/vm_config.rs | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/vmm/src/config.rs b/vmm/src/config.rs
index d023f98a1..a09989730 100644
--- a/vmm/src/config.rs
+++ b/vmm/src/config.rs
@@ -373,18 +373,6 @@ pub enum ValidationError {
     /// Invalid block device serial length
     #[error("Block device serial length ({0}) exceeds maximum allowed length ({1})")]
     InvalidSerialLength(usize, usize),
-    #[cfg(feature = "fw_cfg")]
-    /// FwCfg missing kernel
-    #[error("Error --fw-cfg-config: missing --kernel")]
-    FwCfgMissingKernel,
-    #[cfg(feature = "fw_cfg")]
-    /// FwCfg missing cmdline
-    #[error("Error --fw-cfg-config: missing --cmdline")]
-    FwCfgMissingCmdline,
-    #[cfg(feature = "fw_cfg")]
-    /// FwCfg missing initramfs
-    #[error("Error --fw-cfg-config: missing --initramfs")]
-    FwCfgMissingInitramfs,
     #[cfg(feature = "ivshmem")]
     /// Invalid Ivshmem input size
     #[error("Invalid ivshmem input size")]
@@ -2038,14 +2026,13 @@ impl FwCfgConfig {
             items,
         })
     }
-    pub fn validate(&self, vm_config: &VmConfig) -> ValidationResult<()> {
-        let payload = vm_config.payload.as_ref().unwrap();
+    pub fn validate(&self, payload: &PayloadConfig) -> std::result::Result<(), PayloadConfigError> {
         if self.kernel && payload.kernel.is_none() {
-            return Err(ValidationError::FwCfgMissingKernel);
+            return Err(PayloadConfigError::FwCfgMissingKernel);
         } else if self.cmdline && payload.cmdline.is_none() {
-            return Err(ValidationError::FwCfgMissingCmdline);
+            return Err(PayloadConfigError::FwCfgMissingCmdline);
         } else if self.initramfs && payload.initramfs.is_none() {
-            return Err(ValidationError::FwCfgMissingInitramfs);
+            return Err(PayloadConfigError::FwCfgMissingInitramfs);
         }
         Ok(())
     }
diff --git a/vmm/src/vm_config.rs b/vmm/src/vm_config.rs
index 01d3bb010..3753b4b49 100644
--- a/vmm/src/vm_config.rs
+++ b/vmm/src/vm_config.rs
@@ -747,6 +747,18 @@ pub enum PayloadConfigError {
     /// Specifying a kernel or firmware is not supported when an igvm is provided.
     #[error("Specifying a kernel or firmware is not supported when an igvm is provided")]
     IgvmPlusOtherPayloads,
+    #[cfg(feature = "fw_cfg")]
+    /// FwCfg missing kernel
+    #[error("Error --fw-cfg-config: missing --kernel")]
+    FwCfgMissingKernel,
+    #[cfg(feature = "fw_cfg")]
+    /// FwCfg missing cmdline
+    #[error("Error --fw-cfg-config: missing --cmdline")]
+    FwCfgMissingCmdline,
+    #[cfg(feature = "fw_cfg")]
+    /// FwCfg missing initramfs
+    #[error("Error --fw-cfg-config: missing --initramfs")]
+    FwCfgMissingInitramfs,
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -872,6 +884,11 @@ impl PayloadConfig {
             (None, None) => Err(PayloadConfigError::MissingBootitem),
         }?;
 
+        #[cfg(feature = "fw_cfg")]
+        if let Some(fw_cfg_config) = &self.fw_cfg_config {
+            fw_cfg_config.validate(self)?;
+        }
+
         Ok(())
     }
 }