api: Block unsupported actions with vDPA

There are a number of operations that are known not to work with vDPA
interfaces and another few that may work but haven't been tested. Start
blocking these. In all cases where an operation is blocked a HTTP 409
(Conflict) is returned. This will allow lifecycle operations to be
enabled as they are tested or bugs are addressed.

Change-Id: I7f3cbc57a374b2f271018a2f6ef33ef579798db8
Blueprint: libvirt-vdpa-support

nova/tests/unit/api/openstack/compute/test_migrate_server.py

@@ -283,6 +283,13 @@ class MigrateServerTestsV21(admin_only_action_common.CommonTests):
             expected_exc=webob.exc.HTTPConflict,
             check_response=False)
 
+    def test_migrate_live_sev_not_supported(self):
+        self._test_migrate_live_failed_with_exception(
+            exception.OperationNotSupportedForSEV(
+                instance_uuid=uuids.instance, operation='foo'),
+            expected_exc=webob.exc.HTTPConflict,
+            check_response=False)
+
     def test_migrate_live_vtpm_not_supported(self):
         self._test_migrate_live_failed_with_exception(
             exception.OperationNotSupportedForVTPM(
@@ -290,6 +297,13 @@ class MigrateServerTestsV21(admin_only_action_common.CommonTests):
             expected_exc=webob.exc.HTTPConflict,
             check_response=False)
 
+    def test_migrate_live_vdpa_interfaces_not_supported(self):
+        self._test_migrate_live_failed_with_exception(
+            exception.OperationNotSupportedForVDPAInterface(
+                instance_uuid=uuids.instance, operation='foo'),
+            expected_exc=webob.exc.HTTPConflict,
+            check_response=False)
+
     def test_migrate_live_pre_check_error(self):
         self._test_migrate_live_failed_with_exception(
             exception.MigrationPreCheckError(reason=''))
@@ -594,22 +608,6 @@ class MigrateServerTestsV268(MigrateServerTestsV256):
                            method_translations=method_translations,
                            args_map=args_map)
 
-    @mock.patch('nova.virt.hardware.get_mem_encryption_constraint',
-                new=mock.Mock(return_value=True))
-    @mock.patch.object(
-        objects.instance.Instance, 'image_meta',
-        new=objects.ImageMeta.from_dict({}))
-    def test_live_migrate_sev_rejected(self):
-        instance = self._stub_instance_get()
-        body = {'os-migrateLive': {'host': 'hostname',
-                                   'block_migration': 'auto'}}
-        ex = self.assertRaises(webob.exc.HTTPConflict,
-                               self.controller._migrate_live,
-                               self.req, fakes.FAKE_UUID, body=body)
-        self.assertIn("Operation 'live-migration' not supported for "
-                      "SEV-enabled instance (%s)" % instance.uuid,
-                      str(ex))
-
     def test_live_migrate_with_forced_host(self):
         body = {'os-migrateLive': {'host': 'hostname',
                                    'block_migration': 'auto',