| Message ID | f9391aea17154c05a8d51da8a15b8aec4e2d5873.1625704981.git.isaku.yamahata@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | TDX support | expand |
> +## > +# @TDXInfo: > +# > +# Information about Trust Domain Extensions (TDX) support > +# > +# @enabled: true if TDX is active > +# > +## > +{ 'struct': 'TDXInfo', > + 'data': { 'enabled': 'bool' }, > + 'if': 'defined(TARGET_I386)' > +} I think a generic 'ConfidentialComputing' enum with 'none', 'sev' and 'tdx' would be better. Hmm, I see sev already has a collection of sev-specific commands, so not sure whenever going that route now buys us much though ... take care, Gerd
On Wed, Jul 07, 2021 at 05:55:03PM -0700, isaku.yamahata@gmail.com wrote: > From: Chenyi Qiang <chenyi.qiang@intel.com> > > Add QMP commands that can be used by libvirt to query the TDX capabilities > and TDX info. The set of capabilities that needs to be reported is only > enabled at the moment, which means TDX is enabled. > > Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com> > Co-developed-by: Isaku Yamahata <isaku.yamahata@intel.com> > Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> > --- > include/sysemu/tdx.h | 6 ++++ > qapi/misc-target.json | 59 ++++++++++++++++++++++++++++++++++++++ In addition to Gerd's suggestion to use an enum, > +++ b/qapi/misc-target.json > @@ -323,3 +323,62 @@ > { 'command': 'query-sev-attestation-report', 'data': { 'mnonce': 'str' }, > 'returns': 'SevAttestationReport', > 'if': 'defined(TARGET_I386)' } > + > +## > +# @TDXInfo: > +# > +# Information about Trust Domain Extensions (TDX) support > +# > +# @enabled: true if TDX is active > +# > +## Missing a 'Since: 6.2' line, here and elsewhere in the patch. > +{ 'struct': 'TDXInfo', > + 'data': { 'enabled': 'bool' }, > + 'if': 'defined(TARGET_I386)' > +} > + > +## > +# @query-tdx: > +# > +# Returns information about TDX > +# > +# Returns: @TdxInfo > +# > +# > +# Example: > +# > +# -> { "execute": "query-tdx" } > +# <- { "return": { "enabled": true } } > +# > +## > +{ 'command': 'query-tdx', 'returns': 'TDXInfo', > + 'if': 'defined(TARGET_I386)' } > + > +## > +# @TDXCapability: > +# > +# The struct describes capability for a TDX > +# feature. > +# > +## > +{ 'struct': 'TDXCapability', > + 'data': { 'enabled': 'bool' }, > + 'if': 'defined(TARGET_I386)' } > + > +## > +# @query-tdx-capabilities: Do we need two separate commands, or could 'query-tdx' be made sufficiently powerful to tell you both whether tdx is available, and what capabilities it has, all in one command? > +# > +# This command is used to get the TDX capabilities, and is supported on Intel > +# X86 platforms only. > +# > +# Returns: @TDXCapability. > +# > +# > +# Example: > +# > +# -> { "execute": "query-tdx-capabilities" } > +# <- { "return": { 'enabled': 'bool' }} > +# > +## > +{ 'command': 'query-tdx-capabilities', 'returns': 'TDXCapability', > + 'if': 'defined(TARGET_I386)' }
diff --git a/include/sysemu/tdx.h b/include/sysemu/tdx.h index f3eced10f9..756f46d2de 100644 --- a/include/sysemu/tdx.h +++ b/include/sysemu/tdx.h @@ -13,4 +13,10 @@ int tdx_system_firmware_init(PCMachineState *pcms, MemoryRegion *rom_memory); void tdx_pre_create_vcpu(CPUState *cpu); void tdx_post_init_vcpu(CPUState *cpu); +struct TDXInfo; +struct TDXInfo *tdx_get_info(void); + +struct TDXCapability; +struct TDXCapability *tdx_get_capabilities(void); + #endif diff --git a/qapi/misc-target.json b/qapi/misc-target.json index 5573dcf8f0..c1de95c082 100644 --- a/qapi/misc-target.json +++ b/qapi/misc-target.json @@ -323,3 +323,62 @@ { 'command': 'query-sev-attestation-report', 'data': { 'mnonce': 'str' }, 'returns': 'SevAttestationReport', 'if': 'defined(TARGET_I386)' } + +## +# @TDXInfo: +# +# Information about Trust Domain Extensions (TDX) support +# +# @enabled: true if TDX is active +# +## +{ 'struct': 'TDXInfo', + 'data': { 'enabled': 'bool' }, + 'if': 'defined(TARGET_I386)' +} + +## +# @query-tdx: +# +# Returns information about TDX +# +# Returns: @TdxInfo +# +# +# Example: +# +# -> { "execute": "query-tdx" } +# <- { "return": { "enabled": true } } +# +## +{ 'command': 'query-tdx', 'returns': 'TDXInfo', + 'if': 'defined(TARGET_I386)' } + +## +# @TDXCapability: +# +# The struct describes capability for a TDX +# feature. +# +## +{ 'struct': 'TDXCapability', + 'data': { 'enabled': 'bool' }, + 'if': 'defined(TARGET_I386)' } + +## +# @query-tdx-capabilities: +# +# This command is used to get the TDX capabilities, and is supported on Intel +# X86 platforms only. +# +# Returns: @TDXCapability. +# +# +# Example: +# +# -> { "execute": "query-tdx-capabilities" } +# <- { "return": { 'enabled': 'bool' }} +# +## +{ 'command': 'query-tdx-capabilities', 'returns': 'TDXCapability', + 'if': 'defined(TARGET_I386)' } diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c index 4e1a0a4280..5d8faf0716 100644 --- a/target/i386/kvm/tdx-stub.c +++ b/target/i386/kvm/tdx-stub.c @@ -21,3 +21,13 @@ void tdx_pre_create_vcpu(CPUState *cpu) void tdx_post_init_vcpu(CPUState *cpu) { } + +struct TDXInfo *tdx_get_info(void) +{ + return NULL; +} + +struct TDXCapability *tdx_get_capabilities(void) +{ + return NULL; +} diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c index 6b560c1c0b..1316d95209 100644 --- a/target/i386/kvm/tdx.c +++ b/target/i386/kvm/tdx.c @@ -22,6 +22,7 @@ #include "hw/i386/tdvf-hob.h" #include "qapi/error.h" #include "qom/object_interfaces.h" +#include "qapi/qapi-types-misc-target.h" #include "standard-headers/asm-x86/kvm_para.h" #include "sysemu/sysemu.h" #include "sysemu/kvm.h" @@ -39,6 +40,24 @@ bool kvm_has_tdx(KVMState *s) return !!(kvm_check_extension(s, KVM_CAP_VM_TYPES) & BIT(KVM_X86_TDX_VM)); } +TDXInfo *tdx_get_info(void) +{ + TDXInfo *info; + + info = g_new0(TDXInfo, 1); + info->enabled = kvm_enabled() && kvm_tdx_enabled(); + return info; +} + +TDXCapability *tdx_get_capabilities(void) +{ + TDXCapability *cap; + + cap = g_new0(TDXCapability, 1); + cap->enabled = kvm_enabled() && kvm_has_tdx(kvm_state); + return cap; +} + static void __tdx_ioctl(void *state, int ioctl_no, const char *ioctl_name, __u32 metadata, void *data) { diff --git a/target/i386/monitor.c b/target/i386/monitor.c index 119211f0b0..c0be99d13d 100644 --- a/target/i386/monitor.c +++ b/target/i386/monitor.c @@ -30,6 +30,7 @@ #include "qapi/qmp/qdict.h" #include "sysemu/kvm.h" #include "sysemu/sev.h" +#include "sysemu/tdx.h" #include "qapi/error.h" #include "sev_i386.h" #include "qapi/qapi-commands-misc-target.h" @@ -763,3 +764,25 @@ qmp_query_sev_attestation_report(const char *mnonce, Error **errp) { return sev_get_attestation_report(mnonce, errp); } + +TDXInfo *qmp_query_tdx(Error **errp) +{ + TDXInfo *info; + + info = tdx_get_info(); + if (!info) { + error_setg(errp, "TDX is not available."); + } + return info; +} + +TDXCapability *qmp_query_tdx_capabilities(Error **errp) +{ + TDXCapability *cap; + + cap = tdx_get_capabilities(); + if (!cap) { + error_setg(errp, "TDX is not available."); + } + return cap; +}