108 lines
3.8 KiB
Diff
108 lines
3.8 KiB
Diff
From 25a90b6f6c0350556c26516a18874040271500a3 Mon Sep 17 00:00:00 2001
|
|
Message-ID: <25a90b6f6c0350556c26516a18874040271500a3.1759908359.git.jdenemar@redhat.com>
|
|
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
|
Date: Thu, 10 Jul 2025 03:21:03 -0400
|
|
Subject: [PATCH] tools: Secure guest check for Intel in virt-host-validate
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Add check in virt-host-validate for secure guest support
|
|
on x86 for Intel Trust Domain Extentions.
|
|
|
|
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
|
|
(cherry picked from commit 908bb55724837e66778e6a2c264c9e92b51d7eb6)
|
|
Resolves: https://issues.redhat.com/browse/RHEL-111863
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
tools/virt-host-validate-common.c | 31 ++++++++++++++++++++++++++++++-
|
|
tools/virt-host-validate-common.h | 1 +
|
|
2 files changed, 31 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c
|
|
index 63cc3dbe7b..59f6ac3319 100644
|
|
--- a/tools/virt-host-validate-common.c
|
|
+++ b/tools/virt-host-validate-common.c
|
|
@@ -44,7 +44,8 @@ VIR_ENUM_IMPL(virHostValidateCPUFlag,
|
|
"svm",
|
|
"sie",
|
|
"158",
|
|
- "sev");
|
|
+ "sev",
|
|
+ "tdx_host_platform");
|
|
|
|
|
|
int virHostValidateDeviceExists(const char *hvname,
|
|
@@ -434,12 +435,36 @@ virHostValidateAMDSev(const char *hvname,
|
|
}
|
|
|
|
|
|
+static int virHostValidateIntelTDX(virValidateLevel level)
|
|
+{
|
|
+ g_autofree char *mod_value = NULL;
|
|
+
|
|
+ if (virFileReadValueString(&mod_value, "/sys/module/kvm_intel/parameters/tdx") < 0) {
|
|
+ virValidateFail(level, "Intel Trust Domain Extentions not "
|
|
+ "supported by the currently used kernel");
|
|
+ return VIR_VALIDATE_FAILURE(level);
|
|
+ }
|
|
+
|
|
+ if (mod_value[0] != 'Y') {
|
|
+ virValidateFail(level,
|
|
+ "Intel Trust Domain Extentions appears to be "
|
|
+ "disabled in kernel. Add kvm_intel.tdx=Y "
|
|
+ "to the kernel cmdline arguments");
|
|
+ return VIR_VALIDATE_FAILURE(level);
|
|
+ }
|
|
+
|
|
+ virValidatePass();
|
|
+ return 1;
|
|
+}
|
|
+
|
|
+
|
|
int virHostValidateSecureGuests(const char *hvname,
|
|
virValidateLevel level)
|
|
{
|
|
g_autoptr(virBitmap) flags = NULL;
|
|
bool hasFac158 = false;
|
|
bool hasAMDSev = false;
|
|
+ bool hasIntelTDX = false;
|
|
virArch arch = virArchFromHost();
|
|
g_autofree char *cmdline = NULL;
|
|
static const char *kIBMValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"};
|
|
@@ -450,6 +475,8 @@ int virHostValidateSecureGuests(const char *hvname,
|
|
hasFac158 = true;
|
|
else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SEV))
|
|
hasAMDSev = true;
|
|
+ else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_TDX))
|
|
+ hasIntelTDX = true;
|
|
|
|
virValidateCheck(hvname, "%s", _("Checking for secure guest support"));
|
|
if (ARCH_IS_S390(arch)) {
|
|
@@ -485,6 +512,8 @@ int virHostValidateSecureGuests(const char *hvname,
|
|
}
|
|
} else if (hasAMDSev) {
|
|
return virHostValidateAMDSev(hvname, level);
|
|
+ } else if (hasIntelTDX) {
|
|
+ return virHostValidateIntelTDX(level);
|
|
}
|
|
|
|
virValidateFail(level,
|
|
diff --git a/tools/virt-host-validate-common.h b/tools/virt-host-validate-common.h
|
|
index 7fb3545fe3..c81d203933 100644
|
|
--- a/tools/virt-host-validate-common.h
|
|
+++ b/tools/virt-host-validate-common.h
|
|
@@ -32,6 +32,7 @@ typedef enum {
|
|
VIR_HOST_VALIDATE_CPU_FLAG_SIE,
|
|
VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158,
|
|
VIR_HOST_VALIDATE_CPU_FLAG_SEV,
|
|
+ VIR_HOST_VALIDATE_CPU_FLAG_TDX,
|
|
|
|
VIR_HOST_VALIDATE_CPU_FLAG_LAST,
|
|
} virHostValidateCPUFlag;
|
|
--
|
|
2.51.0
|