From nobody Fri Dec 12 14:09:14 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1763986694; cv=none; d=zohomail.com; s=zohoarc; b=nxWABc67V3E2SkLPHJyIXkKlHfF0WDb442krg/iaMj2BuPrfTQoWYOyrGyEHyEihYlmWT2GvjV315/tvUG5ojuuHASyyGCuA45GVMke3bDzqJ5nWImycZ/q4/9RtjP7Tyoj6LLDzlMtSH85q7PvjusdurnSLOf1l96JqVJDmDLU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1763986694; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=ZhPONeW5ZKevUGvdsb+1b/opHxhz+0pKUVZUrP0P+CU=; b=fQbZnuavByZIfIWqRi2xzyD0o819L0NIB/V67Zr011ylsM80D3Cg/aukDFmq8XuSKuBcYzr7WeDBfSOrUFxL2LTUZRrvGgbXADfca8eUsyJ9SA5IpbUDNHec4Sku1NWaWHaTuOyg7o3371uECzgIRsVwgydjhJNNy+bpMlPKFC0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1763986694471757.9187838989283; Mon, 24 Nov 2025 04:18:14 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id E171141986; Mon, 24 Nov 2025 07:18:01 -0500 (EST) Received: from [172.19.199.65] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id F03CE4445D; Mon, 24 Nov 2025 07:15:59 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 659593F83D; Mon, 24 Nov 2025 07:15:16 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id EFEE13F33F for ; Mon, 24 Nov 2025 07:15:14 -0500 (EST) Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-221-Jo_XzqXUMPqx_orhHjkhuw-1; Mon, 24 Nov 2025 07:15:13 -0500 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8A4391954B17 for ; Mon, 24 Nov 2025 12:15:12 +0000 (UTC) Received: from toolbx.redhat.com (unknown [10.42.28.58]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7D0A219560B2; Mon, 24 Nov 2025 12:15:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1763986514; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZhPONeW5ZKevUGvdsb+1b/opHxhz+0pKUVZUrP0P+CU=; b=WIyFLYnCvESMiJjwgajzHG6QtpodDnHgvp8gyf7EJlkCHQZvRvQCQM1zc1xGiruk6lDEcg Fr4U+zT2XAgmHLwInlbpsoqap1J0rQX/dAeJjZXINGR4xx07QEQ9kTKld2IGY50QVlHLPg gU6SdAOvTsCQcpLZleqIyqESsDuik7A= X-MC-Unique: Jo_XzqXUMPqx_orhHjkhuw-1 X-Mimecast-MFC-AGG-ID: Jo_XzqXUMPqx_orhHjkhuw_1763986512 To: devel@lists.libvirt.org Subject: [PATCH v2 1/3] qemu: correctly detect working TDX support Date: Mon, 24 Nov 2025 12:15:06 +0000 Message-ID: <20251124121508.484403-2-berrange@redhat.com> In-Reply-To: <20251124121508.484403-1-berrange@redhat.com> References: <20251124121508.484403-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: xyDKmUEPOzh46yG0x_7FPxinKu1OhwKOUx_mTBm1HAA_1763986512 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: DKXKBZAYWOQCGR2C6DZKXKISC2YEKBJZ X-Message-ID-Hash: DKXKBZAYWOQCGR2C6DZKXKISC2YEKBJZ X-MailFrom: berrange@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Paolo Bonzini X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9_via_Devel?= Reply-To: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1763986695863019200 From: Daniel P. Berrang=C3=A9 Querying existence of the 'tdx-guest' type merely tells us whether QEMU has been compiled with TDX support, not whether it is usable on the host. Thus QEMU was incorrectly reporting ... tdx on every platform with new enough QEMU. Unfortunately an earlier patch for a 'query-tdx-capabilities' QMP command in QEMU was dropped, so there is no way to ask QEMU whether it can launch a TDX guest. Libvirt must directly query the KVM device and ask for supported VM types. Signed-off-by: Daniel P. Berrang=C3=A9 Reviewed-by: Peter Krempa --- src/qemu/qemu_capabilities.c | 51 ++++++++++++++++++++++++++++++++++++ src/qemu/qemu_capabilities.h | 3 +++ tests/domaincapsmock.c | 6 +++++ 3 files changed, 60 insertions(+) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 4050d5ccc6..9196ea1bb6 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -54,11 +54,17 @@ # include # include #endif +#ifdef __linux__ +# include +# include +#endif =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 VIR_LOG_INIT("qemu.qemu_capabilities"); =20 +#define KVM_DEVICE "/dev/kvm" + /* While not public, these strings must not change. They * are used in domain status files which are read on * daemon restarts @@ -3686,6 +3692,50 @@ virQEMUCapsProbeQMPSEVCapabilities(virQEMUCaps *qemu= Caps, } =20 =20 +bool +virQEMUCapsKVMSupportsVMTypeTDX(void) +{ +#if defined(KVM_CAP_VM_TYPES) && defined(KVM_X86_TDX_VM) + VIR_AUTOCLOSE kvmfd =3D -1; + int types; + + if (!virFileExists(KVM_DEVICE)) + return false; + + if ((kvmfd =3D open(KVM_DEVICE, O_RDONLY)) < 0) { + VIR_DEBUG("Unable to open %s, cannot check TDX", KVM_DEVICE); + return false; + } + + if ((types =3D ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_VM_TYPES)) < = 0) + types =3D false; + + VIR_DEBUG("KVM VM types: 0x%x", types); + + return !!(types & (1 << KVM_X86_TDX_VM)); +#else + VIR_DEBUG("KVM not compiled"); + return false; +#endif +} + + +/* This ought to be virQEMUCapsProbeQMPTDXCapabilities, + * but there is no 'query-tdx-capabilities' command + * available in QEMU currently. If one arrives, rename + * this method & switch to using that on new enough QEMU + */ +static void +virQEMUCapsProbeTDXCapabilities(virQEMUCaps *qemuCaps) +{ + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_TDX_GUEST)) + return; + + if (!virQEMUCapsKVMSupportsVMTypeTDX()) + virQEMUCapsClear(qemuCaps, QEMU_CAPS_TDX_GUEST); +} + + static int virQEMUCapsProbeQMPSGXCapabilities(virQEMUCaps *qemuCaps, qemuMonitor *mon) @@ -5910,6 +5960,7 @@ virQEMUCapsInitQMPMonitor(virQEMUCaps *qemuCaps, return -1; if (virQEMUCapsProbeQMPSGXCapabilities(qemuCaps, mon) < 0) return -1; + virQEMUCapsProbeTDXCapabilities(qemuCaps); =20 virQEMUCapsInitProcessCaps(qemuCaps); =20 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 2b519be3a8..f180844e66 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -980,3 +980,6 @@ int virQEMUCapsProbeQMPMachineTypes(virQEMUCaps *qemuCaps, virDomainVirtType virtType, qemuMonitor *mon); + +bool +virQEMUCapsKVMSupportsVMTypeTDX(void) ATTRIBUTE_MOCKABLE; diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c index cb6e98dbb8..7bece6c8c1 100644 --- a/tests/domaincapsmock.c +++ b/tests/domaincapsmock.c @@ -48,6 +48,12 @@ virHostCPUGetPhysAddrSize(const virArch hostArch, } =20 #if WITH_QEMU +bool +virQEMUCapsKVMSupportsVMTypeTDX(void) +{ + return true; +} + static bool (*real_virQEMUCapsGetKVMSupportsSecureGuest)(virQEMUCaps *qemu= Caps); =20 bool --=20 2.51.1