[pve-devel] [PATCH qemu-server v3 4/4] Add support for TDX quote-generation-socket object

[Anton Iacobaeus <anton.iacobaeus@canarybit.eu>]

Extend the tdx object with the quote-generation-socket as defined in:
https://www.qemu.org/docs/master/interop/qemu-storage-daemon-qmp-ref.html#object-QSD-qom.TdxGuestProperties

Only vsock and unix sockets are included here since they are the most
commonly used socket types with TDX attestation.

Signed-off-by: Anton Iacobaeus <anton.iacobaeus@canarybit.eu>
---
 src/PVE/QemuServer.pm           |  3 +-
 src/PVE/QemuServer/CPUConfig.pm | 87 ++++++++++++++++++++++++++++++++-
 2 files changed, 87 insertions(+), 3 deletions(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 98180506..77aa612a 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -3770,7 +3770,8 @@ sub config_to_command {
         push @$devices, '-object', get_amd_sev_object($conf->{'amd-sev'}, $conf->{bios});
         push @$machineFlags, 'confidential-guest-support=sev0';
     } elsif ($conf->{'intel-tdx'}) {
-        push @$devices, '-object', get_intel_tdx_object($conf->{'intel-tdx'}, $conf->{bios});
+        my $tdx_object = get_intel_tdx_object($conf->{'intel-tdx'}, $conf->{bios});
+        push @$devices, '-object', to_json($tdx_object, { canonical => 1 });
         push @$machineFlags, 'confidential-guest-support=tdx0';
         push @$machineFlags, 'kernel_irqchip=split';
     }
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index 415d1a9f..a847085c 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -5,7 +5,7 @@ use warnings;
 
 use JSON;
 
-use PVE::JSONSchema;
+use PVE::JSONSchema qw(json_bool);
 use PVE::Cluster qw(cfs_register_file cfs_read_file);
 use PVE::Tools qw(run_command get_host_arch);
 use PVE::QemuServer::Helpers qw(min_version);
@@ -291,6 +291,50 @@ my $tdx_fmt = {
         format_description => "tdx-type",
         enum => ['tdx'],
     },
+    'attestation' => {
+        description => "Enable TDX attestation by including quote-generation-socket",
+        type => 'boolean',
+        default => 1,
+    },
+    'socket-type' => {
+        type => 'string',
+        optional => 1,
+        enum => ['unix', 'vsock'],
+        default => 'vsock',
+        description => "Socket type to communicate with the Quote Generation Service",
+    },
+    'vsock-cid' => {
+        type => 'integer',
+        minimum => 2,
+        default => 2,
+        optional => 1,
+        description => "CID for vsock of Quote Generation Service",
+    },
+    'vsock-port' => {
+        type => 'integer',
+        minimum => 0,
+        default => 4050,
+        optional => 1,
+        description => "Port for vsock of Quote Generation Service",
+    },
+    'unix-path' => {
+        type => 'string',
+        optional => 1,
+        description => "Path to Unix socket",
+        format_description => "unix-path",
+    },
+    'unix-abstract' => {
+        description => "Use Linux abstract socket address",
+        type => 'boolean',
+        default => 0,
+        optional => 1,
+    },
+    'unix-tight' => {
+        description => "Pads the abstract socket address.",
+        type => 'boolean',
+        default => 1,
+        optional => 1,
+    },
 };
 PVE::JSONSchema::register_format('pve-qemu-tdx-fmt', $tdx_fmt);
 
@@ -960,6 +1004,36 @@ sub get_amd_sev_object {
     return $sev_mem_object;
 }
 
+sub get_quote_generation_socket {
+    my ($conf) = @_;
+    my $type = $conf->{'socket-type'}
+        or die "A socket type is required for Quote Generation Socket.\n";
+
+    my $socket = {
+        type => $type,
+    };
+
+    if ($type eq 'unix') {
+        my $path = $conf->{'unix-path'}
+            or die "Missing path for unix socket.\n";
+
+        $socket->{'path'} = $path;
+        $socket->{'abstract'} = json_bool($conf->{'unix-abstract'})
+            if defined $conf->{'unix-abstract'};
+        $socket->{'tight'} = json_bool($conf->{'unix-tight'})
+            if defined $conf->{'unix-tight'};
+    } elsif ($type eq 'vsock') {
+        my ($cid, $port) = @{$conf}{ 'vsock-cid', 'vsock-port' };
+        die "Missing cid/port for vsock.\n" unless defined $cid && defined $port;
+
+        @$socket{ 'cid', 'port' } = ($cid, $port);
+    } else {
+        die "Unsupported socket type for TDX Quote Generation Socket.\n";
+    }
+
+    return $socket;
+}
+
 sub get_intel_tdx_object {
     my ($intel_tdx, $bios) = @_;
     my $intel_tdx_conf = PVE::JSONSchema::parse_property_string($tdx_fmt, $intel_tdx);
@@ -971,7 +1045,16 @@ sub get_intel_tdx_object {
     if (!$bios || $bios ne 'ovmf') {
         die "To use Intel TDX, you need to change the BIOS to OVMF.\n";
     }
-    return 'tdx-guest,id=tdx0';
+
+    my $tdx_object = {
+        'qom-type' => 'tdx-guest',
+        id => 'tdx0',
+    };
+
+    $tdx_object->{'quote-generation-socket'} = get_quote_generation_socket($intel_tdx_conf)
+        unless !$intel_tdx_conf->{'attestation'};
+
+    return $tdx_object;
 }
 
 __PACKAGE__->register();
-- 
2.43.0

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel