[pve-devel] [PATCH manager v3 2/2] Add support for TDX attestation

[Anton Iacobaeus <anton.iacobaeus@canarybit.eu>]

Add configuration options for the quote-generation-socket used to
communicate with the Quote Generation Service. This enables attestation
support for TDX using vsock or unix sockets.

More information can be found at:
https://www.qemu.org/docs/master/interop/qemu-storage-daemon-qmp-ref.html#object-QSD-qom.TdxGuestProperties

This only includes support for vsock and unix sockets. The SocketAddress
object in QEMU also supports inet and fd, which are not commonly used in
TDX.

Signed-off-by: Anton Iacobaeus <anton.iacobaeus@canarybit.eu>
---
 www/manager6/qemu/TdxEdit.js | 103 ++++++++++++++++++++++++++++++++++-
 1 file changed, 102 insertions(+), 1 deletion(-)

diff --git a/www/manager6/qemu/TdxEdit.js b/www/manager6/qemu/TdxEdit.js
index 3f43bf7a..95e086b5 100644
--- a/www/manager6/qemu/TdxEdit.js
+++ b/www/manager6/qemu/TdxEdit.js
@@ -7,9 +7,14 @@ Ext.define('PVE.qemu.TdxInputPanel', {
     viewModel: {
         data: {
             type: '__default__',
+            attestation: 1,
+            socketType: 'vsock',
         },
         formulas: {
             tdxEnabled: (get) => get('type') === 'tdx',
+            attestationEnabled: (get) => Number(get('attestation')) === 1,
+            vsockEnabled: (get) => get('socketType') === 'vsock',
+            unixSocketEnabled: (get) => get('socketType') === 'unix',
         },
     },
 
@@ -18,12 +23,17 @@ Ext.define('PVE.qemu.TdxInputPanel', {
             values.delete = 'intel-tdx';
             return values;
         }
+        if (values.tight !== undefined && !values.tight) {
+            values['unix-tight'] = 0;
+        }
+        delete values.tight;
         let ret = {};
         ret['intel-tdx'] = PVE.Parser.printPropertyString(values, 'type');
         return ret;
     },
 
     setValues: function (values) {
+        values.tight = PVE.Parser.parseBoolean(values['unix-tight'], 1);
         this.callParent(arguments);
     },
 
@@ -63,7 +73,98 @@ Ext.define('PVE.qemu.TdxInputPanel', {
         },
     ],
 
-    advancedItems: [],
+    advancedItems: [
+        {
+            xtype: 'proxmoxcheckbox',
+            fieldLabel: gettext('Enable Attestation'),
+            labelWidth: 150,
+            name: 'attestation',
+            value: 1,
+            uncheckedValue: 0,
+            bind: {
+                value: '{attestation}',
+                hidden: '{!tdxEnabled}',
+                disabled: '{!tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'proxmoxKVComboBox',
+            fieldLabel: gettext('Socket Type'),
+            labelWidth: 150,
+            name: 'socket-type',
+            value: 'vsock',
+            comboItems: [
+                ['vsock', 'VSOCK'],
+                ['unix', 'Unix Socket'],
+            ],
+            bind: {
+                value: '{socketType}',
+                hidden: '{!tdxEnabled}',
+                disabled: '{!attestationEnabled || !tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'proxmoxintegerfield',
+            fieldLabel: gettext('CID'),
+            labelWidth: 150,
+            name: 'vsock-cid',
+            minValue: 2,
+            value: '2',
+            allowBlank: false,
+            bind: {
+                hidden: '{!vsockEnabled || !tdxEnabled}',
+                disabled: '{!vsockEnabled || !attestationEnabled || !tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'proxmoxintegerfield',
+            fieldLabel: gettext('Port'),
+            labelWidth: 150,
+            name: 'vsock-port',
+            minValue: 0,
+            value: '4050',
+            allowBlank: false,
+            bind: {
+                hidden: '{!vsockEnabled || !tdxEnabled}',
+                disabled: '{!vsockEnabled || !attestationEnabled || !tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'textfield',
+            fieldLabel: gettext('Socket Path'),
+            labelWidth: 150,
+            name: 'unix-path',
+            value: '/var/run/tdx-qgs/qgs.socket',
+            allowBlank: false,
+            bind: {
+                hidden: '{!unixSocketEnabled || !tdxEnabled}',
+                disabled: '{!unixSocketEnabled || !attestationEnabled || !tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'proxmoxcheckbox',
+            fieldLabel: gettext('Abstract'),
+            labelWidth: 150,
+            name: 'unix-abstract',
+            value: 0,
+            bind: {
+                hidden: '{!unixSocketEnabled || !tdxEnabled}',
+                disabled: '{!unixSocketEnabled || !attestationEnabled || !tdxEnabled}',
+            },
+        },
+        {
+            xtype: 'proxmoxcheckbox',
+            fieldLabel: gettext('Tight'),
+            labelWidth: 150,
+            name: 'tight',
+            value: 1,
+            uncheckedValue: 0,
+            bind: {
+                hidden: '{!unixSocketEnabled || !tdxEnabled}',
+                disabled: '{!unixSocketEnabled || !attestationEnabled || !tdxEnabled}',
+            },
+        },
+    ],
 });
 
 Ext.define('PVE.qemu.TdxEdit', {
-- 
2.43.0

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel