[PATCH v1 01/18] tools: Secure guest check for Intel in virt-host-validate

[Zhenzhong Duan]

Add check in virt-host-validate for secure guest support
on x86 for Intel Trust Domain Extentions.

Suggested-by: Daniel P. Berrangé <berra...@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.d...@intel.com>
Reviewed-by: Daniel P. Berrangé <berra...@redhat.com>
---
 tools/virt-host-validate-common.c | 31 ++++++++++++++++++++++++++++++-
 tools/virt-host-validate-common.h |  1 +
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/tools/virt-host-validate-common.c 
b/tools/virt-host-validate-common.c
index 63cc3dbe7b..59f6ac3319 100644
--- a/tools/virt-host-validate-common.c
+++ b/tools/virt-host-validate-common.c
@@ -44,7 +44,8 @@ VIR_ENUM_IMPL(virHostValidateCPUFlag,
               "svm",
               "sie",
               "158",
-              "sev");
+              "sev",
+              "tdx_host_platform");
 
 
 int virHostValidateDeviceExists(const char *hvname,
@@ -434,12 +435,36 @@ virHostValidateAMDSev(const char *hvname,
 }
 
 
+static int virHostValidateIntelTDX(virValidateLevel level)
+{
+    g_autofree char *mod_value = NULL;
+
+    if (virFileReadValueString(&mod_value, 
"/sys/module/kvm_intel/parameters/tdx") < 0) {
+        virValidateFail(level, "Intel Trust Domain Extentions not "
+                               "supported by the currently used kernel");
+        return VIR_VALIDATE_FAILURE(level);
+    }
+
+    if (mod_value[0] != 'Y') {
+        virValidateFail(level,
+                        "Intel Trust Domain Extentions appears to be "
+                        "disabled in kernel. Add kvm_intel.tdx=Y "
+                        "to the kernel cmdline arguments");
+        return VIR_VALIDATE_FAILURE(level);
+    }
+
+    virValidatePass();
+    return 1;
+}
+
+
 int virHostValidateSecureGuests(const char *hvname,
                                 virValidateLevel level)
 {
     g_autoptr(virBitmap) flags = NULL;
     bool hasFac158 = false;
     bool hasAMDSev = false;
+    bool hasIntelTDX = false;
     virArch arch = virArchFromHost();
     g_autofree char *cmdline = NULL;
     static const char *kIBMValues[] = {"y", "Y", "on", "ON", "oN", "On", "1"};
@@ -450,6 +475,8 @@ int virHostValidateSecureGuests(const char *hvname,
         hasFac158 = true;
     else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SEV))
         hasAMDSev = true;
+    else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_TDX))
+        hasIntelTDX = true;
 
     virValidateCheck(hvname, "%s", _("Checking for secure guest support"));
     if (ARCH_IS_S390(arch)) {
@@ -485,6 +512,8 @@ int virHostValidateSecureGuests(const char *hvname,
         }
     } else if (hasAMDSev) {
         return virHostValidateAMDSev(hvname, level);
+    } else if (hasIntelTDX) {
+        return virHostValidateIntelTDX(level);
     }
 
     virValidateFail(level,
diff --git a/tools/virt-host-validate-common.h 
b/tools/virt-host-validate-common.h
index 7fb3545fe3..c81d203933 100644
--- a/tools/virt-host-validate-common.h
+++ b/tools/virt-host-validate-common.h
@@ -32,6 +32,7 @@ typedef enum {
     VIR_HOST_VALIDATE_CPU_FLAG_SIE,
     VIR_HOST_VALIDATE_CPU_FLAG_FACILITY_158,
     VIR_HOST_VALIDATE_CPU_FLAG_SEV,
+    VIR_HOST_VALIDATE_CPU_FLAG_TDX,
 
     VIR_HOST_VALIDATE_CPU_FLAG_LAST,
 } virHostValidateCPUFlag;
-- 
2.34.1