[pve-devel] [PATCH qemu-server v3 4/4] Add support for TDX quote-generation-socket object

[Fiona Ebner]

Am 28.10.25 um 1:56 PM schrieb Anton Iacobaeus:
> @@ -291,6 +291,50 @@ my $tdx_fmt = {
>          format_description => "tdx-type",
>          enum => ['tdx'],
>      },
> +    'attestation' => {
> +        description => "Enable TDX attestation by including quote-generation-socket",
> +        type => 'boolean',
> +        default => 1,
> +    },
> +    'socket-type' => {
> +        type => 'string',
> +        optional => 1,
> +        enum => ['unix', 'vsock'],
> +        default => 'vsock',
> +        description => "Socket type to communicate with the Quote Generation Service",
> +    },
> +    'vsock-cid' => {
> +        type => 'integer',
> +        minimum => 2,
> +        default => 2,
> +        optional => 1,
> +        description => "CID for vsock of Quote Generation Service",
> +    },
> +    'vsock-port' => {
> +        type => 'integer',
> +        minimum => 0,
> +        default => 4050,
> +        optional => 1,
> +        description => "Port for vsock of Quote Generation Service",
> +    },
> +    'unix-path' => {
> +        type => 'string',
> +        optional => 1,
> +        description => "Path to Unix socket",
> +        format_description => "unix-path",
> +    },
> +    'unix-abstract' => {
> +        description => "Use Linux abstract socket address",
> +        type => 'boolean',
> +        default => 0,
> +        optional => 1,
> +    },
> +    'unix-tight' => {
> +        description => "Pads the abstract socket address.",
> +        type => 'boolean',
> +        default => 1,
> +        optional => 1,
> +    },

Do we really want/need to support all these possible configuration
options to start out? In particular, 'unix-tight' and 'unix-abstract'
seem like we could rather just require users to set it up a certain way.
Maybe vsock+cid+port is enough to begin with and we can add more when
users actually request it? Or are there situations where a vsock cannot
easily be set up?

>  };
>  PVE::JSONSchema::register_format('pve-qemu-tdx-fmt', $tdx_fmt);
>  
> @@ -960,6 +1004,36 @@ sub get_amd_sev_object {
>      return $sev_mem_object;
>  }
>  
> +sub get_quote_generation_socket {
> +    my ($conf) = @_;
> +    my $type = $conf->{'socket-type'}
> +        or die "A socket type is required for Quote Generation Socket.\n";
> +
> +    my $socket = {
> +        type => $type,
> +    };
> +
> +    if ($type eq 'unix') {
> +        my $path = $conf->{'unix-path'}
> +            or die "Missing path for unix socket.\n";
> +
> +        $socket->{'path'} = $path;
> +        $socket->{'abstract'} = json_bool($conf->{'unix-abstract'})
> +            if defined $conf->{'unix-abstract'};
> +        $socket->{'tight'} = json_bool($conf->{'unix-tight'})
> +            if defined $conf->{'unix-tight'};
> +    } elsif ($type eq 'vsock') {
> +        my ($cid, $port) = @{$conf}{ 'vsock-cid', 'vsock-port' };

Style nit: our code base uses the following style:
$conf->@{qw(vsock-cid vsock-port)};

> +        die "Missing cid/port for vsock.\n" unless defined $cid && defined $port;

Style nit: we don't usually use unless [0] and please use parentheses
with defined()

> +
> +        @$socket{ 'cid', 'port' } = ($cid, $port);

Style nit: again, not really a style seen in our code base, I'd prefer
to just have two assignments

> +    } else {
> +        die "Unsupported socket type for TDX Quote Generation Socket.\n";
> +    }
> +
> +    return $socket;
> +}
> +
>  sub get_intel_tdx_object {
>      my ($intel_tdx, $bios) = @_;
>      my $intel_tdx_conf = PVE::JSONSchema::parse_property_string($tdx_fmt, $intel_tdx);
> @@ -971,7 +1045,16 @@ sub get_intel_tdx_object {
>      if (!$bios || $bios ne 'ovmf') {
>          die "To use Intel TDX, you need to change the BIOS to OVMF.\n";
>      }
> -    return 'tdx-guest,id=tdx0';
> +
> +    my $tdx_object = {
> +        'qom-type' => 'tdx-guest',
> +        id => 'tdx0',
> +    };
> +
> +    $tdx_object->{'quote-generation-socket'} = get_quote_generation_socket($intel_tdx_conf)
> +        unless !$intel_tdx_conf->{'attestation'};

Style nit regarding unless

[0]: https://pve.proxmox.com/wiki/Perl_Style_Guide#Perl_syntax_choices