[pve-devel] [PATCH qemu-server 2/3] Add check for TDX support

[Anton Iacobaeus]

From: Philipp Giersfeld <philipp.giersfeld at canarybit.eu>

Check whether TDX is enabled on this machine. Instead of using CPUID
like AMD SEV, Intel TDX enablement can be verified by reading an MSR
(https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/05/host_os_setup/).

Signed-off-by: Philipp Giersfeld <philipp.giersfeld at canarybit.eu>
Signed-off-by: Anton Iacobaeus <anton.iacobaeus at canarybit.eu>
---
 .../query-machine-capabilities.c              | 56 ++++++++++++++++++-
 src/usr/modules-load.conf                     |  1 +
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/src/query-machine-capabilities/query-machine-capabilities.c b/src/query-machine-capabilities/query-machine-capabilities.c
index 0c522afc..913d15c5 100644
--- a/src/query-machine-capabilities/query-machine-capabilities.c
+++ b/src/query-machine-capabilities/query-machine-capabilities.c
@@ -4,6 +4,9 @@
 #include <sys/stat.h>
 #include <errno.h>
 #include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
 
 #define eprintf(...) fprintf(stderr, __VA_ARGS__)
 
@@ -15,11 +18,49 @@ typedef struct {
     bool sev_support;
     bool sev_es_support;
     bool sev_snp_support;
+    bool tdx_support;
 
     uint8_t cbitpos;
     uint8_t reduced_phys_bits;
 } cpu_caps_t;
 
+int read_msr(uint32_t msr_index, unsigned int *value) {
+    int64_t data;
+    char* msr_file_name = "/dev/cpu/0/msr";
+    int fd;
+
+    fd = open(msr_file_name, O_RDONLY);
+    if (fd < 0) {
+            if (errno == ENXIO) {
+                fprintf(stderr, "rdmsr: No CPU 0\n");
+                exit(2);
+            } else if (errno == EIO) {
+                    fprintf(stderr, "rdmsr: CPU oesn't support MSRs\n");
+                    exit(3);
+	    } else {
+                perror("rdmsr: open");
+                exit(127);
+            }
+    }
+
+    if (pread(fd, &data, sizeof data, msr_index) != sizeof data) {
+        if (errno == EIO) {
+            fprintf(stderr, "rdmsr: CPU cannot read MSR 0x%08x\n", msr_index);
+            exit(4);
+        } else {
+            perror("rdmsr: pread");
+            exit(127);
+        }
+    }
+
+
+    *value = data;
+
+    close(fd);
+    return 0;
+}
+
+
 void query_cpu_capabilities(cpu_caps_t *res) {
     uint32_t eax, ebx, ecx, edx;
 
@@ -37,6 +78,15 @@ void query_cpu_capabilities(cpu_caps_t *res) {
 
     res->cbitpos = ebx & 0x3f;
     res->reduced_phys_bits = (ebx >> 6) & 0x3f;
+
+    unsigned int value;
+
+    if (read_msr(0x1401, &value) == 0) {
+        fprintf(stderr, "to read MSR: %08x \n", value);
+        res->tdx_support = (value & (1<<11));
+    } else {
+        fprintf(stderr, "Failed to read MSR\n");
+    }
 }
 
 int prepare_output_directory() {
@@ -82,13 +132,17 @@ int main() {
         " \"sev-support\": %s,"
         " \"sev-support-es\": %s,"
         " \"sev-support-snp\": %s"
+        " },"
+        " \"intel-tdx\": {"
+        " \"tdx-support\": %s"
         " }"
         " }\n",
         caps.cbitpos,
         caps.reduced_phys_bits,
         caps.sev_support ? "true" : "false",
         caps.sev_es_support ? "true" : "false",
-        caps.sev_snp_support ? "true" : "false"
+        caps.sev_snp_support ? "true" : "false",
+        caps.tdx_support ? "true" : "false"
     );
     if (ret < 0) {
         eprintf("Error writing to file '" OUTPUT_PATH "': %s\n", strerror(errno));
diff --git a/src/usr/modules-load.conf b/src/usr/modules-load.conf
index aee7d42a..f45d256b 100644
--- a/src/usr/modules-load.conf
+++ b/src/usr/modules-load.conf
@@ -1 +1,2 @@
 vhost_net
+msr
-- 
2.43.0