[pve-devel] [PATCH qemu-server 2/3] Add check for TDX support

[Thomas Lamprecht]

Am 16.09.25 um 11:14 schrieb Anton Iacobaeus:
> From: Philipp Giersfeld <philipp.giersfeld at canarybit.eu>
> 
> Check whether TDX is enabled on this machine. Instead of using CPUID
> like AMD SEV, Intel TDX enablement can be verified by reading an MSR
> (https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/05/host_os_setup/).
> 
> Signed-off-by: Philipp Giersfeld <philipp.giersfeld at canarybit.eu>
> Signed-off-by: Anton Iacobaeus <anton.iacobaeus at canarybit.eu>
> ---
>  .../query-machine-capabilities.c              | 56 ++++++++++++++++++-
>  src/usr/modules-load.conf                     |  1 +
>  2 files changed, 56 insertions(+), 1 deletion(-)
> 
> diff --git a/src/query-machine-capabilities/query-machine-capabilities.c b/src/query-machine-capabilities/query-machine-capabilities.c
> index 0c522afc..913d15c5 100644
> --- a/src/query-machine-capabilities/query-machine-capabilities.c
> +++ b/src/query-machine-capabilities/query-machine-capabilities.c
> @@ -4,6 +4,9 @@
>  #include <sys/stat.h>
>  #include <errno.h>
>  #include <string.h>
> +#include <stdlib.h>
> +#include <unistd.h>
> +#include <fcntl.h>
>  
>  #define eprintf(...) fprintf(stderr, __VA_ARGS__)
>  
> @@ -15,11 +18,49 @@ typedef struct {
>      bool sev_support;
>      bool sev_es_support;
>      bool sev_snp_support;
> +    bool tdx_support;
>  
>      uint8_t cbitpos;
>      uint8_t reduced_phys_bits;
>  } cpu_caps_t;
>  
> +int read_msr(uint32_t msr_index, unsigned int *value) {
> +    int64_t data;
> +    char* msr_file_name = "/dev/cpu/0/msr";
> +    int fd;
> +
> +    fd = open(msr_file_name, O_RDONLY);
> +    if (fd < 0) {
> +            if (errno == ENXIO) {
> +                fprintf(stderr, "rdmsr: No CPU 0\n");
> +                exit(2);

let's please not randomly exit in some helper function due to an error
specific to that function, but rather return with an error code from
the function and map that to "null" or not including the respective keys
in the JSON output (either is fine for me).

> +            } else if (errno == EIO) {
> +                    fprintf(stderr, "rdmsr: CPU oesn't support MSRs\n");
> +                    exit(3);

same here w.r.t exit.

> +	    } else {
> +                perror("rdmsr: open");
> +                exit(127);

same here w.r.t exit.

> +            }
> +    }
> +
> +    if (pread(fd, &data, sizeof data, msr_index) != sizeof data) {
> +        if (errno == EIO) {
> +            fprintf(stderr, "rdmsr: CPU cannot read MSR 0x%08x\n", msr_index);
> +            exit(4);

same here w.r.t exit.

> +        } else {
> +            perror("rdmsr: pread");
> +            exit(127);

same here w.r.t exit.

> +        }
> +    }
> +
> +
> +    *value = data;
> +
> +    close(fd);
> +    return 0;
> +}
> +
> +
>  void query_cpu_capabilities(cpu_caps_t *res) {
>      uint32_t eax, ebx, ecx, edx;
>  
> @@ -37,6 +78,15 @@ void query_cpu_capabilities(cpu_caps_t *res) {
>  
>      res->cbitpos = ebx & 0x3f;
>      res->reduced_phys_bits = (ebx >> 6) & 0x3f;
> +
> +    unsigned int value;
> +
> +    if (read_msr(0x1401, &value) == 0) {

> +        fprintf(stderr, "to read MSR: %08x \n", value);

We do not have any always-on debugging outputs here, either add a helper
for that which can be optionally enabled on build through defining a
constant or just omit it for now.

> +        res->tdx_support = (value & (1<<11));
> +    } else {

As of now this is a dead branch as read_msr either returns 0 or exits
the program.

> +        fprintf(stderr, "Failed to read MSR\n");

please re-use the `eprintf` helper we define here in the file and use
everywhere else.

> +    }
>  }
>  
>  int prepare_output_directory() {
> @@ -82,13 +132,17 @@ int main() {
>          " \"sev-support\": %s,"
>          " \"sev-support-es\": %s,"
>          " \"sev-support-snp\": %s"
> +        " },"
> +        " \"intel-tdx\": {"
> +        " \"tdx-support\": %s"
>          " }"
>          " }\n",
>          caps.cbitpos,
>          caps.reduced_phys_bits,
>          caps.sev_support ? "true" : "false",
>          caps.sev_es_support ? "true" : "false",
> -        caps.sev_snp_support ? "true" : "false"
> +        caps.sev_snp_support ? "true" : "false",
> +        caps.tdx_support ? "true" : "false"
>      );
>      if (ret < 0) {
>          eprintf("Error writing to file '" OUTPUT_PATH "': %s\n", strerror(errno));
> diff --git a/src/usr/modules-load.conf b/src/usr/modules-load.conf
> index aee7d42a..f45d256b 100644
> --- a/src/usr/modules-load.conf
> +++ b/src/usr/modules-load.conf
> @@ -1 +1,2 @@
>  vhost_net
> +msr