From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 10 Jul 2025 07:21:08 +0000 (-0400)
Subject: conf: Expose TDX feature in domain capabilities
X-Git-Tag: v11.6.0-rc1~29
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f87397488337ed596b0961855ccdea81de0e161c;p=thirdparty%2Flibvirt.git

conf: Expose TDX feature in domain capabilities

Extend qemu TDX capability to domain capabilities.

Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---

diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst
index ed95af4fee..664194b16d 100644
--- a/docs/formatdomaincaps.rst
+++ b/docs/formatdomaincaps.rst
@@ -720,6 +720,7 @@ capabilities. All features occur as children of the main ``features`` element.
        <backingStoreInput supported='yes'/>
        <backup supported='yes'/>
        <async-teardown supported='yes'/>
+       <tdx supported='yes'/>
        <sev>
          <cbitpos>47</cbitpos>
          <reduced-phys-bits>1</reduced-phys-bits>
diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c
index f7cce92ca1..f29c4e0515 100644
--- a/src/conf/domain_capabilities.c
+++ b/src/conf/domain_capabilities.c
@@ -44,6 +44,7 @@ VIR_ENUM_IMPL(virDomainCapsFeature,
               "async-teardown",
               "s390-pv",
               "ps2",
+              "tdx",
 );
 
 static virClass *virDomainCapsClass;
diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h
index 60d5fe77de..43141dbdd5 100644
--- a/src/conf/domain_capabilities.h
+++ b/src/conf/domain_capabilities.h
@@ -281,6 +281,7 @@ typedef enum {
     VIR_DOMAIN_CAPS_FEATURE_ASYNC_TEARDOWN,
     VIR_DOMAIN_CAPS_FEATURE_S390_PV,
     VIR_DOMAIN_CAPS_FEATURE_PS2,
+    VIR_DOMAIN_CAPS_FEATURE_TDX,
 
     VIR_DOMAIN_CAPS_FEATURE_LAST
 } virDomainCapsFeature;
diff --git a/src/conf/schemas/domaincaps.rng b/src/conf/schemas/domaincaps.rng
index 8bc34691c7..7edae54931 100644
--- a/src/conf/schemas/domaincaps.rng
+++ b/src/conf/schemas/domaincaps.rng
@@ -367,6 +367,9 @@
       <optional>
         <ref name="ps2"/>
       </optional>
+      <optional>
+        <ref name="tdx"/>
+      </optional>
       <optional>
         <ref name="sev"/>
       </optional>
@@ -431,6 +434,12 @@
     </element>
   </define>
 
+  <define name="tdx">
+    <element name="tdx">
+      <ref name="supported"/>
+    </element>
+  </define>
+
   <define name="sev">
     <element name="sev">
       <ref name="supported"/>
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index 3def894a22..f4f77a491c 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -7012,6 +7012,18 @@ virQEMUCapsFillDomainFeatureHypervCaps(virQEMUCaps *qemuCaps,
 }
 
 
+static void
+virQEMUCapsFillDomainFeatureTDXCaps(virQEMUCaps *qemuCaps,
+                                    virDomainCaps *domCaps)
+{
+    if (domCaps->arch == VIR_ARCH_X86_64 &&
+        domCaps->virttype == VIR_DOMAIN_VIRT_KVM &&
+        virQEMUCapsGet(qemuCaps, QEMU_CAPS_TDX_GUEST) &&
+        virQEMUCapsGetKVMSupportsSecureGuest(qemuCaps))
+            domCaps->features[VIR_DOMAIN_CAPS_FEATURE_TDX] = VIR_TRISTATE_BOOL_YES;
+}
+
+
 int
 virQEMUCapsFillDomainCaps(virQEMUDriverConfig *cfg,
                           virQEMUCaps *qemuCaps,
@@ -7076,6 +7088,7 @@ virQEMUCapsFillDomainCaps(virQEMUDriverConfig *cfg,
     virQEMUCapsFillDomainFeaturePS2Caps(qemuCaps, domCaps);
     virQEMUCapsFillDomainFeatureSGXCaps(qemuCaps, domCaps);
     virQEMUCapsFillDomainFeatureHypervCaps(qemuCaps, domCaps);
+    virQEMUCapsFillDomainFeatureTDXCaps(qemuCaps, domCaps);
     virQEMUCapsFillDomainDeviceCryptoCaps(qemuCaps, crypto);
     virQEMUCapsFillDomainLaunchSecurity(qemuCaps, launchSecurity);
     virQEMUCapsFillDomainDeviceNetCaps(qemuCaps, net);
diff --git a/tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml b/tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml
index 2bca47b8b1..61aa1aafd0 100644
--- a/tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml
+++ b/tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml
@@ -739,6 +739,7 @@
     <backup supported='yes'/>
     <async-teardown supported='yes'/>
     <ps2 supported='yes'/>
+    <tdx supported='yes'/>
     <sev supported='no'/>
     <sgx supported='yes'>
       <flc>yes</flc>
diff --git a/tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml b/tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml
index e3558bd834..d85073300d 100644
--- a/tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml
@@ -1695,6 +1695,7 @@
     <backup supported='yes'/>
     <async-teardown supported='yes'/>
     <ps2 supported='yes'/>
+    <tdx supported='yes'/>
     <sev supported='no'/>
     <sgx supported='no'/>
     <hyperv supported='yes'>
diff --git a/tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml b/tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml
index ffa95830f4..6048a66b87 100644
--- a/tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml
+++ b/tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml
@@ -739,6 +739,7 @@
     <backup supported='yes'/>
     <async-teardown supported='yes'/>
     <ps2 supported='yes'/>
+    <tdx supported='yes'/>
     <sev supported='no'/>
     <sgx supported='yes'>
       <flc>yes</flc>
diff --git a/tests/domaincapsdata/qemu_10.1.0.x86_64.xml b/tests/domaincapsdata/qemu_10.1.0.x86_64.xml
index 06dc8d0058..3d69ed3af1 100644
--- a/tests/domaincapsdata/qemu_10.1.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_10.1.0.x86_64.xml
@@ -1695,6 +1695,7 @@
     <backup supported='yes'/>
     <async-teardown supported='yes'/>
     <ps2 supported='yes'/>
+    <tdx supported='yes'/>
     <sev supported='no'/>
     <sgx supported='no'/>
     <hyperv supported='yes'>
diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c
index 6ae0c4ad45..cb6e98dbb8 100644
--- a/tests/domaincapsmock.c
+++ b/tests/domaincapsmock.c
@@ -54,7 +54,8 @@ bool
 virQEMUCapsGetKVMSupportsSecureGuest(virQEMUCaps *qemuCaps)
 {
     if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MACHINE_CONFIDENTAL_GUEST_SUPPORT) &&
-        virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST))
+        (virQEMUCapsGet(qemuCaps, QEMU_CAPS_S390_PV_GUEST) ||
+         virQEMUCapsGet(qemuCaps, QEMU_CAPS_TDX_GUEST)))
         return true;
 
     if (!real_virQEMUCapsGetKVMSupportsSecureGuest)