NuKVM/virt-manager
3
0
Fork 0
mirror of https://github.com/virt-manager/virt-manager.git synced 2026-09-03 20:52:52 -05:00
Code Issues Packages Projects Releases Wiki Activity

virtinst: add support for creating TDX guests

Browse Source 
A minimal config to enable TDX, with support for attestation
would be

 $ virt-install
     ...args...
     --boot uefi \
     --machine q35 \
     --launchSecurity type=tdx,quoteGenerationService=on

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé
2025-07-28 15:12:08 +02:00
committed by Pavel Hrdina
parent ead255cada
commit 1ead880b2e
6 changed files with 278 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/data/cli/compare/virt-install-x86_64-launch-security-tdx-full.xml
+83
View File
@@ -0,0 +1,83 @@
<domain type="kvm">
<name>vm1</name>
<uuid>00000000-1111-2222-3333-444444444444</uuid>
<memory>65536</memory>
<currentMemory>65536</currentMemory>
<vcpu>1</vcpu>
<os firmware="efi">
<type arch="x86_64" machine="q35">hvm</type>
<boot dev="hd"/>
</os>
<features>
<acpi/>
<apic/>
<vmport state="off"/>
</features>
<cpu mode="host-passthrough"/>
<clock offset="utc">
<timer name="rtc" tickpolicy="catchup"/>
<timer name="pit" tickpolicy="delay"/>
<timer name="hpet" present="no"/>
</clock>
<pm>
<suspend-to-mem enabled="no"/>
<suspend-to-disk enabled="no"/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<controller type="usb" model="ich9-ehci1"/>
<controller type="usb" model="ich9-uhci1">
<master startport="0"/>
</controller>
<controller type="usb" model="ich9-uhci2">
<master startport="2"/>
</controller>
<controller type="usb" model="ich9-uhci3">
<master startport="4"/>
</controller>
<controller type="pci" model="pcie-root"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<interface type="bridge">
<source bridge="testsuitebr0"/>
<mac address="00:11:22:33:44:55"/>
<model type="e1000e"/>
</interface>
<console type="pty"/>
<channel type="spicevmc">
<target type="virtio" name="com.redhat.spice.0"/>
</channel>
<input type="tablet" bus="usb"/>
<tpm model="tpm-crb">
<backend type="emulator"/>
</tpm>
<graphics type="spice" port="-1" tlsPort="-1" autoport="yes">
<image compression="off"/>
</graphics>
<sound model="ich9"/>
<video>
<model type="qxl"/>
</video>
<redirdev bus="usb" type="spicevmc"/>
<redirdev bus="usb" type="spicevmc"/>
</devices>
<launchSecurity type="tdx">
<policy>0x10000000</policy>
<mrConfigId>ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v</mrConfigId>
<mrOwner>ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v</mrOwner>
<mrOwnerConfig>ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v</mrOwnerConfig>
<quoteGenerationService path="/var/run/tdx-qgs/qgs.socket"/>
</launchSecurity>
</domain>
tests/data/cli/compare/virt-install-x86_64-launch-security-tdx-qgs.xml
+79
View File
@@ -0,0 +1,79 @@
<domain type="kvm">
<name>vm1</name>
<uuid>00000000-1111-2222-3333-444444444444</uuid>
<memory>65536</memory>
<currentMemory>65536</currentMemory>
<vcpu>1</vcpu>
<os firmware="efi">
<type arch="x86_64" machine="q35">hvm</type>
<boot dev="hd"/>
</os>
<features>
<acpi/>
<apic/>
<vmport state="off"/>
</features>
<cpu mode="host-passthrough"/>
<clock offset="utc">
<timer name="rtc" tickpolicy="catchup"/>
<timer name="pit" tickpolicy="delay"/>
<timer name="hpet" present="no"/>
</clock>
<pm>
<suspend-to-mem enabled="no"/>
<suspend-to-disk enabled="no"/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<controller type="usb" model="ich9-ehci1"/>
<controller type="usb" model="ich9-uhci1">
<master startport="0"/>
</controller>
<controller type="usb" model="ich9-uhci2">
<master startport="2"/>
</controller>
<controller type="usb" model="ich9-uhci3">
<master startport="4"/>
</controller>
<controller type="pci" model="pcie-root"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<interface type="bridge">
<source bridge="testsuitebr0"/>
<mac address="00:11:22:33:44:55"/>
<model type="e1000e"/>
</interface>
<console type="pty"/>
<channel type="spicevmc">
<target type="virtio" name="com.redhat.spice.0"/>
</channel>
<input type="tablet" bus="usb"/>
<tpm model="tpm-crb">
<backend type="emulator"/>
</tpm>
<graphics type="spice" port="-1" tlsPort="-1" autoport="yes">
<image compression="off"/>
</graphics>
<sound model="ich9"/>
<video>
<model type="qxl"/>
</video>
<redirdev bus="usb" type="spicevmc"/>
<redirdev bus="usb" type="spicevmc"/>
</devices>
<launchSecurity type="tdx">
<quoteGenerationService/>
</launchSecurity>
</domain>
tests/data/cli/compare/virt-install-x86_64-launch-security-tdx.xml
+79
View File
@@ -0,0 +1,79 @@
<domain type="kvm">
<name>vm1</name>
<uuid>00000000-1111-2222-3333-444444444444</uuid>
<memory>65536</memory>
<currentMemory>65536</currentMemory>
<vcpu>1</vcpu>
<os firmware="efi">
<type arch="x86_64" machine="q35">hvm</type>
<boot dev="hd"/>
</os>
<features>
<acpi/>
<apic/>
<vmport state="off"/>
</features>
<cpu mode="host-passthrough"/>
<clock offset="utc">
<timer name="rtc" tickpolicy="catchup"/>
<timer name="pit" tickpolicy="delay"/>
<timer name="hpet" present="no"/>
</clock>
<pm>
<suspend-to-mem enabled="no"/>
<suspend-to-disk enabled="no"/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<controller type="usb" model="ich9-ehci1"/>
<controller type="usb" model="ich9-uhci1">
<master startport="0"/>
</controller>
<controller type="usb" model="ich9-uhci2">
<master startport="2"/>
</controller>
<controller type="usb" model="ich9-uhci3">
<master startport="4"/>
</controller>
<controller type="pci" model="pcie-root"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<controller type="pci" model="pcie-root-port"/>
<interface type="bridge">
<source bridge="testsuitebr0"/>
<mac address="00:11:22:33:44:55"/>
<model type="e1000e"/>
</interface>
<console type="pty"/>
<channel type="spicevmc">
<target type="virtio" name="com.redhat.spice.0"/>
</channel>
<input type="tablet" bus="usb"/>
<tpm model="tpm-crb">
<backend type="emulator"/>
</tpm>
<graphics type="spice" port="-1" tlsPort="-1" autoport="yes">
<image compression="off"/>
</graphics>
<sound model="ich9"/>
<video>
<model type="qxl"/>
</video>
<redirdev bus="usb" type="spicevmc"/>
<redirdev bus="usb" type="spicevmc"/>
</devices>
<launchSecurity type="tdx">
<policy>0x10000000</policy>
</launchSecurity>
</domain>
tests/test_cli.py
+21
View File
@@ -1853,6 +1853,27 @@ c.add_invalid(
prerun_check="10.5.0",
)
c.add_compare(
"--boot uefi --machine q35 --launchSecurity type=tdx,policy=0x10000000",
"x86_64-launch-security-tdx",
prerun_check="11.6.0",
)
c.add_compare(
"--boot uefi --machine q35 --launchSecurity type=tdx,quoteGenerationService=on",
"x86_64-launch-security-tdx-qgs",
prerun_check="11.6.0",
)
c.add_compare(
"--boot uefi --machine q35 --launchSecurity type=tdx,policy=0x10000000,mrConfigId=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,mrOwner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,mrOwnerConfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,quoteGenerationSocket=/var/run/tdx-qgs/qgs.socket",
"x86_64-launch-security-tdx-full",
prerun_check="11.6.0",
)
c.add_invalid(
"--machine pc --launchSecurity type=tdx,policy=0x10000000",
grep="TDX launch security requires a Q35 UEFI machine",
prerun_check="11.6.0",
)
######################
# LXC specific tests #