qemu-options: Add description of tdx-guest object
Add description of tdx-guest object so that QEMU doc page can have the description. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20260512084458.622465-5-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Xiaoyao Li committed
May 12, 2026 at 16:44 UTC
791b5178ed37247cb0d7d4b379b9980f642ec06c
1 file changed
+41
qemu-options.hx
+41
@@ -6372,6 +6372,47 @@ SRST
6372
-machine ...,confidential-guest-support=sev0 \\
6373
.....
6374
6375
+ ``-object tdx-guest,id=id,[attributes=attrs,sept-ve-disable=on|off,mrconfigid=sha384_digest,mrowner=sha384_digest,mrownerconfig=sha384_digest,quote-generation-socket=socketaddr]``
6376
+ Create an Intel Trusted Domain eXtensions (TDX) guest object, which is
6377
+ the type of ``confidential-guest-support`` object. When pass the object
6378
+ ID to machine's ``confidential-guest-support`` property, it can create
6379
+ a TDX guest.
6380
+
6381
+ The ``attributes`` property is a 64-bit integer, which specifies the
6382
+ TD attributes of the TD.
6383
+
6384
+ The ``sept-ve-disable`` property controls the bit 28 of TD attributes
6385
+ specifically. When it's on, the EPT violation conversion to #VE on
6386
+ guest access of PENDING pages is disabled. Some guest OS (e.g., Linux
6387
+ TD guest) may require this to be set, otherwise they refuse to boot.
6388
+ The default value is on.
6389
+
6390
+ The ``mrconfigid`` property is base64 encoded SHA384 digest, which
6391
+ provides the ID for non-owner-defined configuration of the guest TD,
6392
+ e.g., run-time or OS configuration. The default value is all zeros.
6393
+
6394
+ The ``mrowner`` property is base64 encoded SHA384 digest, which
6395
+ provides the ID for guest TD's owner. The default value is all zeros.
6396
+
6397
+ The ``mrownerconfig`` property is base64 encoded SHA384 digest, which
6398
+ provides the ID for owner-defined configuration of the guest TD, e.g.,
6399
+ the configuration specific to the workload rather than the run-time of
6400
+ OS. The default value is all zeros.
6401
+
6402
+ The ``quote-generation-socket`` property specifies the socket address
6403
+ of the Quote Generation Service (QGS). QGS is a daemon running on the
6404
+ host. QEMU forwards the <GetQuote> request from TD guest to QGS and
6405
+ sents the reply (which contains generated QUOTE on success) from QGS
6406
+ to guest TD.
6407
+
6408
+ .. parsed-literal::
6409
+
6410
+ # |qemu_system_x86| \\
6411
+ ...... \\
6412
+ -object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"unix","path":"/var/run/qgs.socket"}}' \\
6413
+ -machine ...,confidential-guest-support=tdx \\
6414
+ ......
6415
+
6416
``-object igvm-cfg,file=file``
6417
Create an IGVM configuration object that defines the initial state
6418
of the guest using a file in that conforms to the Independent Guest