Re: [PATCH] Add query-tdx-capabilities

[Markus Armbruster <armbru@redhat.com>]

Daniel P. Berrangé <berrange@redhat.com> writes:

> On Fri, Jan 09, 2026 at 10:30:32AM +0100, Markus Armbruster wrote:
>> Daniel P. Berrangé <berrange@redhat.com> writes:
>> 
>> > On Tue, Jan 06, 2026 at 10:36:20PM +0400, marcandre.lureau@redhat.com wrote:
>> >> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>> >> 
>> >> Return an empty TdxCapability struct, for extensibility and matching
>> >> query-sev-capabilities return type.
>> >> 
>> >> Fixes: https://issues.redhat.com/browse/RHEL-129674
>> >> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

[...]

>> > This matches the conceptual design used with query-sev-capabilities,
>> > where the lack of SEV support has to be inferred from the command
>> > returning "GenericError".
>> 
>> Such guesswork is brittle.  An interface requiring it is flawed, and
>> should be improved.
>> 
>> Our SEV interface doesn't actually require it: query-sev tells you
>> whether we have SEV.  Just run that first.
>
> Actually these commands are intended for different use cases.
>
> "query-sev" only returns info if you have launched qemu with
>
>   $QEMU -object sev-guest,id=cgs0  -machine confidential-guest-support=cgs0
>
> The goal of "query-sev-capabilities" is to allow you to determine
> if the combination of host+kvm+qemu are capable of running a guest
> with "sev-guest".
>
> IOW, query-sev-capabilities alone is what you want/need in order
> to probe host features.
>
> query-sev is for examining running guest configuration

The doc comments fail to explain this.  Needs fixing.

Do management applications need to know more than "this combination of
host + KVM + QEMU can do SEV, yes / no?

If yes, what do they need?  "No" split up into serval "No, because X"?

I'd like to propose that "human user of management application needs to
know more to debug things" does not count.  The error's @desc should
tell them all they need.

>> This patch adds query-tdx-capabilities without query-tdx.  This results
>> in a flawed interface.
>> 
>> Should we add a query-tdx instead?
>
> No, per the above explanation of the differences.

Got it.

[...]