github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-02 02:02:24 +00:00
Code Issues Projects Releases Wiki Activity

virtcontainers: Also check /sys/firmwares/tdx for TDX

Browse Source 
Let's make sure we also check /sys/firmwares/tdx for TDX guest
protection, as the location may depend on whether TDX Seam is being used
or not.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio 2023-01-13 13:31:04 +01:00
parent 9feec533ce
commit 01bdacb4e4
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/runtime/virtcontainers/hypervisor_linux_amd64.go
View File

@ -8,7 +8,9 @@ package virtcontainers
import "os"
const (
tdxSysFirmwareDir = "/sys/firmware/tdx_seam/"
tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/"
tdxSysFirmwareDir = "/sys/firmware/tdx/"
tdxCPUFlag = "tdx"
@ -17,6 +19,23 @@ const (
snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
)
// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag
func checkTdxGuestProtection(flags map[string]bool) bool {
if flags[tdxCPUFlag] {
return true
}
if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() {
return true
}
if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() {
return true
}
return false
}
// Implementation of this function is architecture specific
func availableGuestProtection() (guestProtection, error) {
flags, err := CPUFlags(procCPUInfo)
@ -24,10 +43,10 @@ func availableGuestProtection() (guestProtection, error) {
return noneProtection, err
}
// TDX is supported and properly loaded when the firmware directory exists or `tdx` is part of the CPU flags
if d, err := os.Stat(tdxSysFirmwareDir); (err == nil && d.IsDir()) || flags[tdxCPUFlag] {
if checkTdxGuestProtection(flags) {
return tdxProtection, nil
}
// SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y`
// SEV-SNP support infers SEV (-ES) support
if _, err := os.Stat(snpKvmParameterPath); err == nil {