diff --git a/src/runtime/virtcontainers/hypervisor_linux_amd64.go b/src/runtime/virtcontainers/hypervisor_linux_amd64.go index 8cfc9aca9a..304d0446a4 100644 --- a/src/runtime/virtcontainers/hypervisor_linux_amd64.go +++ b/src/runtime/virtcontainers/hypervisor_linux_amd64.go @@ -8,7 +8,9 @@ package virtcontainers import "os" const ( - tdxSysFirmwareDir = "/sys/firmware/tdx_seam/" + tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/" + + tdxSysFirmwareDir = "/sys/firmware/tdx/" tdxCPUFlag = "tdx" @@ -17,6 +19,23 @@ const ( snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp" ) +// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag +func checkTdxGuestProtection(flags map[string]bool) bool { + if flags[tdxCPUFlag] { + return true + } + + if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() { + return true + } + + if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() { + return true + } + + return false +} + // Implementation of this function is architecture specific func availableGuestProtection() (guestProtection, error) { flags, err := CPUFlags(procCPUInfo) @@ -24,10 +43,10 @@ func availableGuestProtection() (guestProtection, error) { return noneProtection, err } - // TDX is supported and properly loaded when the firmware directory exists or `tdx` is part of the CPU flags - if d, err := os.Stat(tdxSysFirmwareDir); (err == nil && d.IsDir()) || flags[tdxCPUFlag] { + if checkTdxGuestProtection(flags) { return tdxProtection, nil } + // SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y` // SEV-SNP support infers SEV (-ES) support if _, err := os.Stat(snpKvmParameterPath); err == nil {