virtcontainers: Also check /sys/firmwares/tdx for TDX

Let's make sure we also check /sys/firmwares/tdx for TDX guest
protection, as the location may depend on whether TDX Seam is being used
or not.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>

src/runtime/virtcontainers/hypervisor_linux_amd64.go

@@ -8,7 +8,9 @@ package virtcontainers
 import "os"
 
 const (
-	tdxSysFirmwareDir = "/sys/firmware/tdx_seam/"
+	tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/"
+
+	tdxSysFirmwareDir = "/sys/firmware/tdx/"
 
 	tdxCPUFlag = "tdx"
 
@@ -17,6 +19,23 @@ const (
 	snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
 )
 
+// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag
+func checkTdxGuestProtection(flags map[string]bool) bool {
+	if flags[tdxCPUFlag] {
+		return true
+	}
+
+	if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() {
+		return true
+	}
+
+	if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() {
+		return true
+	}
+
+	return false
+}
+
 // Implementation of this function is architecture specific
 func availableGuestProtection() (guestProtection, error) {
 	flags, err := CPUFlags(procCPUInfo)
@@ -24,10 +43,10 @@ func availableGuestProtection() (guestProtection, error) {
 		return noneProtection, err
 	}
 
-	// TDX is supported and properly loaded when the firmware directory exists or `tdx` is part of the CPU flags
+	if checkTdxGuestProtection(flags) {
-	if d, err := os.Stat(tdxSysFirmwareDir); (err == nil && d.IsDir()) || flags[tdxCPUFlag] {
 		return tdxProtection, nil
 	}
+
 	// SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y`
 	// SEV-SNP support infers SEV (-ES) support
 	if _, err := os.Stat(snpKvmParameterPath); err == nil {