kata-check: optionally require kvm-intel unrestricted_guest

We have optionally handled it in kernel parameter in
genericArchKernelParamHandler but kata-check still forcely require it to
be present. Let's only require it when running on baremetal.

Signed-off-by: Peng Tao <bergwolf@gmail.com>

cli/kata-check.go

@@ -291,7 +291,10 @@ var kataCheckCLICommand = cli.Command{
 		span, _ := trace(ctx, "kata-check")
 		defer span.Finish()
 
-		setCPUtype()
+		err = setCPUtype()
+		if err != nil {
+			return err
+		}
 
 		details := vmContainerCapableDetails{
 			cpuInfoFile:           procCPUInfo,

cli/kata-check_amd64.go

@@ -6,9 +6,12 @@
 package main
 
 import (
+	"fmt"
 	"github.com/sirupsen/logrus"
 	"io/ioutil"
 	"strings"
+
+	vc "github.com/kata-containers/runtime/virtcontainers"
 )
 
 const (
@@ -45,13 +48,23 @@ var archRequiredCPUAttribs map[string]string
 // required module parameters.
 var archRequiredKernelModules map[string]kernelModule
 
-func setCPUtype() {
+func setCPUtype() error {
 	cpuType = getCPUtype()
 
 	if cpuType == cpuTypeUnknown {
-		kataLog.Fatal("Unknown CPU Type")
+		return fmt.Errorf("Unknow CPU Type")
-		exit(1)
 	} else if cpuType == cpuTypeIntel {
+		var kvmIntelParams map[string]string
+		onVMM, err := vc.RunningOnVMM(procCPUInfo)
+		if err != nil && !onVMM {
+			kvmIntelParams = map[string]string{
+				// "VMX Unrestricted mode support". This is used
+				// as a heuristic to determine if the system is
+				// "new enough" to run a Kata Container
+				// (atleast a Westmere).
+				"unrestricted_guest": "Y",
+			}
+		}
 		archRequiredCPUFlags = map[string]string{
 			"vmx":    "Virtualization support",
 			"lm":     "64Bit CPU",
@@ -65,14 +78,8 @@ func setCPUtype() {
 				desc: msgKernelVM,
 			},
 			"kvm_intel": {
-				desc: "Intel KVM",
+				desc:       "Intel KVM",
-				parameters: map[string]string{
+				parameters: kvmIntelParams,
-					// "VMX Unrestricted mode support". This is used
-					// as a heuristic to determine if the system is
-					// "new enough" to run a Kata Container
-					// (atleast a Westmere).
-					"unrestricted_guest": "Y",
-				},
 			},
 			"vhost": {
 				desc: msgKernelVirtio,
@@ -105,6 +112,8 @@ func setCPUtype() {
 			},
 		}
 	}
+
+	return nil
 }
 
 func getCPUtype() int {

cli/kata-check_amd64_test.go

@@ -81,9 +81,7 @@ func TestCCCheckCLIFunction(t *testing.T) {
 			{archGenuineIntel, "lm vmx sse4_1", false},
 		}
 
-		moduleData = []testModuleData{
+		moduleData = []testModuleData{}
-			{filepath.Join(sysModuleDir, "kvm_intel/parameters/unrestricted_guest"), false, "Y"},
-		}
 	} else if cpuType == cpuTypeAMD {
 		cpuData = []testCPUData{
 			{archAuthenticAMD, "lm svm sse4_1", false},
@@ -393,7 +391,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 	}
 
 	err = hostIsVMContainerCapable(details)
-	assert.Error(err)
+	assert.Nil(err)
 }
 
 func TestArchKernelParamHandler(t *testing.T) {

cli/kata-check_arm64.go

@@ -40,7 +40,8 @@ var archRequiredKernelModules = map[string]kernelModule{
 	},
 }
 
-func setCPUtype() {
+func setCPUtype() error {
+	return nil
 }
 
 // kvmIsUsable determines if it will be possible to create a full virtual machine

cli/kata-check_ppc64le.go

@@ -44,7 +44,8 @@ var archRequiredKernelModules = map[string]kernelModule{
 	},
 }
 
-func setCPUtype() {
+func setCPUtype() error {
+	return nil
 }
 
 func archHostCanCreateVMContainer() error {

cli/kata-env.go

@@ -325,7 +325,10 @@ func getHypervisorInfo(config oci.RuntimeConfig) HypervisorInfo {
 }
 
 func getEnvInfo(configFile string, config oci.RuntimeConfig) (env EnvInfo, err error) {
-	setCPUtype()
+	err = setCPUtype()
+	if err != nil {
+		return EnvInfo{}, err
+	}
 
 	meta := getMetaInfo()