github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-06 03:56:34 +00:00
Code Issues Projects Releases Wiki Activity

hypervisor: Simplify TDX protection detection

Browse Source 
Let's rely on the kvm module 'tdx' parameter to do so.
This aligns with both OSVs (Canonical, Red Hat, SUSE) and the TDX
adoption (https://github.com/intel/tdx-linux) stacks.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio 2024-01-18 14:23:14 +01:00
parent 2ee03b5dc3
commit cdb8531302
No known key found for this signature in database
GPG Key ID: EE926C2BDACC177B
1 changed files with 6 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/runtime/virtcontainers/hypervisor_linux_amd64.go
View File

@ -8,39 +8,21 @@ package virtcontainers
import "os"
const (
tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/"
tdxSysFirmwareDir = "/sys/firmware/tdx/"
tdxKvmParameterPath = "/sys/module/kvm_intel/parameters/tdx"
sevKvmParameterPath = "/sys/module/kvm_amd/parameters/sev"
snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
)
// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag
func checkTdxGuestProtection(flags map[string]bool) bool {
if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() {
return true
}
if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() {
return true
}
return false
}
// Implementation of this function is architecture specific
func availableGuestProtection() (guestProtection, error) {
flags, err := CPUFlags(procCPUInfo)
if err != nil {
return noneProtection, err
// TDX is supported and enabled when the kvm module 'tdx' parameter is set to 'Y'
if _, err := os.Stat(tdxKvmParameterPath); err == nil {
if c, err := os.ReadFile(tdxKvmParameterPath); err == nil && len(c) > 0 && (c[0] == 'Y') {
return tdxProtection, nil
}
}
if checkTdxGuestProtection(flags) {
return tdxProtection, nil
}
// SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y`
// SEV-SNP support infers SEV (-ES) support
if _, err := os.Stat(snpKvmParameterPath); err == nil {