mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-04-11 06:22:55 +00:00
Compare commits
2 Commits
topic/runt
...
sprt/fix-r
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
9d4fcd3708 | ||
|
|
78272ad7b7 |
@@ -103,7 +103,7 @@ impl BrandString {
|
|||||||
/// of the host CPU.
|
/// of the host CPU.
|
||||||
fn from_host_cpuid() -> Result<Self, Error> {
|
fn from_host_cpuid() -> Result<Self, Error> {
|
||||||
let mut this = Self::new();
|
let mut this = Self::new();
|
||||||
let mut cpuid_regs = unsafe { host_cpuid(0x8000_0000) };
|
let mut cpuid_regs = host_cpuid(0x8000_0000);
|
||||||
|
|
||||||
if cpuid_regs.eax < 0x8000_0004 {
|
if cpuid_regs.eax < 0x8000_0004 {
|
||||||
// Brand string not supported by the host CPU
|
// Brand string not supported by the host CPU
|
||||||
@@ -111,7 +111,7 @@ impl BrandString {
|
|||||||
}
|
}
|
||||||
|
|
||||||
for leaf in 0x8000_0002..=0x8000_0004 {
|
for leaf in 0x8000_0002..=0x8000_0004 {
|
||||||
cpuid_regs = unsafe { host_cpuid(leaf) };
|
cpuid_regs = host_cpuid(leaf);
|
||||||
this.set_reg_for_leaf(leaf, Reg::Eax, cpuid_regs.eax);
|
this.set_reg_for_leaf(leaf, Reg::Eax, cpuid_regs.eax);
|
||||||
this.set_reg_for_leaf(leaf, Reg::Ebx, cpuid_regs.ebx);
|
this.set_reg_for_leaf(leaf, Reg::Ebx, cpuid_regs.ebx);
|
||||||
this.set_reg_for_leaf(leaf, Reg::Ecx, cpuid_regs.ecx);
|
this.set_reg_for_leaf(leaf, Reg::Ecx, cpuid_regs.ecx);
|
||||||
@@ -393,7 +393,7 @@ mod tests {
|
|||||||
match BrandString::from_host_cpuid() {
|
match BrandString::from_host_cpuid() {
|
||||||
Ok(bstr) => {
|
Ok(bstr) => {
|
||||||
for leaf in 0x8000_0002..=0x8000_0004_u32 {
|
for leaf in 0x8000_0002..=0x8000_0004_u32 {
|
||||||
let host_regs = unsafe { host_cpuid(leaf) };
|
let host_regs = host_cpuid(leaf);
|
||||||
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Eax), host_regs.eax);
|
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Eax), host_regs.eax);
|
||||||
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Ebx), host_regs.ebx);
|
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Ebx), host_regs.ebx);
|
||||||
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Ecx), host_regs.ecx);
|
assert_eq!(bstr.get_reg_for_leaf(leaf, Reg::Ecx), host_regs.ecx);
|
||||||
@@ -403,7 +403,7 @@ mod tests {
|
|||||||
Err(Error::NotSupported) => {
|
Err(Error::NotSupported) => {
|
||||||
// from_host_cpuid() should only fail if the host CPU doesn't support
|
// from_host_cpuid() should only fail if the host CPU doesn't support
|
||||||
// CPUID leaves up to 0x80000004, so let's make sure that's what happened.
|
// CPUID leaves up to 0x80000004, so let's make sure that's what happened.
|
||||||
let host_regs = unsafe { host_cpuid(0x8000_0000) };
|
let host_regs = host_cpuid(0x8000_0000);
|
||||||
assert!(host_regs.eax < 0x8000_0004);
|
assert!(host_regs.eax < 0x8000_0004);
|
||||||
}
|
}
|
||||||
_ => panic!("This function should not return another type of error"),
|
_ => panic!("This function should not return another type of error"),
|
||||||
|
|||||||
@@ -25,7 +25,7 @@ pub fn get_cpuid(function: u32, count: u32) -> Result<CpuidResult, Error> {
|
|||||||
// TODO: replace with validation based on `has_cpuid()` when it becomes stable:
|
// TODO: replace with validation based on `has_cpuid()` when it becomes stable:
|
||||||
// https://doc.rust-lang.org/core/arch/x86/fn.has_cpuid.html
|
// https://doc.rust-lang.org/core/arch/x86/fn.has_cpuid.html
|
||||||
// this is safe because the host supports the `cpuid` instruction
|
// this is safe because the host supports the `cpuid` instruction
|
||||||
let max_function = unsafe { __get_cpuid_max(function & leaf_0x80000000::LEAF_NUM).0 };
|
let max_function = __get_cpuid_max(function & leaf_0x80000000::LEAF_NUM).0;
|
||||||
if function > max_function {
|
if function > max_function {
|
||||||
return Err(Error::InvalidParameters(format!(
|
return Err(Error::InvalidParameters(format!(
|
||||||
"Function not supported: 0x{function:x}",
|
"Function not supported: 0x{function:x}",
|
||||||
@@ -33,7 +33,7 @@ pub fn get_cpuid(function: u32, count: u32) -> Result<CpuidResult, Error> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// this is safe because the host supports the `cpuid` instruction
|
// this is safe because the host supports the `cpuid` instruction
|
||||||
let entry = unsafe { __cpuid_count(function, count) };
|
let entry = __cpuid_count(function, count);
|
||||||
if entry.eax == 0 && entry.ebx == 0 && entry.ecx == 0 && entry.edx == 0 {
|
if entry.eax == 0 && entry.ebx == 0 && entry.ecx == 0 && entry.edx == 0 {
|
||||||
return Err(Error::InvalidParameters(format!("Invalid count: {count}")));
|
return Err(Error::InvalidParameters(format!("Invalid count: {count}")));
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -225,7 +225,7 @@ pub fn create_mount_destination<S: AsRef<Path>, D: AsRef<Path>, R: AsRef<Path>>(
|
|||||||
/// Caller needs to ensure safety of the `dst` to avoid possible file path based attacks.
|
/// Caller needs to ensure safety of the `dst` to avoid possible file path based attacks.
|
||||||
pub fn bind_remount<P: AsRef<Path>>(dst: P, readonly: bool) -> Result<()> {
|
pub fn bind_remount<P: AsRef<Path>>(dst: P, readonly: bool) -> Result<()> {
|
||||||
let dst = dst.as_ref();
|
let dst = dst.as_ref();
|
||||||
if dst.is_empty() {
|
if NixPath::is_empty(dst) {
|
||||||
return Err(Error::NullMountPointPath);
|
return Err(Error::NullMountPointPath);
|
||||||
}
|
}
|
||||||
let dst = dst
|
let dst = dst
|
||||||
@@ -262,10 +262,10 @@ pub fn bind_mount_unchecked<S: AsRef<Path>, D: AsRef<Path>>(
|
|||||||
|
|
||||||
let src = src.as_ref();
|
let src = src.as_ref();
|
||||||
let dst = dst.as_ref();
|
let dst = dst.as_ref();
|
||||||
if src.is_empty() {
|
if NixPath::is_empty(src) {
|
||||||
return Err(Error::NullMountPointPath);
|
return Err(Error::NullMountPointPath);
|
||||||
}
|
}
|
||||||
if dst.is_empty() {
|
if NixPath::is_empty(dst) {
|
||||||
return Err(Error::NullMountPointPath);
|
return Err(Error::NullMountPointPath);
|
||||||
}
|
}
|
||||||
let abs_src = src
|
let abs_src = src
|
||||||
@@ -760,7 +760,7 @@ pub fn umount_timeout<P: AsRef<Path>>(path: P, timeout: u64) -> Result<()> {
|
|||||||
/// # Safety
|
/// # Safety
|
||||||
/// Caller needs to ensure safety of the `path` to avoid possible file path based attacks.
|
/// Caller needs to ensure safety of the `path` to avoid possible file path based attacks.
|
||||||
pub fn umount_all<P: AsRef<Path>>(mountpoint: P, lazy_umount: bool) -> Result<()> {
|
pub fn umount_all<P: AsRef<Path>>(mountpoint: P, lazy_umount: bool) -> Result<()> {
|
||||||
if mountpoint.as_ref().is_empty() || !mountpoint.as_ref().exists() {
|
if NixPath::is_empty(mountpoint.as_ref()) || !mountpoint.as_ref().exists() {
|
||||||
return Ok(());
|
return Ok(());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -126,7 +126,7 @@ pub fn arch_guest_protection(
|
|||||||
// shouldn't hurt to double-check and have better logging if anything
|
// shouldn't hurt to double-check and have better logging if anything
|
||||||
// goes wrong.
|
// goes wrong.
|
||||||
|
|
||||||
let fn0 = unsafe { x86_64::__cpuid(0) };
|
let fn0 = x86_64::__cpuid(0);
|
||||||
// The values in [ ebx, edx, ecx ] spell out "AuthenticAMD" when
|
// The values in [ ebx, edx, ecx ] spell out "AuthenticAMD" when
|
||||||
// interpreted byte-wise as ASCII. No need to bother here with an
|
// interpreted byte-wise as ASCII. No need to bother here with an
|
||||||
// actual conversion to string though.
|
// actual conversion to string though.
|
||||||
@@ -139,7 +139,7 @@ pub fn arch_guest_protection(
|
|||||||
}
|
}
|
||||||
|
|
||||||
// AMD64 Architecture Prgrammer's Manual Fn8000_001f docs on pg. 640
|
// AMD64 Architecture Prgrammer's Manual Fn8000_001f docs on pg. 640
|
||||||
let fn8000_001f = unsafe { x86_64::__cpuid(0x8000_001f) };
|
let fn8000_001f = x86_64::__cpuid(0x8000_001f);
|
||||||
if fn8000_001f.eax & 0x10 == 0 {
|
if fn8000_001f.eax & 0x10 == 0 {
|
||||||
return Err(ProtectionError::CheckFailed("SEV not supported".to_owned()));
|
return Err(ProtectionError::CheckFailed("SEV not supported".to_owned()));
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user