mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-04-03 18:43:50 +00:00
83dd7dcc75
Virtio-mmio transport is not hardened for confidential computing (unlike virtio-pci). Reject config that would use virtio-blk-mmio for rootfs/block when confidential_guest is set, so CoCo guests only use virtio-blk-pci. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
76 lines
2.0 KiB
Go
76 lines
2.0 KiB
Go
// Copyright (c) 2022 Apple Inc.
|
|
//
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
//
|
|
|
|
package virtcontainers
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
|
|
)
|
|
|
|
func validateHypervisorConfig(conf *HypervisorConfig) error {
|
|
|
|
if conf.RemoteHypervisorSocket != "" {
|
|
return nil
|
|
}
|
|
|
|
if conf.KernelPath == "" {
|
|
return fmt.Errorf("Missing kernel path")
|
|
}
|
|
|
|
if conf.ConfidentialGuest && conf.HypervisorMachineType == QemuCCWVirtio {
|
|
if conf.ImagePath != "" || conf.InitrdPath != "" {
|
|
fmt.Println("yes, failing")
|
|
return fmt.Errorf("Neither the image or initrd path may be set for Secure Execution")
|
|
}
|
|
} else if conf.ImagePath == "" && conf.InitrdPath == "" {
|
|
return fmt.Errorf("Missing image and initrd path")
|
|
} else if conf.ImagePath != "" && conf.InitrdPath != "" {
|
|
return fmt.Errorf("Image and initrd path cannot be both set")
|
|
}
|
|
|
|
if err := conf.CheckTemplateConfig(); err != nil {
|
|
return err
|
|
}
|
|
|
|
if conf.NumVCPUsF == 0 {
|
|
conf.NumVCPUsF = defaultVCPUs
|
|
}
|
|
|
|
if conf.MemorySize == 0 {
|
|
conf.MemorySize = defaultMemSzMiB
|
|
}
|
|
|
|
if conf.DefaultBridges == 0 {
|
|
conf.DefaultBridges = defaultBridges
|
|
}
|
|
|
|
if conf.BlockDeviceDriver == "" {
|
|
conf.BlockDeviceDriver = defaultBlockDriver
|
|
} else if conf.BlockDeviceDriver == config.VirtioBlock && conf.HypervisorMachineType == QemuCCWVirtio {
|
|
conf.BlockDeviceDriver = config.VirtioBlockCCW
|
|
}
|
|
|
|
// CoCo guest hardening: virtio-mmio is not hardened for confidential computing.
|
|
if conf.ConfidentialGuest && conf.BlockDeviceDriver == config.VirtioMmio {
|
|
return fmt.Errorf("confidential guests must not use virtio-mmio (use virtio-blk-pci); virtio-mmio is not hardened for CoCo")
|
|
}
|
|
|
|
if conf.DefaultMaxVCPUs == 0 || conf.DefaultMaxVCPUs > defaultMaxVCPUs {
|
|
conf.DefaultMaxVCPUs = defaultMaxVCPUs
|
|
}
|
|
|
|
if numNUMA := conf.NumGuestNUMANodes(); numNUMA > 1 {
|
|
conf.DefaultMaxVCPUs -= conf.DefaultMaxVCPUs % numNUMA
|
|
}
|
|
|
|
if conf.Msize9p == 0 && conf.SharedFS != config.VirtioFS {
|
|
conf.Msize9p = defaultMsize9p
|
|
}
|
|
|
|
return nil
|
|
}
|