mirror of
https://github.com/aljazceru/kata-containers.git
synced 2026-01-04 23:14:19 +01:00
25b3cdd38c
In the recent kernels provided by Intel the `tdx` CPU flag is not present anymore. Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
60 lines
1.6 KiB
Go
60 lines
1.6 KiB
Go
// Copyright (c) 2021 Intel Corporation
|
|
//
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
//
|
|
|
|
package virtcontainers
|
|
|
|
import "os"
|
|
|
|
const (
|
|
tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/"
|
|
|
|
tdxSysFirmwareDir = "/sys/firmware/tdx/"
|
|
|
|
sevKvmParameterPath = "/sys/module/kvm_amd/parameters/sev"
|
|
|
|
snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
|
|
)
|
|
|
|
// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag
|
|
func checkTdxGuestProtection(flags map[string]bool) bool {
|
|
if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() {
|
|
return true
|
|
}
|
|
|
|
if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// Implementation of this function is architecture specific
|
|
func availableGuestProtection() (guestProtection, error) {
|
|
flags, err := CPUFlags(procCPUInfo)
|
|
if err != nil {
|
|
return noneProtection, err
|
|
}
|
|
|
|
if checkTdxGuestProtection(flags) {
|
|
return tdxProtection, nil
|
|
}
|
|
|
|
// SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y`
|
|
// SEV-SNP support infers SEV (-ES) support
|
|
if _, err := os.Stat(snpKvmParameterPath); err == nil {
|
|
if c, err := os.ReadFile(snpKvmParameterPath); err == nil && len(c) > 0 && (c[0] == 'Y') {
|
|
return snpProtection, nil
|
|
}
|
|
}
|
|
// SEV is supported and enabled when the kvm module `sev` parameter is set to `1` (or `Y` for linux >= 5.12)
|
|
if _, err := os.Stat(sevKvmParameterPath); err == nil {
|
|
if c, err := os.ReadFile(sevKvmParameterPath); err == nil && len(c) > 0 && (c[0] == '1' || c[0] == 'Y') {
|
|
return sevProtection, nil
|
|
}
|
|
}
|
|
|
|
return noneProtection, nil
|
|
}
|