mirror of
https://github.com/aljazceru/kata-containers.git
synced 2026-01-16 04:44:21 +01:00
fe6e918ddc
This reverts commit 25b3cdd38c.
As the Jenkins TDX CI is running on a system with a TDX stack called
"2022ww44", we should keep the QEMU / kernel / OVMF versions matching
what's provided in that stack.
The reason we were able to update this on `main` is because the GHA TDX
CI is running on a TDX stack called "2023ww01", but we have decided to
NOT take the bullet, NOT updating the Jenkins CI in order to avoid
unexepected breakages.
This regression was introduced as part of the last CCv0 merge to main,
and would've been caught by the CI, and should've been caught by the
reviewer (myself :-)), but CI was having a hard time to even build the
compoenents and I wrote in the PR and I'm quoting it here: "I rather
deal with possible breakages on this later on, than block this PR to get
in." ... and here we are. :-)
Fixes: #6884
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
66 lines
1.7 KiB
Go
66 lines
1.7 KiB
Go
// Copyright (c) 2021 Intel Corporation
|
|
//
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
//
|
|
|
|
package virtcontainers
|
|
|
|
import "os"
|
|
|
|
const (
|
|
tdxSeamSysFirmwareDir = "/sys/firmware/tdx_seam/"
|
|
|
|
tdxSysFirmwareDir = "/sys/firmware/tdx/"
|
|
|
|
tdxCPUFlag = "tdx"
|
|
|
|
sevKvmParameterPath = "/sys/module/kvm_amd/parameters/sev"
|
|
|
|
snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
|
|
)
|
|
|
|
// TDX is supported and properly loaded when the firmware directory (either tdx or tdx_seam) exists or `tdx` is part of the CPU flag
|
|
func checkTdxGuestProtection(flags map[string]bool) bool {
|
|
if flags[tdxCPUFlag] {
|
|
return true
|
|
}
|
|
|
|
if d, err := os.Stat(tdxSysFirmwareDir); err == nil && d.IsDir() {
|
|
return true
|
|
}
|
|
|
|
if d, err := os.Stat(tdxSeamSysFirmwareDir); err == nil && d.IsDir() {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// Implementation of this function is architecture specific
|
|
func availableGuestProtection() (guestProtection, error) {
|
|
flags, err := CPUFlags(procCPUInfo)
|
|
if err != nil {
|
|
return noneProtection, err
|
|
}
|
|
|
|
if checkTdxGuestProtection(flags) {
|
|
return tdxProtection, nil
|
|
}
|
|
|
|
// SEV-SNP is supported and enabled when the kvm module `sev_snp` parameter is set to `Y`
|
|
// SEV-SNP support infers SEV (-ES) support
|
|
if _, err := os.Stat(snpKvmParameterPath); err == nil {
|
|
if c, err := os.ReadFile(snpKvmParameterPath); err == nil && len(c) > 0 && (c[0] == 'Y') {
|
|
return snpProtection, nil
|
|
}
|
|
}
|
|
// SEV is supported and enabled when the kvm module `sev` parameter is set to `1` (or `Y` for linux >= 5.12)
|
|
if _, err := os.Stat(sevKvmParameterPath); err == nil {
|
|
if c, err := os.ReadFile(sevKvmParameterPath); err == nil && len(c) > 0 && (c[0] == '1' || c[0] == 'Y') {
|
|
return sevProtection, nil
|
|
}
|
|
}
|
|
|
|
return noneProtection, nil
|
|
}
|