swendel/nixpkgs
1
0
Fork 0
mirror of https://github.com/SebastianWendel/nixpkgs.git synced 2024-09-20 04:19:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

nixos/amd.sev: add hardware.cpu.amd.sevGuest option

Browse source 
Allow setting the owner, group and mode of the `/dev/sev-guest` device,
similar to what is already possible for `/dev/sev` through the
`hardware.cpu.amd.sev` options.

The `/dev/sev` device is available to AMD SEV hosts, e.g., to start an
AMD SEV-SNP guest. In contrast, the `/dev/sev-guest` device is only
available within SEV-SNP guests. The guest uses the device, for example,
to request an attestation report. Linux has in-tree support for SEV-SNP
guests since 5.19.
This commit is contained in:
Vincent Haupert 2023-08-10 16:33:19 +02:00
parent 3b1f3712a4
commit e22dff17f5
1 changed files with 60 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

91
nixos/modules/hardware/cpu/amd-sev.nix
View file

@ -1,37 +1,43 @@
{ config, lib, ... }:
{ config, options, lib, ... }:
with lib;
let
cfg = config.hardware.cpu.amd.sev;
defaultGroup = "sev";
in
with lib; {
options.hardware.cpu.amd.sev = {
enable = mkEnableOption (lib.mdDoc "access to the AMD SEV device");
user = mkOption {
description = lib.mdDoc "Owner to assign to the SEV device.";
type = types.str;
default = "root";
};
group = mkOption {
description = lib.mdDoc "Group to assign to the SEV device.";
type = types.str;
default = defaultGroup;
};
mode = mkOption {
description = lib.mdDoc "Mode to set for the SEV device.";
type = types.str;
default = "0660";
};
};
cfgSev = config.hardware.cpu.amd.sev;
cfgSevGuest = config.hardware.cpu.amd.sevGuest;
config = mkIf cfg.enable {
optionsFor = device: group: {
enable = mkEnableOption (lib.mdDoc "access to the AMD ${device} device");
user = mkOption {
description = lib.mdDoc "Owner to assign to the ${device} device.";
type = types.str;
default = "root";
};
group = mkOption {
description = lib.mdDoc "Group to assign to the ${device} device.";
type = types.str;
default = group;
};
mode = mkOption {
description = lib.mdDoc "Mode to set for the ${device} device.";
type = types.str;
default = "0660";
};
};
in
with lib; {
options.hardware.cpu.amd.sev = optionsFor "SEV" "sev";
options.hardware.cpu.amd.sevGuest = optionsFor "SEV guest" "sev-guest";
config = mkMerge [
# /dev/sev
(mkIf cfgSev.enable {
assertions = [
{
assertion = hasAttr cfg.user config.users.users;
assertion = hasAttr cfgSev.user config.users.users;
message = "Given user does not exist";
}
{
assertion = (cfg.group == defaultGroup) || (hasAttr cfg.group config.users.groups);
assertion = (cfgSev.group == options.hardware.cpu.amd.sev.group.default) || (hasAttr cfgSev.group config.users.groups);
message = "Given group does not exist";
}
];
@ -40,12 +46,35 @@ in
options kvm_amd sev=1
'';
users.groups = optionalAttrs (cfg.group == defaultGroup) {
"${cfg.group}" = {};
users.groups = optionalAttrs (cfgSev.group == options.hardware.cpu.amd.sev.group.default) {
"${cfgSev.group}" = { };
};
services.udev.extraRules = with cfg; ''
services.udev.extraRules = with cfgSev; ''
KERNEL=="sev", OWNER="${user}", GROUP="${group}", MODE="${mode}"
'';
};
}
})
# /dev/sev-guest
(mkIf cfgSevGuest.enable {
assertions = [
{
assertion = hasAttr cfgSevGuest.user config.users.users;
message = "Given user does not exist";
}
{
assertion = (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) || (hasAttr cfgSevGuest.group config.users.groups);
message = "Given group does not exist";
}
];
users.groups = optionalAttrs (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) {
"${cfgSevGuest.group}" = { };
};
services.udev.extraRules = with cfgSevGuest; ''
KERNEL=="sev-guest", OWNER="${user}", GROUP="${group}", MODE="${mode}"
'';
})
];
}