Skip to content

Commit 3a00e73

Browse files
authored
Detect TDX Guest when it's virtualised using Hyper-V (#138)
Microsoft has decided to purposefully hide the information of the guest TEE when VMs are being created using Hyper-V. This leads us to check for the Hyper-V cpuid features (0x4000000C), and then for the `ebx` value set. For Intel TDX, `ebx` is set as `0xbe3`, being 3 the part we're mostly interested about,according to: https://github.com/torvalds/linux/blob/d2f51b3516dade79269ff45eae2a7668ae711b25/arch/x86/include/asm/hyperv-tlfs.h#L169-L174 NOTE: On the tests side, we had to manually override the cpuid in order to avoid the tests failing, and this was suggested by Klaus himself. Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
1 parent 21e1a5b commit 3a00e73

2 files changed

Lines changed: 15 additions & 1 deletion

File tree

cpuid.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1418,6 +1418,20 @@ func support() flagSet {
14181418
fs.setIf((a>>24)&1 == 1, VMSA_REGPROT)
14191419
}
14201420

1421+
if mfi >= 0x20 {
1422+
// Microsoft has decided to purposefully hide the information
1423+
// of the guest TEE when VMs are being created using Hyper-V.
1424+
//
1425+
// This leads us to check for the Hyper-V cpuid features
1426+
// (0x4000000C), and then for the `ebx` value set.
1427+
//
1428+
// For Intel TDX, `ebx` is set as `0xbe3`, being 3 the part
1429+
// we're mostly interested about,according to:
1430+
// https://github.com/torvalds/linux/blob/d2f51b3516dade79269ff45eae2a7668ae711b25/arch/x86/include/asm/hyperv-tlfs.h#L169-L174
1431+
_, ebx, _, _ := cpuid(0x4000000C)
1432+
fs.setIf(ebx == 0xbe3, TDX_GUEST)
1433+
}
1434+
14211435
if mfi >= 0x21 {
14221436
// Intel Trusted Domain Extensions Guests have their own cpuid leaf (0x21).
14231437
_, ebx, ecx, edx := cpuid(0x21)

mockcpu_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func mockCPU(def []byte) func() {
9898
}(idfuncs{cpuid: cpuid, cpuidex: cpuidex, xgetbv: xgetbv})
9999

100100
cpuid = func(op uint32) (eax, ebx, ecx, edx uint32) {
101-
if op == 0x80000000 || op == 0 {
101+
if op == 0x80000000 || op == 0 || op == 0x4000000c {
102102
var ok bool
103103
_, ok = fakeID[op]
104104
if !ok {

0 commit comments

Comments
 (0)