klauspost / cpuid

CPU feature identification for Go
MIT License
1.04k stars 128 forks source link

Detect TDX Guest when it's virtualised using Hyper-V #138

Closed fidencio closed 11 months ago

fidencio commented 11 months ago

Microsoft has decided to purposefully hide the information of the guest TEE when VMs are being created using Hyper-V.

This leads us to check for the Hyper-V cpuid features (0x4000000C), and then for the ebx value set.

For Intel TDX, ebx is set as 0xbe3, being 3 the part we're mostly interested about,according to: https://github.com/torvalds/linux/blob/d2f51b3516dade79269ff45eae2a7668ae711b25/arch/x86/include/asm/hyperv-tlfs.h#L169-L174

fidencio commented 11 months ago

Here's the test that I've done on a TDX Guest using this PR:

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ git rev-parse --short HEAD
21e1a5b

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ git clean -xfd

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ go build

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ ./cpuid | grep -o TDX_GUEST

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ git reset --hard fidencio/topic/add-tdx-guest-detection
HEAD is now at 3224975 Detect TDX Guest when it's virtualised using Hyper-V

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ git rev-parse --short HEAD
3224975

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ git clean -xfd
Removing cpuid

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ go build

intel-coco@tdvm:~/fidencio/cpuid/cmd/cpuid$ ./cpuid | grep -o TDX_GUEST
TDX_GUEST
fidencio commented 11 months ago

Wow, it seems I need to adapt the tests, @klauspost, I'd appreciate a pointer here.

fidencio commented 11 months ago

Thanks @klauspost, do you think we can have a new release of the project soon enough? I'd like to get this into Node Feature Discovery.

klauspost commented 11 months ago

Sure thing. Cut https://github.com/klauspost/cpuid/releases/tag/v2.2.6

fidencio commented 11 months ago

Sure thing. Cut https://github.com/klauspost/cpuid/releases/tag/v2.2.6

Thanks a lot, I've opened #139 as a way to say "thank you for all the work!" (unfortunately it gives your more work, but that's life). :-)