(
&self,
command: &mut Command,
workdir: &VmWorkDir,
cfg: &CvmConfig,
app_compose: &AppCompose,
)
| 778 | } |
| 779 | |
| 780 | fn configure_machine( |
| 781 | &self, |
| 782 | command: &mut Command, |
| 783 | workdir: &VmWorkDir, |
| 784 | cfg: &CvmConfig, |
| 785 | app_compose: &AppCompose, |
| 786 | ) -> Result<()> { |
| 787 | if self.manifest.no_tee { |
| 788 | command |
| 789 | .arg("-machine") |
| 790 | .arg("q35,kernel-irqchip=split,hpet=off"); |
| 791 | return Ok(()); |
| 792 | } |
| 793 | |
| 794 | command |
| 795 | .arg("-machine") |
| 796 | .arg("q35,kernel-irqchip=split,confidential-guest-support=tdx,hpet=off"); |
| 797 | |
| 798 | let img_ver = self.image.info.version_tuple().unwrap_or_default(); |
| 799 | let support_mr_config_id = img_ver >= (0, 5, 2); |
| 800 | |
| 801 | // Compute mrconfigid if needed |
| 802 | let mrconfigid = if cfg.use_mrconfigid && support_mr_config_id { |
| 803 | let compose_hash = workdir |
| 804 | .app_compose_hash() |
| 805 | .context("Failed to get compose hash")?; |
| 806 | let mr_config = if app_compose.key_provider_id.is_empty() { |
| 807 | MrConfig::V1 { |
| 808 | compose_hash: &compose_hash, |
| 809 | } |
| 810 | } else { |
| 811 | let instance_info = workdir |
| 812 | .instance_info() |
| 813 | .context("Failed to get instance info")?; |
| 814 | let app_id = if instance_info.app_id.is_empty() { |
| 815 | &compose_hash[..20] |
| 816 | } else { |
| 817 | &instance_info.app_id |
| 818 | }; |
| 819 | |
| 820 | let key_provider = app_compose.key_provider(); |
| 821 | let key_provider_id = &app_compose.key_provider_id; |
| 822 | MrConfig::V2 { |
| 823 | compose_hash: &compose_hash, |
| 824 | app_id: &app_id.try_into().context("Invalid app ID")?, |
| 825 | key_provider, |
| 826 | key_provider_id, |
| 827 | } |
| 828 | }; |
| 829 | Some(BASE64_STANDARD.encode(mr_config.to_mr_config_id())) |
| 830 | } else { |
| 831 | None |
| 832 | }; |
| 833 | |
| 834 | // Build tdx-guest object with optional quote-generation-socket for kernel-level TSM support |
| 835 | #[derive(Serialize)] |
| 836 | struct QgsSocket { |
| 837 | r#type: &'static str, |
no test coverage detected