nixpkgs/nixos/modules/hardware/cpu/amd-sev.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

{ config, lib, ... }:
with lib;
let
  cfg = config.hardware.cpu.amd.sev;
  defaultGroup = "sev";
in
  with lib; {
    options.hardware.cpu.amd.sev = {
      enable = mkEnableOption "access to the AMD SEV device";
      user = mkOption {
        description = "Owner to assign to the SEV device.";
        type = types.str;
        default = "root";
      };
      group = mkOption {
        description = "Group to assign to the SEV device.";
        type = types.str;
        default = defaultGroup;
      };
      mode = mkOption {
        description = "Mode to set for the SEV device.";
        type = types.str;
        default = "0660";
      };
    };

    config = mkIf cfg.enable {
      assertions = [
        {
          assertion = hasAttr cfg.user config.users.users;
          message = "Given user does not exist";
        }
        {
          assertion = (cfg.group == defaultGroup) || (hasAttr cfg.group config.users.groups);
          message = "Given group does not exist";
        }
      ];

      boot.extraModprobeConfig = ''
        options kvm_amd sev=1
      '';

      users.groups = optionalAttrs (cfg.group == defaultGroup) {
        "${cfg.group}" = {};
      };

      services.udev.extraRules = with cfg; ''
        KERNEL=="sev", OWNER="${user}", GROUP="${group}", MODE="${mode}"
      '';
    };
  }