Merge pull request #181079 from profianinc/init/nixos/amd-sev
nixos/amd.sev: init
This commit is contained in:
commit
5ad2e70f95
@ -406,6 +406,12 @@
|
||||
application tries to talk to the libsecret D-Bus API.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
There is a new module for AMD SEV CPU functionality, which
|
||||
grants access to the hardware.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
There is a new module for the <literal>thunar</literal>
|
||||
|
@ -149,6 +149,8 @@ Use `configure.packages` instead.
|
||||
|
||||
- The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
|
||||
|
||||
- There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
|
||||
|
||||
- There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and in a future release it may be removed.
|
||||
|
||||
- There is a new module for the `xfconf` program (the Xfce configuration storage system), which has a dbus service.
|
||||
|
51
nixos/modules/hardware/cpu/amd-sev.nix
Normal file
51
nixos/modules/hardware/cpu/amd-sev.nix
Normal file
@ -0,0 +1,51 @@
|
||||
{ config, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.hardware.cpu.amd.sev;
|
||||
defaultGroup = "sev";
|
||||
in
|
||||
with lib; {
|
||||
options.hardware.cpu.amd.sev = {
|
||||
enable = mkEnableOption "access to the AMD SEV device";
|
||||
user = mkOption {
|
||||
description = "Owner to assign to the SEV device.";
|
||||
type = types.str;
|
||||
default = "root";
|
||||
};
|
||||
group = mkOption {
|
||||
description = "Group to assign to the SEV device.";
|
||||
type = types.str;
|
||||
default = defaultGroup;
|
||||
};
|
||||
mode = mkOption {
|
||||
description = "Mode to set for the SEV device.";
|
||||
type = types.str;
|
||||
default = "0660";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
assertions = [
|
||||
{
|
||||
assertion = hasAttr cfg.user config.users.users;
|
||||
message = "Given user does not exist";
|
||||
}
|
||||
{
|
||||
assertion = (cfg.group == defaultGroup) || (hasAttr cfg.group config.users.groups);
|
||||
message = "Given group does not exist";
|
||||
}
|
||||
];
|
||||
|
||||
boot.extraModprobeConfig = ''
|
||||
options kvm_amd sev=1
|
||||
'';
|
||||
|
||||
users.groups = optionalAttrs (cfg.group == defaultGroup) {
|
||||
"${cfg.group}" = {};
|
||||
};
|
||||
|
||||
services.udev.extraRules = with cfg; ''
|
||||
KERNEL=="sev", OWNER="${user}", GROUP="${group}", MODE="${mode}"
|
||||
'';
|
||||
};
|
||||
}
|
Loading…
Reference in New Issue
Block a user