diff options
| author | Xiaoyao Li <xiaoyao.li@intel.com> | 2025-08-14 17:21:11 +0800 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2025-08-27 10:57:03 +0200 |
| commit | a7542a38f399c50337e10aadd60513a400c45013 (patch) | |
| tree | d597d77719602db57eff0292356d8115f9624b90 | |
| parent | 6f8924163ff1fb4bd19e0cd9dc7910bb540486f3 (diff) | |
| download | qemu-a7542a38f399c50337e10aadd60513a400c45013.zip qemu-a7542a38f399c50337e10aadd60513a400c45013.tar.gz qemu-a7542a38f399c50337e10aadd60513a400c45013.tar.bz2 | |
x86/loader: Don't update kernel header for CoCo VMs
Update the header makes it different from the original kernel that user
provides via "-kernel", which leads to a different hash and breaks the
attestation, e.g., for TDX.
We already skip it for SEV VMs. Instead of adding another check of
is_tdx_vm() to cover the TDX case, check machine->cgs to cover all the
confidential computing case for x86.
Reported-by: Vikrant Garg <vikrant1garg@gmail.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250814092111.2353598-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | hw/i386/x86-common.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c index b1b5f11..7512be6 100644 --- a/hw/i386/x86-common.c +++ b/hw/i386/x86-common.c @@ -952,7 +952,7 @@ void x86_load_linux(X86MachineState *x86ms, * kernel on the other side of the fw_cfg interface matches the hash of the * file the user passed in. */ - if (!sev_enabled() && protocol > 0) { + if (!MACHINE(x86ms)->cgs && protocol > 0) { memcpy(setup, header, MIN(sizeof(header), setup_size)); } |