From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 14 Aug 2025 09:21:11 +0000 (+0800)
Subject: x86/loader: Don't update kernel header for CoCo VMs
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a7542a38f399c50337e10aadd60513a400c45013;p=thirdparty%2Fqemu.git

x86/loader: Don't update kernel header for CoCo VMs

Update the header makes it different from the original kernel that user
provides via "-kernel", which leads to a different hash and breaks the
attestation, e.g., for TDX.

We already skip it for SEV VMs. Instead of adding another check of
is_tdx_vm() to cover the TDX case, check machine->cgs to cover all the
confidential computing case for x86.

Reported-by: Vikrant Garg <vikrant1garg@gmail.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250814092111.2353598-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index b1b5f11e739..7512be64d67 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -952,7 +952,7 @@ void x86_load_linux(X86MachineState *x86ms,
      * kernel on the other side of the fw_cfg interface matches the hash of the
      * file the user passed in.
      */
-    if (!sev_enabled() && protocol > 0) {
+    if (!MACHINE(x86ms)->cgs && protocol > 0) {
         memcpy(setup, header, MIN(sizeof(header), setup_size));
     }