62 lines
2.1 KiB
Diff
62 lines
2.1 KiB
Diff
From e8e1554e0b626131745170c94a780b0d875aad63 Mon Sep 17 00:00:00 2001
|
|
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
Date: Fri, 18 Jul 2025 18:03:47 +0200
|
|
Subject: [PATCH 065/115] i386/tdx: Disable SMM for TDX VMs
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
|
RH-MergeRequest: 391: TDX support, including attestation and device assignment
|
|
RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
|
|
RH-Acked-by: Yash Mankad <None>
|
|
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
RH-Acked-by: David Hildenbrand <david@redhat.com>
|
|
RH-Commit: [65/115] 69f950f26ffbea4f8ad6ff7f0be7ee3a4ce13c2b (bonzini/rhel-qemu-kvm)
|
|
|
|
TDX doesn't support SMM and VMM cannot emulate SMM for TDX VMs because
|
|
VMM cannot manipulate TDX VM's memory.
|
|
|
|
Disable SMM for TDX VMs and error out if user requests to enable SMM.
|
|
|
|
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
|
|
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
|
|
Link: https://lore.kernel.org/r/20250508150002.689633-37-xiaoyao.li@intel.com
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 810d4e83d07ca0d072205453a42c324a51d5a5fa)
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
---
|
|
target/i386/kvm/tdx.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
|
|
index 7bc36b620e..9bd6843988 100644
|
|
--- a/target/i386/kvm/tdx.c
|
|
+++ b/target/i386/kvm/tdx.c
|
|
@@ -367,11 +367,20 @@ static Notifier tdx_machine_done_notify = {
|
|
|
|
static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
|
|
{
|
|
+ MachineState *ms = MACHINE(qdev_get_machine());
|
|
+ X86MachineState *x86ms = X86_MACHINE(ms);
|
|
TdxGuest *tdx = TDX_GUEST(cgs);
|
|
int r = 0;
|
|
|
|
kvm_mark_guest_state_protected();
|
|
|
|
+ if (x86ms->smm == ON_OFF_AUTO_AUTO) {
|
|
+ x86ms->smm = ON_OFF_AUTO_OFF;
|
|
+ } else if (x86ms->smm == ON_OFF_AUTO_ON) {
|
|
+ error_setg(errp, "TDX VM doesn't support SMM");
|
|
+ return -EINVAL;
|
|
+ }
|
|
+
|
|
if (!tdx_caps) {
|
|
r = get_tdx_capabilities(errp);
|
|
if (r) {
|
|
--
|
|
2.50.1
|
|
|