target/i386: sev: fail query-sev-capabilities if QEMU cannot use SEV
In some cases, such as if the kvm-amd "sev" module parameter is set to 0, SEV will be unavailable but query-sev-capabilities will still return all the information. This tricks libvirt into erroneously reporting that SEV is available. Check the actual usability of the feature and return the appropriate error if QEMU cannot use KVM or KVM cannot use SEV. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
e4f6278557
commit
1b38750c40
|
@ -450,6 +450,15 @@ sev_get_capabilities(Error **errp)
|
||||||
uint32_t ebx;
|
uint32_t ebx;
|
||||||
int fd;
|
int fd;
|
||||||
|
|
||||||
|
if (!kvm_enabled()) {
|
||||||
|
error_setg(errp, "KVM not enabled");
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
if (kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, NULL) < 0) {
|
||||||
|
error_setg(errp, "SEV is not enabled in KVM");
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
|
fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
|
||||||
if (fd < 0) {
|
if (fd < 0) {
|
||||||
error_setg_errno(errp, errno, "Failed to open %s",
|
error_setg_errno(errp, errno, "Failed to open %s",
|
||||||
|
|
Loading…
Reference in a new issue