Hi,

The CD_COCOVM filter already keeps ipmi(4) from attaching on a
confidential VM, but it runs too late: ipmi_probe() is called directly
from mainbus_attach() and scans the BIOS ROM window at 0xc0000-0xfffff
for an IPMI signature before config_found() is reached.  Skip the probe
as well.

ok?

Take care,
HJ.

---
 sys/dev/ipmi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/dev/ipmi.c b/sys/dev/ipmi.c
index 1e4dad88ae3..2680689fe51 100644
--- a/sys/dev/ipmi.c
+++ b/sys/dev/ipmi.c
@@ -37,6 +37,7 @@
 #include <sys/malloc.h>
 #include <sys/kthread.h>
 #include <sys/task.h>
+#include <sys/reboot.h>
 
 #include <machine/bus.h>
 #include <machine/smbiosvar.h>
@@ -2014,6 +2015,9 @@ ipmi_probe(void *aux)
 	struct dmd_ipmi *pipmi;
 	struct smbtable tbl;
 
+	if (ISSET(boothowto, RB_COCOVM))
+		return (0);
+
 	tbl.cookie = 0;
 	if (smbios_find_table(SMBIOS_TYPE_IPMIDEV, &tbl))
 		ipmi_smbios_probe(tbl.tblhdr, ia);
-- 
2.47.3