From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Tom Lendacky <thomas.lendacky@amd.com> Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Paolo Bonzini <pbonzini@redhat.com>, Eduardo Habkost <ehabkost@redhat.com>, Richard Henderson <rth@twiddle.net>, Connor Kuehl <ckuehl@redhat.com>, Brijesh Singh <brijesh.singh@amd.com>, Jiri Slaby <jslaby@suse.cz>, Marcelo Tosatti <mtosatti@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com> Subject: Re: [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest Date: Thu, 17 Sep 2020 18:01:19 +0100 [thread overview] Message-ID: <20200917170119.GR2793@work-vm> (raw) In-Reply-To: <058dcb33a9cc223e3180133d29e7a92bfdc40938.1600205384.git.thomas.lendacky@amd.com> * Tom Lendacky (thomas.lendacky@amd.com) wrote: > From: Tom Lendacky <thomas.lendacky@amd.com> > > An SEV-ES guest does not allow register state to be altered once it has > been measured. When a SEV-ES guest issues a reboot command, Qemu will > reset the vCPU state and resume the guest. This will cause failures under > SEV-ES, so prevent that from occurring. > > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > accel/kvm/kvm-all.c | 9 +++++++++ > include/sysemu/cpus.h | 2 ++ > include/sysemu/hw_accel.h | 5 +++++ > include/sysemu/kvm.h | 2 ++ > softmmu/cpus.c | 5 +++++ > softmmu/vl.c | 5 ++++- > 6 files changed, 27 insertions(+), 1 deletion(-) > > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c > index 20725b0368..63153b6e53 100644 > --- a/accel/kvm/kvm-all.c > +++ b/accel/kvm/kvm-all.c > @@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void) > s->coalesced_flush_in_progress = false; > } > > +bool kvm_cpu_check_resettable(void) > +{ > + /* > + * If we have a valid reset vector override, then SEV-ES is active > + * and the CPU can't be reset. > + */ > + return !kvm_state->reset_valid; This seems a bit weird since it's in generic rather than x86 specific code. Dave > +} > + > static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) > { > if (!cpu->vcpu_dirty) { > diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h > index 3c1da6a018..6d688c757f 100644 > --- a/include/sysemu/cpus.h > +++ b/include/sysemu/cpus.h > @@ -24,6 +24,8 @@ void dump_drift_info(void); > void qemu_cpu_kick_self(void); > void qemu_timer_notify_cb(void *opaque, QEMUClockType type); > > +bool cpu_is_resettable(void); > + > void cpu_synchronize_all_states(void); > void cpu_synchronize_all_post_reset(void); > void cpu_synchronize_all_post_init(void); > diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h > index e128f8b06b..8b4536e7ae 100644 > --- a/include/sysemu/hw_accel.h > +++ b/include/sysemu/hw_accel.h > @@ -17,6 +17,11 @@ > #include "sysemu/hvf.h" > #include "sysemu/whpx.h" > > +static inline bool cpu_check_resettable(void) > +{ > + return kvm_enabled() ? kvm_cpu_check_resettable() : true; > +} > + > static inline void cpu_synchronize_state(CPUState *cpu) > { > if (kvm_enabled()) { > diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h > index f74cfa85ab..eb94bbbff9 100644 > --- a/include/sysemu/kvm.h > +++ b/include/sysemu/kvm.h > @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr, > > #endif /* NEED_CPU_H */ > > +bool kvm_cpu_check_resettable(void); > + > void kvm_cpu_synchronize_state(CPUState *cpu); > void kvm_cpu_synchronize_post_reset(CPUState *cpu); > void kvm_cpu_synchronize_post_init(CPUState *cpu); > diff --git a/softmmu/cpus.c b/softmmu/cpus.c > index a802e899ab..32f286643f 100644 > --- a/softmmu/cpus.c > +++ b/softmmu/cpus.c > @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...) > abort(); > } > > +bool cpu_is_resettable(void) > +{ > + return cpu_check_resettable(); > +} > + > void cpu_synchronize_all_states(void) > { > CPUState *cpu; > diff --git a/softmmu/vl.c b/softmmu/vl.c > index 4eb9d1f7fd..422fbb1650 100644 > --- a/softmmu/vl.c > +++ b/softmmu/vl.c > @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info) > > void qemu_system_reset_request(ShutdownCause reason) > { > - if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) { > + if (!cpu_is_resettable()) { > + error_report("cpus are not resettable, terminating"); > + shutdown_requested = reason; > + } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) { > shutdown_requested = reason; > } else { > reset_requested = reason; > -- > 2.28.0 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
WARNING: multiple messages have this Message-ID (diff)
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Tom Lendacky <thomas.lendacky@amd.com> Cc: Brijesh Singh <brijesh.singh@amd.com>, Eduardo Habkost <ehabkost@redhat.com>, kvm@vger.kernel.org, "Michael S. Tsirkin" <mst@redhat.com>, Connor Kuehl <ckuehl@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>, qemu-devel@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>, Jiri Slaby <jslaby@suse.cz>, Richard Henderson <rth@twiddle.net> Subject: Re: [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest Date: Thu, 17 Sep 2020 18:01:19 +0100 [thread overview] Message-ID: <20200917170119.GR2793@work-vm> (raw) In-Reply-To: <058dcb33a9cc223e3180133d29e7a92bfdc40938.1600205384.git.thomas.lendacky@amd.com> * Tom Lendacky (thomas.lendacky@amd.com) wrote: > From: Tom Lendacky <thomas.lendacky@amd.com> > > An SEV-ES guest does not allow register state to be altered once it has > been measured. When a SEV-ES guest issues a reboot command, Qemu will > reset the vCPU state and resume the guest. This will cause failures under > SEV-ES, so prevent that from occurring. > > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > accel/kvm/kvm-all.c | 9 +++++++++ > include/sysemu/cpus.h | 2 ++ > include/sysemu/hw_accel.h | 5 +++++ > include/sysemu/kvm.h | 2 ++ > softmmu/cpus.c | 5 +++++ > softmmu/vl.c | 5 ++++- > 6 files changed, 27 insertions(+), 1 deletion(-) > > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c > index 20725b0368..63153b6e53 100644 > --- a/accel/kvm/kvm-all.c > +++ b/accel/kvm/kvm-all.c > @@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void) > s->coalesced_flush_in_progress = false; > } > > +bool kvm_cpu_check_resettable(void) > +{ > + /* > + * If we have a valid reset vector override, then SEV-ES is active > + * and the CPU can't be reset. > + */ > + return !kvm_state->reset_valid; This seems a bit weird since it's in generic rather than x86 specific code. Dave > +} > + > static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) > { > if (!cpu->vcpu_dirty) { > diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h > index 3c1da6a018..6d688c757f 100644 > --- a/include/sysemu/cpus.h > +++ b/include/sysemu/cpus.h > @@ -24,6 +24,8 @@ void dump_drift_info(void); > void qemu_cpu_kick_self(void); > void qemu_timer_notify_cb(void *opaque, QEMUClockType type); > > +bool cpu_is_resettable(void); > + > void cpu_synchronize_all_states(void); > void cpu_synchronize_all_post_reset(void); > void cpu_synchronize_all_post_init(void); > diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h > index e128f8b06b..8b4536e7ae 100644 > --- a/include/sysemu/hw_accel.h > +++ b/include/sysemu/hw_accel.h > @@ -17,6 +17,11 @@ > #include "sysemu/hvf.h" > #include "sysemu/whpx.h" > > +static inline bool cpu_check_resettable(void) > +{ > + return kvm_enabled() ? kvm_cpu_check_resettable() : true; > +} > + > static inline void cpu_synchronize_state(CPUState *cpu) > { > if (kvm_enabled()) { > diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h > index f74cfa85ab..eb94bbbff9 100644 > --- a/include/sysemu/kvm.h > +++ b/include/sysemu/kvm.h > @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr, > > #endif /* NEED_CPU_H */ > > +bool kvm_cpu_check_resettable(void); > + > void kvm_cpu_synchronize_state(CPUState *cpu); > void kvm_cpu_synchronize_post_reset(CPUState *cpu); > void kvm_cpu_synchronize_post_init(CPUState *cpu); > diff --git a/softmmu/cpus.c b/softmmu/cpus.c > index a802e899ab..32f286643f 100644 > --- a/softmmu/cpus.c > +++ b/softmmu/cpus.c > @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...) > abort(); > } > > +bool cpu_is_resettable(void) > +{ > + return cpu_check_resettable(); > +} > + > void cpu_synchronize_all_states(void) > { > CPUState *cpu; > diff --git a/softmmu/vl.c b/softmmu/vl.c > index 4eb9d1f7fd..422fbb1650 100644 > --- a/softmmu/vl.c > +++ b/softmmu/vl.c > @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info) > > void qemu_system_reset_request(ShutdownCause reason) > { > - if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) { > + if (!cpu_is_resettable()) { > + error_report("cpus are not resettable, terminating"); > + shutdown_requested = reason; > + } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) { > shutdown_requested = reason; > } else { > reset_requested = reason; > -- > 2.28.0 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2020-09-17 17:03 UTC|newest] Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-15 21:29 [PATCH v3 0/5] Qemu SEV-ES guest support Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-15 21:29 ` [PATCH v3 1/5] sev/i386: Add initial support for SEV-ES Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-17 16:36 ` Dr. David Alan Gilbert 2020-09-17 16:36 ` Dr. David Alan Gilbert 2020-09-21 6:45 ` Dov Murik 2020-09-21 13:55 ` Tom Lendacky 2020-09-15 21:29 ` [PATCH v3 2/5] sev/i386: Require in-kernel irqchip support for SEV-ES guests Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-15 21:29 ` [PATCH v3 3/5] sev/i386: Allow AP booting under SEV-ES Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-16 9:23 ` Laszlo Ersek 2020-09-16 20:31 ` Tom Lendacky 2020-09-17 16:46 ` Dr. David Alan Gilbert 2020-09-17 16:46 ` Dr. David Alan Gilbert 2020-09-17 18:07 ` Tom Lendacky 2020-09-17 18:07 ` Tom Lendacky 2020-09-15 21:29 ` [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-17 17:01 ` Dr. David Alan Gilbert [this message] 2020-09-17 17:01 ` Dr. David Alan Gilbert 2020-09-17 18:16 ` Tom Lendacky 2020-09-17 18:16 ` Tom Lendacky 2020-09-18 9:23 ` Dr. David Alan Gilbert 2020-09-18 9:23 ` Dr. David Alan Gilbert 2020-09-15 21:29 ` [PATCH v3 5/5] sev/i386: Enable an SEV-ES guest based on SEV policy Tom Lendacky 2020-09-15 21:29 ` Tom Lendacky 2020-09-17 15:34 ` Dr. David Alan Gilbert 2020-09-17 15:34 ` Dr. David Alan Gilbert 2020-09-17 16:07 ` Tom Lendacky 2020-09-17 16:07 ` Tom Lendacky 2020-09-17 16:11 ` Tom Lendacky 2020-09-17 16:11 ` Tom Lendacky 2020-09-17 17:28 ` [PATCH v3 0/5] Qemu SEV-ES guest support Dr. David Alan Gilbert 2020-09-17 17:28 ` Dr. David Alan Gilbert 2020-09-17 18:56 ` Tom Lendacky 2020-09-17 18:56 ` Tom Lendacky 2020-09-18 3:40 ` Sean Christopherson 2020-09-18 15:54 ` Tom Lendacky 2020-09-18 15:54 ` Tom Lendacky 2020-09-18 10:00 ` Dr. David Alan Gilbert 2020-09-18 10:00 ` Dr. David Alan Gilbert 2020-09-18 18:47 ` Tom Lendacky 2020-09-18 18:47 ` Tom Lendacky 2020-09-21 11:48 ` Dr. David Alan Gilbert 2020-09-21 11:48 ` Dr. David Alan Gilbert 2020-09-21 14:23 ` Tom Lendacky 2020-09-21 14:23 ` Tom Lendacky
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200917170119.GR2793@work-vm \ --to=dgilbert@redhat.com \ --cc=brijesh.singh@amd.com \ --cc=ckuehl@redhat.com \ --cc=ehabkost@redhat.com \ --cc=jslaby@suse.cz \ --cc=kvm@vger.kernel.org \ --cc=marcel.apfelbaum@gmail.com \ --cc=mst@redhat.com \ --cc=mtosatti@redhat.com \ --cc=pbonzini@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=rth@twiddle.net \ --cc=thomas.lendacky@amd.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.