[v4] Add AMD Secure Nested Paging (SEV-SNP) support

[PATCH v4 17/31] i386/sev: Set CPU state to protected once SNP guest payload is finalized

Pankaj Gupta posted 31 patches 5 months, 4 weeks ago

Diff against v1 v2 v3
Download mbox

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>, Richard Henderson <richard.henderson@linaro.org>, Eduardo Habkost <eduardo@habkost.net>, "Michael S. Tsirkin" <mst@redhat.com>, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Peter Xu <peterx@redhat.com>, David Hildenbrand <david@redhat.com>, "Philippe Mathieu-Daudé" <philmd@linaro.org>, Cornelia Huck <cohuck@redhat.com>, Eric Blake <eblake@redhat.com>, Markus Armbruster <armbru@redhat.com>, "Daniel P. Berrangé" <berrange@redhat.com>

There is a newer version of this series

Expand all Fold all

[PATCH v4 17/31] i386/sev: Set CPU state to protected once SNP guest payload is finalized

Posted by Pankaj Gupta 5 months, 4 weeks ago

From: Michael Roth <michael.roth@amd.com>

Once KVM_SNP_LAUNCH_FINISH is called the vCPU state is copied into the
vCPU's VMSA page and measured/encrypted. Any attempt to read/write CPU
state afterward will only be acting on the initial data and so are
effectively no-ops.

Set the vCPU state to protected at this point so that QEMU don't
continue trying to re-sync vCPU data during guest runtime.

Signed-off-by: Michael Roth <michael.roth@amd.com>
Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
---
 target/i386/sev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index cd47c195cd..2ca9a86bf3 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -1011,6 +1011,7 @@ sev_snp_launch_finish(SevCommonState *sev_common)
         exit(1);
     }
 
+    kvm_mark_guest_state_protected();
     sev_set_guest_state(sev_common, SEV_STATE_RUNNING);
 
     /* add migration blocker */
-- 
2.34.1