1. Patchew
  2. QEMU
  3. [PATCH v3 0/5] Qemu SEV-ES guest support
  4. View patch

[PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest

Tom Lendacky posted 5 patches 5 years, 4 months ago
Maintainers: "Michael S. Tsirkin" <mst@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Eduardo Habkost <ehabkost@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>, Richard Henderson <rth@twiddle.net>
There is a newer version of this series
[PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest
Posted by Tom Lendacky 5 years, 4 months ago 
From: Tom Lendacky <thomas.lendacky@amd.com>

An SEV-ES guest does not allow register state to be altered once it has
been measured. When a SEV-ES guest issues a reboot command, Qemu will
reset the vCPU state and resume the guest. This will cause failures under
SEV-ES, so prevent that from occurring.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
 accel/kvm/kvm-all.c       | 9 +++++++++
 include/sysemu/cpus.h     | 2 ++
 include/sysemu/hw_accel.h | 5 +++++
 include/sysemu/kvm.h      | 2 ++
 softmmu/cpus.c            | 5 +++++
 softmmu/vl.c              | 5 ++++-
 6 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 20725b0368..63153b6e53 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void)
     s->coalesced_flush_in_progress = false;
 }
 
+bool kvm_cpu_check_resettable(void)
+{
+    /*
+     * If we have a valid reset vector override, then SEV-ES is active
+     * and the CPU can't be reset.
+     */
+    return !kvm_state->reset_valid;
+}
+
 static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->vcpu_dirty) {
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index 3c1da6a018..6d688c757f 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -24,6 +24,8 @@ void dump_drift_info(void);
 void qemu_cpu_kick_self(void);
 void qemu_timer_notify_cb(void *opaque, QEMUClockType type);
 
+bool cpu_is_resettable(void);
+
 void cpu_synchronize_all_states(void);
 void cpu_synchronize_all_post_reset(void);
 void cpu_synchronize_all_post_init(void);
diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
index e128f8b06b..8b4536e7ae 100644
--- a/include/sysemu/hw_accel.h
+++ b/include/sysemu/hw_accel.h
@@ -17,6 +17,11 @@
 #include "sysemu/hvf.h"
 #include "sysemu/whpx.h"
 
+static inline bool cpu_check_resettable(void)
+{
+    return kvm_enabled() ? kvm_cpu_check_resettable() : true;
+}
+
 static inline void cpu_synchronize_state(CPUState *cpu)
 {
     if (kvm_enabled()) {
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index f74cfa85ab..eb94bbbff9 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
 
 #endif /* NEED_CPU_H */
 
+bool kvm_cpu_check_resettable(void);
+
 void kvm_cpu_synchronize_state(CPUState *cpu);
 void kvm_cpu_synchronize_post_reset(CPUState *cpu);
 void kvm_cpu_synchronize_post_init(CPUState *cpu);
diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index a802e899ab..32f286643f 100644
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)
     abort();
 }
 
+bool cpu_is_resettable(void)
+{
+    return cpu_check_resettable();
+}
+
 void cpu_synchronize_all_states(void)
 {
     CPUState *cpu;
diff --git a/softmmu/vl.c b/softmmu/vl.c
index 4eb9d1f7fd..422fbb1650 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)
 
 void qemu_system_reset_request(ShutdownCause reason)
 {
-    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
+    if (!cpu_is_resettable()) {
+        error_report("cpus are not resettable, terminating");
+        shutdown_requested = reason;
+    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
         shutdown_requested = reason;
     } else {
         reset_requested = reason;
-- 
2.28.0
Re: [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest
Posted by Dr. David Alan Gilbert 5 years, 4 months ago 
* Tom Lendacky (thomas.lendacky@amd.com) wrote:
> From: Tom Lendacky <thomas.lendacky@amd.com>
> 
> An SEV-ES guest does not allow register state to be altered once it has
> been measured. When a SEV-ES guest issues a reboot command, Qemu will
> reset the vCPU state and resume the guest. This will cause failures under
> SEV-ES, so prevent that from occurring.
> 
> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
>  accel/kvm/kvm-all.c       | 9 +++++++++
>  include/sysemu/cpus.h     | 2 ++
>  include/sysemu/hw_accel.h | 5 +++++
>  include/sysemu/kvm.h      | 2 ++
>  softmmu/cpus.c            | 5 +++++
>  softmmu/vl.c              | 5 ++++-
>  6 files changed, 27 insertions(+), 1 deletion(-)
> 
> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> index 20725b0368..63153b6e53 100644
> --- a/accel/kvm/kvm-all.c
> +++ b/accel/kvm/kvm-all.c
> @@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void)
>      s->coalesced_flush_in_progress = false;
>  }
>  
> +bool kvm_cpu_check_resettable(void)
> +{
> +    /*
> +     * If we have a valid reset vector override, then SEV-ES is active
> +     * and the CPU can't be reset.
> +     */
> +    return !kvm_state->reset_valid;

This seems a bit weird since it's in generic rather than x86 specific
code.

Dave

> +}
> +
>  static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
>  {
>      if (!cpu->vcpu_dirty) {
> diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
> index 3c1da6a018..6d688c757f 100644
> --- a/include/sysemu/cpus.h
> +++ b/include/sysemu/cpus.h
> @@ -24,6 +24,8 @@ void dump_drift_info(void);
>  void qemu_cpu_kick_self(void);
>  void qemu_timer_notify_cb(void *opaque, QEMUClockType type);
>  
> +bool cpu_is_resettable(void);
> +
>  void cpu_synchronize_all_states(void);
>  void cpu_synchronize_all_post_reset(void);
>  void cpu_synchronize_all_post_init(void);
> diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
> index e128f8b06b..8b4536e7ae 100644
> --- a/include/sysemu/hw_accel.h
> +++ b/include/sysemu/hw_accel.h
> @@ -17,6 +17,11 @@
>  #include "sysemu/hvf.h"
>  #include "sysemu/whpx.h"
>  
> +static inline bool cpu_check_resettable(void)
> +{
> +    return kvm_enabled() ? kvm_cpu_check_resettable() : true;
> +}
> +
>  static inline void cpu_synchronize_state(CPUState *cpu)
>  {
>      if (kvm_enabled()) {
> diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
> index f74cfa85ab..eb94bbbff9 100644
> --- a/include/sysemu/kvm.h
> +++ b/include/sysemu/kvm.h
> @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
>  
>  #endif /* NEED_CPU_H */
>  
> +bool kvm_cpu_check_resettable(void);
> +
>  void kvm_cpu_synchronize_state(CPUState *cpu);
>  void kvm_cpu_synchronize_post_reset(CPUState *cpu);
>  void kvm_cpu_synchronize_post_init(CPUState *cpu);
> diff --git a/softmmu/cpus.c b/softmmu/cpus.c
> index a802e899ab..32f286643f 100644
> --- a/softmmu/cpus.c
> +++ b/softmmu/cpus.c
> @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)
>      abort();
>  }
>  
> +bool cpu_is_resettable(void)
> +{
> +    return cpu_check_resettable();
> +}
> +
>  void cpu_synchronize_all_states(void)
>  {
>      CPUState *cpu;
> diff --git a/softmmu/vl.c b/softmmu/vl.c
> index 4eb9d1f7fd..422fbb1650 100644
> --- a/softmmu/vl.c
> +++ b/softmmu/vl.c
> @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)
>  
>  void qemu_system_reset_request(ShutdownCause reason)
>  {
> -    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
> +    if (!cpu_is_resettable()) {
> +        error_report("cpus are not resettable, terminating");
> +        shutdown_requested = reason;
> +    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
>          shutdown_requested = reason;
>      } else {
>          reset_requested = reason;
> -- 
> 2.28.0
> 
-- 
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
Re: [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest
Posted by Tom Lendacky 5 years, 4 months ago 
On 9/17/20 12:01 PM, Dr. David Alan Gilbert wrote:
> * Tom Lendacky (thomas.lendacky@amd.com) wrote:
>> From: Tom Lendacky <thomas.lendacky@amd.com>
>>
>> An SEV-ES guest does not allow register state to be altered once it has
>> been measured. When a SEV-ES guest issues a reboot command, Qemu will
>> reset the vCPU state and resume the guest. This will cause failures under
>> SEV-ES, so prevent that from occurring.
>>
>> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
>> ---
>>   accel/kvm/kvm-all.c       | 9 +++++++++
>>   include/sysemu/cpus.h     | 2 ++
>>   include/sysemu/hw_accel.h | 5 +++++
>>   include/sysemu/kvm.h      | 2 ++
>>   softmmu/cpus.c            | 5 +++++
>>   softmmu/vl.c              | 5 ++++-
>>   6 files changed, 27 insertions(+), 1 deletion(-)
>>
>> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
>> index 20725b0368..63153b6e53 100644
>> --- a/accel/kvm/kvm-all.c
>> +++ b/accel/kvm/kvm-all.c
>> @@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void)
>>       s->coalesced_flush_in_progress = false;
>>   }
>>   
>> +bool kvm_cpu_check_resettable(void)
>> +{
>> +    /*
>> +     * If we have a valid reset vector override, then SEV-ES is active
>> +     * and the CPU can't be reset.
>> +     */
>> +    return !kvm_state->reset_valid;
> 
> This seems a bit weird since it's in generic rather than x86 specific
> code.

I could push it down to arch specific code. Is there a way to do that 
without defining the function for all the other arches?

Thanks,
Tom

> 
> Dave
> 
>> +}
>> +
>>   static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
>>   {
>>       if (!cpu->vcpu_dirty) {
>> diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
>> index 3c1da6a018..6d688c757f 100644
>> --- a/include/sysemu/cpus.h
>> +++ b/include/sysemu/cpus.h
>> @@ -24,6 +24,8 @@ void dump_drift_info(void);
>>   void qemu_cpu_kick_self(void);
>>   void qemu_timer_notify_cb(void *opaque, QEMUClockType type);
>>   
>> +bool cpu_is_resettable(void);
>> +
>>   void cpu_synchronize_all_states(void);
>>   void cpu_synchronize_all_post_reset(void);
>>   void cpu_synchronize_all_post_init(void);
>> diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
>> index e128f8b06b..8b4536e7ae 100644
>> --- a/include/sysemu/hw_accel.h
>> +++ b/include/sysemu/hw_accel.h
>> @@ -17,6 +17,11 @@
>>   #include "sysemu/hvf.h"
>>   #include "sysemu/whpx.h"
>>   
>> +static inline bool cpu_check_resettable(void)
>> +{
>> +    return kvm_enabled() ? kvm_cpu_check_resettable() : true;
>> +}
>> +
>>   static inline void cpu_synchronize_state(CPUState *cpu)
>>   {
>>       if (kvm_enabled()) {
>> diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
>> index f74cfa85ab..eb94bbbff9 100644
>> --- a/include/sysemu/kvm.h
>> +++ b/include/sysemu/kvm.h
>> @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
>>   
>>   #endif /* NEED_CPU_H */
>>   
>> +bool kvm_cpu_check_resettable(void);
>> +
>>   void kvm_cpu_synchronize_state(CPUState *cpu);
>>   void kvm_cpu_synchronize_post_reset(CPUState *cpu);
>>   void kvm_cpu_synchronize_post_init(CPUState *cpu);
>> diff --git a/softmmu/cpus.c b/softmmu/cpus.c
>> index a802e899ab..32f286643f 100644
>> --- a/softmmu/cpus.c
>> +++ b/softmmu/cpus.c
>> @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)
>>       abort();
>>   }
>>   
>> +bool cpu_is_resettable(void)
>> +{
>> +    return cpu_check_resettable();
>> +}
>> +
>>   void cpu_synchronize_all_states(void)
>>   {
>>       CPUState *cpu;
>> diff --git a/softmmu/vl.c b/softmmu/vl.c
>> index 4eb9d1f7fd..422fbb1650 100644
>> --- a/softmmu/vl.c
>> +++ b/softmmu/vl.c
>> @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)
>>   
>>   void qemu_system_reset_request(ShutdownCause reason)
>>   {
>> -    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
>> +    if (!cpu_is_resettable()) {
>> +        error_report("cpus are not resettable, terminating");
>> +        shutdown_requested = reason;
>> +    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
>>           shutdown_requested = reason;
>>       } else {
>>           reset_requested = reason;
>> -- 
>> 2.28.0
>>
Re: [PATCH v3 4/5] sev/i386: Don't allow a system reset under an SEV-ES guest
Posted by Dr. David Alan Gilbert 5 years, 4 months ago 
* Tom Lendacky (thomas.lendacky@amd.com) wrote:
> On 9/17/20 12:01 PM, Dr. David Alan Gilbert wrote:
> > * Tom Lendacky (thomas.lendacky@amd.com) wrote:
> > > From: Tom Lendacky <thomas.lendacky@amd.com>
> > > 
> > > An SEV-ES guest does not allow register state to be altered once it has
> > > been measured. When a SEV-ES guest issues a reboot command, Qemu will
> > > reset the vCPU state and resume the guest. This will cause failures under
> > > SEV-ES, so prevent that from occurring.
> > > 
> > > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> > > ---
> > >   accel/kvm/kvm-all.c       | 9 +++++++++
> > >   include/sysemu/cpus.h     | 2 ++
> > >   include/sysemu/hw_accel.h | 5 +++++
> > >   include/sysemu/kvm.h      | 2 ++
> > >   softmmu/cpus.c            | 5 +++++
> > >   softmmu/vl.c              | 5 ++++-
> > >   6 files changed, 27 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> > > index 20725b0368..63153b6e53 100644
> > > --- a/accel/kvm/kvm-all.c
> > > +++ b/accel/kvm/kvm-all.c
> > > @@ -2388,6 +2388,15 @@ void kvm_flush_coalesced_mmio_buffer(void)
> > >       s->coalesced_flush_in_progress = false;
> > >   }
> > > +bool kvm_cpu_check_resettable(void)
> > > +{
> > > +    /*
> > > +     * If we have a valid reset vector override, then SEV-ES is active
> > > +     * and the CPU can't be reset.
> > > +     */
> > > +    return !kvm_state->reset_valid;
> > 
> > This seems a bit weird since it's in generic rather than x86 specific
> > code.
> 
> I could push it down to arch specific code.

It seems best to me.

> Is there a way to do that
> without defining the function for all the other arches?

I don't know this interface too well.

Dave

> 
> Thanks,
> Tom
> 
> > 
> > Dave
> > 
> > > +}
> > > +
> > >   static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
> > >   {
> > >       if (!cpu->vcpu_dirty) {
> > > diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
> > > index 3c1da6a018..6d688c757f 100644
> > > --- a/include/sysemu/cpus.h
> > > +++ b/include/sysemu/cpus.h
> > > @@ -24,6 +24,8 @@ void dump_drift_info(void);
> > >   void qemu_cpu_kick_self(void);
> > >   void qemu_timer_notify_cb(void *opaque, QEMUClockType type);
> > > +bool cpu_is_resettable(void);
> > > +
> > >   void cpu_synchronize_all_states(void);
> > >   void cpu_synchronize_all_post_reset(void);
> > >   void cpu_synchronize_all_post_init(void);
> > > diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
> > > index e128f8b06b..8b4536e7ae 100644
> > > --- a/include/sysemu/hw_accel.h
> > > +++ b/include/sysemu/hw_accel.h
> > > @@ -17,6 +17,11 @@
> > >   #include "sysemu/hvf.h"
> > >   #include "sysemu/whpx.h"
> > > +static inline bool cpu_check_resettable(void)
> > > +{
> > > +    return kvm_enabled() ? kvm_cpu_check_resettable() : true;
> > > +}
> > > +
> > >   static inline void cpu_synchronize_state(CPUState *cpu)
> > >   {
> > >       if (kvm_enabled()) {
> > > diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
> > > index f74cfa85ab..eb94bbbff9 100644
> > > --- a/include/sysemu/kvm.h
> > > +++ b/include/sysemu/kvm.h
> > > @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
> > >   #endif /* NEED_CPU_H */
> > > +bool kvm_cpu_check_resettable(void);
> > > +
> > >   void kvm_cpu_synchronize_state(CPUState *cpu);
> > >   void kvm_cpu_synchronize_post_reset(CPUState *cpu);
> > >   void kvm_cpu_synchronize_post_init(CPUState *cpu);
> > > diff --git a/softmmu/cpus.c b/softmmu/cpus.c
> > > index a802e899ab..32f286643f 100644
> > > --- a/softmmu/cpus.c
> > > +++ b/softmmu/cpus.c
> > > @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)
> > >       abort();
> > >   }
> > > +bool cpu_is_resettable(void)
> > > +{
> > > +    return cpu_check_resettable();
> > > +}
> > > +
> > >   void cpu_synchronize_all_states(void)
> > >   {
> > >       CPUState *cpu;
> > > diff --git a/softmmu/vl.c b/softmmu/vl.c
> > > index 4eb9d1f7fd..422fbb1650 100644
> > > --- a/softmmu/vl.c
> > > +++ b/softmmu/vl.c
> > > @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)
> > >   void qemu_system_reset_request(ShutdownCause reason)
> > >   {
> > > -    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
> > > +    if (!cpu_is_resettable()) {
> > > +        error_report("cpus are not resettable, terminating");
> > > +        shutdown_requested = reason;
> > > +    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
> > >           shutdown_requested = reason;
> > >       } else {
> > >           reset_requested = reason;
> > > -- 
> > > 2.28.0
> > > 
> 
-- 
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.