Re: [PATCH 3/4] sev/i386: Don't allow a system reset under an SEV-ES guest

[Connor Kuehl <ckuehl@xxxxxxxxxx>]

On 8/25/20 2:05 PM, Tom Lendacky wrote:
> From: Tom Lendacky <thomas.lendacky@xxxxxxx>
>
> An SEV-ES guest does not allow register state to be altered once it has
> been measured. When a SEV-ES guest issues a reboot command, Qemu will
> reset the vCPU state and resume the guest. This will cause failures under
> SEV-ES, so prevent that from occurring.
>
> Signed-off-by: Tom Lendacky <thomas.lendacky@xxxxxxx>
> ---
>   accel/kvm/kvm-all.c       | 8 ++++++++
>   include/sysemu/cpus.h     | 2 ++
>   include/sysemu/hw_accel.h | 4 ++++
>   include/sysemu/kvm.h      | 2 ++
>   softmmu/cpus.c            | 5 +++++
>   softmmu/vl.c              | 5 ++++-
>   6 files changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
> index 54e8fd098d..1d925821b2 100644
> --- a/accel/kvm/kvm-all.c
> +++ b/accel/kvm/kvm-all.c
> @@ -2384,6 +2384,14 @@ void kvm_flush_coalesced_mmio_buffer(void)
>       s->coalesced_flush_in_progress = false;
>   }
>   
> +bool kvm_cpu_check_resettable(void)
> +{
> +    /* If we have a valid reset vector override, then SEV-ES is active
> +     * and the CPU can't be reset.
> +     */
> +    return !kvm_state->reset_valid;
> +}
> +
>   static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
>   {
>       if (!cpu->vcpu_dirty) {
> diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
> index 3c1da6a018..6d688c757f 100644
> --- a/include/sysemu/cpus.h
> +++ b/include/sysemu/cpus.h
> @@ -24,6 +24,8 @@ void dump_drift_info(void);
>   void qemu_cpu_kick_self(void);
>   void qemu_timer_notify_cb(void *opaque, QEMUClockType type);
>   
> +bool cpu_is_resettable(void);
> +
>   void cpu_synchronize_all_states(void);
>   void cpu_synchronize_all_post_reset(void);
>   void cpu_synchronize_all_post_init(void);
> diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
> index e128f8b06b..1fddf4f5e1 100644
> --- a/include/sysemu/hw_accel.h
> +++ b/include/sysemu/hw_accel.h
> @@ -17,6 +17,10 @@
>   #include "sysemu/hvf.h"
>   #include "sysemu/whpx.h"
>   
> +static inline bool cpu_check_resettable(void)
> +{
> +    return kvm_enabled() ? kvm_cpu_check_resettable() : true;
> +}

There's a missing newline here that would separate the closing brace 
from the function below this one.

>   static inline void cpu_synchronize_state(CPUState *cpu)
>   {
>       if (kvm_enabled()) {
> diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
> index f74cfa85ab..eb94bbbff9 100644
> --- a/include/sysemu/kvm.h
> +++ b/include/sysemu/kvm.h
> @@ -494,6 +494,8 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
>   
>   #endif /* NEED_CPU_H */
>   
> +bool kvm_cpu_check_resettable(void);
> +
>   void kvm_cpu_synchronize_state(CPUState *cpu);
>   void kvm_cpu_synchronize_post_reset(CPUState *cpu);
>   void kvm_cpu_synchronize_post_init(CPUState *cpu);
> diff --git a/softmmu/cpus.c b/softmmu/cpus.c
> index a802e899ab..32f286643f 100644
> --- a/softmmu/cpus.c
> +++ b/softmmu/cpus.c
> @@ -927,6 +927,11 @@ void hw_error(const char *fmt, ...)
>       abort();
>   }
>   
> +bool cpu_is_resettable(void)
> +{
> +    return cpu_check_resettable();
> +}
> +
>   void cpu_synchronize_all_states(void)
>   {
>       CPUState *cpu;
> diff --git a/softmmu/vl.c b/softmmu/vl.c
> index 4eb9d1f7fd..422fbb1650 100644
> --- a/softmmu/vl.c
> +++ b/softmmu/vl.c
> @@ -1475,7 +1475,10 @@ void qemu_system_guest_crashloaded(GuestPanicInformation *info)
>   
>   void qemu_system_reset_request(ShutdownCause reason)
>   {
> -    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
> +    if (!cpu_is_resettable()) {
> +        error_report("cpus are not resettable, terminating");
> +        shutdown_requested = reason;
> +    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
>           shutdown_requested = reason;
>       } else {
>           reset_requested = reason;