sev/i386: Don't allow a system reset under an SEV-ES guest

An SEV-ES guest does not allow register state to be altered once it has
been measured. When an SEV-ES guest issues a reboot command, Qemu will
reset the vCPU state and resume the guest. This will cause failures under
SEV-ES. Prevent that from occuring by introducing an arch-specific
callback that returns a boolean indicating whether vCPUs are resettable.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
Cc: David Gibson <david@gibson.dropbear.id.au>
Cc: David Hildenbrand <david@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Venu Busireddy <venu.busireddy@oracle.com>
Message-Id: <1ac39c441b9a3e970e9556e1cc29d0a0814de6fd.1611682609.git.thomas.lendacky@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index bf61ef4b54beacfe0273c80fff6b648edde0a54d..84c943fcdb2167a990c7f6d752c9dc76b94e5c6d 100644 (file)
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2312,6 +2312,11 @@ void kvm_flush_coalesced_mmio_buffer(void)
     s->coalesced_flush_in_progress = false;
 }
 
+bool kvm_cpu_check_are_resettable(void)
+{
+    return kvm_arch_cpu_check_are_resettable();
+}
+
 static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->vcpu_dirty) {

diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index 2cd74392e05ba1e310e68bc0bc65900ee2bd7965..868f1192dee1f4d884deaf84276c5ab53c2a5616 100644 (file)
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -41,6 +41,8 @@ extern int icount_align_option;
 /* Unblock cpu */
 void qemu_cpu_kick_self(void);
 
+bool cpus_are_resettable(void);
+
 void cpu_synchronize_all_states(void);
 void cpu_synchronize_all_post_reset(void);
 void cpu_synchronize_all_post_init(void);

diff --git a/include/sysemu/hw_accel.h b/include/sysemu/hw_accel.h
index ffed6192a371a29fca9811660eece713698b8dc8..61672f9b322ea65e5a2339315a2c9bbd60ef881e 100644 (file)
--- a/include/sysemu/hw_accel.h
+++ b/include/sysemu/hw_accel.h
@@ -22,4 +22,9 @@ void cpu_synchronize_post_reset(CPUState *cpu);
 void cpu_synchronize_post_init(CPUState *cpu);
 void cpu_synchronize_pre_loadvm(CPUState *cpu);
 
+static inline bool cpu_check_are_resettable(void)
+{
+    return kvm_enabled() ? kvm_cpu_check_are_resettable() : true;
+}
+
 #endif /* QEMU_HW_ACCEL_H */

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index c5546bdecceaa2830366751f60c0eb6bb4c29637..687c598be9b35165ae72cbc3772a4e78a980e71a 100644 (file)
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -541,4 +541,14 @@ int kvm_get_max_memslots(void);
 /* Notify resamplefd for EOI of specific interrupts. */
 void kvm_resample_fd_notify(int gsi);
 
+/**
+ * kvm_cpu_check_are_resettable - return whether CPUs can be reset
+ *
+ * Returns: true: CPUs are resettable
+ *          false: CPUs are not resettable
+ */
+bool kvm_cpu_check_are_resettable(void);
+
+bool kvm_arch_cpu_check_are_resettable(void);
+
 #endif

diff --git a/softmmu/cpus.c b/softmmu/cpus.c
index 112eba9d54e797481d06941ea411bea77b2fceeb..a7ee431187adb67137c0c9b0e1605d50f2ba5f89 100644 (file)
--- a/softmmu/cpus.c
+++ b/softmmu/cpus.c
@@ -194,6 +194,11 @@ void cpu_synchronize_pre_loadvm(CPUState *cpu)
     }
 }
 
+bool cpus_are_resettable(void)
+{
+    return cpu_check_are_resettable();
+}
+
 int64_t cpus_get_virtual_clock(void)
 {
     /*

diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index a7fcb603f7110a48fd1746ed46d505a2fe229b2b..2874417b61830597faf43cadb4df0e60fd67ff31 100644 (file)
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -528,6 +528,9 @@ void qemu_system_reset_request(ShutdownCause reason)
     if (reboot_action == REBOOT_ACTION_SHUTDOWN &&
         reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
         shutdown_requested = reason;
+    } else if (!cpus_are_resettable()) {
+        error_report("cpus are not resettable, terminating");
+        shutdown_requested = reason;
     } else {
         reset_requested = reason;
     }

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index ffe186de8d1974fb31645dd6b1c4691e3040afd1..00e124c8123978e437c4230964173e79d04e2e06 100644 (file)
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -1045,3 +1045,8 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
 {
     return (data - 32) & 0xffff;
 }
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return true;
+}

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index f56a8536d07b38685199dd3ec01ccc106ad9813f..d10667b21b878e25909a50f71ef2581c743a0f01 100644 (file)
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -27,6 +27,7 @@
 #include "sysemu/kvm_int.h"
 #include "sysemu/runstate.h"
 #include "kvm_i386.h"
+#include "sev_i386.h"
 #include "hyperv.h"
 #include "hyperv-proto.h"
 
@@ -4821,3 +4822,8 @@ bool kvm_has_waitpkg(void)
 {
     return has_msr_umwait;
 }
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return !sev_es_enabled();
+}

diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index 84fb10ea35debd9231539dd8c8b44d780ff66eae..123ec1be7e1fe99ce6c64ef2aa4dbd2471c6ae73 100644 (file)
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -1290,3 +1290,8 @@ int mips_kvm_type(MachineState *machine, const char *vm_type)
 
     return -1;
 }
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return true;
+}

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 0c5056dd5b279ae83574887325dc89c473b0856c..298c1f882c674b0ef11b742aa2138d00120acf75 100644 (file)
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2929,3 +2929,8 @@ void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset)
         kvm_set_one_reg(cs, KVM_REG_PPC_TB_OFFSET, &tb_offset);
     }
 }
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return true;
+}

diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
index dc27fa36c99ada577851b333aee2b24c3e7e3bf5..7a892d663df6d050ed6d70dd07421ababfa15410 100644 (file)
--- a/target/s390x/kvm.c
+++ b/target/s390x/kvm.c
@@ -2599,3 +2599,8 @@ void kvm_s390_stop_interrupt(S390CPU *cpu)
 
     kvm_s390_vcpu_interrupt(cpu, &irq);
 }
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return true;
+}