From b2f73a0784b7a5eae2022ccf3293792bd008cc64 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Mon, 8 Feb 2021 15:04:52 +0100 Subject: sev/i386: Allow AP booting under SEV-ES When SEV-ES is enabled, it is not possible modify the guests register state after it has been initially created, encrypted and measured. Normally, an INIT-SIPI-SIPI request is used to boot the AP. However, the hypervisor cannot emulate this because it cannot update the AP register state. For the very first boot by an AP, the reset vector CS segment value and the EIP value must be programmed before the register has been encrypted and measured. Search the guest firmware for the guest for a specific GUID that tells Qemu the value of the reset vector to use. Cc: Paolo Bonzini Cc: "Michael S. Tsirkin" Cc: Marcel Apfelbaum Cc: Richard Henderson Cc: Eduardo Habkost Cc: Marcelo Tosatti Signed-off-by: Tom Lendacky Message-Id: <22db2bfb4d6551aed661a9ae95b4fdbef613ca21.1611682609.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini --- accel/kvm/kvm-all.c | 1 - 1 file changed, 1 deletion(-) (limited to 'accel') diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 47516913b7..bf61ef4b54 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -39,7 +39,6 @@ #include "qemu/main-loop.h" #include "trace.h" #include "hw/irq.h" -#include "sysemu/sev.h" #include "qapi/visitor.h" #include "qapi/qapi-types-common.h" #include "qapi/qapi-visit-common.h" -- cgit v1.2.3 From 92a5199b29f6519aa5f774f4b96dc41954f641d1 Mon Sep 17 00:00:00 2001 From: Tom Lendacky Date: Tue, 26 Jan 2021 11:36:47 -0600 Subject: sev/i386: Don't allow a system reset under an SEV-ES guest An SEV-ES guest does not allow register state to be altered once it has been measured. When an SEV-ES guest issues a reboot command, Qemu will reset the vCPU state and resume the guest. This will cause failures under SEV-ES. Prevent that from occuring by introducing an arch-specific callback that returns a boolean indicating whether vCPUs are resettable. Cc: Peter Maydell Cc: Aurelien Jarno Cc: Jiaxun Yang Cc: Aleksandar Rikalo Cc: David Gibson Cc: David Hildenbrand Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Tom Lendacky Reviewed-by: Venu Busireddy Message-Id: <1ac39c441b9a3e970e9556e1cc29d0a0814de6fd.1611682609.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini --- accel/kvm/kvm-all.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'accel') diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index bf61ef4b54..84c943fcdb 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -2312,6 +2312,11 @@ void kvm_flush_coalesced_mmio_buffer(void) s->coalesced_flush_in_progress = false; } +bool kvm_cpu_check_are_resettable(void) +{ + return kvm_arch_cpu_check_are_resettable(); +} + static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg) { if (!cpu->vcpu_dirty) { -- cgit v1.2.3