diff mbox series

[v1,33/40] i386/tdx: Don't allow system reset for TDX VMs

Message ID	20220802074750.2581308-34-xiaoyao.li@intel.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <kvm-owner@kernel.org> From: Xiaoyao Li <xiaoyao.li@intel.com> To: Paolo Bonzini <pbonzini@redhat.com>, Isaku Yamahata <isaku.yamahata@gmail.com>, Gerd Hoffmann <kraxel@redhat.com>, =?utf-8?q?Daniel_P_=2E_Berrang=C3=A9?= <berrange@redhat.com>, =?utf-8?q?Phi?= =?utf-8?q?lippe_Mathieu-Daud=C3=A9?= <f4bug@amsat.org>, Richard Henderson <richard.henderson@linaro.org>, "Michael S . Tsirkin" <mst@redhat.com>, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Cornelia Huck <cohuck@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>, Laszlo Ersek <lersek@redhat.com>, Eric Blake <eblake@redhat.com> Cc: Connor Kuehl <ckuehl@redhat.com>, erdemaktas@google.com, kvm@vger.kernel.org, qemu-devel@nongnu.org, seanjc@google.com, xiaoyao.li@intel.com Subject: [PATCH v1 33/40] i386/tdx: Don't allow system reset for TDX VMs Date: Tue, 2 Aug 2022 15:47:43 +0800 Message-Id: <20220802074750.2581308-34-xiaoyao.li@intel.com> In-Reply-To: <20220802074750.2581308-1-xiaoyao.li@intel.com> References: <20220802074750.2581308-1-xiaoyao.li@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	TDX QEMU support \| expand [v1,00/40] TDX QEMU support [v1,01/40] * HACK * linux-headers: Update headers to pull in TDX API changes [v1,02/40] i386: Introduce tdx-guest object [v1,03/40] target/i386: Implement mc->kvm_type() to get VM type [v1,04/40] target/i386: Introduce kvm_confidential_guest_init() [v1,05/40] i386/tdx: Implement tdx_kvm_init() to initialize TDX VM context [v1,06/40] i386/tdx: Get tdx_capabilities via KVM_TDX_CAPABILITIES [v1,07/40] i386/tdx: Introduce is_tdx_vm() helper and cache tdx_guest object [v1,08/40] i386/tdx: Adjust the supported CPUID based on TDX restrictions [v1,09/40] i386/tdx: Update tdx_fixed0/1 bits by tdx_caps.cpuid_config[] [v1,10/40] i386/tdx: Integrate tdx_caps->xfam_fixed0/1 into tdx_cpuid_lookup [v1,11/40] i386/tdx: Integrate tdx_caps->attrs_fixed0/1 to tdx_cpuid_lookup [v1,12/40] i386/kvm: Move architectural CPUID leaf generation to separate helper [v1,13/40] KVM: Introduce kvm_arch_pre_create_vcpu() [v1,14/40] i386/tdx: Initialize TDX before creating TD vcpus [v1,15/40] i386/tdx: Add property sept-ve-disable for tdx-guest object [v1,16/40] i386/tdx: Wire CPU features up with attributes of TD guest [v1,17/40] i386/tdx: Validate TD attributes [v1,18/40] i386/tdx: Implement user specified tsc frequency [v1,19/40] i386/tdx: Set kvm_readonly_mem_enabled to false for TDX VM [v1,20/40] i386/tdvf: Introduce function to parse TDVF metadata [v1,21/40] i386/tdx: Parse TDVF metadata for TDX VM [v1,22/40] i386/tdx: Skip BIOS shadowing setup [v1,23/40] i386/tdx: Don't initialize pc.rom for TDX VMs [v1,24/40] i386/tdx: Track mem_ptr for each firmware entry of TDVF [v1,25/40] i386/tdx: Track RAM entries for TDX VM [v1,26/40] headers: Add definitions from UEFI spec for volumes, resources, etc... [v1,27/40] i386/tdx: Setup the TD HOB list [v1,28/40] i386/tdx: Add TDVF memory via KVM_TDX_INIT_MEM_REGION [v1,29/40] i386/tdx: Call KVM_TDX_INIT_VCPU to initialize TDX vcpu [v1,30/40] i386/tdx: Finalize TDX VM [v1,31/40] i386/tdx: Disable SMM for TDX VMs [v1,32/40] i386/tdx: Disable PIC for TDX VMs [v1,33/40] i386/tdx: Don't allow system reset for TDX VMs [v1,34/40] hw/i386: add eoi_intercept_unsupported member to X86MachineState [v1,35/40] hw/i386: add option to forcibly report edge trigger in acpi tables [v1,36/40] i386/tdx: Don't synchronize guest tsc for TDs [v1,37/40] i386/tdx: Only configure MSR_IA32_UCODE_REV in kvm_init_msrs() for TDs [v1,38/40] i386/tdx: Skip kvm_put_apicbase() for TDs [v1,39/40] i386/tdx: Don't get/put guest state for TDX VMs [v1,40/40] docs: Add TDX documentation

Commit Message

Xiaoyao Li Aug. 2, 2022, 7:47 a.m. UTC

TDX CPU state is protected and thus vcpu state cann't be reset by VMM.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
---
 target/i386/kvm/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 1545b6f870f5..8c282122ed67 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5455,7 +5455,7 @@  bool kvm_has_waitpkg(void)
 
 bool kvm_arch_cpu_check_are_resettable(void)
 {
-    return !sev_es_enabled();
+    return !sev_es_enabled() && !is_tdx_vm();
 }
 
 #define ARCH_REQ_XCOMP_GUEST_PERM       0x1025