diff options
| author | Michael Roth <michael.roth@amd.com> | 2024-05-30 06:16:29 -0500 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-06-05 11:01:06 +0200 |
| commit | 3d44fdff60ea66fbd7a33f5d32b50843cd80f48a (patch) | |
| tree | 73a2c38395f97c048ac2775128e32b49cb9e0c03 | |
| parent | 9f3a6999f9730a694d7db448a99f9c9cb6515992 (diff) | |
| download | focaccia-qemu-3d44fdff60ea66fbd7a33f5d32b50843cd80f48a.tar.gz focaccia-qemu-3d44fdff60ea66fbd7a33f5d32b50843cd80f48a.zip | |
i386/sev: Set CPU state to protected once SNP guest payload is finalized
Once KVM_SNP_LAUNCH_FINISH is called the vCPU state is copied into the vCPU's VMSA page and measured/encrypted. Any attempt to read/write CPU state afterward will only be acting on the initial data and so are effectively no-ops. Set the vCPU state to protected at this point so that QEMU don't continue trying to re-sync vCPU data during guest runtime. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-18-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/sev.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/target/i386/sev.c b/target/i386/sev.c index ef2e592ca7..e84e4395a5 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -997,6 +997,7 @@ sev_snp_launch_finish(SevCommonState *sev_common) exit(1); } + kvm_mark_guest_state_protected(); sev_set_guest_state(sev_common, SEV_STATE_RUNNING); /* add migration blocker */ |