Re: [PATCH v4 4/6] sev/i386: Don't allow a system reset under an SEV-ES guest

On 25/09/20 21:03, Tom Lendacky wrote:

 {
-    if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
+    if (!cpus_are_resettable()) {
+        error_report("cpus are not resettable, terminating");
+        shutdown_requested = reason;
+    } else if (no_reboot && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {

The error should not be emitted if "no_reboot && reason != 
SHUTDOWN_CAUSE_SUBSYSTEM_RESET" (the condition has changed a bit in 
latest QEMU but the idea is the same).

This is because whoever invoked QEMU could already know about this 
SEV-ES limitation, and use -no-reboot (aka -action reset=shutdown in 
6.0) in order to change the forbidden warm reset into a shutdown+restart 
cold reset.

Paolo