Commit 6defa24d authored by Peter Gonda's avatar Peter Gonda Committed by Paolo Bonzini
Browse files

KVM: SEV: Init target VMCBs in sev_migrate_from 



The target VMCBs during an intra-host migration need to correctly setup
for running SEV and SEV-ES guests. Add sev_init_vmcb() function and make
sev_es_init_vmcb() static. sev_init_vmcb() uses the now private function
to init SEV-ES guests VMCBs when needed.

Fixes: 0b020f5a ("KVM: SEV: Add support for SEV-ES intra host migration")
Fixes: b5663931 ("KVM: SEV: Add support for SEV intra host migration")
Signed-off-by: default avatarPeter Gonda <pgonda@google.com>
Cc: Marc Orr <marcorr@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: <20220623173406.744645-1-pgonda@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent ebdec859

arch/x86/kvm/svm/sev.c

+45 −23
Original line number Diff line number Diff line
@@ -1665,19 +1665,24 @@ static void sev_migrate_from(struct kvm *dst_kvm, struct kvm *src_kvm) 
{

	struct kvm_sev_info *dst = &to_kvm_svm(dst_kvm)->sev_info;

	struct kvm_sev_info *src = &to_kvm_svm(src_kvm)->sev_info;

	struct kvm_vcpu *dst_vcpu, *src_vcpu;

	struct vcpu_svm *dst_svm, *src_svm;

	struct kvm_sev_info *mirror;

	unsigned long i;



	dst->active = true;

	dst->asid = src->asid;

	dst->handle = src->handle;

	dst->pages_locked = src->pages_locked;

	dst->enc_context_owner = src->enc_context_owner;

	dst->es_active = src->es_active;



	src->asid = 0;

	src->active = false;

	src->handle = 0;

	src->pages_locked = 0;

	src->enc_context_owner = NULL;

	src->es_active = false;



	list_cut_before(&dst->regions_list, &src->regions_list, &src->regions_list);
@@ -1704,26 +1709,21 @@ static void sev_migrate_from(struct kvm *dst_kvm, struct kvm *src_kvm) 
		list_del(&src->mirror_entry);

		list_add_tail(&dst->mirror_entry, &owner_sev_info->mirror_vms);

	}

}



static int sev_es_migrate_from(struct kvm *dst, struct kvm *src)

{

	unsigned long i;

	struct kvm_vcpu *dst_vcpu, *src_vcpu;

	struct vcpu_svm *dst_svm, *src_svm;

	kvm_for_each_vcpu(i, dst_vcpu, dst_kvm) {

		dst_svm = to_svm(dst_vcpu);



	if (atomic_read(&src->online_vcpus) != atomic_read(&dst->online_vcpus))

		return -EINVAL;

		sev_init_vmcb(dst_svm);



	kvm_for_each_vcpu(i, src_vcpu, src) {

		if (!src_vcpu->arch.guest_state_protected)

			return -EINVAL;

	}

		if (!dst->es_active)

			continue;



	kvm_for_each_vcpu(i, src_vcpu, src) {

		/*

		 * Note, the source is not required to have the same number of

		 * vCPUs as the destination when migrating a vanilla SEV VM.

		 */

		src_vcpu = kvm_get_vcpu(dst_kvm, i);

		src_svm = to_svm(src_vcpu);

		dst_vcpu = kvm_get_vcpu(dst, i);

		dst_svm = to_svm(dst_vcpu);



		/*

		 * Transfer VMSA and GHCB state to the destination.  Nullify and
@@ -1740,8 +1740,23 @@ static int sev_es_migrate_from(struct kvm *dst, struct kvm *src) 
		src_svm->vmcb->control.vmsa_pa = INVALID_PAGE;

		src_vcpu->arch.guest_state_protected = false;

	}

	to_kvm_svm(src)->sev_info.es_active = false;

	to_kvm_svm(dst)->sev_info.es_active = true;

}



static int sev_check_source_vcpus(struct kvm *dst, struct kvm *src)

{

	struct kvm_vcpu *src_vcpu;

	unsigned long i;



	if (!sev_es_guest(src))

		return 0;



	if (atomic_read(&src->online_vcpus) != atomic_read(&dst->online_vcpus))

		return -EINVAL;



	kvm_for_each_vcpu(i, src_vcpu, src) {

		if (!src_vcpu->arch.guest_state_protected)

			return -EINVAL;

	}



	return 0;

}
@@ -1789,11 +1804,9 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd) 
	if (ret)

		goto out_dst_vcpu;



	if (sev_es_guest(source_kvm)) {

		ret = sev_es_migrate_from(kvm, source_kvm);

	ret = sev_check_source_vcpus(kvm, source_kvm);

	if (ret)

		goto out_source_vcpu;

	}



	sev_migrate_from(kvm, source_kvm);

	kvm_vm_dead(source_kvm);
@@ -2914,7 +2927,7 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) 
				    count, in);

}



void sev_es_init_vmcb(struct vcpu_svm *svm)

static void sev_es_init_vmcb(struct vcpu_svm *svm)

{

	struct kvm_vcpu *vcpu = &svm->vcpu;
@@ -2967,6 +2980,15 @@ void sev_es_init_vmcb(struct vcpu_svm *svm) 
	}

}



void sev_init_vmcb(struct vcpu_svm *svm)

{

	svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;

	clr_exception_intercept(svm, UD_VECTOR);



	if (sev_es_guest(svm->vcpu.kvm))

		sev_es_init_vmcb(svm);

}



void sev_es_vcpu_reset(struct vcpu_svm *svm)

{

	/*

arch/x86/kvm/svm/svm.c

+2 −9
Original line number Diff line number Diff line
@@ -1212,15 +1212,8 @@ static void init_vmcb(struct kvm_vcpu *vcpu) 
		svm->vmcb->control.int_ctl |= V_GIF_ENABLE_MASK;

	}



	if (sev_guest(vcpu->kvm)) {

		svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;

		clr_exception_intercept(svm, UD_VECTOR);



		if (sev_es_guest(vcpu->kvm)) {

			/* Perform SEV-ES specific VMCB updates */

			sev_es_init_vmcb(svm);

		}

	}

	if (sev_guest(vcpu->kvm))

		sev_init_vmcb(svm);



	svm_hv_init_vmcb(vmcb);

	init_vmcb_after_set_cpuid(vcpu);

arch/x86/kvm/svm/svm.h

+1 −1
Original line number Diff line number Diff line
@@ -649,10 +649,10 @@ void __init sev_set_cpu_caps(void); 
void __init sev_hardware_setup(void);

void sev_hardware_unsetup(void);

int sev_cpu_init(struct svm_cpu_data *sd);

void sev_init_vmcb(struct vcpu_svm *svm);

void sev_free_vcpu(struct kvm_vcpu *vcpu);

int sev_handle_vmgexit(struct kvm_vcpu *vcpu);

int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in);

void sev_es_init_vmcb(struct vcpu_svm *svm);

void sev_es_vcpu_reset(struct vcpu_svm *svm);

void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector);

void sev_es_prepare_switch_to_guest(struct sev_es_save_area *hostsa);