KVM: SEV: Init target VMCBs in sev_migrate_from

The target VMCBs during an intra-host migration need to correctly setup
for running SEV and SEV-ES guests. Add sev_init_vmcb() function and make
sev_es_init_vmcb() static. sev_init_vmcb() uses the now private function
to init SEV-ES guests VMCBs when needed.

Fixes: 7d473e792ae7 ("KVM: SEV: Add support for SEV-ES intra host migration")
Fixes: 0f9a534d193e ("KVM: SEV: Add support for SEV intra host migration")
Signed-off-by: Peter Gonda <pgonda@google.com>
Cc: Marc Orr <marcorr@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: <20220623173406.744645-1-pgonda@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index e2c7fada0b3da585482b8917308c1c2eccae6d63..0c240ed04f96c5ade0085c3b5c770090c956057f 100644 (file)
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -1665,19 +1665,24 @@ static void sev_migrate_from(struct kvm *dst_kvm, struct kvm *src_kvm)
 {
        struct kvm_sev_info *dst = &to_kvm_svm(dst_kvm)->sev_info;
        struct kvm_sev_info *src = &to_kvm_svm(src_kvm)->sev_info;
+       struct kvm_vcpu *dst_vcpu, *src_vcpu;
+       struct vcpu_svm *dst_svm, *src_svm;
        struct kvm_sev_info *mirror;
+       unsigned long i;
 
        dst->active = true;
        dst->asid = src->asid;
        dst->handle = src->handle;
        dst->pages_locked = src->pages_locked;
        dst->enc_context_owner = src->enc_context_owner;
+       dst->es_active = src->es_active;
 
        src->asid = 0;
        src->active = false;
        src->handle = 0;
        src->pages_locked = 0;
        src->enc_context_owner = NULL;
+       src->es_active = false;
 
        list_cut_before(&dst->regions_list, &src->regions_list, &src->regions_list);
 
@@ -1704,26 +1709,21 @@ static void sev_migrate_from(struct kvm *dst_kvm, struct kvm *src_kvm)
                list_del(&src->mirror_entry);
                list_add_tail(&dst->mirror_entry, &owner_sev_info->mirror_vms);
        }
-}
 
-static int sev_es_migrate_from(struct kvm *dst, struct kvm *src)
-{
-       unsigned long i;
-       struct kvm_vcpu *dst_vcpu, *src_vcpu;
-       struct vcpu_svm *dst_svm, *src_svm;
+       kvm_for_each_vcpu(i, dst_vcpu, dst_kvm) {
+               dst_svm = to_svm(dst_vcpu);
 
-       if (atomic_read(&src->online_vcpus) != atomic_read(&dst->online_vcpus))
-               return -EINVAL;
+               sev_init_vmcb(dst_svm);
 
-       kvm_for_each_vcpu(i, src_vcpu, src) {
-               if (!src_vcpu->arch.guest_state_protected)
-                       return -EINVAL;
-       }
+               if (!dst->es_active)
+                       continue;
 
-       kvm_for_each_vcpu(i, src_vcpu, src) {
+               /*
+                * Note, the source is not required to have the same number of
+                * vCPUs as the destination when migrating a vanilla SEV VM.
+                */
+               src_vcpu = kvm_get_vcpu(dst_kvm, i);
                src_svm = to_svm(src_vcpu);
-               dst_vcpu = kvm_get_vcpu(dst, i);
-               dst_svm = to_svm(dst_vcpu);
 
                /*
                 * Transfer VMSA and GHCB state to the destination.  Nullify and
@@ -1740,8 +1740,23 @@ static int sev_es_migrate_from(struct kvm *dst, struct kvm *src)
                src_svm->vmcb->control.vmsa_pa = INVALID_PAGE;
                src_vcpu->arch.guest_state_protected = false;
        }
-       to_kvm_svm(src)->sev_info.es_active = false;
-       to_kvm_svm(dst)->sev_info.es_active = true;
+}
+
+static int sev_check_source_vcpus(struct kvm *dst, struct kvm *src)
+{
+       struct kvm_vcpu *src_vcpu;
+       unsigned long i;
+
+       if (!sev_es_guest(src))
+               return 0;
+
+       if (atomic_read(&src->online_vcpus) != atomic_read(&dst->online_vcpus))
+               return -EINVAL;
+
+       kvm_for_each_vcpu(i, src_vcpu, src) {
+               if (!src_vcpu->arch.guest_state_protected)
+                       return -EINVAL;
+       }
 
        return 0;
 }
@@ -1789,11 +1804,9 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd)
        if (ret)
                goto out_dst_vcpu;
 
-       if (sev_es_guest(source_kvm)) {
-               ret = sev_es_migrate_from(kvm, source_kvm);
-               if (ret)
-                       goto out_source_vcpu;
-       }
+       ret = sev_check_source_vcpus(kvm, source_kvm);
+       if (ret)
+               goto out_source_vcpu;
 
        sev_migrate_from(kvm, source_kvm);
        kvm_vm_dead(source_kvm);
@@ -2914,7 +2927,7 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
                                    count, in);
 }
 
-void sev_es_init_vmcb(struct vcpu_svm *svm)
+static void sev_es_init_vmcb(struct vcpu_svm *svm)
 {
        struct kvm_vcpu *vcpu = &svm->vcpu;
 
@@ -2967,6 +2980,15 @@ void sev_es_init_vmcb(struct vcpu_svm *svm)
        }
 }
 
+void sev_init_vmcb(struct vcpu_svm *svm)
+{
+       svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;
+       clr_exception_intercept(svm, UD_VECTOR);
+
+       if (sev_es_guest(svm->vcpu.kvm))
+               sev_es_init_vmcb(svm);
+}
+
 void sev_es_vcpu_reset(struct vcpu_svm *svm)
 {
        /*

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 87da90360bc76215ceb0342c612ef264b0acf1d0..44bbf25dfeb950b0fd4df14262a5803144824e08 100644 (file)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1212,15 +1212,8 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
                svm->vmcb->control.int_ctl |= V_GIF_ENABLE_MASK;
        }
 
-       if (sev_guest(vcpu->kvm)) {
-               svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;
-               clr_exception_intercept(svm, UD_VECTOR);
-
-               if (sev_es_guest(vcpu->kvm)) {
-                       /* Perform SEV-ES specific VMCB updates */
-                       sev_es_init_vmcb(svm);
-               }
-       }
+       if (sev_guest(vcpu->kvm))
+               sev_init_vmcb(svm);
 
        svm_hv_init_vmcb(vmcb);
        init_vmcb_after_set_cpuid(vcpu);

diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index 1bddd336a27e088c16d747237e369dd3f13d73fd..9223ac100ef57fdf283103b89a1841a2946a3262 100644 (file)
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -649,10 +649,10 @@ void __init sev_set_cpu_caps(void);
 void __init sev_hardware_setup(void);
 void sev_hardware_unsetup(void);
 int sev_cpu_init(struct svm_cpu_data *sd);
+void sev_init_vmcb(struct vcpu_svm *svm);
 void sev_free_vcpu(struct kvm_vcpu *vcpu);
 int sev_handle_vmgexit(struct kvm_vcpu *vcpu);
 int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in);
-void sev_es_init_vmcb(struct vcpu_svm *svm);
 void sev_es_vcpu_reset(struct vcpu_svm *svm);
 void sev_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector);
 void sev_es_prepare_switch_to_guest(struct sev_es_save_area *hostsa);