lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 20 Oct 2021 14:43:36 -0600 From: Peter Gonda <pgonda@...gle.com> To: Tom Lendacky <thomas.lendacky@....com> Cc: kvm list <kvm@...r.kernel.org>, Marc Orr <marcorr@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>, Sean Christopherson <seanjc@...gle.com>, David Rientjes <rientjes@...gle.com>, "Dr . David Alan Gilbert" <dgilbert@...hat.com>, Brijesh Singh <brijesh.singh@....com>, Vitaly Kuznetsov <vkuznets@...hat.com>, Wanpeng Li <wanpengli@...cent.com>, Jim Mattson <jmattson@...gle.com>, Joerg Roedel <joro@...tes.org>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, "H. Peter Anvin" <hpa@...or.com>, LKML <linux-kernel@...r.kernel.org> Subject: Re: [PATCH 3/5 V10] KVM: SEV: Add support for SEV-ES intra host migration On Fri, Oct 15, 2021 at 3:36 PM Tom Lendacky <thomas.lendacky@....com> wrote: > > On 10/12/21 3:48 PM, Peter Gonda wrote: > > For SEV-ES to work with intra host migration the VMSAs, GHCB metadata, > > and other SEV-ES info needs to be preserved along with the guest's > > memory. > > > > Signed-off-by: Peter Gonda <pgonda@...gle.com> > > Reviewed-by: Marc Orr <marcorr@...gle.com> > > Cc: Marc Orr <marcorr@...gle.com> > > Cc: Paolo Bonzini <pbonzini@...hat.com> > > Cc: Sean Christopherson <seanjc@...gle.com> > > Cc: David Rientjes <rientjes@...gle.com> > > Cc: Dr. David Alan Gilbert <dgilbert@...hat.com> > > Cc: Brijesh Singh <brijesh.singh@....com> > > Cc: Tom Lendacky <thomas.lendacky@....com> > > Cc: Vitaly Kuznetsov <vkuznets@...hat.com> > > Cc: Wanpeng Li <wanpengli@...cent.com> > > Cc: Jim Mattson <jmattson@...gle.com> > > Cc: Joerg Roedel <joro@...tes.org> > > Cc: Thomas Gleixner <tglx@...utronix.de> > > Cc: Ingo Molnar <mingo@...hat.com> > > Cc: Borislav Petkov <bp@...en8.de> > > Cc: "H. Peter Anvin" <hpa@...or.com> > > Cc: kvm@...r.kernel.org > > Cc: linux-kernel@...r.kernel.org > > --- > > arch/x86/kvm/svm/sev.c | 48 +++++++++++++++++++++++++++++++++++++++++- > > 1 file changed, 47 insertions(+), 1 deletion(-) > > > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > > index 42ff1ccfe1dc..a486ab08a766 100644 > > --- a/arch/x86/kvm/svm/sev.c > > +++ b/arch/x86/kvm/svm/sev.c > > @@ -1600,6 +1600,46 @@ static void sev_migrate_from(struct kvm_sev_info *dst, > > list_replace_init(&src->regions_list, &dst->regions_list); > > } > > > > +static int sev_es_migrate_from(struct kvm *dst, struct kvm *src) > > +{ > > + int i; > > + struct kvm_vcpu *dst_vcpu, *src_vcpu; > > + struct vcpu_svm *dst_svm, *src_svm; > > + > > + if (atomic_read(&src->online_vcpus) != atomic_read(&dst->online_vcpus)) > > + return -EINVAL; > > + > > + kvm_for_each_vcpu(i, src_vcpu, src) { > > + if (!src_vcpu->arch.guest_state_protected) > > + return -EINVAL; > > + } > > + > > + kvm_for_each_vcpu(i, src_vcpu, src) { > > + src_svm = to_svm(src_vcpu); > > + dst_vcpu = kvm_get_vcpu(dst, i); > > + dst_svm = to_svm(dst_vcpu); > > + > > + /* > > + * Transfer VMSA and GHCB state to the destination. Nullify and > > + * clear source fields as appropriate, the state now belongs to > > + * the destination. > > + */ > > + dst_vcpu->vcpu_id = src_vcpu->vcpu_id; > > + memcpy(&dst_svm->sev_es, &src_svm->sev_es, > > + sizeof(dst_svm->sev_es)); > > + dst_svm->vmcb->control.ghcb_gpa = > > + src_svm->vmcb->control.ghcb_gpa; > > + dst_svm->vmcb->control.vmsa_pa = __pa(dst_svm->sev_es.vmsa); > > + dst_vcpu->arch.guest_state_protected = true; > > Maybe just add a blank line here to separate the setting and clearing > (only if you have to do another version). > > > + src_svm->vmcb->control.ghcb_gpa = 0; > > + src_svm->vmcb->control.vmsa_pa = 0; > > + src_vcpu->arch.guest_state_protected = false; > > In the previous patch you were clearing some of the fields that are now in > the vcpu_sev_es_state. Did you want to memset that to zero now? Oops, making that an easy memset was one of the pros of the |sev_es| refactor. Will fix and add newline in V11. > > Thanks, > Tom > > > + } > > + to_kvm_svm(src)->sev_info.es_active = false; > > + > > + return 0; > > +} > > +
Powered by blists - more mailing lists