diff mbox series

[RFC,08/11] KVM: x86: Let moving encryption context be configurable

Message ID 196a2130f155cbc0201cce06579f122352c8b236.1691446946.git.ackerleytng@google.com
State New
Headers
Series New KVM ioctl to link a gmem inode to a new gmem file |

Commit Message

Ackerley Tng Aug. 7, 2023, 11:01 p.m. UTC 
  SEV-capable VMs may also use the KVM_X86_SW_PROTECTED_VM type, but
they will still need architecture-specific handling to move encryption
context. Hence, we let moving of encryption context be configurable
and store that configuration in a flag.

Co-developed-by: Vishal Annapurve <vannapurve@google.com>
Signed-off-by: Vishal Annapurve <vannapurve@google.com>
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
---
 arch/x86/include/asm/kvm_host.h | 2 ++
 arch/x86/kvm/svm/sev.c          | 2 ++
 arch/x86/kvm/x86.c              | 9 ++++++++-
 3 files changed, 12 insertions(+), 1 deletion(-)

Comments

Paolo Bonzini Aug. 10, 2023, 2:03 p.m. UTC | #1 
On 8/8/23 01:01, Ackerley Tng wrote:
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 75d48379d94d..a1a28dd77b94 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6351,7 +6351,14 @@ static int kvm_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd)
>   	if (r)
>   		goto out_mark_migration_done;
>   
> -	r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
> +	/*
> +	 * Different types of VMs will allow userspace to define if moving
> +	 * encryption context should be supported.
> +	 */
> +	if (kvm->arch.vm_move_enc_ctxt_supported &&
> +	    kvm_x86_ops.vm_move_enc_context_from) {
> +		r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
> +	}

Rather than "supported" this is more "required".  So  perhaps 
kvm->arch.use_vm_enc_ctxt_op?

Paolo
Ackerley Tng Aug. 17, 2023, 4:53 p.m. UTC | #2 
Paolo Bonzini <pbonzini@redhat.com> writes:

> On 8/8/23 01:01, Ackerley Tng wrote:
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 75d48379d94d..a1a28dd77b94 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -6351,7 +6351,14 @@ static int kvm_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd)
>>   	if (r)
>>   		goto out_mark_migration_done;
>>   
>> -	r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
>> +	/*
>> +	 * Different types of VMs will allow userspace to define if moving
>> +	 * encryption context should be supported.
>> +	 */
>> +	if (kvm->arch.vm_move_enc_ctxt_supported &&
>> +	    kvm_x86_ops.vm_move_enc_context_from) {
>> +		r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
>> +	}
>
> Rather than "supported" this is more "required".  So  perhaps 
> kvm->arch.use_vm_enc_ctxt_op?
>
> Paolo

Thanks, that is a great suggestion, I'll incorporate this in the next
revision!
diff mbox series

Patch

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 71c1236e4f18..ab45a3d3c867 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1445,6 +1445,8 @@  struct kvm_arch {
 	 */
 #define SPLIT_DESC_CACHE_MIN_NR_OBJECTS (SPTE_ENT_PER_PAGE + 1)
 	struct kvm_mmu_memory_cache split_desc_cache;
+
+	bool vm_move_enc_ctxt_supported;
 };
 
 struct kvm_vm_stat {
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index e0e206aa3e62..b09e6477e309 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -256,6 +256,8 @@  static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		goto e_no_asid;
 	sev->asid = asid;
 
+	kvm->arch.vm_move_enc_ctxt_supported = true;
+
 	ret = sev_platform_init(&argp->error);
 	if (ret)
 		goto e_free;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 75d48379d94d..a1a28dd77b94 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6351,7 +6351,14 @@  static int kvm_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd)
 	if (r)
 		goto out_mark_migration_done;
 
-	r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
+	/*
+	 * Different types of VMs will allow userspace to define if moving
+	 * encryption context should be supported.
+	 */
+	if (kvm->arch.vm_move_enc_ctxt_supported &&
+	    kvm_x86_ops.vm_move_enc_context_from) {
+		r = static_call(kvm_x86_vm_move_enc_context_from)(kvm, source_kvm);
+	}
 
 	kvm_unlock_two_vms(kvm, source_kvm);
 out_mark_migration_done: