On Tue, Sep 14, 2021 at 12:41 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote: > > -stable, for giggles > > On Tue, Sep 14, 2021, Peter Gonda wrote: > > On Tue, Sep 14, 2021 at 11:32 AM Sean Christopherson <seanjc@xxxxxxxxxx> wrote: > > > > > > On Tue, Sep 14, 2021, Peter Gonda wrote: > > > > Copying an ASID into new vCPUs will not work for SEV-ES since the vCPUs > > > > VMSAs need to be setup and measured before SEV_LAUNCH_FINISH. Return an > > > > error if a users tries to KVM_CAP_VM_COPY_ENC_CONTEXT_FROM from an > > > > SEV-ES guest. > > > > > > What happens if userspace does KVM_CAP_VM_COPY_ENC_CONTEXT_FROM before the source > > > has created vCPUs, i.e. before it has done SEV_LAUNCH_FINISH? > > > > That's not enough. If you wanted to be able to mirror SEV-ES you'd > > also need to call LAUNCH_UPDATE_VMSA on the mirror's vCPUs before > > SEV_LAUNCH_FINISH. That is do-able but I was writing a small change to > > fix this bug. If mirroring of SEV-ES is wanted it's a much bigger > > change. > > Is it doable without KVM updates? If so, then outright rejection may not be the > correct behavior. I do not think so. You cannot call KVM_SEV_LAUNCH_UPDATE_VMSA on the mirror because svm_mem_enc_op() blocks calls from the mirror. So either you have to update vmsa from the mirror or have the original VM read through its mirror's vCPUs when calling KVM_SEV_LAUNCH_UPDATE_VMSA. Not sure which way is better but I don't see a way to do this without updating KVM. > > > > Might be worth noting that the destination cannot be an SEV guest, and therefore > > > can't be an SEV-ES guest either. > > > > sev_guest() implies sev_es_guest() so I think this case is covered. > > Yes, I was suggesting calling that out in the changelog so that readers/reviewers > don't worry about that case. > > > > Cc: stable@xxxxxxxxxxxxxxx > > > Oops. I'll update in the V2 if needed. Added to this thread for now. > > FWIW, you don't actually need to Cc stable, just including it in the changelog is > sufficient as the script automagic will pick it up when it hits Linus' tree. Ack. I'll send out a V2 with updated changelog after we've settled on the first issue.
