Re: [PATCH 2/2] KVM: SVM: Skip VMSA init in sev_es_init_vmcb() if pointer is NULL

[Peter Gonda]

On Fri, Aug 25, 2023 at 4:26 AM Gupta, Pankaj <pankaj.gupta@xxxxxxx> wrote:
>
> On 8/25/2023 4:23 AM, Sean Christopherson wrote:
> > Skip initializing the VMSA physical address in the VMCB if the VMSA is
> > NULL, which occurs during intrahost migration as KVM initializes the VMCB
> > before copying over state from the source to the destination (including
> > the VMSA and its physical address).
> >
> > In normal builds, __pa() is just math, so the bug isn't fatal, but with
> > CONFIG_DEBUG_VIRTUAL=y, the validity of the virtual address is verified
> > and passing in NULL will make the kernel unhappy.
> >
> > Fixes: 6defa24d3b12 ("KVM: SEV: Init target VMCBs in sev_migrate_from")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Cc: Peter Gonda <pgonda@xxxxxxxxxx>
> > Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> > ---
> >   arch/x86/kvm/svm/sev.c | 7 +++++--
> >   1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> > index acc700bcb299..5585a3556179 100644
> > --- a/arch/x86/kvm/svm/sev.c
> > +++ b/arch/x86/kvm/svm/sev.c
> > @@ -2975,9 +2975,12 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm)
> >       /*
> >        * An SEV-ES guest requires a VMSA area that is a separate from the
> >        * VMCB page. Do not include the encryption mask on the VMSA physical
> > -      * address since hardware will access it using the guest key.
> > +      * address since hardware will access it using the guest key.  Note,
> > +      * the VMSA will be NULL if this vCPU is the destination for intrahost
> > +      * migration, and will be copied later.
> >        */
> > -     svm->vmcb->control.vmsa_pa = __pa(svm->sev_es.vmsa);
> > +     if (svm->sev_es.vmsa)
> > +             svm->vmcb->control.vmsa_pa = __pa(svm->sev_es.vmsa);
> >
> >       /* Can't intercept CR register access, HV can't modify CR registers */
> >       svm_clr_intercept(svm, INTERCEPT_CR0_READ);
>
> Reviewed-by: Pankaj Gupta <pankaj.gupta@xxxxxxx>

Reviewed-by: Peter Gonda <pgonda@xxxxxxxxxx>