sev_launch_finish() and sev_snp_launch_finish() could be called multiple times if the confidential guest is capable of being reset/rebooted. The migration blockers should not be added multiple times, once per invocation. This change makes sure that the migration blockers are added only one time by adding the migration blockers from sev instance init code which is called only once.
Signed-off-by: Ani Sinha <[email protected]> --- target/i386/sev.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/target/i386/sev.c b/target/i386/sev.c index fb5a3b5d77..c260c162b1 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -1421,11 +1421,6 @@ sev_launch_finish(SevCommonState *sev_common) } sev_set_guest_state(sev_common, SEV_STATE_RUNNING); - - /* add migration blocker */ - error_setg(&sev_mig_blocker, - "SEV: Migration is not implemented"); - migrate_add_blocker(&sev_mig_blocker, &error_fatal); } static int snp_launch_update_data(uint64_t gpa, void *hva, size_t len, @@ -1608,7 +1603,6 @@ static void sev_snp_launch_finish(SevCommonState *sev_common) { int ret, error; - Error *local_err = NULL; OvmfSevMetadata *metadata; SevLaunchUpdateData *data; SevSnpGuestState *sev_snp = SEV_SNP_GUEST(sev_common); @@ -1655,15 +1649,6 @@ sev_snp_launch_finish(SevCommonState *sev_common) kvm_mark_guest_state_protected(); sev_set_guest_state(sev_common, SEV_STATE_RUNNING); - - /* add migration blocker */ - error_setg(&sev_mig_blocker, - "SEV-SNP: Migration is not implemented"); - ret = migrate_add_blocker(&sev_mig_blocker, &local_err); - if (local_err) { - error_report_err(local_err); - exit(1); - } } @@ -2764,6 +2749,11 @@ sev_common_instance_init(Object *obj) cgs->set_guest_policy = cgs_set_guest_policy; QTAILQ_INIT(&sev_common->launch_vmsa); + + /* add migration blocker */ + error_setg(&sev_mig_blocker, + "SEV: Migration is not implemented"); + migrate_add_blocker(&sev_mig_blocker, &error_fatal); } /* sev guest info common to sev/sev-es/sev-snp */ -- 2.42.0
