Re: [RFC PATCH v2 2/4] KVM: x86: Add optional KVM_CAP_LIVE_MIGRATION and KVM_MIGRATE_CMD

[Tony Lindgren <tony.lindgren@linux.intel.com>]

On Mon, Aug 31, 2026 at 07:23:11AM +0000, sashiko-bot@kernel.org wrote:
> Author: Tony Lindgren <tony.lindgren@linux.intel.com>
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -7614,6 +7617,28 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
> >  		r = kvm_vm_ioctl_set_msr_filter(kvm, &filter);
> >  		break;
> >  	}
> > +	case KVM_MIGRATE_CMD: {
> > +		struct kvm_migrate_cmd cmd;
> > +
> > +		if (!kvm_x86_ops.migrate_cmd ||
> > +		    !kvm_x86_call(cap_live_migration)(kvm))
> > +			return -ENOTTY;
> > +
> > +		if (copy_from_user(&cmd, argp, sizeof(cmd)))
> > +			return -EFAULT;
> > +
> > +		if (cmd.reserved || cmd.buf.reserved)
> > +			return -EINVAL;
> 
> [Severity: High]
> Does this code also need to validate that the new flags field is zero?
> 
> If uninitialized memory or garbage is passed by userspace in cmd.flags, it
> will currently be silently ignored. When a future kernel introduces a new
> flag, old userspace applications passing uninitialized flags will inadvertently
> enable it, which could permanently break backwards compatibility.

Could be zero, or we could check for the known flags.

We are currently using the following flags for KVM_MIGRATE_CMD
sub-commands for TDX:

1. KVM_MIGRATE_SETUP
====================

TDX_MIGRATE_SETUP_SESSION       exchange the migration keys
TDX_MIGRATE_IMMUTABLE_STATE     transfer the TDX immutable state

2. KVM_MIGRATE_ITERATION
========================

TDX_MIGRATE_IN_ORDER_DONE       end the in-order migration

3. KVM_MIGRATE_STOP_AND_COPY
============================

TDX_MIGRATE_STOP_COPY_PAUSE     pause the TD
TDX_MIGRATE_STOP_COPY_TD_STATE  transfer the mutable TD state

4. KVM_MIGRATE_END
==================

TDX_MIGRATE_ABORT               abort migration

Maybe all the above TDX specific flags could be turned into generic
flags for the sub-commands.