Re: [PATCH v10 03/15] s390/vfio-ap: Functions to initialize/release vfio device migration data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] s390/vfio-ap: ap_is_se_guest() checks host in vfio_ap_init_migration_data()
--

commit 79c297f4ef408f423e0eed3174df28dca4e407f2
Author: Anthony Krowiak <akrowiak@linux.ibm.com>

s390/vfio-ap: Functions to initialize/release vfio device migration data

This patch adds helper functions to allocate, initialize, and release the
vfio_ap_migration_data structure and its associated migration file state
when a vfio_ap mediated device is opened, closed, or released.

> diff --git a/drivers/s390/crypto/vfio_ap_migration.c b/drivers/s390/crypto/vfio_ap_migration.c
> index f01a37e4c418f..ba86a1afbb332 100644
> --- a/drivers/s390/crypto/vfio_ap_migration.c
> +++ b/drivers/s390/crypto/vfio_ap_migration.c

[ ... ]

> +int vfio_ap_init_migration_data(struct ap_matrix_mdev *matrix_mdev)
> +{
> +	struct vfio_ap_migration_data *mig_data;
> +
> +	lockdep_assert_held(&matrix_dev->mdevs_lock);
> +
> +	/*
> +	 * Live guest migration is not supported for SE guests, so there is no
> +	 * need to initialize the migration data.
> +	 */
> +	if (ap_is_se_guest())
> +		return 0;

[Severity: Medium]
Does ap_is_se_guest() check the right entity here when called via
vfio_ap_mdev_open_device() -> vfio_ap_init_migration_data()?

In drivers/s390/crypto/ap_bus.c, ap_is_se_guest() is defined as:

bool ap_is_se_guest(void)
{
	return is_prot_virt_guest() && ap_sb_available();
}

That helper checks whether the currently running kernel itself is executing as
a Protected Virtualization (Secure Execution) guest, rather than checking
whether the target KVM guest attached to the mediated device is an SE guest.
Because vfio_ap runs on the KVM host where is_prot_virt_guest() is false,
ap_is_se_guest() will always evaluate to false here and matrix_mdev->mig_data
will still be allocated and initialized for SE guests.

Additionally, vfio_ap_init_migration_data() is called from
vfio_ap_mdev_open_device() when userspace first opens the VFIO device (and
before vfio_ap_mdev_set_kvm() sets matrix_mdev->kvm), whereas an s390 KVM
guest only transitions into Protected Virtualization mode later when the guest
executes DIAG 308 subcode 8 or 10. Can the SE guest check be performed when a
migration state transition is requested via kvm_s390_pv_is_protected(), rather
than during device open?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023174349.3545941-1-akrowiak@linux.ibm.com?part=3