Re: [PATCH v3 2/8] KVM: SVM: Implement GET_AP_APIC_IDS NAE event

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM: SVM: Unconditional enablement of GHCB_HV_FT_APIC_ID_LIST feature
--

commit 3bffb8ab055298369df7622e8e3308488b5501b8
Author: Joerg Roedel <joerg.roedel@amd.com>

KVM: SVM: Implement GET_AP_APIC_IDS NAE event

This commit advertises GHCB_HV_FT_APIC_ID_LIST and implements the
SVM_VMGEXIT_GET_APIC_IDS NAE event so SEV-SNP guests can retrieve the list of
online vCPU APIC IDs without relying on INIT-SIPI.

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index fad72cab76cf4..c0ae34871be90 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -40,7 +40,9 @@
>  #define GHCB_VERSION_MAX	2ULL
>  #define GHCB_VERSION_MIN	1ULL
>  
> -#define GHCB_HV_FT_SUPPORTED	(GHCB_HV_FT_SNP | GHCB_HV_FT_SNP_AP_CREATION)
> +#define GHCB_HV_FT_SUPPORTED	(GHCB_HV_FT_SNP | \
> +				 GHCB_HV_FT_SNP_AP_CREATION | \
> +				 GHCB_HV_FT_APIC_ID_LIST)

[ ... ]

> @@ -4708,6 +4769,8 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
>  		if (sev_snp_ap_creation(svm))
>  			svm_vmgexit_bad_input(svm, GHCB_ERR_INVALID_INPUT);
>  		return 1;
> +	case SVM_VMGEXIT_GET_APIC_IDS:
> +		return sev_snp_get_apic_ids(svm);

[Severity: High]
As reported by Sashiko on v2 [1], GHCB_HV_FT_APIC_ID_LIST is added
unconditionally to GHCB_HV_FT_SUPPORTED and sev_handle_vmgexit() dispatches
SVM_VMGEXIT_GET_APIC_IDS to sev_snp_get_apic_ids() for all SEV-SNP guests
without host userspace opting in.

When an SEV-SNP guest queries hypervisor features via GHCB_MSR_HV_FT_REQ in
sev_handle_vmgexit_msr_protocol() or SVM_VMGEXIT_HV_FEATURES in
sev_handle_vmgexit(), it will unconditionally observe GHCB_HV_FT_APIC_ID_LIST.
If a guest uses this feature and is migrated or restored onto a kernel without
SVM_VMGEXIT_GET_APIC_IDS support, guest execution will fail when invoking the
NAE event.

Should this new guest-visible feature default to off and be gated behind a
capability via KVM_CHECK_EXTENSION and KVM_ENABLE_CAP so userspace can manage
feature exposure and live migration compatibility?

[1] https://lore.kernel.org/r/20260908103338.427254-3-joro@8bytes.org

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102114137.1198982-1-joro@8bytes.org?part=2