Re: [PATCH v2 2/8] KVM: SVM: Implement GET_AP_APIC_IDS NAE event

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The new SVM_VMGEXIT_GET_APIC_IDS feature is unconditionally enabled and advertised to the guest, breaking the default-off policy and live migration capability.
--

commit b3798f7802c495f4483b09adbdba116cdb452f71
Author: Joerg Roedel <joerg.roedel@amd.com>

KVM: SVM: Implement GET_AP_APIC_IDS NAE event

This commit implements the GHCB APIC ID list feature to allow SNP guests to
discover vCPUs needing VMSAs without INIT-SIPI. It handles undersized buffers
and copies online vCPU APIC IDs to guest memory.

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 5705723f1f412..c16eca9983f37 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -40,7 +40,9 @@
>  #define GHCB_VERSION_MAX	2ULL
>  #define GHCB_VERSION_MIN	1ULL
>  
> -#define GHCB_HV_FT_SUPPORTED	(GHCB_HV_FT_SNP | GHCB_HV_FT_SNP_AP_CREATION)
> +#define GHCB_HV_FT_SUPPORTED	(GHCB_HV_FT_SNP | \
> +				 GHCB_HV_FT_SNP_AP_CREATION | \
> +				 GHCB_HV_FT_APIC_ID_LIST)

[Severity: High]
Does unconditionally adding GHCB_HV_FT_APIC_ID_LIST bypass userspace 
capability negotiation? 

KVM subsystem guidelines mandate that any new behavior the guest can observe
must be off by default and discoverable through the architecture's standard
enumeration interface.

If a VM boots on a kernel with this patch, observes the feature via the
GHCB_MSR_HV_FT_REQ MSR, and is then live-migrated to an older kernel that
lacks support, could it cause the VM to crash when it attempts to use the
NAE event? Should this feature require explicit opt-in from host userspace
(e.g., via a KVM_CAP_ check) before advertising it to the guest?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908103338.427254-1-joro@8bytes.org?part=2