Re: [PATCH v10 03/15] s390/vfio-ap: Functions to initialize/release vfio device migration data

[Anthony Krowiak <akrowiak@linux.ibm.com>]

On 10/23/26 2:09 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] s390/vfio-ap: ap_is_se_guest() checks host in vfio_ap_init_migration_data()
> --
>
> commit 79c297f4ef408f423e0eed3174df28dca4e407f2
> Author: Anthony Krowiak <akrowiak@linux.ibm.com>
>
> s390/vfio-ap: Functions to initialize/release vfio device migration data
>
> This patch adds helper functions to allocate, initialize, and release the
> vfio_ap_migration_data structure and its associated migration file state
> when a vfio_ap mediated device is opened, closed, or released.
>
>> diff --git a/drivers/s390/crypto/vfio_ap_migration.c b/drivers/s390/crypto/vfio_ap_migration.c
>> index f01a37e4c418f..ba86a1afbb332 100644
>> --- a/drivers/s390/crypto/vfio_ap_migration.c
>> +++ b/drivers/s390/crypto/vfio_ap_migration.c
> [ ... ]
>
>> +int vfio_ap_init_migration_data(struct ap_matrix_mdev *matrix_mdev)
>> +{
>> +	struct vfio_ap_migration_data *mig_data;
>> +
>> +	lockdep_assert_held(&matrix_dev->mdevs_lock);
>> +
>> +	/*
>> +	 * Live guest migration is not supported for SE guests, so there is no
>> +	 * need to initialize the migration data.
>> +	 */
>> +	if (ap_is_se_guest())
>> +		return 0;
> [Severity: Medium]
> Does ap_is_se_guest() check the right entity here when called via
> vfio_ap_mdev_open_device() -> vfio_ap_init_migration_data()?
>
> In drivers/s390/crypto/ap_bus.c, ap_is_se_guest() is defined as:
>
> bool ap_is_se_guest(void)
> {
> 	return is_prot_virt_guest() && ap_sb_available();
> }
>
> That helper checks whether the currently running kernel itself is executing as
> a Protected Virtualization (Secure Execution) guest, rather than checking
> whether the target KVM guest attached to the mediated device is an SE guest.
> Because vfio_ap runs on the KVM host where is_prot_virt_guest() is false,
> ap_is_se_guest() will always evaluate to false here and matrix_mdev->mig_data
> will still be allocated and initialized for SE guests.
>
> Additionally, vfio_ap_init_migration_data() is called from
> vfio_ap_mdev_open_device() when userspace first opens the VFIO device (and
> before vfio_ap_mdev_set_kvm() sets matrix_mdev->kvm), whereas an s390 KVM
> guest only transitions into Protected Virtualization mode later when the guest
> executes DIAG 308 subcode 8 or 10. Can the SE guest check be performed when a
> migration state transition is requested via kvm_s390_pv_is_protected(), rather
> than during device open?

It is true that ap_is_se_guest() checks only whether the host kernel 
itself is
running as a Secure Execution guest; it does not check whether the KVM 
guest
attached to the mdev is protected. However, when the host kernel is an 
SE guest,
the AP hardware queues are bound to that SE host under UV control. The 
AP queue
state on an SE host is protected memory and cannot be extracted and 
transmitted
to a destination host, so live guest migration of vfio-ap devices is not
possible from such a host regardless of whether any particular KVM guest is
also running under SE. The ap_is_se_guest() guard in
vfio_ap_setup_vfio_device_migration() and vfio_ap_init_migration_data() is
checking the right entity for the right reason.

The existing uses of ap_is_se_guest() in ap_queue.c (e.g. the secure binding
path) follow the same pattern — they gate AP subsystem behavior on the 
host's
own SE status, not on any KVM guest's status. The features_show() 
function in
vfio_ap_drv.c omits the migration feature token on SE hosts for the same 
reason.

>