Re: [PATCH 8/8] KVM: SEV: Disallow the use of hardware-switched PMU

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch correctly disables hardware-switched PMU for newly initialized SEV-ES guests to fix a bug where KVM attempts to interact with PMU state in the unencrypted VMCB save area instead of the guest's encrypted VMSA. However, this fix fails to apply to SEV-ES VMs created via migration or mirroring.
--

--- Patch [8]: [PATCH 8/8] KVM: SEV: Disallow the use of hardware-switched PMU ---
commit 0e4fd883c1122d7a244f0bb8754669e617c9a34a
Author: Sandipan Das <[email protected]>

KVM: SEV: Disallow the use of hardware-switched PMU

For hardware-switched mediated PMU, the guest PMU state resides in the
VMCB save area. When SEV-ES or SEV-SNP is used, KVM cannot access the
encrypted VMSA, so this patch clears KVM_MEDIATED_PMU_CAP_HW_SWITCHED for
such guests to force software-switched mode.

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 944aaea6501f2..c5df6da8d030f 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -534,6 +534,9 @@ static int __sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp,
>  	if (snp_active)
>  		sev->vmsa_features |= SVM_SEV_FEAT_SNP_ACTIVE;
>  
> +	if (es_active)
> +		kvm_clr_mediated_pmu_caps(kvm, KVM_MEDIATED_PMU_CAP_HW_SWITCHED);
> +

[Severity: High]
Does this clearing also need to happen when an SEV-ES VM is created via
migration or mirroring?

Looking at sev_migrate_from(), it copies the es_active state to the
destination VM but does not appear to clear the hardware-switched PMU
capability:

arch/x86/kvm/svm/sev.c:sev_migrate_from() {
	...
	dst->es_active = src->es_active;
	dst->vmsa_features = src->vmsa_features;
	...
}

Similarly, in sev_vm_copy_enc_context_from(), the mirror_sev->es_active flag
is set to true without clearing the PMU capability:

arch/x86/kvm/svm/sev.c:sev_vm_copy_enc_context_from() {
	...
	mirror_sev->es_active = source_sev->es_active;
	...
}

Since KVM unconditionally sets KVM_MEDIATED_PMU_CAP_HW_SWITCHED during VM
creation, could failing to clear it on the destination VMs leave the hardware
PMU feature incorrectly enabled?

If a user migrates or mirrors an SEV-ES VM, might KVM attempt to read/write
PMU state from the unencrypted VMCB save area instead of the guest's
encrypted VMSA, reintroducing the issue this patch aims to fix?

>  	ret = sev_asid_new(sev, vm_type);
>  	if (ret)
>  		goto e_no_asid;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=8