Re: [PATCH 1/2] KVM: SEV: Do not allow SEV-SNP VMs from intra-host migration

[Atish Patra <atish.patra@linux.dev>]

On 5/29/26 3:28 PM, Sean Christopherson wrote:
> On Fri, May 29, 2026, Atish Patra wrote:
>>> Because the mirror's vmsa_features is zero, KVM treats the mirror VM as a
>>> standard SEV-ES VM (since ____sev_snp_guest() will evaluate to false).
>>>
>>> When vCPUs are created for the mirror VM, KVM allocates standard SEV-ES
>>> VMSAs and fails to perform SNP-specific initialization, such as registering
>>> the VMSA pages in the RMP via SEV_CMD_SNP_LAUNCH_UPDATE.
>>>
>>> When KVM executes VMRUN for the mirror VM's vCPU, the hardware evaluates an
>>> ASID bound to SNP execution using an invalid, non-RMP-registered VMSA page.
>>> Will this trigger an RMP #NPF (Nested Page Fault) on the host hypervisor,
>>> leading to an unhandled hypervisor crash and denial of service?
>> Nice catch! I don't think it will lead to hypervisor crash though. As per my
>> understanding, the fault on VMSA page would be sent to user space and just a
>> VM instance will crash which is not that critical.
> RMP #PFs on the VMSA will typically crash the host.  In this case, I would
> expect VMRUN to fault, which would trigger the BUG_ON() in kvm_spurious_fault().
> So assuming the "bad" VM can get far enough along to attempt VMRUN, this is
> likely fatal.

Ahh VMRUN would fault it self which would be bad. So no RMP #NPF.
Thanks for the clarification. I will send the v2 with the mirroring fix.

>> Having said that, we should close the gap for such mistakes from VMM side
>> though by rejecting mirroring of sev-snp VMs. I will add a patch and update
>> the migration kselftest as well for sanity checking.
>>
>>>>    		ret = -EINVAL;
>>>>    		goto out_unlock;
>>>>    	}