Re: [PATCH 1/2] KVM: SEV: Do not allow SEV-SNP VMs from intra-host migration

[Sean Christopherson <seanjc@google.com>]

On Fri, May 29, 2026, Atish Patra wrote:
> > Because the mirror's vmsa_features is zero, KVM treats the mirror VM as a
> > standard SEV-ES VM (since ____sev_snp_guest() will evaluate to false).
> > 
> > When vCPUs are created for the mirror VM, KVM allocates standard SEV-ES
> > VMSAs and fails to perform SNP-specific initialization, such as registering
> > the VMSA pages in the RMP via SEV_CMD_SNP_LAUNCH_UPDATE.
> > 
> > When KVM executes VMRUN for the mirror VM's vCPU, the hardware evaluates an
> > ASID bound to SNP execution using an invalid, non-RMP-registered VMSA page.
> > Will this trigger an RMP #NPF (Nested Page Fault) on the host hypervisor,
> > leading to an unhandled hypervisor crash and denial of service?
> 
> Nice catch! I don't think it will lead to hypervisor crash though. As per my
> understanding, the fault on VMSA page would be sent to user space and just a
> VM instance will crash which is not that critical.

RMP #PFs on the VMSA will typically crash the host.  In this case, I would
expect VMRUN to fault, which would trigger the BUG_ON() in kvm_spurious_fault().
So assuming the "bad" VM can get far enough along to attempt VMRUN, this is
likely fatal.

> Having said that, we should close the gap for such mistakes from VMM side
> though by rejecting mirroring of sev-snp VMs. I will add a patch and update
> the migration kselftest as well for sanity checking.
> 
> > >   		ret = -EINVAL;
> > >   		goto out_unlock;
> > >   	}