Re: [RFC PATCH v2 0/4] Add KVM API for confidential guest live migration

["Serge Hallyn (AMD)" <sergeh@kernel.org>]

On Tue, Sep 22, 2026 at 11:09:42AM +0300, Artem Bityutskiy wrote:
> Hi Peter,
...
> > Said that, we'll need to be careful then in case of migration fallbacks at
> > the final stage. Nowadays, I believe QEMU can still fallback to source side
> > at a very, very late stage after all things applied.  If I'm not mistaken,
> > the final handshake is done at migration_incoming_state_destroy() ->
> > migrate_send_rp_shut() telling source to be gone.
> 
> Right. In traditional pre-copy VM migration model, the fallback is possible
> at any point before the destination VM starts running and modifying its
> state.
> 
> The same is true for TDX, but with more complexity and limitations.
> 
> We have 2 points:
> 1. Before the source has exported the start token - fallback is similar to
>    traditional VM migration - just abort the migration on source and
>    continue running the source TD, and just destroy the destination TD.
> 2. After the source has exported the start token - fallback is still
>    possible, but more complex - it requires the destination to first
>    generate the abort token, which should be delivered to the source and
>    consumed there. There are seamcalls for both generating and consuming the
>    abort token. The token basically makes sure the destination cannot run,
>    and the source can run again - same "only one of the TDs can run at a
>    time" security rule that we discussed earlier.
> 
> Now, the limitation here is that if the abort is because the network
> connectivity is lost, the abort token cannot be delivered. Then I'd guess
> migration should stop, without destroying the source and the destination,
> and the token should be delivered later manually, QEMU could even provide an
> infrastructure / commands for that.
> 
> Would be very helpful to learn the abort protocol the other CoCo vendors
> offer - is it similar to TDX or not?

Yup, that sounds very similar to the expected SEV-SNP late abort semantics,

-serge