Re: [PATCH v3 2/8] KVM: SVM: Implement GET_AP_APIC_IDS NAE event

["Jörg Rödel" <joro@8bytes.org>]

On Mon, Nov 02, 2026 at 11:52:44AM +0000, sashiko-bot@kernel.org wrote:
> [Severity: High]
> As reported by Sashiko on v2 [1], GHCB_HV_FT_APIC_ID_LIST is added
> unconditionally to GHCB_HV_FT_SUPPORTED and sev_handle_vmgexit() dispatches
> SVM_VMGEXIT_GET_APIC_IDS to sev_snp_get_apic_ids() for all SEV-SNP guests
> without host userspace opting in.
> 
> When an SEV-SNP guest queries hypervisor features via GHCB_MSR_HV_FT_REQ in
> sev_handle_vmgexit_msr_protocol() or SVM_VMGEXIT_HV_FEATURES in
> sev_handle_vmgexit(), it will unconditionally observe GHCB_HV_FT_APIC_ID_LIST.
> If a guest uses this feature and is migrated or restored onto a kernel without
> SVM_VMGEXIT_GET_APIC_IDS support, guest execution will fail when invoking the
> NAE event.
> 
> Should this new guest-visible feature default to off and be gated behind a
> capability via KVM_CHECK_EXTENSION and KVM_ENABLE_CAP so userspace can manage
> feature exposure and live migration compatibility?

No, this feature is for SEV-SNP guests only, which can not be live migrated.
Live migration for SEV-SNP guests will be built on-top of this feature (among
others).