Re: [RFC PATCH v3 16/27] KVM: SVM: Add handler for VMGEXIT Secure AVIC NAE event

[Sean Christopherson <seanjc@google.com>]

On Wed, Sep 30, 2026, Naveen N Rao wrote:
> On Tue, Sep 22, 2026 at 08:31:45PM +0530, Naveen N Rao wrote:
> With the below hunk, I think we should be able to catch invalidations 
> due to PUNCH_HOLE, HWPOISON, memslot DELETE and to-SHARED conversions, 
> and should help make the source of the invalidation clear:
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 96992d10cb2b..3c8daa876045 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -5571,11 +5571,36 @@ void sev_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range)
>                  * vCPU to re-establish its VMSA.
>                  */
>                 gpa_t gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_vmsa_gpa);
> +               gpa_t savic_gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_savic_gpa);
> 
>                 if (VALID_PAGE(gpa) &&
>                     gpa_to_gfn(gpa) >= range->start &&
>                     gpa_to_gfn(gpa) < range->end)
>                         kvm_make_request_and_kick(KVM_REQ_VMSA_PAGE_RELOAD, vcpu);
> +
> +               /*
> +                * All PRIVATE invalidations that hit the Secure AVIC backing page in
> +                * this path will result in a subsequent access by the Secure AVIC HW
> +                * to cause a not-restartable #NPF killing the VM. Catch such
> +                * invalidations here so that the source of those invalidations is
> +                * clear, rather than a subsequent guest access resulting in a
> +                * unrecoverable #NPF.
> +                *
> +                * This is expected on guest teardown, so check if there is a valid
> +                * gmem.file before killing the VM.
> +                */
> +               if (VALID_PAGE(savic_gpa) &&
> +                   READ_ONCE(range->slot->gmem.file) &&
> +                   (range->attr_filter & KVM_FILTER_PRIVATE) &&
> +                   gpa_to_gfn(savic_gpa) >= range->start &&
> +                   gpa_to_gfn(savic_gpa) < range->end) {
> +                       if (!kvm->vm_dead) {
> +                               vcpu_err(vcpu, "Secure AVIC backing page invalidated, GPA 0x%llx!\n", savic_gpa);
> +                               dump_stack();
> +                               kvm_vm_dead(vcpu->kvm);
> +                               return;
> +                       }
> +               }

This is beyond gross.  If anything, this is just soldifying my opinion that Secure
AVIC is poorly architected in order to accomodate limitations in hardware/microcode,
and that KVM should not support Secure AVIC in its current form.

I'll take another look at some point, but I want to be very transparent that this
is about as far down on my priority list as something can get without falling off
entirely.