Re: [RFC PATCH v3 16/27] KVM: SVM: Add handler for VMGEXIT Secure AVIC NAE event

[Naveen N Rao <naveen@kernel.org>]

On Wed, Sep 30, 2026 at 08:45:27AM -0700, Sean Christopherson wrote:
> On Wed, Sep 30, 2026, Naveen N Rao wrote:
> > On Tue, Sep 22, 2026 at 08:31:45PM +0530, Naveen N Rao wrote:
> > With the below hunk, I think we should be able to catch invalidations 
> > due to PUNCH_HOLE, HWPOISON, memslot DELETE and to-SHARED conversions, 
> > and should help make the source of the invalidation clear:
> > 
> > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> > index 96992d10cb2b..3c8daa876045 100644
> > --- a/arch/x86/kvm/svm/sev.c
> > +++ b/arch/x86/kvm/svm/sev.c
> > @@ -5571,11 +5571,36 @@ void sev_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range)
> >                  * vCPU to re-establish its VMSA.
> >                  */
> >                 gpa_t gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_vmsa_gpa);
> > +               gpa_t savic_gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_savic_gpa);
> > 
> >                 if (VALID_PAGE(gpa) &&
> >                     gpa_to_gfn(gpa) >= range->start &&
> >                     gpa_to_gfn(gpa) < range->end)
> >                         kvm_make_request_and_kick(KVM_REQ_VMSA_PAGE_RELOAD, vcpu);
> > +
> > +               /*
> > +                * All PRIVATE invalidations that hit the Secure AVIC backing page in
> > +                * this path will result in a subsequent access by the Secure AVIC HW
> > +                * to cause a not-restartable #NPF killing the VM. Catch such
> > +                * invalidations here so that the source of those invalidations is
> > +                * clear, rather than a subsequent guest access resulting in a
> > +                * unrecoverable #NPF.
> > +                *
> > +                * This is expected on guest teardown, so check if there is a valid
> > +                * gmem.file before killing the VM.
> > +                */
> > +               if (VALID_PAGE(savic_gpa) &&
> > +                   READ_ONCE(range->slot->gmem.file) &&
> > +                   (range->attr_filter & KVM_FILTER_PRIVATE) &&
> > +                   gpa_to_gfn(savic_gpa) >= range->start &&
> > +                   gpa_to_gfn(savic_gpa) < range->end) {
> > +                       if (!kvm->vm_dead) {
> > +                               vcpu_err(vcpu, "Secure AVIC backing page invalidated, GPA 0x%llx!\n", savic_gpa);
> > +                               dump_stack();
> > +                               kvm_vm_dead(vcpu->kvm);
> > +                               return;
> > +                       }
> > +               }
> 
> This is beyond gross.

Ack, and to be perfectly clear: this change is not required.

I added this only to address concerns raised during PUCK that 
invalidation sources may not be evident if we take a not-restartable 
#NPF.

In reality, if we address memslot DELETE, all the other invalidation 
sources that reach here are already destructive to the VM (PUNCH_HOLE, 
MCE/HWPOISON and to-SHARED conversions) and point at a buggy guest/VMM 
(or HW in the case of MCE).

Hmm.. that made me think I may have got this backwards. This hook was 
added for VMSA reload to address PUNCH_HOLE, so I ended up using it for 
that purpose. But, it probably makes better sense to handle the 
invalidation from a memslot DELETE here, rather than BUG the VM. This 
hook is called on that path before the pages are zapped, so a KVM_REQ 
here might just be what we need to handle that.

Untested, but something like this instead (will look at this more 
tomorrow)?

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 96992d10cb2b..22b3f9fcac74 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -5571,11 +5571,25 @@ void sev_gmem_invalidate_range(struct kvm *kvm, struct kvm_gfn_range *range)
 		 * vCPU to re-establish its VMSA.
 		 */
 		gpa_t gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_vmsa_gpa);
+		gpa_t savic_gpa = READ_ONCE(to_svm(vcpu)->sev_es.snp_guest_savic_gpa);
 
 		if (VALID_PAGE(gpa) &&
 		    gpa_to_gfn(gpa) >= range->start &&
 		    gpa_to_gfn(gpa) < range->end)
 			kvm_make_request_and_kick(KVM_REQ_VMSA_PAGE_RELOAD, vcpu);
+
+		/*
+		 * For invalidations that hit the Secure AVIC backing page, kick the
+		 * vCPU out and queue a KVM_REQ to have the backing page prefaulted.
+		 * For memslot DELETE+CREATE, the vCPU won't re-enter the guest until
+		 * the memslot is re-created. For other destructive operations
+		 * (PUNCH_HOLE, HWPOISON, SHARED conversion), the VM is dead
+		 * regardless.
+		 */
+		if (VALID_PAGE(savic_gpa) &&
+		    gpa_to_gfn(savic_gpa) >= range->start &&
+		    gpa_to_gfn(savic_gpa) < range->end)
+			kvm_make_request_and_kick(KVM_REQ_PROTECTED_APIC_PAGE_RELOAD, vcpu);
 	}
 }
  

- Naveen