Re: [PATCH v3 00/12] KVM: SEV: Fix RMP #PF due to freeing in-use VMSA

[Tom Lendacky]

On 6/30/26 17:25, Sean Christopherson wrote:
> Rework KVM's handling of guest-provided (and always guest_memfd-backed) VMSAs
> to forcefully reclaim VMSA pages when the pages are being freed from their
> backing gmem instance, e.g. in response to PUNCH_HOLE.  In the worst case
> scenario, marking the page SHARED in the RMP will fail due to the page being
> IN_USE, ultimately leading to RMP #PF violations due to guest_memfd freeing
> the memory back to the kernel while it's still assigned to a VM.
> 
> Note, the implementation nearly identical to that used by KVM for VMX's APIC
> access page (which isn't guest controlled, but is migratable and whose PA is
> shoved directly into a vCPU control structure).

Looks good. If you wanted, you could replace some of those quick
mutex_lock()/mutex_unlock() and write_lock()/write_unlock() calls with
scoped guards, e.g. in patch #8:

	scoped_guard(write_lock, &kvm->mmu_lock)
		__kvm_mmu_zap_all_fast_front_half(kvm);

I think those are all available back in 6.12.

Thanks,
Tom

> 
> v3:
>  - Ensure disabling quirks while the VM is live won't result in KVM skipping
>    the back-half of "zap all fast". [Sashiko]
>  - s/gmem_free_folio/gmem_reclaim_memory. [Ackerley]
>  - Use {READ,WRITE}_ONCE() when accessing the guest's VMSA GPA outside of the
>    per-vCPU mutex, and comment. [Sashiko]
> 
> v2:
>  - https://lore.kernel.org/all/20260626231416.3943216-1-seanjc@xxxxxxxxxx
>  - Invalidate VMSAs if the memslot is DELETED or MOVED. [Sashiko]
>  - Limit stable@ patches without a Fixes to 6.12+.
> 
> v1: https://lore.kernel.org/all/20260625222229.3367197-2-seanjc@xxxxxxxxxx
> 
> Sean Christopherson (12):
>   KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP
>     guests
>   KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
>   KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
>   KVM: Rename .gmem_invalidate() to .gmem_reclaim_memory()
>   KVM: x86: Serialize writes to disabled_quirks using kvm->lock
>   KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
>   KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into
>     kvm_arch_flush_shadow_memslot()
>   KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back"
>     halves
>   KVM: x86/mmu: Use split "zap all fast" helpers when invalidating
>     memslot
>   KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is
>     zapped
>   KVM: x86: Guard .gmem_prepare() declarations with
>     HAVE_KVM_GMEM_PREPARE=y
>   KVM: SEV: Mark vCPU has having guest-provided VMSA even if its invalid
> 
>  arch/x86/include/asm/kvm-x86-ops.h |   8 +-
>  arch/x86/include/asm/kvm_host.h    |  10 +-
>  arch/x86/kvm/mmu/mmu.c             |  74 +++++++------
>  arch/x86/kvm/svm/sev.c             | 163 +++++++++++++++++++++--------
>  arch/x86/kvm/svm/svm.c             |   6 +-
>  arch/x86/kvm/svm/svm.h             |   8 +-
>  arch/x86/kvm/x86.c                 |  15 ++-
>  arch/x86/kvm/x86.h                 |   2 +-
>  include/linux/kvm_host.h           |   3 +-
>  virt/kvm/guest_memfd.c             |   6 +-
>  10 files changed, 210 insertions(+), 85 deletions(-)
> 
> 
> base-commit: a204badd8432f93b7e862e7dac6db0fe3d65f370