Re: [PATCH v4 00/18] KVM: SEV: Fix RMP #PF due to freeing in-use VMSA

[Sean Christopherson]

On Thu, 09 Jul 2026 13:49:30 -0700, Sean Christopherson wrote:
> Rework KVM's handling of guest-provided (and always guest_memfd-backed) VMSAs
> to forcefully reclaim VMSA pages when the pages are being freed from their
> backing gmem instance, e.g. in response to PUNCH_HOLE.  In the worst case
> scenario, marking the page SHARED in the RMP will fail due to the page being
> IN_USE, ultimately leading to RMP #PF violations due to guest_memfd freeing
> the memory back to the kernel while it's still assigned to a VM.
> 
> [...]

Applied 1-12 to kvm-x86 coco.  I'll send a v5 for the remaining changes.

[01/18] KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
        https://github.com/kvm-x86/linux/commit/42a39ad5d592
[02/18] KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
        https://github.com/kvm-x86/linux/commit/0060569e4f18
[03/18] KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
        https://github.com/kvm-x86/linux/commit/98ade8c48c28
[04/18] KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
        https://github.com/kvm-x86/linux/commit/01a96ff30dde
[05/18] KVM: x86: Serialize writes to disabled_quirks using kvm->lock
        https://github.com/kvm-x86/linux/commit/ba76b23ed36a
[06/18] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
        https://github.com/kvm-x86/linux/commit/ed15cb219992
[07/18] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
        https://github.com/kvm-x86/linux/commit/06d38eaa78fd
[08/18] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
        https://github.com/kvm-x86/linux/commit/b27622c4eeb1
[09/18] KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
        https://github.com/kvm-x86/linux/commit/db095727ff57
[10/18] KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
        https://github.com/kvm-x86/linux/commit/d1a3c2162334
[11/18] KVM: SEV: Mark vCPU has having guest-provided VMSA even if its invalid
        https://github.com/kvm-x86/linux/commit/98fb11aed12b
[12/18] KVM: x86: Guard .gmem_prepare() declarations with HAVE_KVM_GMEM_PREPARE=y
        https://github.com/kvm-x86/linux/commit/bfbf5fa51145

--
https://github.com/kvm-x86/linux/tree/next