From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D14E432694A for ; Thu, 13 Nov 2025 22:56:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074592; cv=none; b=n89SFFaCXC31xgdNPS1xOl12pPJhbOlu52d/BPIZn9DpEIyfuNTjM+7023LfN4dUNyHtIQ7lZDIaY0LUzy0qHT9TrBfaUGUMjHorBwQqz6i31vcb1x5pCIzGmoLwCdKL14uATJ3RXBo1R2IUKslL4n7UstpHG6HEmp07//kjH2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074592; c=relaxed/simple; bh=DZnTVcVd7ilWEk7QprLP8HYWZGe/PyhrQBrHuLnfjVw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=jtDXQ6lfqfA2Ypg6Mn/zFUvrfMJ3EFsn+gKh+Hlj2/OcecY4QI5ljiEptPqxXq1fveYvm4z9xFsMuyYTxklzXw9CwWZYwKsXDg0h7CHkr//bkJNVIFGsd1sPWzj5kWiny/6yYv4FFd+EHbiRzrP0KO92dhsK0u9qHMYlh2rCvV8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=sPElYpZ5; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="sPElYpZ5" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-34377900dbcso1954318a91.2 for ; Thu, 13 Nov 2025 14:56:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074590; x=1763679390; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=BxKLVgWi122XtoiJoBFjxbdILt6Adpgcci0Yx4/UOzI=; b=sPElYpZ5qbvV7CgEjpxR2Dy+Yl7szuBZgwNYaWy7bX08vGSH4hqLRjN8hCBCmGFA6E ViaUerATWkBPozqP8UG4ROfuD4fUzQ4HN7Y+61kXldp6XSMu36u/SgM+soTLymGDemlx 6rV00Rfozndc+gqSNdJM2XdTNuku/sU9KDTxEmusKUT5PqCwPk1NCMMWlnWosAw7+9Ak BRz4NRJi4Aphhbo1FFUy01HDjmrLpnuscxbxa/i1GmbbKEinTZcjDRcC/w4ppfODqBJX yY5irAT5Pxb2w4V+dEN6A2OGa4UdRWgG2BQ9bXhMI+vZpIW5WtFwAAiVz01YYnO8IaUq nA4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074590; x=1763679390; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=BxKLVgWi122XtoiJoBFjxbdILt6Adpgcci0Yx4/UOzI=; b=tjhvofDTcGbMGaLBp7XTaaX5a+elxHWkSSMgBkMfm70XAPDEi6eU+Cxo0fffjP4OlN f4eOqzB9dIOxBErxRp3OdIIXTUkGzOr3RR6zRA3LAOTZe5RN9X/+A34WF1baUsqGCZXI tslu4TQg49rFsBmm6Qw+nW7jx2gQcJJqeI0JmEi7n/nWmR2fzT3Q08kHr6Na/O2gBuJ/ nU9jcNJNPRDru0bMpNNCIaBZ1n8sTYaVk0KDoN8y85kcbr3mr022Pg4i/uDvOa1BnSVS B+G+qNDvNPGyWRmmU+7GNc7GunFcWMSIgQv0v92h61DntpJl+T3VbXUfvKN0I+YWVXk2 Zehg== X-Forwarded-Encrypted: i=1; AJvYcCXCRzs8sNEC4Mn1It1EOBUU136XW4ldeNsNEruOL86ds2GQbYUFkod+rgyKFapcFg8bKI4FuWfLbgy6fSk=@vger.kernel.org X-Gm-Message-State: AOJu0YxgCTMWHdNqoZsOF6TvdlZycvKkn1nr//oNsIKFrtw27OTHkB71 MnJJW5th3AKse2MIvH+iJjPpGRRtSItV5576jOZ9TGFS2OkGglKsMXBGhrVlEGnNzU1Ev8XZrEX SXEh+zg== X-Google-Smtp-Source: AGHT+IFiv3A2MIePSw/tKTb0y96BVRTrr/TBLsOXY9EWmbc08jEkv0VCYdfjj5l0yUt5Qx95CRl430wU9PY= X-Received: from pjbgw11.prod.google.com ([2002:a17:90b:a4b:b0:343:641d:e8c3]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4c48:b0:341:2b78:61b8 with SMTP id 98e67ed59e1d1-343fa637866mr946508a91.20.1763074590204; Thu, 13 Nov 2025 14:56:30 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:13 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-2-seanjc@google.com> Subject: [PATCH 1/9] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly clear exit_code_hi in the VMCB when synthesizing "normal" nested VM-Exits, as the full exit code is a 64-bit value (spoiler alert), and all exit codes for non-failing VMRUN use only bits 31:0. Cc: Jim Mattson Cc: Yosry Ahmed Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/svm/svm.h | 7 ++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index fc42bcdbb520..7ea034ee6b6c 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2433,6 +2433,7 @@ static bool check_selective_cr0_intercepted(struct kv= m_vcpu *vcpu, =20 if (cr0 ^ val) { svm->vmcb->control.exit_code =3D SVM_EXIT_CR0_SEL_WRITE; + svm->vmcb->control.exit_code_hi =3D 0; ret =3D (nested_svm_exit_handled(svm) =3D=3D NESTED_EXIT_DONE); } =20 @@ -4608,6 +4609,7 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, if (static_cpu_has(X86_FEATURE_NRIPS)) vmcb->control.next_rip =3D info->next_rip; vmcb->control.exit_code =3D icpt_info.exit_code; + vmcb->control.exit_code_hi =3D 0; vmexit =3D nested_svm_exit_handled(svm); =20 ret =3D (vmexit =3D=3D NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index c2acaa49ee1c..253a8dca412c 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -763,9 +763,10 @@ int nested_svm_vmexit(struct vcpu_svm *svm); =20 static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_= code) { - svm->vmcb->control.exit_code =3D exit_code; - svm->vmcb->control.exit_info_1 =3D 0; - svm->vmcb->control.exit_info_2 =3D 0; + svm->vmcb->control.exit_code =3D exit_code; + svm->vmcb->control.exit_code_hi =3D 0; + svm->vmcb->control.exit_info_1 =3D 0; + svm->vmcb->control.exit_info_2 =3D 0; return nested_svm_vmexit(svm); } =20 --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C1383271E0 for ; Thu, 13 Nov 2025 22:56:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074595; cv=none; b=R8ZxZnMjwwrB1oMpygkKe6M3FfGDMg841KwQD0K5h28ysZ7HRa34IsqWn9bLPh9rZ3mrmGOZP7TXdXdQPYt0ZTAt/re3snBr4s5NHqDVdK11mozZQuUPnfsJtqVrlCNcPdcpoiMAlSGEwKeq7pCyVLwZDjDGUAm6xncbRZaKKO4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074595; c=relaxed/simple; bh=dooIsaMHUN0qX+ajs8N5jkyY00eEMse5x1PsDaesgCc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=TbigQFfyFS3V208O328d5LpUqexrKFzN68KetS4MwWnqAff1Ap1nPlsDRoxJE/jQva35rEeXmorU2VvaXB44vVfDS4XlTiy5nRu0oTSJRZeOQkVmM2lMWjEXLLhwPQxw7V/sz45HHlBVJaeyVdWFQbiNbQ3ArR8rzNiQ5mUJ3/M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=M1btft1o; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="M1btft1o" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2956a694b47so16878745ad.1 for ; Thu, 13 Nov 2025 14:56:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074592; x=1763679392; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:from:to:cc:subject:date :message-id:reply-to; bh=uTfLPg3dHJBu/ZKUp1ze2yjCBpHKVd90r/rQFmyW4xA=; b=M1btft1o5Tcm9ACBdEOq9U3KnJOBB+220wcDFk/m0pc+Cu5OZIZ3+gvyfFvuoihwS5 nZJCUi9rPrEdqSHtTstzOIatR8CaaS8rUI7yrqLvzY85PzHkO+d6CT4QMQx96GgUc+UH /YAuV3lOt+1UJn+EAVcg1RecfYKAA098/nnlAjucI5ysnjJL4ULhh8mzQiuvgs28zKdZ KTz/cAsfocuL849pS7iQ2hA2nts/0iTFFmxpCdAW2xR3FqYFSjpV4dSAt61Ft4lZKRkD wqKDbUTlrqgQ1eQmtRs25II+lKaSGk4x9wwjPSxjJXe3w5JDETP0yfMDsywM4Wb5U2zZ V0KA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074592; x=1763679392; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=uTfLPg3dHJBu/ZKUp1ze2yjCBpHKVd90r/rQFmyW4xA=; b=OeggM3mzyCbzHnHamxxlMYbIwuN2k/Uk7rdUdgXPblCd4enDkGQOacAzMtbl5OoTru n/9nAylKviJOUBvaDUJOIB3IXh+Y/aPAApe3jBtJVk0+6SU3WWNRiD+O3xoERflRx7QJ pDG7l6pg0ES25/f7ER1Gh61ILOGs6YyejO+7S19GpeTEW2tj617yb+RVJe17I4lB4HGT 3quIsZVL6i0YOA/5YD7zgw+OKSeDiiYGoMpwGW0/7yjCa2CGTo8l8jrD0bafhEav0kvo 42uHSv2bV/wdo7+T8sWG5oHdgIXLGL1JIW8ci49uKxZq4z+o+b1xsJHQgrcRnLTf/AZB w3MQ== X-Forwarded-Encrypted: i=1; AJvYcCXO9gvPXGu4HNN890dW4Q/e5zVgch1YbCTLaJnca7Eb4TGkudDsWqwL//76vpHAWBTH0jw/aSzivDrVVsE=@vger.kernel.org X-Gm-Message-State: AOJu0Yx1DNhPAJ1UHir/b2H3hf7VcqniIL+vndhUKMZHgJnHdeJ0X0yQ Q5Jr3jeWpDoPxEnAp7IQ4N0gBitI/pLhflgcgxjmeut+7Ghb9afMA7qYL6l4GFEtJUXNhq5VLxT BbbBpBA== X-Google-Smtp-Source: AGHT+IGqaleYBrBpIZDDEVOSXWg82pvZBfh9IfeZ7WNXzFngQTkVikEu8YA5GvKWL3ExVT05ZqFLMjWDxSE= X-Received: from pgnn15.prod.google.com ([2002:a05:6a02:4f0f:b0:bc2:9d07:6db1]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:2406:b0:295:24ab:fb06 with SMTP id d9443c01a7336-2986a6ceb22mr6800465ad.22.1763074591763; Thu, 13 Nov 2025 14:56:31 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:14 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-3-seanjc@google.com> Subject: [PATCH 2/9] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Set exit_code_hi to -1u as a temporary band-aid to fix a long-standing (effectively since KVM's inception) bug where KVM treats the exit code as a 32-bit value, when in reality it's a 64-bit value. Per the APM, offset 0x70 is a single 64-bit value: 070h 63:0 EXITCODE And a sane reading of the error values defined in "Table C-1. SVM Intercept Codes" is that negative values use the full 64 bits: =E2=80=931 VMEXIT_INVALID Invalid guest state in VMCB. =E2=80=932 VMEXIT_BUSYBUSY bit was set in the VMSA =E2=80=933 VMEXIT_IDLE_REQUIREDThe sibling thread is not in an idle state -4 VMEXIT_INVALID_PMC Invalid PMC state And that interpretation is confirmed by testing on Milan and Turin (by setting bits in CR0[63:32] to generate VMEXIT_INVALID on VMRUN). Furthermore, Xen has treated exitcode as a 64-bit value since HVM support was adding in 2006 (see Xen commit d1bd157fbc ("Big merge the HVM full-virtualisation abstractions.")). Cc: Jim Mattson Cc: Yosry Ahmed Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index c81005b24522..ba0f11c68372 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -985,7 +985,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) if (!nested_vmcb_check_save(vcpu) || !nested_vmcb_check_controls(vcpu)) { vmcb12->control.exit_code =3D SVM_EXIT_ERR; - vmcb12->control.exit_code_hi =3D 0; + vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; vmcb12->control.exit_info_2 =3D 0; goto out; @@ -1018,7 +1018,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->soft_int_injected =3D false; =20 svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; - svm->vmcb->control.exit_code_hi =3D 0; + svm->vmcb->control.exit_code_hi =3D -1u; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; =20 --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECB11326947 for ; Thu, 13 Nov 2025 22:56:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074595; cv=none; b=OxLKphRgJY3NNjrCCNcBkfn86KK1wqhBySQU8bTby6L0epAqf5AIopi5LyDgD3kI1EmdC8QoWqdrkFnoUkQEzHxRg3/ijFRNprUf/8qxX3OvIS31le6bUJlvvUCm9AIE85rWq0zJu85G7i9ANftgVJ/Fi9l3YQGF/YjuRDTrBmA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074595; c=relaxed/simple; bh=nXwgs7YC0LiuNXWTz4iE60qbMFkvolkxQM+YKYIzQlw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=lBgaXEIq+sa5/YHK0dTNoW+KleXksDS7v6/z8946vrEDi8F7LrhDVR0eA+oSqFuX82Ii6YqldnGVwiBPn+FY2neRSmHBZYcXk3zg9aDDPwa1OQxygxuItvLSCf3zHGVtdhykEa8RutcKhSIIWx0/esAEsjiQcdXdGYc+zBWDPR0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=lUNlLu+h; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="lUNlLu+h" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-b9b9e8b0812so3016732a12.0 for ; Thu, 13 Nov 2025 14:56:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074593; x=1763679393; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=CFaed3xQWUAcBYMaUt6HihcqYzlaPmtpnemkzp18gZ0=; b=lUNlLu+hdRYCoZVZgS+G68cGmrUfG3ekWuUASrTRmSz5nhTWb28ZDb9MPdpjsanXaT TalNYmfp0EuZgetElPxQd+mlRwoyTLTPFGaZ0Zol01lLxlQvfmBG8et5VPa64X5Ut1Lf tJehIA4Q5ThxdrhTSIcg42+aLlhRbgG4UHP9t4+s4IvBabqw0qunrXVGhyQilNjCcDfq o/TLj/Jqz+mc5T0RQo+hKrvqxGk1QIHdOp6rsa5W8cD9Ada6DqRK7OWFToejRStt48w/ 9ZkL7RkxrszZGqYG1cdduK4sjI+7vqt1eNh4AWAi9lFZ+ZQRGpzOC7eBUGUjUxcKsd8K Yv7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074593; x=1763679393; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=CFaed3xQWUAcBYMaUt6HihcqYzlaPmtpnemkzp18gZ0=; b=Q66x0J1OVX6zMH3q9B6QtOQU0NXBiwhvHao1Rmf3Oyc4NXh7c4KcKigCSbCjVXIfJc bVxwKWUKYCUkQXWUS7iMOOHJ4XaziZEQTlP1oWTCfoRhDxcTEz6lQ3rosne73yitP2oO BE/XmCMPaNTqIsPK040EGTPxKa7wbeFvOSYzbCBn0TfJ6R9jFRki4wl/yTaATkVnxFPF F09wnTp6P7VB7CzdTj2suNGwrXZqvzDAizRY4D9p6CBwtOe6LR3pM3js+A6adMW6qVKP fi968Q4DWJqvW7xvprsB+JQo9cGYKLdTWN0Jq8wy7QHqFRvMT6vPNCCkRJy0cZinFAoD tNvw== X-Forwarded-Encrypted: i=1; AJvYcCXcrJQ9v2JXza/wstNEsPN4VSigzaTwr0wBXjQQ/BOVFeFwpxFG1lqglmR0KqfuD19RfTzywCfAfc8qW58=@vger.kernel.org X-Gm-Message-State: AOJu0YxzbUyDQckk2uv7FouzhCgWK+QAtWd+sJCFPxY9yPwizfsbfkkV GVAPUbt4hvWkqvYotkqp2Kcis7BtHo0Zp8NtSCeWHXtIZhvYnitRTk7gP5+rCnIuE3e2N8A+XKH VZ0nycg== X-Google-Smtp-Source: AGHT+IEcrzaNJQufxlW40Sp3VWWox0Ok4kOufZZG1NpP6gqSUezvSr1DIEaBEs4ZT20+btmiUcbM2j0csjE= X-Received: from plpn11.prod.google.com ([2002:a17:902:968b:b0:297:eb04:dff7]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:e80a:b0:295:8662:6a4e with SMTP id d9443c01a7336-2986a75739dmr6698255ad.47.1763074593310; Thu, 13 Nov 2025 14:56:33 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:15 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-4-seanjc@google.com> Subject: [PATCH 3/9] KVM: SVM: Add a helper to detect VMRUN failures From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a helper to detect VMRUN failures so that KVM can guard against its own long-standing bug, where KVM neglects to set exitcode[63:32] when synthesizing a nested VMFAIL_INVALID VM-Exit. This will allow fixing KVM's mess of treating exitcode as two separate 32-bit values without breaking KVM-on-KVM when running on an older, unfixed KVM. Cc: Jim Mattson Cc: Yosry Ahmed Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/nested.c | 16 +++++++--------- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/svm/svm.h | 5 +++++ 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index ba0f11c68372..8070e20ed5a7 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1134,7 +1134,7 @@ int nested_svm_vmexit(struct vcpu_svm *svm) vmcb12->control.exit_info_1 =3D vmcb02->control.exit_info_1; vmcb12->control.exit_info_2 =3D vmcb02->control.exit_info_2; =20 - if (vmcb12->control.exit_code !=3D SVM_EXIT_ERR) + if (svm_is_vmrun_failure(vmcb12->control.exit_code)) nested_save_pending_event_to_vmcb12(svm, vmcb12); =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) @@ -1425,6 +1425,9 @@ static int nested_svm_intercept(struct vcpu_svm *svm) u32 exit_code =3D svm->vmcb->control.exit_code; int vmexit =3D NESTED_EXIT_HOST; =20 + if (svm_is_vmrun_failure(exit_code)) + return NESTED_EXIT_DONE; + switch (exit_code) { case SVM_EXIT_MSR: vmexit =3D nested_svm_exit_handled_msr(svm); @@ -1432,7 +1435,7 @@ static int nested_svm_intercept(struct vcpu_svm *svm) case SVM_EXIT_IOIO: vmexit =3D nested_svm_intercept_ioio(svm); break; - case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: { + case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: /* * Host-intercepted exceptions have been checked already in * nested_svm_exit_special. There is nothing to do here, @@ -1440,15 +1443,10 @@ static int nested_svm_intercept(struct vcpu_svm *sv= m) */ vmexit =3D NESTED_EXIT_DONE; break; - } - case SVM_EXIT_ERR: { - vmexit =3D NESTED_EXIT_DONE; - break; - } - default: { + default: if (vmcb12_is_intercept(&svm->nested.ctl, exit_code)) vmexit =3D NESTED_EXIT_DONE; - } + break; } =20 return vmexit; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 7ea034ee6b6c..52b759408853 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3530,7 +3530,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) return 1; } =20 - if (svm->vmcb->control.exit_code =3D=3D SVM_EXIT_ERR) { + if (svm_is_vmrun_failure(svm->vmcb->control.exit_code)) { kvm_run->exit_reason =3D KVM_EXIT_FAIL_ENTRY; kvm_run->fail_entry.hardware_entry_failure_reason =3D svm->vmcb->control.exit_code; @@ -4302,7 +4302,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_= vcpu *vcpu, u64 run_flags) =20 /* Track VMRUNs that have made past consistency checking */ if (svm->nested.nested_run_pending && - svm->vmcb->control.exit_code !=3D SVM_EXIT_ERR) + !svm_is_vmrun_failure(svm->vmcb->control.exit_code)) ++vcpu->stat.nested_run; =20 svm->nested.nested_run_pending =3D 0; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 253a8dca412c..6b35925e3a33 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -426,6 +426,11 @@ static __always_inline struct vcpu_svm *to_svm(struct = kvm_vcpu *vcpu) return container_of(vcpu, struct vcpu_svm, vcpu); } =20 +static inline bool svm_is_vmrun_failure(u64 exit_code) +{ + return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; +} + /* * Only the PDPTRs are loaded on demand into the shadow MMU. All other * fields are synchronized on VM-Exit, because accessing the VMCB is cheap. --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E75A43271FB for ; Thu, 13 Nov 2025 22:56:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074597; cv=none; b=MRCk+GtFo014f+7BTxED7/y/GAlrKVDhnGXBUfxiIiubN5LtRX9wfKOdcABQhp+2Zsk2na0++mn3S42QWCU4IioLAXWnhmlYKV2+YsyqLD0ToMElVLTbQiPM2/abGYKlucngndJDZOTAiylH+B4MBb/+/WG1IJgkyUn+WJtBDD8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074597; c=relaxed/simple; bh=3ZKH73v//RDZ3fRn2i/PSc16YVjKg39gkH1Xa11RzC8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=WznjAkuO0pTTWOt2f3uGRl+M+UGuNtXcGg1ZDlDbwv+snBU8JaTI+0XlB1jYGOvd/aEw3xEIdcQrYO0+iXkpFBBIi43MWzQ47ZREmCf58hM8XnMSW81bxTaf+Z0FIgcxuEbU2xpf9kKcRkUWMvAf4PDmI5JiwoPqJffrFT1iFac= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bkrMYktg; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bkrMYktg" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-29848363458so33092855ad.2 for ; Thu, 13 Nov 2025 14:56:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074595; x=1763679395; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=44sHkalx4c+buJJlySyLatvfmOk9JIz0iW1u4PfgOGQ=; b=bkrMYktguQLziZS8oZIiD2611kMJzuTmPUNSEk0JmR/GZ7jjvY4u9XSVlBNSVZxvTX IUTqURSqNPqBHZBKwH13iGTtOpIdl19ga9LzO2r857mHVF6c+ipQjC0StFkrQ6EKVuuw scPc0ewPzJywxNGeIQOLfpMuiTe+w4AbjU2ykKqAbbNURvMotvvATK6Q3kieGpWjjBDB PX5Rdx4khzyVx6rbLn+MDrolQ8UIE8Gbs2elfwThDqsE+QKz7Ni7hS4VR1vHF1jUw6By PUTDNpELRCKJSjNNpzhFYT+quA7/Qb+d+bi0ZE2IlEo2Iby+bXSx2l/uitKkpj0jtNOu GroA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074595; x=1763679395; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=44sHkalx4c+buJJlySyLatvfmOk9JIz0iW1u4PfgOGQ=; b=TnkCtiUXzgaZgdhzU6NSX5hAa4NiY8PvB4W3+5C7BzxGAUJ0j4QbiqsvS/2wWS4PMY I44ZAyysegr7H2yS0+0qYsdrcBtT7J4WtTHWsSzpG9zmaUSYsQXswV/w8Trgfg4iHWoT ap3XN9FgYYvIdWLnqvrQHu51MPtf2r2/ZqG57BlUylx+uD7iDqJn8QIZRbgMai+AiBdJ 5TqpoZq4HHkQSLdp/nqn0R6xY0QkAuKE/mfEhrQbCi50UKwjmA87+W8DAZMqmAcINHkr dRTu4TZRkpqhOuukSNMvm+57Q9wtZTULZ0H3MZkC9C+Aqbtm/auYwv9pYyNDCpsoQDy8 YbJA== X-Forwarded-Encrypted: i=1; AJvYcCW6aSaNfAEfIoY2bQMcyJUYu3cFU+m1m3IM0bsEfJff+JJTh4lBVofHdarUN3k081kihxHHNEfTiikDvIM=@vger.kernel.org X-Gm-Message-State: AOJu0YwWX9L3hrYEtge0YVMCoXS8VmKZR5MgNpXyyIDkw7O6KS3Xy3uN O12Q7sezqEEVMa7+ySO6lTeglSdV5iAVpKwyhnL4rk//Q4MK0H1x8KcJrgaHqYCa6lIPGUIXw24 NErYRZg== X-Google-Smtp-Source: AGHT+IGqAKWqFoUFyf2m0vap9g7gkzKL0KXcEIHMGW0cbM1JyDMMiT3yzbCUGWEfKZvzY/3IrvdaWAPUMuQ= X-Received: from pldr17.prod.google.com ([2002:a17:903:4111:b0:27e:dc53:d244]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f790:b0:297:f8dd:4d8e with SMTP id d9443c01a7336-2986a741b93mr7487325ad.30.1763074595173; Thu, 13 Nov 2025 14:56:35 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:16 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-5-seanjc@google.com> Subject: [PATCH 4/9] KVM: SVM: Open code handling of unexpected exits in svm_invoke_exit_handler() From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fold svm_check_exit_valid() and svm_handle_invalid_exit() into their sole caller, svm_invoke_exit_handler(), as having tiny single-use helpers makes the code unncessarily difficult to follow. This will also allow for additional cleanups in svm_invoke_exit_handler(). No functional change intended. Suggested-by: Yosry Ahmed Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/svm.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 52b759408853..638a67ef0c37 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3433,23 +3433,13 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) sev_free_decrypted_vmsa(vcpu, save); } =20 -static bool svm_check_exit_valid(u64 exit_code) -{ - return (exit_code < ARRAY_SIZE(svm_exit_handlers) && - svm_exit_handlers[exit_code]); -} - -static int svm_handle_invalid_exit(struct kvm_vcpu *vcpu, u64 exit_code) -{ - dump_vmcb(vcpu); - kvm_prepare_unexpected_reason_exit(vcpu, exit_code); - return 0; -} - int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) { - if (!svm_check_exit_valid(exit_code)) - return svm_handle_invalid_exit(vcpu, exit_code); + if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) + goto unexpected_vmexit; + + if (!svm_exit_handlers[exit_code]) + goto unexpected_vmexit; =20 #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) @@ -3468,6 +3458,11 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u= 64 exit_code) #endif #endif return svm_exit_handlers[exit_code](vcpu); + +unexpected_vmexit: + dump_vmcb(vcpu); + kvm_prepare_unexpected_reason_exit(vcpu, exit_code); + return 0; } =20 static void svm_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason, --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A48A9328B66 for ; Thu, 13 Nov 2025 22:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074599; cv=none; b=hlKbuu8f5DbHGVkvESsf83UqRldkMQuvQTsNTkQ9H+mc88mKlFu7EZneEzi5vK5Vr3rirGohkYjBs7M5Fp3wlOVzeQChJHxteXhXuSyMOj2DGX0ZcGVpYA/3JiR5Q5GsSaW1up+k5KxaaXrtOsVekYCgIS2KuXbvxxl/SwlB3RM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074599; c=relaxed/simple; bh=0CIm1vKKJY5ZLYOu6NiJGAw93xER85gCl/NfVvEElD0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=XcH4oOjrVAlivgx3nGVuVcNZ0koM8qpUFftP01uzRCCbjBMz4mLKkcgZiG9jBdI7y55Sj+SfaGMK/b3e421f4WWgeOzMGSNzGzMqUzxGw/AA1eEhf0AxG0HviTKEM1nKD4RNN2fLsYgKobS1MSQ/IkS9ShucA4ISg1X1cIatE2Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=AocFHH2/; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="AocFHH2/" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-295595cd102so32607475ad.3 for ; Thu, 13 Nov 2025 14:56:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074597; x=1763679397; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=YmRUHznDSpJK0xelbJUhvMx/o3h12zh1VqONC/F/8SI=; b=AocFHH2/3i7UUnauc5KbKfhWgajO9G6MONneNdnFsln9FCxkri3F30Z3aIIzm0Xbvj 62MRjHQwwRnwRpwRq72YNwQIZahjCCCZ5mpXLZeX1pJ3vTuf/1oxNYgAVwreDDzT0dzn VP8M9YdLA6/p6SqkO2dZMB7KglcDUPFIIb78ffTYp+BJzV6nOleUQ/n547x2B9umQNF2 P//eZacShUgtNDAak0qSyvCOFbo+N5HXZ/RtvFZFofMGlFnqwO0ZYU3BMl5e2B4fl5GN Z0Wg5XK4nAwCkuaGRoExRtpJavLJ0MyJ3GSSQkuAZDrR6veAI9LgY3ixlg3G7HGlCiNz ytVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074597; x=1763679397; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=YmRUHznDSpJK0xelbJUhvMx/o3h12zh1VqONC/F/8SI=; b=sJK9zFxYeAQ/BVgpKypDKXHrOSxwVb6CbeKnC1AS2SY2KptCR1s5HNoFRW7Jej+qji WLbIu5+UzUWGxpoftosy18UlnpU57FIQO6ZxGoPPWt3U9k8MeFE0TY3wUSvuaN4+ohcg abaMrUl65aH2bC4rLd0ceoeun2xmwFJJTa0HwHpPKU2PLTKHx+l9soMcDlDMgzR8GJ5x gwF/uZifTf98ZUldq5DJJhK26FeE8Ia0Ghe1+z0P94ndRuiaulIQ5L3xYCNpjh2Ka8p2 g02dpnOjmJuuThWp4o4aHLhk+0CmdmX75cJz95OZCOMwc+XEJdnxC4dDEYgGciCxOY5V 0PRQ== X-Forwarded-Encrypted: i=1; AJvYcCXNECw++dNNPJMxgzYesAHyHjxDoywjNfgs/2h6W1SczNWDqZHwQMf8NocY6eGyhXcPnRh6SUR0lAo04Oo=@vger.kernel.org X-Gm-Message-State: AOJu0Yzgu0QPiYogWHxJsJUkj9ih+zk8jLSFNL8LatXsNkEFEN91v82d PXbCdr2XOsRZ39+jDefOecQNW6/6i5wJfrFign+Tw61KdcBRf+1uGrf92gN3aNB486H0T1X5wWT pmryj5A== X-Google-Smtp-Source: AGHT+IHtz3Opt/igSZsRzu0/BD9t+30LNZaNdqDEY5l03VcfbOrCZ8LxD69Ny8ODDjVmq8xM/VyGmM41VdQ= X-Received: from pllb17.prod.google.com ([2002:a17:902:e951:b0:268:c82:4230]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:18b:b0:295:8c51:6505 with SMTP id d9443c01a7336-2986a741aaemr6849745ad.33.1763074596938; Thu, 13 Nov 2025 14:56:36 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:17 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-6-seanjc@google.com> Subject: [PATCH 5/9] KVM: SVM: Check for an unexpected VM-Exit after RETPOLINE "fast" handling From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Check for an unexpected/unhandled VM-Exit after the manual RETPOLINE=3Dy handling. The entire point of the RETPOLINE checks is to optimize for common VM-Exits, i.e. checking for the rare case of an unsupported VM-Exit is counter-productive. This also aligns SVM and VMX exit handling. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/svm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 638a67ef0c37..202a4d8088a2 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3435,12 +3435,6 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) =20 int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) { - if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) - goto unexpected_vmexit; - - if (!svm_exit_handlers[exit_code]) - goto unexpected_vmexit; - #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) return msr_interception(vcpu); @@ -3457,6 +3451,12 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u= 64 exit_code) return sev_handle_vmgexit(vcpu); #endif #endif + if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) + goto unexpected_vmexit; + + if (!svm_exit_handlers[exit_code]) + goto unexpected_vmexit; + return svm_exit_handlers[exit_code](vcpu); =20 unexpected_vmexit: --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC75632939B for ; Thu, 13 Nov 2025 22:56:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074600; cv=none; b=Ohl7If9/lpGJlvi06p+BmMl4rjwolbiwBv4M+3Vxbjq+o7UdZ1cNCvGVnESYs0CgxhOLKeJY7aFKkqSB/EZiYYMcsdfANUO7hxzTEhxlEK0e3kSZuVrFLKNR73YgyJ8i3HUlkRu1I+XMVO5pF1nwaAfZVFPSRgJ5q+wCGpuGh94= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074600; c=relaxed/simple; bh=FrLYypfXkWMF/B8MfR9jtaa3rG5AmOBlRcsStUH+QyM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=sXtFukvqNq0Y2nCIM4F2PASnpyvnqU9tK6gTdUqiEn7U71TFhJpmOTS6BvVWUKtYTT3yZJx7Tmk+WTP+Mll7NCN5+A2bEGMKzUsDeg1ZbQeRBuB5tEptEz4r6oBUJTW/nudWs0/nM7PS1VQsZkYOcwfZ+QUARVX/AN1XPdOKDVU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nsxT1APJ; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nsxT1APJ" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-b630b4d8d52so1145379a12.3 for ; Thu, 13 Nov 2025 14:56:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074598; x=1763679398; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=Ib2v7Ui/fjE5+JdRUXnMPJd5ZodcfqQQWSBde2U7kt4=; b=nsxT1APJPbPY9mIax9OUsn18Tm0M9Ngn/se9QKH9CwWg7uWFE1s044R9j41eZdSwtH 4K1vczGCXRdmY90Djpew9ZCOKCMpRsuLuEbL6CHKB/gzAK1RFfsCovMiTP3p1tj0fpc3 HdRUwo49eAtMPz7GvL8NguTftXnpbVXMr4ziutJM0/H6iCLB9gUkKiGts5hYfWWjGZLT 2sKF27+hpsryMIHN/oYTKan8BbwvA/VPSIJvgmWRjLsee1NylUA/BQbzap85bnnr/V/2 Asd1OwGLcndnvQGlpNGDfBTDt37XDuhcGtbpaHXHl05hO/DDYc5Y214P7HbfBBD915yh HQGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074598; x=1763679398; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ib2v7Ui/fjE5+JdRUXnMPJd5ZodcfqQQWSBde2U7kt4=; b=YvppFhDWkmFbEQCEvh2qtNc1q/2cutLpxvvFNFXzvtjmGbJWj7+Fu1ZcrP+5OsthHV CMY5JTyW/JE50rkn6h03zK51q45iUX9xjhYHLMK8OksDq9+dljJS43sYxuUTagtmzTmO 6f3v73phlOQIPRuCFXRJhvRfWyVtm5yzHa9QDp/vCI1GZi2HPiBZjmXbR273hjZ2gzry Go01Md3atYcZVZUfcRC3oZLR2qn+emQyrbm4apCikMlVZA4va37BJMWR38do3gBGEycb OhxBf+LaXwWgABP/XyPwwfqiAYOuOJQwDpMzOjXQrq0yR4w89pKsxRD8E9ynmIBORJl/ euHA== X-Forwarded-Encrypted: i=1; AJvYcCVoaAt1GPvqPj2m2fINUrO0p8S04XnVZ/fvS66VXnDivT7FGjCyS36HU96q94w3zO8CYPVediHjiWJZuXI=@vger.kernel.org X-Gm-Message-State: AOJu0YzAIjfpIPUXICvOxeTbEQyiTS9jp1DYjWXIoQSayWbOiycBdo3i bzRMfB+YdivClf3MhEmV1gwr6E4QY9NEu7w63Ww+YDryn/25J+AwiiO33K2afKBp63hZXjZVrwZ n+V67qw== X-Google-Smtp-Source: AGHT+IH8IA3FWekt1ULXu2lSks3XBHqEUS4FhRpMQVG9SUdbxMomw9Nt9TFp3kJLPvjiS9a6PESnoKZm6yQ= X-Received: from pgcv11.prod.google.com ([2002:a05:6a02:530b:b0:bac:a20:5ef9]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6300:50b:20b0:35b:cc61:680 with SMTP id adf61e73a8af0-35bcc610d4emr550460637.9.1763074598407; Thu, 13 Nov 2025 14:56:38 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:18 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-7-seanjc@google.com> Subject: [PATCH 6/9] KVM: SVM: Filter out 64-bit exit codes when invoking exit handlers on bare metal From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly filter out 64-bit exit codes when invoking exit handlers, as svm_exit_handlers[] will never be sized with entries that use bits 63:32. Processing the non-failing exit code as a 32-bit value will allow tracking exit_code as a single 64-bit value (which it is, architecturally). This will also allow hardening KVM against Spectre-like attacks without needing to do silly things to avoid build failures on 32-bit kernels (array_index_nospec() rightly asserts that the index fits in an "unsigned long"). Omit the check when running as a VM, as KVM has historically failed to set bits 63:32 appropriately when synthesizing VM-Exits, i.e. KVM could get false positives when running as a VM on an older, broken KVM/kernel. From a functional perspective, omitting the check is "fine", as any unwanted collision between e.g. VMEXIT_INVALID and a 32-bit exit code will be fatal to KVM-on-KVM regardless of what KVM-as-L1 does. Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/svm.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 202a4d8088a2..3b05476296d0 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3433,8 +3433,22 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) sev_free_decrypted_vmsa(vcpu, save); } =20 -int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) +int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 __exit_code) { + u32 exit_code =3D __exit_code; + + /* + * SVM uses negative values, i.e. 64-bit values, to indicate that VMRUN + * failed. Report all such errors to userspace (note, VMEXIT_INVALID, + * a.k.a. SVM_EXIT_ERR, is special cased by svm_handle_exit()). Skip + * the check when running as a VM, as KVM has historically left garbage + * in bits 63:32, i.e. running KVM-on-KVM would hit false positives if + * the underlying kernel is buggy. + */ + if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR) && + (u64)exit_code !=3D __exit_code) + goto unexpected_vmexit; + #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) return msr_interception(vcpu); @@ -3461,7 +3475,7 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u6= 4 exit_code) =20 unexpected_vmexit: dump_vmcb(vcpu); - kvm_prepare_unexpected_reason_exit(vcpu, exit_code); + kvm_prepare_unexpected_reason_exit(vcpu, __exit_code); return 0; } =20 --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92934329E52 for ; Thu, 13 Nov 2025 22:56:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074602; cv=none; b=NaWwMMWioNsQ8m8dcrcalJkQeiInRdIqBb4C/KHdSBShMO1dZH1Z+BQ4744pVJFSXD0jQulMUhZbryf1HcUk3J5UoLarFIZH/DBf08Iihd5K6GCBmztkRMG2vb4Mdi4Ne0x1EpVbClJ0tyxIegMfEZsp1Zz48llM+YXROIsaNpE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074602; c=relaxed/simple; bh=+X6sod/HQNu/SJbZY670DshcFgt84tBrtiEH6SU0y2k=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=mb8gMRtSS0f7TB6qe/ERsb1eyz1nwywHJr7ddClvTQoKQw4CdbgWuLoyT8+hxKfP6n7WAHEkkNnMgMu9TVZjc81pT5nbVnJR1EweLT1Uvwq0KE4kQXX5GZG9w695rL/RFOtBXpcXjukX9Z45tjhSRqKOtcqJcFrfhvdwhxB3a78= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=QfRGepqE; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="QfRGepqE" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-297ddb3c707so12408555ad.2 for ; Thu, 13 Nov 2025 14:56:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074600; x=1763679400; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=yCySYnLm9S91HvD17dKSq/J5PnFR2ZVykwVecEeKkWU=; b=QfRGepqEstcQBwfs5YonUBrj2TXS+O+pBasgqFDz6SM+eXAaEnYhbAXF7CTXhI1dUM SlhsqZbPHxUwAOlakgb0jg+PVeAk5XZBrA9cp4umYbnVJYFkiiLCczphYPoiAWcVhPDf lS14UYXfUeqa0cH5kSWi4XLe1yWZOVI7IkFbCzdluKfOR+/i5KDY+i+EJgIMnoffolv1 H/wmvzllyCLuZ+tnEZVDpYwy3f4iBV2FA2cT5ss7HmJNe0oeTRec0E3Yk4+hGZnjZsy3 K7zMGUr1sFCYya2EqmGxxaQoCL9eyfPUQRYEyXF9jd9hdGTTFff4+lnCGYnvzD8EKPp5 W67g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074600; x=1763679400; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=yCySYnLm9S91HvD17dKSq/J5PnFR2ZVykwVecEeKkWU=; b=ApUlfNXlrTAZNTW+5vfcIhgnLcKoBsg7c+86RqgIvKR3AbfL5I03UYRzTLGQg4/jgq n4CC+TtLWbKvQkBflmo6vVcO7TNnSiLaJKSOa+ucizuJr6jWER32OLew/ohrYzkhquMy cNA+ED//5vVD0OHviBoj0SgiHi0Stzm1PZsajTfCYi7VyQUBQ8n39iimw7RTNiMYbuF3 S1RkwmPRsICf+qOJCZN4BH9zeE1S1MUsJ1Lv/my5DfN/8uFiLogDzrL9P5oRLtVF6RB2 8kGv44EotKtYkwoKuReqnjNdoJGJ11HiQyixd2DRX7tFlRU4molYIX3yXpb0EviQKXZz tmaw== X-Forwarded-Encrypted: i=1; AJvYcCWeRzcU0H2wcdGjGTRdyU0GuOgJUvjtFJkqqy2yDBB7Fva0X/MOzE1aDuU/leItdaif50vn2D07h6HjBJs=@vger.kernel.org X-Gm-Message-State: AOJu0YwbwU90EIxdKqzpNUXFTe4bRSiOr5FUCm1LO4Afsxf+ygOZlD4Q 0q8IQaQC7cR1E+Veb0uACpWEoUdIuRdnj2QnfpImZDnBOxlczyXc6P8+aIPA38j9AtHyVQTfDSr RMwFVUQ== X-Google-Smtp-Source: AGHT+IG6E24XApKx+zIhb5ajqLukds5HfcT59hf6lWOOA+2i4xJxuR1Z5mbdRMsu25A7WJP7cMfpNSjAepA= X-Received: from pjboj14.prod.google.com ([2002:a17:90b:4d8e:b0:33b:c211:1fa9]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:a8f:b0:295:7453:b58b with SMTP id d9443c01a7336-2986a6b56b4mr7439355ad.4.1763074599984; Thu, 13 Nov 2025 14:56:39 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:19 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-8-seanjc@google.com> Subject: [PATCH 7/9] KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix KVM's long-standing buggy handling of SVM's exit_code as a 32-bit value. Per the APM and Xen commit d1bd157fbc ("Big merge the HVM full-virtualisation abstractions.") (which is arguably more trustworthy than KVM), offset 0x70 is a single 64-bit value: 070h 63:0 EXITCODE Track exit_code as a single u64 to prevent reintroducing bugs where KVM neglects to correctly set bits 63:32. Fixes: 6aa8b732ca01 ("[PATCH] kvm: userspace interface") Cc: Jim Mattson Cc: Yosry Ahmed Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/include/asm/svm.h | 3 +-- arch/x86/include/uapi/asm/svm.h | 32 ++++++++++++++--------------- arch/x86/kvm/svm/hyperv.c | 1 - arch/x86/kvm/svm/nested.c | 13 +++--------- arch/x86/kvm/svm/sev.c | 36 +++++++++++---------------------- arch/x86/kvm/svm/svm.c | 7 ++----- arch/x86/kvm/svm/svm.h | 4 +--- arch/x86/kvm/trace.h | 2 +- include/hyperv/hvgdk.h | 2 +- 9 files changed, 37 insertions(+), 63 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index e69b6d0dedcf..66b22cffedfc 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -136,8 +136,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u32 int_vector; u32 int_state; u8 reserved_3[4]; - u32 exit_code; - u32 exit_code_hi; + u64 exit_code; u64 exit_info_1; u64 exit_info_2; u32 exit_int_info; diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/sv= m.h index 650e3256ea7d..010a45c9f614 100644 --- a/arch/x86/include/uapi/asm/svm.h +++ b/arch/x86/include/uapi/asm/svm.h @@ -103,38 +103,38 @@ #define SVM_EXIT_VMGEXIT 0x403 =20 /* SEV-ES software-defined VMGEXIT events */ -#define SVM_VMGEXIT_MMIO_READ 0x80000001 -#define SVM_VMGEXIT_MMIO_WRITE 0x80000002 -#define SVM_VMGEXIT_NMI_COMPLETE 0x80000003 -#define SVM_VMGEXIT_AP_HLT_LOOP 0x80000004 -#define SVM_VMGEXIT_AP_JUMP_TABLE 0x80000005 +#define SVM_VMGEXIT_MMIO_READ 0x80000001ull +#define SVM_VMGEXIT_MMIO_WRITE 0x80000002ull +#define SVM_VMGEXIT_NMI_COMPLETE 0x80000003ull +#define SVM_VMGEXIT_AP_HLT_LOOP 0x80000004ull +#define SVM_VMGEXIT_AP_JUMP_TABLE 0x80000005ull #define SVM_VMGEXIT_SET_AP_JUMP_TABLE 0 #define SVM_VMGEXIT_GET_AP_JUMP_TABLE 1 -#define SVM_VMGEXIT_PSC 0x80000010 -#define SVM_VMGEXIT_GUEST_REQUEST 0x80000011 -#define SVM_VMGEXIT_EXT_GUEST_REQUEST 0x80000012 -#define SVM_VMGEXIT_AP_CREATION 0x80000013 +#define SVM_VMGEXIT_PSC 0x80000010ull +#define SVM_VMGEXIT_GUEST_REQUEST 0x80000011ull +#define SVM_VMGEXIT_EXT_GUEST_REQUEST 0x80000012ull +#define SVM_VMGEXIT_AP_CREATION 0x80000013ull #define SVM_VMGEXIT_AP_CREATE_ON_INIT 0 #define SVM_VMGEXIT_AP_CREATE 1 #define SVM_VMGEXIT_AP_DESTROY 2 -#define SVM_VMGEXIT_SNP_RUN_VMPL 0x80000018 -#define SVM_VMGEXIT_SAVIC 0x8000001a +#define SVM_VMGEXIT_SNP_RUN_VMPL 0x80000018ull +#define SVM_VMGEXIT_SAVIC 0x8000001aull #define SVM_VMGEXIT_SAVIC_REGISTER_GPA 0 #define SVM_VMGEXIT_SAVIC_UNREGISTER_GPA 1 #define SVM_VMGEXIT_SAVIC_SELF_GPA ~0ULL -#define SVM_VMGEXIT_HV_FEATURES 0x8000fffd -#define SVM_VMGEXIT_TERM_REQUEST 0x8000fffe +#define SVM_VMGEXIT_HV_FEATURES 0x8000fffdull +#define SVM_VMGEXIT_TERM_REQUEST 0x8000fffeull #define SVM_VMGEXIT_TERM_REASON(reason_set, reason_code) \ /* SW_EXITINFO1[3:0] */ \ (((((u64)reason_set) & 0xf)) | \ /* SW_EXITINFO1[11:4] */ \ ((((u64)reason_code) & 0xff) << 4)) -#define SVM_VMGEXIT_UNSUPPORTED_EVENT 0x8000ffff +#define SVM_VMGEXIT_UNSUPPORTED_EVENT 0x8000ffffull =20 /* Exit code reserved for hypervisor/software use */ -#define SVM_EXIT_SW 0xf0000000 +#define SVM_EXIT_SW 0xf0000000ull =20 -#define SVM_EXIT_ERR -1 +#define SVM_EXIT_ERR -1ull =20 #define SVM_EXIT_REASONS \ { SVM_EXIT_READ_CR0, "read_cr0" }, \ diff --git a/arch/x86/kvm/svm/hyperv.c b/arch/x86/kvm/svm/hyperv.c index 088f6429b24c..3ec580d687f5 100644 --- a/arch/x86/kvm/svm/hyperv.c +++ b/arch/x86/kvm/svm/hyperv.c @@ -11,7 +11,6 @@ void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct= kvm_vcpu *vcpu) struct vcpu_svm *svm =3D to_svm(vcpu); =20 svm->vmcb->control.exit_code =3D HV_SVM_EXITCODE_ENL; - svm->vmcb->control.exit_code_hi =3D 0; svm->vmcb->control.exit_info_1 =3D HV_SVM_ENL_EXITCODE_TRAP_AFTER_FLUSH; svm->vmcb->control.exit_info_2 =3D 0; nested_svm_vmexit(svm); diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 8070e20ed5a7..89120245cd22 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -45,7 +45,6 @@ static void nested_svm_inject_npf_exit(struct kvm_vcpu *v= cpu, * correctly fill in the high bits of exit_info_1. */ vmcb->control.exit_code =3D SVM_EXIT_NPF; - vmcb->control.exit_code_hi =3D 0; vmcb->control.exit_info_1 =3D (1ULL << 32); vmcb->control.exit_info_2 =3D fault->address; } @@ -421,7 +420,6 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, to->int_vector =3D from->int_vector; to->int_state =3D from->int_state; to->exit_code =3D from->exit_code; - to->exit_code_hi =3D from->exit_code_hi; to->exit_info_1 =3D from->exit_info_1; to->exit_info_2 =3D from->exit_info_2; to->exit_int_info =3D from->exit_int_info; @@ -727,8 +725,8 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm, enter_guest_mode(vcpu); =20 /* - * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2, - * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes. + * Filled at exit: exit_code, exit_info_1, exit_info_2, exit_int_info, + * exit_int_info_err, next_rip, insn_len, insn_bytes. */ =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_VGIF) && @@ -985,7 +983,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) if (!nested_vmcb_check_save(vcpu) || !nested_vmcb_check_controls(vcpu)) { vmcb12->control.exit_code =3D SVM_EXIT_ERR; - vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; vmcb12->control.exit_info_2 =3D 0; goto out; @@ -1018,7 +1015,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->soft_int_injected =3D false; =20 svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; - svm->vmcb->control.exit_code_hi =3D -1u; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; =20 @@ -1130,7 +1126,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm) =20 vmcb12->control.int_state =3D vmcb02->control.int_state; vmcb12->control.exit_code =3D vmcb02->control.exit_code; - vmcb12->control.exit_code_hi =3D vmcb02->control.exit_code_hi; vmcb12->control.exit_info_1 =3D vmcb02->control.exit_info_1; vmcb12->control.exit_info_2 =3D vmcb02->control.exit_info_2; =20 @@ -1422,7 +1417,7 @@ static int nested_svm_intercept_ioio(struct vcpu_svm = *svm) =20 static int nested_svm_intercept(struct vcpu_svm *svm) { - u32 exit_code =3D svm->vmcb->control.exit_code; + u64 exit_code =3D svm->vmcb->control.exit_code; int vmexit =3D NESTED_EXIT_HOST; =20 if (svm_is_vmrun_failure(exit_code)) @@ -1494,7 +1489,6 @@ static void nested_svm_inject_exception_vmexit(struct= kvm_vcpu *vcpu) struct vmcb *vmcb =3D svm->vmcb; =20 vmcb->control.exit_code =3D SVM_EXIT_EXCP_BASE + ex->vector; - vmcb->control.exit_code_hi =3D 0; =20 if (ex->has_error_code) vmcb->control.exit_info_1 =3D ex->error_code; @@ -1669,7 +1663,6 @@ static void nested_copy_vmcb_cache_to_control(struct = vmcb_control_area *dst, dst->int_vector =3D from->int_vector; dst->int_state =3D from->int_state; dst->exit_code =3D from->exit_code; - dst->exit_code_hi =3D from->exit_code_hi; dst->exit_info_1 =3D from->exit_info_1; dst->exit_info_2 =3D from->exit_info_2; dst->exit_int_info =3D from->exit_int_info; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 0835c664fbfd..5aedd07194aa 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -3264,11 +3264,6 @@ void sev_free_vcpu(struct kvm_vcpu *vcpu) kvfree(svm->sev_es.ghcb_sa); } =20 -static u64 kvm_get_cached_sw_exit_code(struct vmcb_control_area *control) -{ - return (((u64)control->exit_code_hi) << 32) | control->exit_code; -} - static void dump_ghcb(struct vcpu_svm *svm) { struct vmcb_control_area *control =3D &svm->vmcb->control; @@ -3290,7 +3285,7 @@ static void dump_ghcb(struct vcpu_svm *svm) */ pr_err("GHCB (GPA=3D%016llx) snapshot:\n", svm->vmcb->control.ghcb_gpa); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_code", - kvm_get_cached_sw_exit_code(control), kvm_ghcb_sw_exit_code_is_val= id(svm)); + control->exit_code, kvm_ghcb_sw_exit_code_is_valid(svm)); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_info_1", control->exit_info_1, kvm_ghcb_sw_exit_info_1_is_valid(svm)); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_info_2", @@ -3324,7 +3319,6 @@ static void sev_es_sync_from_ghcb(struct vcpu_svm *sv= m) struct vmcb_control_area *control =3D &svm->vmcb->control; struct kvm_vcpu *vcpu =3D &svm->vcpu; struct ghcb *ghcb =3D svm->sev_es.ghcb; - u64 exit_code; =20 /* * The GHCB protocol so far allows for the following data @@ -3358,9 +3352,7 @@ static void sev_es_sync_from_ghcb(struct vcpu_svm *sv= m) __kvm_emulate_msr_write(vcpu, MSR_IA32_XSS, kvm_ghcb_get_xss(svm)); =20 /* Copy the GHCB exit information into the VMCB fields */ - exit_code =3D kvm_ghcb_get_sw_exit_code(svm); - control->exit_code =3D lower_32_bits(exit_code); - control->exit_code_hi =3D upper_32_bits(exit_code); + control->exit_code =3D kvm_ghcb_get_sw_exit_code(svm); control->exit_info_1 =3D kvm_ghcb_get_sw_exit_info_1(svm); control->exit_info_2 =3D kvm_ghcb_get_sw_exit_info_2(svm); svm->sev_es.sw_scratch =3D kvm_ghcb_get_sw_scratch_if_valid(svm); @@ -3373,15 +3365,8 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *= svm) { struct vmcb_control_area *control =3D &svm->vmcb->control; struct kvm_vcpu *vcpu =3D &svm->vcpu; - u64 exit_code; u64 reason; =20 - /* - * Retrieve the exit code now even though it may not be marked valid - * as it could help with debugging. - */ - exit_code =3D kvm_get_cached_sw_exit_code(control); - /* Only GHCB Usage code 0 is supported */ if (svm->sev_es.ghcb->ghcb_usage) { reason =3D GHCB_ERR_INVALID_USAGE; @@ -3395,7 +3380,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *s= vm) !kvm_ghcb_sw_exit_info_2_is_valid(svm)) goto vmgexit_err; =20 - switch (exit_code) { + switch (control->exit_code) { case SVM_EXIT_READ_DR7: break; case SVM_EXIT_WRITE_DR7: @@ -3496,15 +3481,19 @@ static int sev_es_validate_vmgexit(struct vcpu_svm = *svm) return 0; =20 vmgexit_err: + /* + * Print the exit code even though it may not be marked valid as it + * could help with debugging. + */ if (reason =3D=3D GHCB_ERR_INVALID_USAGE) { vcpu_unimpl(vcpu, "vmgexit: ghcb usage %#x is not valid\n", svm->sev_es.ghcb->ghcb_usage); } else if (reason =3D=3D GHCB_ERR_INVALID_EVENT) { vcpu_unimpl(vcpu, "vmgexit: exit code %#llx is not valid\n", - exit_code); + control->exit_code); } else { vcpu_unimpl(vcpu, "vmgexit: exit code %#llx input is not valid\n", - exit_code); + control->exit_code); dump_ghcb(svm); } =20 @@ -4343,7 +4332,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); struct vmcb_control_area *control =3D &svm->vmcb->control; - u64 ghcb_gpa, exit_code; + u64 ghcb_gpa; int ret; =20 /* Validate the GHCB */ @@ -4385,8 +4374,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) =20 svm_vmgexit_success(svm, 0); =20 - exit_code =3D kvm_get_cached_sw_exit_code(control); - switch (exit_code) { + switch (control->exit_code) { case SVM_VMGEXIT_MMIO_READ: ret =3D setup_vmgexit_scratch(svm, true, control->exit_info_2); if (ret) @@ -4478,7 +4466,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) ret =3D -EINVAL; break; default: - ret =3D svm_invoke_exit_handler(vcpu, exit_code); + ret =3D svm_invoke_exit_handler(vcpu, control->exit_code); } =20 return ret; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 3b05476296d0..85bc99f93275 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2433,7 +2433,6 @@ static bool check_selective_cr0_intercepted(struct kv= m_vcpu *vcpu, =20 if (cr0 ^ val) { svm->vmcb->control.exit_code =3D SVM_EXIT_CR0_SEL_WRITE; - svm->vmcb->control.exit_code_hi =3D 0; ret =3D (nested_svm_exit_handled(svm) =3D=3D NESTED_EXIT_DONE); } =20 @@ -3265,7 +3264,7 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl); pr_err("%-20s%08x\n", "int_vector:", control->int_vector); pr_err("%-20s%08x\n", "int_state:", control->int_state); - pr_err("%-20s%08x\n", "exit_code:", control->exit_code); + pr_err("%-20s%016llx\n", "exit_code:", control->exit_code); pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1); pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2); pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info); @@ -3515,7 +3514,6 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) { struct vcpu_svm *svm =3D to_svm(vcpu); struct kvm_run *kvm_run =3D vcpu->run; - u32 exit_code =3D svm->vmcb->control.exit_code; =20 /* SEV-ES guests must use the CR write traps to track CR registers. */ if (!sev_es_guest(vcpu->kvm)) { @@ -3551,7 +3549,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) if (exit_fastpath !=3D EXIT_FASTPATH_NONE) return 1; =20 - return svm_invoke_exit_handler(vcpu, exit_code); + return svm_invoke_exit_handler(vcpu, svm->vmcb->control.exit_code); } =20 static int pre_svm_run(struct kvm_vcpu *vcpu) @@ -4618,7 +4616,6 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, if (static_cpu_has(X86_FEATURE_NRIPS)) vmcb->control.next_rip =3D info->next_rip; vmcb->control.exit_code =3D icpt_info.exit_code; - vmcb->control.exit_code_hi =3D 0; vmexit =3D nested_svm_exit_handled(svm); =20 ret =3D (vmexit =3D=3D NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 6b35925e3a33..31ee4f65dcc2 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -162,8 +162,7 @@ struct vmcb_ctrl_area_cached { u32 int_ctl; u32 int_vector; u32 int_state; - u32 exit_code; - u32 exit_code_hi; + u64 exit_code; u64 exit_info_1; u64 exit_info_2; u32 exit_int_info; @@ -769,7 +768,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm); static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_= code) { svm->vmcb->control.exit_code =3D exit_code; - svm->vmcb->control.exit_code_hi =3D 0; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; return nested_svm_vmexit(svm); diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h index e79bc9cb7162..4c7a5cd10990 100644 --- a/arch/x86/kvm/trace.h +++ b/arch/x86/kvm/trace.h @@ -781,7 +781,7 @@ TRACE_EVENT_KVM_EXIT(kvm_nested_vmexit); * Tracepoint for #VMEXIT reinjected to the guest */ TRACE_EVENT(kvm_nested_vmexit_inject, - TP_PROTO(__u32 exit_code, + TP_PROTO(__u64 exit_code, __u64 exit_info1, __u64 exit_info2, __u32 exit_int_info, __u32 exit_int_info_err, __u32 isa), TP_ARGS(exit_code, exit_info1, exit_info2, diff --git a/include/hyperv/hvgdk.h b/include/hyperv/hvgdk.h index dd6d4939ea29..56b695873a72 100644 --- a/include/hyperv/hvgdk.h +++ b/include/hyperv/hvgdk.h @@ -281,7 +281,7 @@ struct hv_vmcb_enlightenments { #define HV_VMCB_NESTED_ENLIGHTENMENTS 31 =20 /* Synthetic VM-Exit */ -#define HV_SVM_EXITCODE_ENL 0xf0000000 +#define HV_SVM_EXITCODE_ENL 0xf0000000u #define HV_SVM_ENL_EXITCODE_TRAP_AFTER_FLUSH (1) =20 /* VM_PARTITION_ASSIST_PAGE */ --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 329A432939A for ; Thu, 13 Nov 2025 22:56:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074603; cv=none; b=BuuDqq9TLMTf8smv/oGaaEzgt+Xc+noJx3zLRoIOo4N5qIP1X8wJj9TFfeJlWTI9XfpEovpRTNfB6PB9q5PmABB1anokd7bnKtlIK0HcsQkbB5qvuhSvbU1c0ScfY/dyBswBuOngindeZ00s/UC/xZkK9Y37cBb4hUZQWOiWuis= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074603; c=relaxed/simple; bh=84mlhZ3JM5RfxlKomoAAeHn9Bvqc4zqHVGnlMIN+Dl0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=uKdGuoOoOqNvEWCAmbMGdyBCmZkR26vyLzKBkzdb/GacBetFfVeSDcxXPgkrIRo2e6Sa+RkEcyWNjbeYKGJGx1SoeQGDWOQ3GZN56gt1WOTzVA/qwbjSfC0hflTobhf59lUOk7mrI2lbYnD5jYRvdz9QMoP/jaU+T62h0NmCil0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=jAI+VEn9; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="jAI+VEn9" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-b630753cc38so2978066a12.1 for ; Thu, 13 Nov 2025 14:56:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074601; x=1763679401; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=yAZ8dC0cSBzCHy+Gncv2WYa1BW9ysI8EoXwobyv3AdE=; b=jAI+VEn9/DCv7c9s80EI/zOj/Tvs3p5UzyZvFsejJTjus68hnNQtEZpGhY34vI2rJt M3diu0V2ar5rxDzXIw03inVQ/kAO+l2p0584qpwnhFENWyUMjRkxf/00aMTe/vaQSuIW OJz7Ksda6rjoqN1OF0eiEAp3gFrjJ20qsbJXMb715CK0zNKAzuEcuAKNyuNFlkOk7Kzs YcWgZy2g4LVe1jZZhqA8v/4zjTWYInc9SYAPQXBHsDgftaTEr9HRB1squX7RWYM8Yo6T QyFllCf7kPhOe/ZqMWktnCM7zncbg3DhofTIg/64XotUPRJJqGdf3/IOL1whi7U+/OHa NBfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074601; x=1763679401; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=yAZ8dC0cSBzCHy+Gncv2WYa1BW9ysI8EoXwobyv3AdE=; b=KCnnfbZLKjrEtzs9ThV6gqiBtWQ7QunejsrAeRtzzjbz/EbLvJpuKJqD1hrPfLt/xe iaI36gu9N3DwY2WApSIL3rXnp1ptW0xrhyMkhysehg2DCbRZDKBdFnjpJztt+s06r06a LUpHXMw2aAWu9BUYtVcY9tEcaU0HNmIK9QB7xlXUaREmAblwRe2keV6BXOebGKsyC3qW EPGHzf/brFTaqxn/YyCr5rB8H5eO7yWxKhaM5sWUMT+P9JSzQCrWIHBxuwBThsY5PH+K xV+ZvUBm8Bc3FXZg17kNTFRkU+qmKO3yRv7PG4d8c2u+fboRnw8nilKwMPcww0I83sA6 +zWw== X-Forwarded-Encrypted: i=1; AJvYcCUtBTn69RM6uFq98arMy58K4SjNITowCfv4DFd9NOQbxOZuVvjH90V2lZk5smMt5POUtM4ezRGbgM8WRNQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyqsORvrz+6kgKjMUWsrkJ8/ed9JB4q8iiK0YV48eEdKbHH9KwX /sB3ySMSTaO6LDX2nkapbWkY5FX14zg8Pyz7P7J9+m64Yz8UWGX/qdqLDifgL5QzeCxypmqqUoq jyHckkA== X-Google-Smtp-Source: AGHT+IF96SyhX4OSFYPPUcMMzzakOIf9y26xhAXkhopdVA6dBw1xWXKKHbc/n2cOWm2tylO2zP96XfNZ/fw= X-Received: from pgdj7.prod.google.com ([2002:a05:6a02:5207:b0:bc5:3be0:b497]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:3294:b0:342:5901:fd9f with SMTP id adf61e73a8af0-35ba16a47f6mr1429299637.28.1763074601451; Thu, 13 Nov 2025 14:56:41 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:20 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-9-seanjc@google.com> Subject: [PATCH 8/9] KVM: SVM: Limit incorrect check on SVM_EXIT_ERR to running as a VM From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Limit KVM's incorrect check for VMXEXIT_INVALID, a.k.a. SVM_EXIT_ERR, to running as a VM, as detected by X86_FEATURE_HYPERVISOR. The exit_code and all failure codes, e.g. VMXEXIT_INVALID, are 64-bit values, and so checking only bits 31:0 could result in false positives when running on non-broken hardware, e.g. in the extremely unlikely scenario exit code 0xffffffffull is ever generated by hardware. Keep the 32-bit check to play nice with running on broken KVM (for years, KVM has not set bits 63:32 when synthesizing nested SVM VM-Exits). Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/svm.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 31ee4f65dcc2..801dcfc64d0b 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -427,7 +427,10 @@ static __always_inline struct vcpu_svm *to_svm(struct = kvm_vcpu *vcpu) =20 static inline bool svm_is_vmrun_failure(u64 exit_code) { - return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; + if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) + return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; + + return exit_code =3D=3D SVM_EXIT_ERR; } =20 /* --=20 2.52.0.rc1.455.g30608eb744-goog From nobody Sun Feb 8 05:23:09 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDEB632AADE for ; Thu, 13 Nov 2025 22:56:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074605; cv=none; b=AdxFKMzuq0BaR9eVLL7PKhtGZH/aJ4Fe+zPMweed1djjVSNwDSshjeDI6gBX2QctB5v14W5DTqBwCZbYC6KIvGy04ah9wd3tpozSlpJXCpPTrja9iIigY2+x/GioSgN0X2URdv3v61HVGZciF9ws3YrAXDsrPulhBMI5VFaoOKI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763074605; c=relaxed/simple; bh=a+s6sZNkgEmBhyZ1wdOGRI7wiOUgOGhVQHVBCdK4J8Q=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=eUqmUGaRSWtUjhAE08k+6cE5l42RkJaWUom2qfRtzPKHJ2JHVZC2Cg4hBh7MPqWkftRYmYOaH1qHcBwP4Rlbre7hdx88euPlXoFfeKLZoV0Qhpylc5Av/GeYa0lPzuvbb0zd83NZTfNIDeYxxNl3i1/Yv0MnKt0M0OBQ9MIA+jI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=XLF/H1se; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="XLF/H1se" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-297b35951b7so18135595ad.3 for ; Thu, 13 Nov 2025 14:56:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763074603; x=1763679403; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=mHz4oN+bRmjr/Tq43pRV+YXBpy16+hTvzgAeUQ/5hJU=; b=XLF/H1sefUQgRYonaKzLHXfznh62AUf/0YB9jSmqZTcAkl7VhloeCFlB2ERuiZPfs4 y8WI96oxdZ1ITX3nZnuhOISOrrR42wAXoTifeLtqxPZNZM1XixfhWqbaKho46bpDeIMX sLzI0+gSxhbxqUupSCDnmD1UUtjCWRPB0I9MeddDeVYmC92gjDfMzGbAxpimaHJsnvgJ Qm2JPWaUjjQRYH2oQxj21XlEZKCH7bfZ7XcPdUCX8DqxCmcQCXH6dRflCar68VVlIfbN McxW/ChMNMaPD82QZB0IZUJJP1Xg/N3k4azzN5VPJF2rbfUjoxjJw5TFEWqZHFe0g0IS tw7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763074603; x=1763679403; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=mHz4oN+bRmjr/Tq43pRV+YXBpy16+hTvzgAeUQ/5hJU=; b=XoH+0f1HDKfBGXSufqMutx8Vv6fwcuM6utcYHlYxXV9/WPN6YAIChB8xjd2fJE1all 3CjbFZKYM4jG1QgNXzlBih2Wm4IXF90FfnZpdEF+o+nSKA0edyHqDjEEU3k1ZRM9NGBU eUeXO9/XrqTHiVSGlm/PrU/k2zOBvhBjqmU6fUTqqDyX91nJ5SmxShZuQsI8sY2R4aS/ gjHILiW/SgpC8/3j+HQRmeTybbJ7iysuRlt5UlKWZ2V2N/XzTpGOHEr06CNHzuZYb0Lb G6O73gWojFoS3l2HX7zihJG8pT4NrSnItqTj5jYdWxFQ0pwpdVjQgQpER9POiHXM6SH2 auJQ== X-Forwarded-Encrypted: i=1; AJvYcCXUaOk1ek0YNLu0W8GkEx65cEUSRrpkDYaS5lvtiIQaapLfLIaauhbzGLsPReJDNPSh9Uy1uc5IIN8Db7M=@vger.kernel.org X-Gm-Message-State: AOJu0Yzj96/xfnYfrdh+ypJaTEtUEgFWkqskJsRdu25UntiEI5J7h5JW FlZuq1h1r2DkC7L/sjvvGUVB0uqLl/KtP34And6tl0Oms9quBJAjxoHBJxVFUIVHB0ix85aB38H QtDK+ew== X-Google-Smtp-Source: AGHT+IEO37c5pwPK2cMLUV9F0xRjUgNCC9Jy0Xa4OyxYda5fCXX6UpbBlg6x0BhMofP9nToBEj/Ouj9X0QU= X-Received: from plot13.prod.google.com ([2002:a17:902:8c8d:b0:295:fb8:7fb1]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:d502:b0:295:586d:677d with SMTP id d9443c01a7336-2986a74185fmr6475565ad.41.1763074603172; Thu, 13 Nov 2025 14:56:43 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 14:56:21 -0800 In-Reply-To: <20251113225621.1688428-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251113225621.1688428-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113225621.1688428-10-seanjc@google.com> Subject: [PATCH 9/9] KVM: SVM: Harden exit_code against being used in Spectre-like attacks From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly clamp the exit code used to index KVM's exit handlers to guard against Spectre-like attacks, mainly to provide consistency between VMX and SVM (VMX was given the same treatment by commit c926f2f7230b ("KVM: x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks"). For normal VMs, it's _extremely_ unlikely the exit code could be used to exploit a speculation vulnerability, as the exit code is set by hardware and unexpected/unknown exit codes should be quite well bounded (as is/was the case with VMX). But with SEV-ES+, the exit code is guest-controlled as it comes from the GHCB, not from hardware, i.e. an attack from the guest is at least somewhat plausible. Irrespective of SEV-ES+, hardening KVM is easy and inexpensive, and such an attack is theoretically possible. Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/svm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 85bc99f93275..308c70b6924e 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3467,6 +3467,7 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u6= 4 __exit_code) if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) goto unexpected_vmexit; =20 + exit_code =3D array_index_nospec(exit_code, ARRAY_SIZE(svm_exit_handlers)= ); if (!svm_exit_handlers[exit_code]) goto unexpected_vmexit; =20 --=20 2.52.0.rc1.455.g30608eb744-goog