From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EDD129DB99 for ; Tue, 30 Dec 2025 21:13:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129234; cv=none; b=TVEjtnooQyLmF+5A5m9zzFHisV86o40Chw5vGQ2guEZegyVrgc3ZoLJykRnLmISRg2mSaq8v9LeiJD9V/iuGSie6HaAgFiGSyXTqhN8cF3X02Xr/9Uxg6AO8qY17Cc1S+3pMpkUrbuzfFK1tHDjeqoLX6ptHaPyTdUTwQRulwpI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129234; c=relaxed/simple; bh=C0RT9xfmtmFEbcE2vwzv7EC+1IXAWAUmiIkyGSmxhK0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=V7eBGqwrOuJefm8sGap4a3sv60+80XNDD8NKcxgbpq0tO9+sFFcobFrN/HMro5voq0YvOMVKEF9yUmf72Dol58lxpAcwWe+mygkw81qqQRWqs52MItw9lylwMpmzM/gs72Z1X6a+bSmJkvnnpMZdJ3v6N4AZvoGkX4f+TksYkio= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=TdMM4Mkm; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="TdMM4Mkm" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-34abd303b4aso29245098a91.1 for ; Tue, 30 Dec 2025 13:13:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129232; x=1767734032; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=7wqozHQILfBR+7AGDrYzCeWuem5verec2J4wlm1ug8s=; b=TdMM4Mkm4X25WU9tn63WPYvV4ZpEzUTXJsuXTt444BEiDSxoTbLDhOIoqRBNVSLyvV SaY7KeOVSMNNdOTWxzZyBjkBjGRdebZayxpxc1X72IA5bIpZqQrsMsFYcxcAprxnETZ0 6Jzpn84V3c8U0E0cTwoQxIg95ApOUVpaVk2q4DUE+WS+71BC69hIvRoRKqBiJ+vigNfN pZxN5qxhdRf666+LJLteKLqumQnEQFECOTG1YO4eXA5uzpo4/vHeFx6i1WHQovmVRoYK 6a/7FZ+nQqNHOtAqlGl5G2RUgfwRIErSmN3gLy+Vouii9DvDrprcovaKVzntWkKuoM8I 9Oww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129232; x=1767734032; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=7wqozHQILfBR+7AGDrYzCeWuem5verec2J4wlm1ug8s=; b=eOIor2Zdj+ErfOIskOTRGIfhkzHBQucMHyvWDR2oRSnfm46mZMgBxGES9U+BynKcjV RFKtWnfUbQc7D2OiM+f9KMBZBWcUXGNhHXUrIfrob8/eTdQUzPdoAZSwlE1rsglApofi o+eicvY9M24m9N3egLd4PoW3a66u4oRG+AvY2jN+NXLELL6EeVstF//iHMXUThD1YYwA WMKlNcQPl2HKvUUQswa0qz+EpXeNCYFernW3qyBKFEA/p3+wjfvK9iQmxPXun1WjMK2Y mPQ0ZllTngb2KlxyoMI+Z67juaagbwFME5gjlH/ETcTnTCiQAEbnfseTrp9rnvr0Jl+1 bZ3A== X-Forwarded-Encrypted: i=1; AJvYcCUkfR3iqrHiIXl1Dfv+d9LROgfEr7gurY9Q8JnFrbJVB2Aj76H5V68VWh1//5DYkAZF+bhfvFiLKtVdESY=@vger.kernel.org X-Gm-Message-State: AOJu0Yzhg1G0WKhPbyJjUIxMftd0c7HAsTF4XoLzMbNiDh03Wf0t6m/b 8NIhcRWyKk6DufiDX6ga/GfVRVnljKWrE81tR/ahFzCUy/1ZFbT/d3/QmLOGTZ2MoJzXgECh1xo sv94IsQ== X-Google-Smtp-Source: AGHT+IFFJm+456D6lf8JwJ1xaSWe0/SdbTVKGZR7AlvWe/wQ/+5VUBL7ZmZTigDPzAcFVXg81Hi1qQTBfRc= X-Received: from pjee13.prod.google.com ([2002:a17:90b:578d:b0:34a:c87f:a95a]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4c46:b0:347:5ddd:b2d1 with SMTP id 98e67ed59e1d1-34e921ccb5cmr30678426a91.27.1767129232376; Tue, 30 Dec 2025 13:13:52 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:40 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-2-seanjc@google.com> Subject: [PATCH v2 1/8] KVM: SVM: Add a helper to detect VMRUN failures From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a helper to detect VMRUN failures so that KVM can guard against its own long-standing bug, where KVM neglects to set exitcode[63:32] when synthesizing a nested VMFAIL_INVALID VM-Exit. This will allow fixing KVM's mess of treating exitcode as two separate 32-bit values without breaking KVM-on-KVM when running on an older, unfixed KVM. Cc: Jim Mattson Cc: Yosry Ahmed Signed-off-by: Sean Christopherson Reviewed-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 16 +++++++--------- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/svm/svm.h | 5 +++++ 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index ba0f11c68372..f5bde972a2b1 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1134,7 +1134,7 @@ int nested_svm_vmexit(struct vcpu_svm *svm) vmcb12->control.exit_info_1 =3D vmcb02->control.exit_info_1; vmcb12->control.exit_info_2 =3D vmcb02->control.exit_info_2; =20 - if (vmcb12->control.exit_code !=3D SVM_EXIT_ERR) + if (!svm_is_vmrun_failure(vmcb12->control.exit_code)) nested_save_pending_event_to_vmcb12(svm, vmcb12); =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) @@ -1425,6 +1425,9 @@ static int nested_svm_intercept(struct vcpu_svm *svm) u32 exit_code =3D svm->vmcb->control.exit_code; int vmexit =3D NESTED_EXIT_HOST; =20 + if (svm_is_vmrun_failure(exit_code)) + return NESTED_EXIT_DONE; + switch (exit_code) { case SVM_EXIT_MSR: vmexit =3D nested_svm_exit_handled_msr(svm); @@ -1432,7 +1435,7 @@ static int nested_svm_intercept(struct vcpu_svm *svm) case SVM_EXIT_IOIO: vmexit =3D nested_svm_intercept_ioio(svm); break; - case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: { + case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: /* * Host-intercepted exceptions have been checked already in * nested_svm_exit_special. There is nothing to do here, @@ -1440,15 +1443,10 @@ static int nested_svm_intercept(struct vcpu_svm *sv= m) */ vmexit =3D NESTED_EXIT_DONE; break; - } - case SVM_EXIT_ERR: { - vmexit =3D NESTED_EXIT_DONE; - break; - } - default: { + default: if (vmcb12_is_intercept(&svm->nested.ctl, exit_code)) vmexit =3D NESTED_EXIT_DONE; - } + break; } =20 return vmexit; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 24d59ccfa40d..c2ddf2e0aa1a 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3540,7 +3540,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) return 1; } =20 - if (svm->vmcb->control.exit_code =3D=3D SVM_EXIT_ERR) { + if (svm_is_vmrun_failure(svm->vmcb->control.exit_code)) { kvm_run->exit_reason =3D KVM_EXIT_FAIL_ENTRY; kvm_run->fail_entry.hardware_entry_failure_reason =3D svm->vmcb->control.exit_code; @@ -4311,7 +4311,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_= vcpu *vcpu, u64 run_flags) =20 /* Track VMRUNs that have made past consistency checking */ if (svm->nested.nested_run_pending && - svm->vmcb->control.exit_code !=3D SVM_EXIT_ERR) + !svm_is_vmrun_failure(svm->vmcb->control.exit_code)) ++vcpu->stat.nested_run; =20 svm->nested.nested_run_pending =3D 0; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 01be93a53d07..0f006793f973 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -424,6 +424,11 @@ static __always_inline struct vcpu_svm *to_svm(struct = kvm_vcpu *vcpu) return container_of(vcpu, struct vcpu_svm, vcpu); } =20 +static inline bool svm_is_vmrun_failure(u64 exit_code) +{ + return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; +} + /* * Only the PDPTRs are loaded on demand into the shadow MMU. All other * fields are synchronized on VM-Exit, because accessing the VMCB is cheap. --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95A592FD675 for ; Tue, 30 Dec 2025 21:13:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129236; cv=none; b=ClfC4q2bplMGO4v8Liq8LkJkpYZT8ZA9GJfudXSUsQR1lGiPn6NraPhNXz8R1pYzT0DORovZ8a/0swY8UkwbxMc8GP2BOE5HGwAEptba75hn2+uPWPWy3yZPxjWtKWAZnWssBTdSu9EM9WM8q1vWnSq6+5Yp8p3ODs6PtOdTitw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129236; c=relaxed/simple; bh=B+4ERGzRCfw5jMwC37fXuEHs9A9jh2a1ZNa1zK4cuGQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=mFVRyKN7o9M5AdWztd0voAj1aP7SLwoCIviiZb+n26uV+IXsOOVtdL+XKP4ZxslgshWo3Tt0R/GZ7is0L92Xq0ufz7HsMLMfGPthGMdsjrG01Kdxkc9LfBGDpDKGcGS0lawuOXrFvalYmd1Ff2V6r1PCDdg/OJFLxLhkkyNgGoo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=cfsZcIU4; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="cfsZcIU4" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-7b9321b9312so21440587b3a.1 for ; Tue, 30 Dec 2025 13:13:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129234; x=1767734034; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=v9BolbukkfXEm81oWgJJ+XaSPsS7Ia/w4dyAHDKHDXI=; b=cfsZcIU4Mnl4KsKMlbqWzOnkdE+yckHbKFlkok9wX2gIXDpxPPm9cgRH3WAzAo5Nwd bbpgWLa0egLVgPNviLesbRJdItivXru0K1z08vkbBOW05Fgs6JKcJjHjsCLvgbdR4oam b6NxKlm51XBZPjmFuKSD46R1p5Q71TdG3oLinGh/3tyrBIgi4hNu9qDR9aBUT2UzqaM/ yG4f9L6akK0+kqnREWATJu6FHBdmHveBgNaRBYioaLJk4N13rfTuQQtXlhch8s/YerV0 LPWPp/OmL5CTJUwsbrc7anMCl3EVqZapWKBSCSlrtIkXJ0rLY+2jkcITcRvS6ZVeKd8q BBHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129234; x=1767734034; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=v9BolbukkfXEm81oWgJJ+XaSPsS7Ia/w4dyAHDKHDXI=; b=Nih/KAgoU2Bx20M4hKvHOCdFiDX2JUC6twrh/4c1HieJ1kTfucAveI0rmH2iE9O5yl YdQC8EE0fphBWQuJ2Vkm87KFKKgmo2CV7drsawL2v5+N007qfnWop6MAmX7VunYnCjGv s/Xq7qx4TVrMpnHZ6Snka4TWCC56HFAiAXyiddeTKsSjK0AZtmJUSqNXVCxAGzShMHBf 7gjJGNW0wIlYMRgUCeGUXiOdNCqde/sJ20RFK1pB4aRfhLCkrFcfFi/R5Twg4ji20ZtT w59SzAs8FG4M/Ib4rtQ2aMkW835VdkUZUMNANH8/1FqZcQY8RpUodmNK70MSDhJPGjpp Sq/g== X-Forwarded-Encrypted: i=1; AJvYcCXufchiVO78kyunW+nWUo07XvXyTQ1cLWz3GvNkMYpDaJRiR9gvu/EsrA0TldqCtjzi4QO9y6PgFJ2eHfo=@vger.kernel.org X-Gm-Message-State: AOJu0YyZNTR3nJT0dqt+m1k6Ksamp5uYyRr4dDX2Gb0RyocOGQLy2U7W Gug53hnu7wCGlscQsNQxEm62K8rfGaB9zKAClqOXCEWLlaJfJZ8yuE9l1qlhjCvuRMcaGgj88F2 kKWr/9g== X-Google-Smtp-Source: AGHT+IHHfrYGaC61aPB/ea5B/ICFankJwCsUHy15saTAvrWaEpZGe7M7AgYdzFXF+BVWYJ5DWGu3cCUZQeI= X-Received: from pfez22.prod.google.com ([2002:aa7:8896:0:b0:7b7:8636:7b21]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:1d0c:b0:7e8:43f5:bd23 with SMTP id d2e1a72fcca58-7ff6735eb64mr31633129b3a.56.1767129234006; Tue, 30 Dec 2025 13:13:54 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:41 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-3-seanjc@google.com> Subject: [PATCH v2 2/8] KVM: SVM: Open code handling of unexpected exits in svm_invoke_exit_handler() From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fold svm_check_exit_valid() and svm_handle_invalid_exit() into their sole caller, svm_invoke_exit_handler(), as having tiny single-use helpers makes the code unncessarily difficult to follow. This will also allow for additional cleanups in svm_invoke_exit_handler(). No functional change intended. Suggested-by: Yosry Ahmed Reviewed-by: Yosry Ahmed Signed-off-by: Sean Christopherson Reviewed-by: Pankaj Gupta --- arch/x86/kvm/svm/svm.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index c2ddf2e0aa1a..a523011f0923 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3443,23 +3443,13 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) sev_free_decrypted_vmsa(vcpu, save); } =20 -static bool svm_check_exit_valid(u64 exit_code) -{ - return (exit_code < ARRAY_SIZE(svm_exit_handlers) && - svm_exit_handlers[exit_code]); -} - -static int svm_handle_invalid_exit(struct kvm_vcpu *vcpu, u64 exit_code) -{ - dump_vmcb(vcpu); - kvm_prepare_unexpected_reason_exit(vcpu, exit_code); - return 0; -} - int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) { - if (!svm_check_exit_valid(exit_code)) - return svm_handle_invalid_exit(vcpu, exit_code); + if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) + goto unexpected_vmexit; + + if (!svm_exit_handlers[exit_code]) + goto unexpected_vmexit; =20 #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) @@ -3478,6 +3468,11 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u= 64 exit_code) #endif #endif return svm_exit_handlers[exit_code](vcpu); + +unexpected_vmexit: + dump_vmcb(vcpu); + kvm_prepare_unexpected_reason_exit(vcpu, exit_code); + return 0; } =20 static void svm_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason, --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F3D72F7AB8 for ; Tue, 30 Dec 2025 21:13:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129238; cv=none; b=KY0MtiSZJlO1hJ5oZikvTpt5gFlIR9l6hl4s+Gcg/nQ25/Ip339ZCml9jhTSQYOxifhwEyIGczJI9STlgpQ9IKJ/8v7cgHsinu0U8joUAv00jKm6JiEyKWoy46Ms8VogtHrVhG1T/pJihNe0r2Ps2zwxKq5u1WVFhZSbFLWLIio= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129238; c=relaxed/simple; bh=dFYvwKO0rAM5gd+DQa6wT7749+Cjr6pisryKGAR8XHI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=UG/MUzGYxCHSMwKp4Zbbajg33/GjeEY7rLhKpUZwhgmsJmpsz1PIm5LXiUgAARGScl2az3YQ9wntrdG+stbHJskypHaU0T1WXgu5p9x0GSu4ELhEu10xQX2Wvl2sHuS68RCmfWVlH2k+A8M0PLfap8f0bUW4HiWN1MrAuC2HdtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=swrQSEnX; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="swrQSEnX" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2a377e15716so84169025ad.3 for ; Tue, 30 Dec 2025 13:13:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129236; x=1767734036; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=OP9hotpCQrsVZqE8v5eRxWNMJZgi8k5mDCW7kmyDFTA=; b=swrQSEnX12C3++X4mU5FO25yCDLIaVsgFNv8gPCgdAsBePsTO9fQgoBerVBSje06y5 STgaKGOWQdDhyCvrl7lNTsXlGWFUBVZDh3l0x2K0UQLiZoZZoGPLZEbell3P5Hkb05Jx yEPRA6X6o9ZejCPZuoddf2kcUYmZe572ThMN1fh6QA5/z8XxrkVnED/+35bQMu79jNBp +wdlox8HSwv2SyXKaMneaVnevTSVomvjUOY8RG7CaCtiVXWy6xC0xbnTnGHZ2XSZLROb 8xSynvtZxkfWdcpOpQl6fP4MjVLH7B1CdSD8aLIW7GAQOEsW0gnQpHyzVv0nUC/5loEl Jmtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129236; x=1767734036; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=OP9hotpCQrsVZqE8v5eRxWNMJZgi8k5mDCW7kmyDFTA=; b=Uamuk+rq75wXpvs0i0/ox3U4pVo+VIKP1ndorHpiAFO9wPEtBjmSBa3TF291xxuOAT FIQHwY50SDtTWKoVgWR2ZHHWK+aG56hGLThLjEvbRIebbwDh0R0n6Bnhuq+O2ktHYWBO STPjThXHHjC7gy+P653lwOrN6th9y3KgAh3AuGsrMJB9THoRyxDbh7L1kTRz6OqT+X90 vip2Ul49OxWg2Tx4DsXate7cD1LX53j3k8QTSRFWQQr9hI9wJtohCOpEg6o1He4litTI Kbj3Up4b4IoHNq1ajJh26RZkBtboPeG9CxOyF5SCbXgbzzeaokuyF0boirxin/f1sF1g iIOQ== X-Forwarded-Encrypted: i=1; AJvYcCV5csZlHktw9faTWOmgaz4hzljlhk3APNSZ4Q54WG9C1ZZaVwSK8ukvL2/peUoiKipryjN5jlxS2ZQAb40=@vger.kernel.org X-Gm-Message-State: AOJu0YyvmKWJroy7P+kEc7+JvifzCYkI5ucjwFzQ3PqQyDJL87275rJn c7HP9amytNiWF46AqfBQPD09cSUSkBOWMWlXwkvzyg/YpqHIapUR2g9rVfsFlG8uR7MfRZd+IQJ z6gBRQA== X-Google-Smtp-Source: AGHT+IGUJEnlpUD6Gd1YvivFP9uFX0/uZZ/iPrK157AWfRyC2+k/meCq+u7wH7O0QvzOvD9z3tsbRw5bG4o= X-Received: from pjbqb12.prod.google.com ([2002:a17:90b:280c:b0:34a:4aa7:b774]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f78d:b0:2a0:c35c:572e with SMTP id d9443c01a7336-2a2f2836480mr346664485ad.30.1767129235953; Tue, 30 Dec 2025 13:13:55 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:42 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-4-seanjc@google.com> Subject: [PATCH v2 3/8] KVM: SVM: Check for an unexpected VM-Exit after RETPOLINE "fast" handling From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Check for an unexpected/unhandled VM-Exit after the manual RETPOLINE=3Dy handling. The entire point of the RETPOLINE checks is to optimize for common VM-Exits, i.e. checking for the rare case of an unsupported VM-Exit is counter-productive. This also aligns SVM and VMX exit handling. No functional change intended. Reviewed-by: Yosry Ahmed Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/svm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index a523011f0923..e24bedf1fc81 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3445,12 +3445,6 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) =20 int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) { - if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) - goto unexpected_vmexit; - - if (!svm_exit_handlers[exit_code]) - goto unexpected_vmexit; - #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) return msr_interception(vcpu); @@ -3467,6 +3461,12 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u= 64 exit_code) return sev_handle_vmgexit(vcpu); #endif #endif + if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) + goto unexpected_vmexit; + + if (!svm_exit_handlers[exit_code]) + goto unexpected_vmexit; + return svm_exit_handlers[exit_code](vcpu); =20 unexpected_vmexit: --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D62B3081C2 for ; Tue, 30 Dec 2025 21:13:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129240; cv=none; b=TTwXYCSSUouccbmxRRAoRRZRghrhyDnb4JEA5USKOyBKxXwpht4AX5KKADqezgey+ok5TngqWNrX/waz6V0aDJcCTr/Nbhx1Y3d5PS2g4Q7gG1gejIK9HET52cxXRQPovxMfpa0tZea6AlcyNK5ywoMxARpi5C6mGNZUbd8TCQM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129240; c=relaxed/simple; bh=FtS6vDWiO9EDo/z8VoY1nvCPCfhD7nX6eEPGDJt96m0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=qbKyBlqpuUhWrCV2vkt+AGIdo2/ni26ZY7raVj94XxDCRmlXAgURyR3PGXE2qi1R9K9CsBvpuOvHaMSMwXYbKH4Kua4ajYEUryS2i7exCUvi+ip8wwoUyHFCtbFfBLmvbY8YQbAm62GnUA9pUMAYAlW0/GDK50+nFcEf/0UQqsw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=tQp1TfNE; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="tQp1TfNE" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2a0e952f153so339152715ad.0 for ; Tue, 30 Dec 2025 13:13:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129238; x=1767734038; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=wOA69MRBSxKnLZU9X2oOZa8j9xPVFywhN+aFtQXd8sE=; b=tQp1TfNEu2OkdrOL0mQ5V6KQ6KD9hiXFQJ3HP03B03weEn01SRLBf/S8CAgG5NFmx6 brEE7bdF01CH9njEpwoK+k2BEUvVXGr9h7GThts8S6YMDjtqN4OYr32mwakAoKkmRQnm bqri2nm9OLUSqkwPUvYSmH3zkUuyi+JR+3B3lBqMoFZ6a5AP+Xp0LcH5jV0ka0bQdtFB POyGUvjTS1iJgOgI5lbXIOJdOeys5M/58r9vWDIzuN34g5g1PjEJQI+E8x0R5/kDY3PJ rVZBx0/2xFKQ0mr+iyF5OGyWsf3msa9YKvj9VvGxRtAEHdi7RMX1J8aUzH2zaE7HljN8 9Hfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129238; x=1767734038; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=wOA69MRBSxKnLZU9X2oOZa8j9xPVFywhN+aFtQXd8sE=; b=pN1ALkg9tt0DCZAQpSJHZhX7Or7Q9U7smQHQDvS/dAhlJc/gS/afXNFcajTHdDp4Ss 00yxb0AV28kko+3ILjWUzaoMWekOIDQj38IDoZbypijuKUYQe5USlE7cyEOJMFFqlfIE 7eYHF0YbTNgebtLxAtcH/bSYe99HcO8op8Ary8qFaOyai9bg6WHpGyqZJp/PsFLydn0+ rFK7VKv2dQHm4EMJr/yKjSPhIx2bP4gP3DPWjvAizWForqa7xh4u6mb1u5nZ/CNshjKB E2b0kNYP3ortuhAWHsbv3liO94lIXDm875lHF1aZK/FOLYavmOeGwriUr6M/R09uLaJT iedQ== X-Forwarded-Encrypted: i=1; AJvYcCX3Slj1ijP9FI9wDEYHcpbewqeikq/yT0fb/tCpFGRcpslDZGsZ40krhKa85mYTBN55EA72C7lsPoOVuXs=@vger.kernel.org X-Gm-Message-State: AOJu0Yy28FJBwC+G0CLHUcSBdPcVv+aZaOErDQjSDgznqy24awBKT3fm bOZM6IDS8HRUsUM3tnXgDo0x5EtgdTBZeeu5RzJNLFWiXDV+54+dZ19jFlBifKeT0M1ACl6tWnW 0RhOjcQ== X-Google-Smtp-Source: AGHT+IGftgrWDxU9JRSkm0FiwGGoGvhG2Dx0NpSdcsxezbCl/FD/ZIEilFGQEh5s6/zxrFLBFLg9TgQMQQo= X-Received: from pjuu16.prod.google.com ([2002:a17:90b:5870:b0:34c:2f52:23aa]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:290:b0:2a1:e19:ff5 with SMTP id d9443c01a7336-2a2f273818fmr384080235ad.38.1767129237699; Tue, 30 Dec 2025 13:13:57 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:43 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-5-seanjc@google.com> Subject: [PATCH v2 4/8] KVM: SVM: Filter out 64-bit exit codes when invoking exit handlers on bare metal From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly filter out 64-bit exit codes when invoking exit handlers, as svm_exit_handlers[] will never be sized with entries that use bits 63:32. Processing the non-failing exit code as a 32-bit value will allow tracking exit_code as a single 64-bit value (which it is, architecturally). This will also allow hardening KVM against Spectre-like attacks without needing to do silly things to avoid build failures on 32-bit kernels (array_index_nospec() rightly asserts that the index fits in an "unsigned long"). Omit the check when running as a VM, as KVM has historically failed to set bits 63:32 appropriately when synthesizing VM-Exits, i.e. KVM could get false positives when running as a VM on an older, broken KVM/kernel. From a functional perspective, omitting the check is "fine", as any unwanted collision between e.g. VMEXIT_INVALID and a 32-bit exit code will be fatal to KVM-on-KVM regardless of what KVM-as-L1 does. Reviewed-by: Yosry Ahmed Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/svm.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e24bedf1fc81..1ffe922e95fd 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3443,8 +3443,22 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) sev_free_decrypted_vmsa(vcpu, save); } =20 -int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 exit_code) +int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u64 __exit_code) { + u32 exit_code =3D __exit_code; + + /* + * SVM uses negative values, i.e. 64-bit values, to indicate that VMRUN + * failed. Report all such errors to userspace (note, VMEXIT_INVALID, + * a.k.a. SVM_EXIT_ERR, is special cased by svm_handle_exit()). Skip + * the check when running as a VM, as KVM has historically left garbage + * in bits 63:32, i.e. running KVM-on-KVM would hit false positives if + * the underlying kernel is buggy. + */ + if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR) && + (u64)exit_code !=3D __exit_code) + goto unexpected_vmexit; + #ifdef CONFIG_MITIGATION_RETPOLINE if (exit_code =3D=3D SVM_EXIT_MSR) return msr_interception(vcpu); @@ -3471,7 +3485,7 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u6= 4 exit_code) =20 unexpected_vmexit: dump_vmcb(vcpu); - kvm_prepare_unexpected_reason_exit(vcpu, exit_code); + kvm_prepare_unexpected_reason_exit(vcpu, __exit_code); return 0; } =20 --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC9E4309DCB for ; Tue, 30 Dec 2025 21:13:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129242; cv=none; b=mMpK1HavFhSGLqT/SLXkT4/rFRcor8+phIjeMjcr+VGYfkE0HdqTEApEsZ/E01YiCZm9n1/x5dM4RQNqDpJUCaxxeUTtqhl6Ksz8xbdSklw+oNO+MVVkDGPuPM2IXkKH7ZWvFVkrWXvY6AwpFSiEJkWkJ51yYqdlWWEBO11xy3Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129242; c=relaxed/simple; bh=8TmN0PWe8ohV9nbZbHJejmzkyoOsTm+s7dO+BfhPtXk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=VYqtSTj4HMpBDBjnaFwMWCsIIw1HLWc8NDXo3XvJKeb6BPt1k+3FEG5aaQF0wlxg2wvuUN9FvV9xw1dj6QZheTmp8rJR4a0zkGXqsCqBCceWjksM9afPLb6uPifcE9EcVvEehpQY+kdH21q8XmRJeL1kfs1jKfRqkbsclhkLgl8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=zSHFMexY; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="zSHFMexY" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-29f27176aa7so217339535ad.2 for ; Tue, 30 Dec 2025 13:13:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129239; x=1767734039; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=5kQ5hAcfjM87Fbx1sd+jH91MEAookXDSOy2lMTsQB+M=; b=zSHFMexYY4wGoM91erqqvYnFG3iDz2TsRFQs/ygl6O/6+zTL9npkYAVV2bTzygd1lM b0omUPDpw5w82OGt8SA71NTIcE3tGMftqJS6LTkmPyQhAyfegC3Hk9Y2D3AH0uyW7S9f z9PqhmPzILeoJMDeXYx/8tVxj76DcKzoXGDyaQZITo/bXS+cRLMuK3iDKIbHIdKGTf3D wQ8A1/kInwrCnb06aypw1FEU50AdVgGLjsdfQGAhqjE5lATL5N/Zowg4HUH3zdUAmpDj fx2uh7s5ZF9EnKm0QSE7hbX7ynmL+9wyYctfXueNJyvaWORs+C1ZTo/Zc2DgN4YdxS7F 6+ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129239; x=1767734039; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=5kQ5hAcfjM87Fbx1sd+jH91MEAookXDSOy2lMTsQB+M=; b=RTk05U3DqPb/He1/ezufMcFAaDvUhvGboqS9RvmGajWR6OFdVmugzpIkbLmgT0BIB9 GrNzG8y7EM3pffmZaOqdBLuCS/e38eCrgX5d+BoKH3r0gZhr2ty2vtk4DsPDLNOf1UJu hmOacXEsKAi58V2uUr3ic65ORQjmEVYu44+WU28LeVlJigYuB/bvtJMJ6mfwtyGx8xJV tb2IG4k8Y0LK5J2siKFf2ltJ3KyJ7KvglK7HgfGM9kzLcPM/ePEuIJaQS8+TycW525YF Lr50tNVBj0v7exf3EusfohDYNKiFr4/oXXxPPW/zWwUzL9hb50oY9D9b4iLGR28BvMxV Tb+w== X-Forwarded-Encrypted: i=1; AJvYcCUJwLf1pmXp57oyWLnJLyLQ/pmUGHFhcplKEV9SYHlrL2Cy+Xnhpwi4uYLyOuPJxzDxS9rR7eLXWAvmKOg=@vger.kernel.org X-Gm-Message-State: AOJu0YwJWeTgjAWNzKLGzahLop47NL5zZaGbiQEm5+7DpCR99OcXqDuQ KL9VYtxNFSEJK5nQ/ef/GuO3SdQiQKaTopv/Z28jHYQuSOLQqPQZlgjL8a3lf1qtnl2G2SmJHZe Mp0hMtg== X-Google-Smtp-Source: AGHT+IGRV274txoTmoxjKEE4Iu7eS2qXdG3uw7/oWM8uZwJYF93epc+37YfAfM8uTfVdJJhUUnhVmURCIUs= X-Received: from plas17.prod.google.com ([2002:a17:903:2011:b0:29f:e787:2b9c]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f603:b0:298:344:1229 with SMTP id d9443c01a7336-2a2f2a400ccmr337700355ad.55.1767129239205; Tue, 30 Dec 2025 13:13:59 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:44 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-6-seanjc@google.com> Subject: [PATCH v2 5/8] KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix KVM's long-standing buggy handling of SVM's exit_code as a 32-bit value. Per the APM and Xen commit d1bd157fbc ("Big merge the HVM full-virtualisation abstractions.") (which is arguably more trustworthy than KVM), offset 0x70 is a single 64-bit value: 070h 63:0 EXITCODE Track exit_code as a single u64 to prevent reintroducing bugs where KVM neglects to correctly set bits 63:32. Fixes: 6aa8b732ca01 ("[PATCH] kvm: userspace interface") Cc: Jim Mattson Cc: Yosry Ahmed Reviewed-by: Yosry Ahmed Signed-off-by: Sean Christopherson --- arch/x86/include/asm/svm.h | 3 +- arch/x86/include/uapi/asm/svm.h | 32 ++++++++--------- arch/x86/kvm/svm/hyperv.c | 1 - arch/x86/kvm/svm/nested.c | 13 ++----- arch/x86/kvm/svm/sev.c | 36 +++++++------------ arch/x86/kvm/svm/svm.c | 7 ++-- arch/x86/kvm/svm/svm.h | 4 +-- arch/x86/kvm/trace.h | 6 ++-- include/hyperv/hvgdk.h | 2 +- tools/testing/selftests/kvm/include/x86/svm.h | 3 +- .../kvm/x86/svm_nested_soft_inject_test.c | 4 +-- 11 files changed, 42 insertions(+), 69 deletions(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 56aa99503dc4..ba28ff531b60 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -136,8 +136,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u32 int_vector; u32 int_state; u8 reserved_3[4]; - u32 exit_code; - u32 exit_code_hi; + u64 exit_code; u64 exit_info_1; u64 exit_info_2; u32 exit_int_info; diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/sv= m.h index 650e3256ea7d..010a45c9f614 100644 --- a/arch/x86/include/uapi/asm/svm.h +++ b/arch/x86/include/uapi/asm/svm.h @@ -103,38 +103,38 @@ #define SVM_EXIT_VMGEXIT 0x403 =20 /* SEV-ES software-defined VMGEXIT events */ -#define SVM_VMGEXIT_MMIO_READ 0x80000001 -#define SVM_VMGEXIT_MMIO_WRITE 0x80000002 -#define SVM_VMGEXIT_NMI_COMPLETE 0x80000003 -#define SVM_VMGEXIT_AP_HLT_LOOP 0x80000004 -#define SVM_VMGEXIT_AP_JUMP_TABLE 0x80000005 +#define SVM_VMGEXIT_MMIO_READ 0x80000001ull +#define SVM_VMGEXIT_MMIO_WRITE 0x80000002ull +#define SVM_VMGEXIT_NMI_COMPLETE 0x80000003ull +#define SVM_VMGEXIT_AP_HLT_LOOP 0x80000004ull +#define SVM_VMGEXIT_AP_JUMP_TABLE 0x80000005ull #define SVM_VMGEXIT_SET_AP_JUMP_TABLE 0 #define SVM_VMGEXIT_GET_AP_JUMP_TABLE 1 -#define SVM_VMGEXIT_PSC 0x80000010 -#define SVM_VMGEXIT_GUEST_REQUEST 0x80000011 -#define SVM_VMGEXIT_EXT_GUEST_REQUEST 0x80000012 -#define SVM_VMGEXIT_AP_CREATION 0x80000013 +#define SVM_VMGEXIT_PSC 0x80000010ull +#define SVM_VMGEXIT_GUEST_REQUEST 0x80000011ull +#define SVM_VMGEXIT_EXT_GUEST_REQUEST 0x80000012ull +#define SVM_VMGEXIT_AP_CREATION 0x80000013ull #define SVM_VMGEXIT_AP_CREATE_ON_INIT 0 #define SVM_VMGEXIT_AP_CREATE 1 #define SVM_VMGEXIT_AP_DESTROY 2 -#define SVM_VMGEXIT_SNP_RUN_VMPL 0x80000018 -#define SVM_VMGEXIT_SAVIC 0x8000001a +#define SVM_VMGEXIT_SNP_RUN_VMPL 0x80000018ull +#define SVM_VMGEXIT_SAVIC 0x8000001aull #define SVM_VMGEXIT_SAVIC_REGISTER_GPA 0 #define SVM_VMGEXIT_SAVIC_UNREGISTER_GPA 1 #define SVM_VMGEXIT_SAVIC_SELF_GPA ~0ULL -#define SVM_VMGEXIT_HV_FEATURES 0x8000fffd -#define SVM_VMGEXIT_TERM_REQUEST 0x8000fffe +#define SVM_VMGEXIT_HV_FEATURES 0x8000fffdull +#define SVM_VMGEXIT_TERM_REQUEST 0x8000fffeull #define SVM_VMGEXIT_TERM_REASON(reason_set, reason_code) \ /* SW_EXITINFO1[3:0] */ \ (((((u64)reason_set) & 0xf)) | \ /* SW_EXITINFO1[11:4] */ \ ((((u64)reason_code) & 0xff) << 4)) -#define SVM_VMGEXIT_UNSUPPORTED_EVENT 0x8000ffff +#define SVM_VMGEXIT_UNSUPPORTED_EVENT 0x8000ffffull =20 /* Exit code reserved for hypervisor/software use */ -#define SVM_EXIT_SW 0xf0000000 +#define SVM_EXIT_SW 0xf0000000ull =20 -#define SVM_EXIT_ERR -1 +#define SVM_EXIT_ERR -1ull =20 #define SVM_EXIT_REASONS \ { SVM_EXIT_READ_CR0, "read_cr0" }, \ diff --git a/arch/x86/kvm/svm/hyperv.c b/arch/x86/kvm/svm/hyperv.c index 088f6429b24c..3ec580d687f5 100644 --- a/arch/x86/kvm/svm/hyperv.c +++ b/arch/x86/kvm/svm/hyperv.c @@ -11,7 +11,6 @@ void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct= kvm_vcpu *vcpu) struct vcpu_svm *svm =3D to_svm(vcpu); =20 svm->vmcb->control.exit_code =3D HV_SVM_EXITCODE_ENL; - svm->vmcb->control.exit_code_hi =3D 0; svm->vmcb->control.exit_info_1 =3D HV_SVM_ENL_EXITCODE_TRAP_AFTER_FLUSH; svm->vmcb->control.exit_info_2 =3D 0; nested_svm_vmexit(svm); diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f5bde972a2b1..18b656508de9 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -45,7 +45,6 @@ static void nested_svm_inject_npf_exit(struct kvm_vcpu *v= cpu, * correctly fill in the high bits of exit_info_1. */ vmcb->control.exit_code =3D SVM_EXIT_NPF; - vmcb->control.exit_code_hi =3D 0; vmcb->control.exit_info_1 =3D (1ULL << 32); vmcb->control.exit_info_2 =3D fault->address; } @@ -421,7 +420,6 @@ void __nested_copy_vmcb_control_to_cache(struct kvm_vcp= u *vcpu, to->int_vector =3D from->int_vector; to->int_state =3D from->int_state; to->exit_code =3D from->exit_code; - to->exit_code_hi =3D from->exit_code_hi; to->exit_info_1 =3D from->exit_info_1; to->exit_info_2 =3D from->exit_info_2; to->exit_int_info =3D from->exit_int_info; @@ -727,8 +725,8 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm, enter_guest_mode(vcpu); =20 /* - * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2, - * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes. + * Filled at exit: exit_code, exit_info_1, exit_info_2, exit_int_info, + * exit_int_info_err, next_rip, insn_len, insn_bytes. */ =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_VGIF) && @@ -985,7 +983,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) if (!nested_vmcb_check_save(vcpu) || !nested_vmcb_check_controls(vcpu)) { vmcb12->control.exit_code =3D SVM_EXIT_ERR; - vmcb12->control.exit_code_hi =3D -1u; vmcb12->control.exit_info_1 =3D 0; vmcb12->control.exit_info_2 =3D 0; goto out; @@ -1018,7 +1015,6 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) svm->soft_int_injected =3D false; =20 svm->vmcb->control.exit_code =3D SVM_EXIT_ERR; - svm->vmcb->control.exit_code_hi =3D -1u; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; =20 @@ -1130,7 +1126,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm) =20 vmcb12->control.int_state =3D vmcb02->control.int_state; vmcb12->control.exit_code =3D vmcb02->control.exit_code; - vmcb12->control.exit_code_hi =3D vmcb02->control.exit_code_hi; vmcb12->control.exit_info_1 =3D vmcb02->control.exit_info_1; vmcb12->control.exit_info_2 =3D vmcb02->control.exit_info_2; =20 @@ -1422,7 +1417,7 @@ static int nested_svm_intercept_ioio(struct vcpu_svm = *svm) =20 static int nested_svm_intercept(struct vcpu_svm *svm) { - u32 exit_code =3D svm->vmcb->control.exit_code; + u64 exit_code =3D svm->vmcb->control.exit_code; int vmexit =3D NESTED_EXIT_HOST; =20 if (svm_is_vmrun_failure(exit_code)) @@ -1494,7 +1489,6 @@ static void nested_svm_inject_exception_vmexit(struct= kvm_vcpu *vcpu) struct vmcb *vmcb =3D svm->vmcb; =20 vmcb->control.exit_code =3D SVM_EXIT_EXCP_BASE + ex->vector; - vmcb->control.exit_code_hi =3D 0; =20 if (ex->has_error_code) vmcb->control.exit_info_1 =3D ex->error_code; @@ -1669,7 +1663,6 @@ static void nested_copy_vmcb_cache_to_control(struct = vmcb_control_area *dst, dst->int_vector =3D from->int_vector; dst->int_state =3D from->int_state; dst->exit_code =3D from->exit_code; - dst->exit_code_hi =3D from->exit_code_hi; dst->exit_info_1 =3D from->exit_info_1; dst->exit_info_2 =3D from->exit_info_2; dst->exit_int_info =3D from->exit_int_info; diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index f59c65abe3cf..794640bebb62 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -3275,11 +3275,6 @@ void sev_free_vcpu(struct kvm_vcpu *vcpu) kvfree(svm->sev_es.ghcb_sa); } =20 -static u64 kvm_get_cached_sw_exit_code(struct vmcb_control_area *control) -{ - return (((u64)control->exit_code_hi) << 32) | control->exit_code; -} - static void dump_ghcb(struct vcpu_svm *svm) { struct vmcb_control_area *control =3D &svm->vmcb->control; @@ -3301,7 +3296,7 @@ static void dump_ghcb(struct vcpu_svm *svm) */ pr_err("GHCB (GPA=3D%016llx) snapshot:\n", svm->vmcb->control.ghcb_gpa); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_code", - kvm_get_cached_sw_exit_code(control), kvm_ghcb_sw_exit_code_is_val= id(svm)); + control->exit_code, kvm_ghcb_sw_exit_code_is_valid(svm)); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_info_1", control->exit_info_1, kvm_ghcb_sw_exit_info_1_is_valid(svm)); pr_err("%-20s%016llx is_valid: %u\n", "sw_exit_info_2", @@ -3335,7 +3330,6 @@ static void sev_es_sync_from_ghcb(struct vcpu_svm *sv= m) struct vmcb_control_area *control =3D &svm->vmcb->control; struct kvm_vcpu *vcpu =3D &svm->vcpu; struct ghcb *ghcb =3D svm->sev_es.ghcb; - u64 exit_code; =20 /* * The GHCB protocol so far allows for the following data @@ -3369,9 +3363,7 @@ static void sev_es_sync_from_ghcb(struct vcpu_svm *sv= m) __kvm_emulate_msr_write(vcpu, MSR_IA32_XSS, kvm_ghcb_get_xss(svm)); =20 /* Copy the GHCB exit information into the VMCB fields */ - exit_code =3D kvm_ghcb_get_sw_exit_code(svm); - control->exit_code =3D lower_32_bits(exit_code); - control->exit_code_hi =3D upper_32_bits(exit_code); + control->exit_code =3D kvm_ghcb_get_sw_exit_code(svm); control->exit_info_1 =3D kvm_ghcb_get_sw_exit_info_1(svm); control->exit_info_2 =3D kvm_ghcb_get_sw_exit_info_2(svm); svm->sev_es.sw_scratch =3D kvm_ghcb_get_sw_scratch_if_valid(svm); @@ -3384,15 +3376,8 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *= svm) { struct vmcb_control_area *control =3D &svm->vmcb->control; struct kvm_vcpu *vcpu =3D &svm->vcpu; - u64 exit_code; u64 reason; =20 - /* - * Retrieve the exit code now even though it may not be marked valid - * as it could help with debugging. - */ - exit_code =3D kvm_get_cached_sw_exit_code(control); - /* Only GHCB Usage code 0 is supported */ if (svm->sev_es.ghcb->ghcb_usage) { reason =3D GHCB_ERR_INVALID_USAGE; @@ -3406,7 +3391,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *s= vm) !kvm_ghcb_sw_exit_info_2_is_valid(svm)) goto vmgexit_err; =20 - switch (exit_code) { + switch (control->exit_code) { case SVM_EXIT_READ_DR7: break; case SVM_EXIT_WRITE_DR7: @@ -3507,15 +3492,19 @@ static int sev_es_validate_vmgexit(struct vcpu_svm = *svm) return 0; =20 vmgexit_err: + /* + * Print the exit code even though it may not be marked valid as it + * could help with debugging. + */ if (reason =3D=3D GHCB_ERR_INVALID_USAGE) { vcpu_unimpl(vcpu, "vmgexit: ghcb usage %#x is not valid\n", svm->sev_es.ghcb->ghcb_usage); } else if (reason =3D=3D GHCB_ERR_INVALID_EVENT) { vcpu_unimpl(vcpu, "vmgexit: exit code %#llx is not valid\n", - exit_code); + control->exit_code); } else { vcpu_unimpl(vcpu, "vmgexit: exit code %#llx input is not valid\n", - exit_code); + control->exit_code); dump_ghcb(svm); } =20 @@ -4354,7 +4343,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); struct vmcb_control_area *control =3D &svm->vmcb->control; - u64 ghcb_gpa, exit_code; + u64 ghcb_gpa; int ret; =20 /* Validate the GHCB */ @@ -4396,8 +4385,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) =20 svm_vmgexit_success(svm, 0); =20 - exit_code =3D kvm_get_cached_sw_exit_code(control); - switch (exit_code) { + switch (control->exit_code) { case SVM_VMGEXIT_MMIO_READ: ret =3D setup_vmgexit_scratch(svm, true, control->exit_info_2); if (ret) @@ -4489,7 +4477,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) ret =3D -EINVAL; break; default: - ret =3D svm_invoke_exit_handler(vcpu, exit_code); + ret =3D svm_invoke_exit_handler(vcpu, control->exit_code); } =20 return ret; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 1ffe922e95fd..b97e6763839b 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2443,7 +2443,6 @@ static bool check_selective_cr0_intercepted(struct kv= m_vcpu *vcpu, =20 if (cr0 ^ val) { svm->vmcb->control.exit_code =3D SVM_EXIT_CR0_SEL_WRITE; - svm->vmcb->control.exit_code_hi =3D 0; ret =3D (nested_svm_exit_handled(svm) =3D=3D NESTED_EXIT_DONE); } =20 @@ -3275,7 +3274,7 @@ static void dump_vmcb(struct kvm_vcpu *vcpu) pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl); pr_err("%-20s%08x\n", "int_vector:", control->int_vector); pr_err("%-20s%08x\n", "int_state:", control->int_state); - pr_err("%-20s%08x\n", "exit_code:", control->exit_code); + pr_err("%-20s%016llx\n", "exit_code:", control->exit_code); pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1); pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2); pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info); @@ -3525,7 +3524,6 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) { struct vcpu_svm *svm =3D to_svm(vcpu); struct kvm_run *kvm_run =3D vcpu->run; - u32 exit_code =3D svm->vmcb->control.exit_code; =20 /* SEV-ES guests must use the CR write traps to track CR registers. */ if (!sev_es_guest(vcpu->kvm)) { @@ -3561,7 +3559,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) if (exit_fastpath !=3D EXIT_FASTPATH_NONE) return 1; =20 - return svm_invoke_exit_handler(vcpu, exit_code); + return svm_invoke_exit_handler(vcpu, svm->vmcb->control.exit_code); } =20 static int pre_svm_run(struct kvm_vcpu *vcpu) @@ -4627,7 +4625,6 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, if (static_cpu_has(X86_FEATURE_NRIPS)) vmcb->control.next_rip =3D info->next_rip; vmcb->control.exit_code =3D icpt_info.exit_code; - vmcb->control.exit_code_hi =3D 0; vmexit =3D nested_svm_exit_handled(svm); =20 ret =3D (vmexit =3D=3D NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 0f006793f973..105f1394026e 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -159,8 +159,7 @@ struct vmcb_ctrl_area_cached { u32 int_ctl; u32 int_vector; u32 int_state; - u32 exit_code; - u32 exit_code_hi; + u64 exit_code; u64 exit_info_1; u64 exit_info_2; u32 exit_int_info; @@ -767,7 +766,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm); static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_= code) { svm->vmcb->control.exit_code =3D exit_code; - svm->vmcb->control.exit_code_hi =3D 0; svm->vmcb->control.exit_info_1 =3D 0; svm->vmcb->control.exit_info_2 =3D 0; return nested_svm_vmexit(svm); diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h index e79bc9cb7162..e7fdbe9efc90 100644 --- a/arch/x86/kvm/trace.h +++ b/arch/x86/kvm/trace.h @@ -383,10 +383,10 @@ TRACE_EVENT(kvm_apic, #define kvm_print_exit_reason(exit_reason, isa) \ (isa =3D=3D KVM_ISA_VMX) ? \ __print_symbolic(exit_reason & 0xffff, VMX_EXIT_REASONS) : \ - __print_symbolic(exit_reason, SVM_EXIT_REASONS), \ + __print_symbolic_u64(exit_reason, SVM_EXIT_REASONS), \ (isa =3D=3D KVM_ISA_VMX && exit_reason & ~0xffff) ? " " : "", \ (isa =3D=3D KVM_ISA_VMX) ? \ - __print_flags(exit_reason & ~0xffff, " ", VMX_EXIT_REASON_FLAGS) : "" + __print_flags_u64(exit_reason & ~0xffff, " ", VMX_EXIT_REASON_FLAGS) : "" =20 #define TRACE_EVENT_KVM_EXIT(name) \ TRACE_EVENT(name, \ @@ -781,7 +781,7 @@ TRACE_EVENT_KVM_EXIT(kvm_nested_vmexit); * Tracepoint for #VMEXIT reinjected to the guest */ TRACE_EVENT(kvm_nested_vmexit_inject, - TP_PROTO(__u32 exit_code, + TP_PROTO(__u64 exit_code, __u64 exit_info1, __u64 exit_info2, __u32 exit_int_info, __u32 exit_int_info_err, __u32 isa), TP_ARGS(exit_code, exit_info1, exit_info2, diff --git a/include/hyperv/hvgdk.h b/include/hyperv/hvgdk.h index dd6d4939ea29..384c3f3ff4a5 100644 --- a/include/hyperv/hvgdk.h +++ b/include/hyperv/hvgdk.h @@ -281,7 +281,7 @@ struct hv_vmcb_enlightenments { #define HV_VMCB_NESTED_ENLIGHTENMENTS 31 =20 /* Synthetic VM-Exit */ -#define HV_SVM_EXITCODE_ENL 0xf0000000 +#define HV_SVM_EXITCODE_ENL 0xf0000000ull #define HV_SVM_ENL_EXITCODE_TRAP_AFTER_FLUSH (1) =20 /* VM_PARTITION_ASSIST_PAGE */ diff --git a/tools/testing/selftests/kvm/include/x86/svm.h b/tools/testing/= selftests/kvm/include/x86/svm.h index 29cffd0a9181..10b30b38bb3f 100644 --- a/tools/testing/selftests/kvm/include/x86/svm.h +++ b/tools/testing/selftests/kvm/include/x86/svm.h @@ -92,8 +92,7 @@ struct __attribute__ ((__packed__)) vmcb_control_area { u32 int_vector; u32 int_state; u8 reserved_3[4]; - u32 exit_code; - u32 exit_code_hi; + u64 exit_code; u64 exit_info_1; u64 exit_info_2; u32 exit_int_info; diff --git a/tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c = b/tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c index 7b6481d6c0d3..4bd1655f9e6d 100644 --- a/tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c +++ b/tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c @@ -103,7 +103,7 @@ static void l1_guest_code(struct svm_test_data *svm, ui= nt64_t is_nmi, uint64_t i =20 run_guest(vmcb, svm->vmcb_gpa); __GUEST_ASSERT(vmcb->control.exit_code =3D=3D SVM_EXIT_VMMCALL, - "Expected VMMCAL #VMEXIT, got '0x%x', info1 =3D '0x%lx, info2 =3D= '0x%lx'", + "Expected VMMCAL #VMEXIT, got '0x%lx', info1 =3D '0x%lx, info2 = =3D '0x%lx'", vmcb->control.exit_code, vmcb->control.exit_info_1, vmcb->control.exit_info_2); =20 @@ -133,7 +133,7 @@ static void l1_guest_code(struct svm_test_data *svm, ui= nt64_t is_nmi, uint64_t i =20 run_guest(vmcb, svm->vmcb_gpa); __GUEST_ASSERT(vmcb->control.exit_code =3D=3D SVM_EXIT_HLT, - "Expected HLT #VMEXIT, got '0x%x', info1 =3D '0x%lx, info2 =3D '0= x%lx'", + "Expected HLT #VMEXIT, got '0x%lx', info1 =3D '0x%lx, info2 =3D '= 0x%lx'", vmcb->control.exit_code, vmcb->control.exit_info_1, vmcb->control.exit_info_2); =20 --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D21B830F948 for ; Tue, 30 Dec 2025 21:14:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129243; cv=none; b=o8yo3y4ORzX7VLQ3dct9YWyOgn0bubE1vLjzjz+b901v8wIlOqlT1Z9uYdqwTMqIwqZWFDbfzRxLDT4tc19PvRp26Ypigplm3cEVe7/uRD9glHCLfAXOIME4Pi0pSQ7ypwNMy+5FEZ1PhP9gwJ54/m7QXWnpRSIXw/0X/TGNumA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129243; c=relaxed/simple; bh=tZZOSec6/iCpiyzfAUT+ddNkhTixOC1p46bySbF1Lsk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=AtDiYfg7DK8wlPyoj2wEfCh9/bUaApcWf+lZvYGPfXzfL82EzNdd3aYHlhV0cBb+v+pQwxmQpwUWTCo6CAw9yU1FREV85vIW477J6NG+i6J5PifS2Vfar+WkEoD/03PP6byXW+IaxfVdDgKo2vKCSx8BLvc1AYt9JSG3wQQQyjY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RTLKa4iJ; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RTLKa4iJ" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-7f89d880668so14905824b3a.2 for ; Tue, 30 Dec 2025 13:14:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129241; x=1767734041; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=1VNAutqDSG+oAcPpulLkMbiDreEONHN5ynm2RRYnZD4=; b=RTLKa4iJxEMv0kdR7Ci+DS7Nhisl5cJKuff7pbFxhVp7jOx2HdQ6xE4XOAapvXnFPg 8KhAHFyw8CqW84ukJPUbEOmXcgwHU+g3JDpuze6lXIlPGUySdHsyxTnB2kEw4OLW/Bla Tn+iLc25UgTDRW1nKZ08N+Ks261MSEed73sFPoZ/O8d9W2zXtcg2k4mcYvZTcd/3Aaht tPT/+x7ZF/WJOeWTEpxLopFFJyzwq+WRXvGTAgWuLN3TiTUkLaqWgzxliqYhS1k86J/k nIPtZOBiooVjd5XYitgZigwgia/XgIQ5w4JN8Z4IlMqWnWDtF2Q+gFi+Ett3JyzpOLT6 iVoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129241; x=1767734041; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=1VNAutqDSG+oAcPpulLkMbiDreEONHN5ynm2RRYnZD4=; b=PY8qgS6MJvshftOIlOVjBiW2eOcOlyCHCMVj6mbtyaLyrx8E4W1MJW8di0E6SRjV6U bQZ+e7+jUaj8LlmfWz2h/ckhrFle8nT1CSO/lz7XhY+N2c+ls1SvyGua+zmcdvpIW3V6 jpdem2qdBQO9nd61OkclWu0Ox6nAB3uKxoHcWy/PAwgeiOThaOCCbBy/tlsI6zZqo5GP eEMwnxFmADXTY8v0G6JQVcEYFj1WvFfnvDasaQCIPufqce2uK9/2kWfMzRAgQkFEH+KF eBePYBSCg5YFFlAlMb6Fxy5EmkK3j/uxBvNCwh4A6KL3IXG+VGAAu6vtVYGjTIp1kBfH aiHw== X-Forwarded-Encrypted: i=1; AJvYcCUxapDK/OOomjgDqHqFxht3rv+AA6TKvvUvclTKDloxWOWr1xtPzd5ai/qoeMHWlDYatxMaHe+XvbrB/Lk=@vger.kernel.org X-Gm-Message-State: AOJu0Yxo2YUExeHFmSrkHOOIJX2p1X/83GdjHJRsM3ARRydavfwyOrfj U8/MtXPhserjlY3j26pjGMWubHRKR6iqM+80maoboFg8NcV5/WKwlrLiC2eh/qfXt04Xi0uy9hD Lxvaw8g== X-Google-Smtp-Source: AGHT+IH7+mef/Yt8vBYVv2MwxPLoJav7Z17cT1/FRzx/Cb02MsEGBMNYfWKFBUDmhPe7ZcDuK/w4obJ/XLg= X-Received: from pjwx15.prod.google.com ([2002:a17:90a:c2cf:b0:34c:64d5:2aa1]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:2591:b0:366:14af:9bbe with SMTP id adf61e73a8af0-376ab2e78f3mr34274847637.72.1767129240895; Tue, 30 Dec 2025 13:14:00 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:45 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-7-seanjc@google.com> Subject: [PATCH v2 6/8] KVM: SVM: Limit incorrect check on SVM_EXIT_ERR to running as a VM From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Limit KVM's incorrect check for VMXEXIT_INVALID, a.k.a. SVM_EXIT_ERR, to running as a VM, as detected by X86_FEATURE_HYPERVISOR. The exit_code and all failure codes, e.g. VMXEXIT_INVALID, are 64-bit values, and so checking only bits 31:0 could result in false positives when running on non-broken hardware, e.g. in the extremely unlikely scenario exit code 0xffffffffull is ever generated by hardware. Keep the 32-bit check to play nice with running on broken KVM (for years, KVM has not set bits 63:32 when synthesizing nested SVM VM-Exits). Reviewed-by: Yosry Ahmed Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/svm.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 105f1394026e..f938679c0231 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -425,7 +425,10 @@ static __always_inline struct vcpu_svm *to_svm(struct = kvm_vcpu *vcpu) =20 static inline bool svm_is_vmrun_failure(u64 exit_code) { - return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; + if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) + return (u32)exit_code =3D=3D (u32)SVM_EXIT_ERR; + + return exit_code =3D=3D SVM_EXIT_ERR; } =20 /* --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pj1-f73.google.com (mail-pj1-f73.google.com [209.85.216.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D513322B84 for ; Tue, 30 Dec 2025 21:14:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129244; cv=none; b=tppryw8pFSd/senuIcfpdZzNBZyTfOxbZiGkoP05OVf1sUJddr0mq/MoCgQmNvFfFmGUGblfsRnfQVyNLSFdk1SyDEu/BuE/l6X99V3YTAw2Q1M67Nk5tl6QrXk7LOIQQLFR6DMAHDn0h8VshdwaCaWp2QUo6OuYU0T8QzlZKw8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129244; c=relaxed/simple; bh=EoxLt9CGajQHyT0DJbDfFAocT+/8S1HWJ5svkZDig3c=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=elSIOSUrQiT+EzMTb/et+o9lD3/F9ByFY8KKHCo1LZpmZ7vvLVP1jmRsi7WNXO2plkhamYjcEw7t6+y++4dfDqbanFt0bNro5thkmstUdxBsjXlRypQZoBaYLdo7hJ+tYYW7Jjln7RJztoO/Ulzp4wdTca8PUiCCiKKKqUMj7rA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=os5/JEm2; arc=none smtp.client-ip=209.85.216.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="os5/JEm2" Received: by mail-pj1-f73.google.com with SMTP id 98e67ed59e1d1-34cc88eca7eso18607823a91.2 for ; Tue, 30 Dec 2025 13:14:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129242; x=1767734042; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=2l8e4mfqS4ac0ofFyg/wkIl0NnSi9zztS3YUrfbABw0=; b=os5/JEm2Ul6c6d87T7xL5TwPVMfUfOnhhZbuxICN8a7SyAi5zKvMLFi1QeWhbIMDI+ p63GLOcB5vhyOqQa1FEbsmQWbtseDJMrf5Ws1efl0pzOVbAoG/TPKE95/Dvxgw0+AwZb iw+aCBxa8s5Lg/pglHvOQksKZfdgzPMAzu7tmOqUU+dryF8JZPEP0Z29zVDXbQJRzQaN cE0k7c9+uiv3FDszjLozErFt6m1OgyK2w8W/tok7dASOybaBFPdTR1QoO7804Oxv7/QD tjOYEtJsahAGJTsUNirKFfsUYQkDY9kL5wCKw+EKGoSE6OngI6f+FbcVLxkeUzB4yGw+ sxZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129242; x=1767734042; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=2l8e4mfqS4ac0ofFyg/wkIl0NnSi9zztS3YUrfbABw0=; b=rTZs5KarjTs4ZGbOLPlNmPtuwQBXp13zrdYTh6yh3u4vStoR14NwG34qvnrJ7M91eg eKhO0zg73Q/sBpEK7PuDsc6QuTB4OsjsGPEC3O0gukv6hbcpNqSeIVE6zItgPbfaK7Rv 4Lf+IAn0PYqfq2AVYN1mNnYUo6Gqs5Pik+g5Onm4ZjdoEJxsU32FnJ8kYNMrd2OsIugy PKndehzBDP7wCFBqCJ95nEYrXK2latmrI4/FiXS7AGcrmqP2duC+uxlpSdQJuDC2Kdh/ B6re4OqpY1zWODtUjinuBgEhijYJhpVH9Ko04ozIzs0QScv4t2SwG7SLDojow/QU0IrQ 3Sdw== X-Forwarded-Encrypted: i=1; AJvYcCXMHdPphEMluNwP4dg+ji9ktvsv8T0B0j2yWQc9HdTECc6Ee5nW7A2Xvxxr2beT4FUQ6m5r5bO0GKJ05pw=@vger.kernel.org X-Gm-Message-State: AOJu0YwYlijIc64c33TcXUX4e5mn4aGsKQColT7nE+bqGR7wQVlyVeAb HeAUPjMyaAWgjywRqcGmk8ipfODyStZ7XYKHCmxrfcEKGFYRpHdD+LdWY6EYYt4/2zBTr/dI549 3E3hnEw== X-Google-Smtp-Source: AGHT+IEsJzuAlVbFq5IPl1q5CmU3amILxSyhNqXHiYg4ksn/VgJLbcnzFFETfo0s8qcklc5ptFrdojqRGHw= X-Received: from pjbot5.prod.google.com ([2002:a17:90b:3b45:b0:34a:a5cf:dcfd]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:514b:b0:341:a9e7:e5f9 with SMTP id 98e67ed59e1d1-34e91f6759emr24551317a91.0.1767129242518; Tue, 30 Dec 2025 13:14:02 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:46 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-8-seanjc@google.com> Subject: [PATCH v2 7/8] KVM: SVM: Harden exit_code against being used in Spectre-like attacks From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explicitly clamp the exit code used to index KVM's exit handlers to guard against Spectre-like attacks, mainly to provide consistency between VMX and SVM (VMX was given the same treatment by commit c926f2f7230b ("KVM: x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks"). For normal VMs, it's _extremely_ unlikely the exit code could be used to exploit a speculation vulnerability, as the exit code is set by hardware and unexpected/unknown exit codes should be quite well bounded (as is/was the case with VMX). But with SEV-ES+, the exit code is guest-controlled as it comes from the GHCB, not from hardware, i.e. an attack from the guest is at least somewhat plausible. Irrespective of SEV-ES+, hardening KVM is easy and inexpensive, and such an attack is theoretically possible. Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/svm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index b97e6763839b..a75cd832e194 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3477,6 +3477,7 @@ int svm_invoke_exit_handler(struct kvm_vcpu *vcpu, u6= 4 __exit_code) if (exit_code >=3D ARRAY_SIZE(svm_exit_handlers)) goto unexpected_vmexit; =20 + exit_code =3D array_index_nospec(exit_code, ARRAY_SIZE(svm_exit_handlers)= ); if (!svm_exit_handlers[exit_code]) goto unexpected_vmexit; =20 --=20 2.52.0.351.gbe84eed79e-goog From nobody Sat Feb 7 12:19:22 2026 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2605A32C31A for ; Tue, 30 Dec 2025 21:14:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129246; cv=none; b=fov0GCCbL88ud+ldYIvInssHYlxwHjqDyEOfHvU9ucjz0cVeywRWytdeccoyWXrkUtzo0I6nay0YnoeHxnDe92Epnpuz4hcU04TIp42oxLykqECLISfbj/cYE5vLHSBUVZOUWnAxzNNGZsba9Fz3tjPiD0XuiaMjzJ19y5vu9Es= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767129246; c=relaxed/simple; bh=HJ4XqLT0jDF3jn5B2II3Oe/iMA/CkcZuvDCcogN2UCI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fVz0QP/plRoHf3cLX+B0H4oDykGZiVyXfK1ifMzZqHLq38OR65tOZ2VzaDQ59yKJ4ijkTUudBj/F9qacU22MzH/H98ZmsQHaCOZK6JiGHrzflBUgI6uOG2zu9R6C7KRw5J5B69gvajAMrczVBqxHZ1pbuvxltoK90llb6V6tWzQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nuzBUEO/; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nuzBUEO/" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-2a0bae9acd4so94573205ad.3 for ; Tue, 30 Dec 2025 13:14:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767129244; x=1767734044; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=XsseyC8LpXkejrQLUQtTZ6AiUdHm1+Ya+dND1b51e8M=; b=nuzBUEO/r7GNfZDfupqYZ1tqabW2Q3sRxZHV2hwQSt0HkBg027pqwpUWuC+OXkgA+3 xbwKr2l8MOEWq6OFQomB62a9cfsP1uTdOKUBs74wErRnXvD7xpX5/BHprBzNIqOQoYc/ LQT4f0h8lm0ajXgkESKJDCCqrX76GX7Xm7jiLpWJMfG9HrpUtEIAvnIikZJcNvOTc2xQ 1BiSK6rjohIo7a6WT4/yH3LunjfMSU6EH1jAXRgavOrPkZDPFXWb0u/yR0E3gskAWkMh TrKNzoXFhYYzfuctk5w1JsxTsTwvI/KHs/XmADj69kugbnTirVC7xwSWVoarpSyCdoT6 w46A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767129244; x=1767734044; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=XsseyC8LpXkejrQLUQtTZ6AiUdHm1+Ya+dND1b51e8M=; b=gusNSYH/iJybDztOwMoKp9czpaD5XbyXdu9GuVI08Sldxp0S0gXRRxXyjWw6RMWpKn /NIZONRgDVq39LFj92bC5ZFZv9sO5jwCymSC8oGEXy20OXn0hAM8wXbwy0vH0I+YruJC cxUZVIU7oGoNqTQzudt/35H9b07kjtrxAUFHo9AsQ7XygVFi3V9ugWlAlqIrZdItBH75 kawWoRHPbLoeR6ypfM2sNaU7rrWeTCsbDwBWihFbIS23DKdBygJGKZ3oP4UPaWcX0LuU wH0ZimVEABtpmeMCge236en2CZ1IFKfTJqFBWTyCTl8KWU2md6JIdq75XKkENyZEVvyk ts4w== X-Forwarded-Encrypted: i=1; AJvYcCWzCpiicd7wM+4jNdoUYks1VrP9OdE0510ByokHBa/PY/VCQbl7OM9xTdfDg20+5KwJ/dqySg17/Tx4kZ8=@vger.kernel.org X-Gm-Message-State: AOJu0Yzj2zLazkkXvSS6JEgkeNxi+Wu17EZM2hqDqJilDji8Lj1u0oFm iKAEoh1YiYnBAYNCLe6L3tSjRhTek4myg/I3uYZof0/5Qul/MaYFlP7oOHL+kkzof37Az9XhQeg aW3yoJA== X-Google-Smtp-Source: AGHT+IE//Ytz9zMUfHCR02XePiAuIy+TlWHCW2xgVPHTiRzkpHTVtEE56Y8+nZktCmfwELz3dGzt6UzrllU= X-Received: from pjbnk22.prod.google.com ([2002:a17:90b:1956:b0:34c:4c6d:ad4f]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f708:b0:298:efa:511f with SMTP id d9443c01a7336-2a2f283680cmr312460165ad.39.1767129244235; Tue, 30 Dec 2025 13:14:04 -0800 (PST) Reply-To: Sean Christopherson Date: Tue, 30 Dec 2025 13:13:47 -0800 In-Reply-To: <20251230211347.4099600-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251230211347.4099600-1-seanjc@google.com> X-Mailer: git-send-email 2.52.0.351.gbe84eed79e-goog Message-ID: <20251230211347.4099600-9-seanjc@google.com> Subject: [PATCH v2 8/8] KVM: SVM: Assert that Hyper-V's HV_SVM_EXITCODE_ENL == SVM_EXIT_SW From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Vitaly Kuznetsov , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li Cc: kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Yosry Ahmed Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a build-time assertiont that Hyper-V's "enlightened" exit code is that, same as the AMD-defined "Reserved for Host" exit code, mostly to help readers connect the dots and understand why synthesizing a software-defined exit code is safe/ok. Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/hyperv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kvm/svm/hyperv.c b/arch/x86/kvm/svm/hyperv.c index 3ec580d687f5..4f24dcb45116 100644 --- a/arch/x86/kvm/svm/hyperv.c +++ b/arch/x86/kvm/svm/hyperv.c @@ -10,6 +10,12 @@ void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struc= t kvm_vcpu *vcpu) { struct vcpu_svm *svm =3D to_svm(vcpu); =20 + /* + * The exit code used by Hyper-V for software-defined exits is reserved + * by AMD specifically for such use cases. + */ + BUILD_BUG_ON(HV_SVM_EXITCODE_ENL !=3D SVM_EXIT_SW); + svm->vmcb->control.exit_code =3D HV_SVM_EXITCODE_ENL; svm->vmcb->control.exit_info_1 =3D HV_SVM_ENL_EXITCODE_TRAP_AFTER_FLUSH; svm->vmcb->control.exit_info_2 =3D 0; --=20 2.52.0.351.gbe84eed79e-goog