[PATCH] LoongArch: KVM: Add hypercall crash support

[PATCH] LoongArch: KVM: Add hypercall crash support

[Bibo Mao]

Now generic pvpanic is supported in Linux kernel which will notify VMM
with VM crash event. There is some limitations with pvpanic, such as it
requires good kernel stack or CPU hardware context and panic() C function
is in health state.

Sometimes CPU hardware context or kernel/irq stack is corrupted. Hypercall
code is more direct and low-level crash method, which is useful in
exception entry with assmble language, here add one hypercall code to
support VM crash function, so that VMM can capture CPU crash context
in time.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
---
 arch/loongarch/include/asm/kvm_host.h      |  1 +
 arch/loongarch/include/asm/kvm_para.h      | 15 +++++++++++++++
 arch/loongarch/include/uapi/asm/kvm.h      |  1 +
 arch/loongarch/include/uapi/asm/kvm_para.h |  1 +
 arch/loongarch/kvm/exit.c                  | 11 +++++++++++
 arch/loongarch/kvm/vm.c                    |  3 ++-
 6 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/arch/loongarch/include/asm/kvm_host.h b/arch/loongarch/include/asm/kvm_host.h
index 65d91c3ce313..96f9f1317cad 100644
--- a/arch/loongarch/include/asm/kvm_host.h
+++ b/arch/loongarch/include/asm/kvm_host.h
@@ -168,6 +168,7 @@ enum emulation_result {
 #define LOONGARCH_PV_FEAT_MASK		(BIT(KVM_FEATURE_IPI) |		\
 					 BIT(KVM_FEATURE_PREEMPT) |	\
 					 BIT(KVM_FEATURE_STEAL_TIME) |	\
+					 BIT(KVM_FEATURE_CRASH)	|	\
 					 BIT(KVM_FEATURE_USER_HCALL) |	\
 					 BIT(KVM_FEATURE_VIRT_EXTIOI))
 
diff --git a/arch/loongarch/include/asm/kvm_para.h b/arch/loongarch/include/asm/kvm_para.h
index fb17ba0fa101..3b183bb1aaa8 100644
--- a/arch/loongarch/include/asm/kvm_para.h
+++ b/arch/loongarch/include/asm/kvm_para.h
@@ -14,6 +14,7 @@
 #define KVM_HCALL_CODE_SERVICE		0
 #define KVM_HCALL_CODE_SWDBG		1
 #define KVM_HCALL_CODE_USER_SERVICE	2
+#define KVM_HCALL_CODE_CRASH		3
 
 #define KVM_HCALL_SERVICE		HYPERCALL_ENCODE(HYPERVISOR_KVM, KVM_HCALL_CODE_SERVICE)
 #define  KVM_HCALL_FUNC_IPI		1
@@ -22,6 +23,7 @@
 #define KVM_HCALL_SWDBG			HYPERCALL_ENCODE(HYPERVISOR_KVM, KVM_HCALL_CODE_SWDBG)
 
 #define KVM_HCALL_USER_SERVICE		HYPERCALL_ENCODE(HYPERVISOR_KVM, KVM_HCALL_CODE_USER_SERVICE)
+#define KVM_HCALL_CRASH			HYPERCALL_ENCODE(HYPERVISOR_KVM, KVM_HCALL_CODE_CRASH)
 
 /*
  * LoongArch hypercall return code
@@ -161,6 +163,19 @@ static __always_inline long kvm_hypercall5(u64 fid,
 	return ret;
 }
 
+static __always_inline long kvm_hypercall_crash(void)
+{
+	register long ret asm("a0");
+
+	__asm__ __volatile__(
+		"hvcl "__stringify(KVM_HCALL_CRASH)
+		: "=r" (ret)
+		: : "memory"
+		);
+
+	return ret;
+}
+
 #ifdef CONFIG_PARAVIRT
 bool kvm_para_available(void);
 unsigned int kvm_arch_para_features(void);
diff --git a/arch/loongarch/include/uapi/asm/kvm.h b/arch/loongarch/include/uapi/asm/kvm.h
index cd0b5c11ca9c..b222bfc48042 100644
--- a/arch/loongarch/include/uapi/asm/kvm.h
+++ b/arch/loongarch/include/uapi/asm/kvm.h
@@ -106,6 +106,7 @@ struct kvm_fpu {
 #define  KVM_LOONGARCH_VM_FEAT_PTW		8
 #define  KVM_LOONGARCH_VM_FEAT_MSGINT		9
 #define  KVM_LOONGARCH_VM_FEAT_PV_PREEMPT	10
+#define  KVM_LOONGARCH_VM_FEAT_CRASH		11
 
 /* Device Control API on vcpu fd */
 #define KVM_LOONGARCH_VCPU_CPUCFG	0
diff --git a/arch/loongarch/include/uapi/asm/kvm_para.h b/arch/loongarch/include/uapi/asm/kvm_para.h
index d28cbcadd276..bf1a0c826ca6 100644
--- a/arch/loongarch/include/uapi/asm/kvm_para.h
+++ b/arch/loongarch/include/uapi/asm/kvm_para.h
@@ -16,6 +16,7 @@
 #define  KVM_FEATURE_IPI		1
 #define  KVM_FEATURE_STEAL_TIME		2
 #define  KVM_FEATURE_PREEMPT		3
+#define  KVM_FEATURE_CRASH		4
 /* BIT 24 - 31 are features configurable by user space vmm */
 #define  KVM_FEATURE_VIRT_EXTIOI	24
 #define  KVM_FEATURE_USER_HCALL		25
diff --git a/arch/loongarch/kvm/exit.c b/arch/loongarch/kvm/exit.c
index 4f58e6e2cf86..3b6daa946c76 100644
--- a/arch/loongarch/kvm/exit.c
+++ b/arch/loongarch/kvm/exit.c
@@ -911,6 +911,17 @@ static int kvm_handle_hypercall(struct kvm_vcpu *vcpu, int ecode)
 		vcpu->run->hypercall.ret = KVM_HCALL_INVALID_CODE;
 		ret = RESUME_HOST;
 		break;
+	case KVM_HCALL_CRASH:
+		if (!kvm_guest_has_pv_feature(vcpu, KVM_FEATURE_CRASH)) {
+			kvm_write_reg(vcpu, LOONGARCH_GPR_A0, KVM_HCALL_INVALID_CODE);
+			break;
+		}
+
+		vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
+		vcpu->run->system_event.type = KVM_SYSTEM_EVENT_CRASH;
+		vcpu->run->system_event.ndata = 0;
+		ret = RESUME_HOST;
+		break;
 	case KVM_HCALL_SWDBG:
 		/* KVM_HCALL_SWDBG only in effective when SW_BP is enabled */
 		if (vcpu->guest_debug & KVM_GUESTDBG_SW_BP_MASK) {
diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
index 6dabb227a732..e5d10ceb5e67 100644
--- a/arch/loongarch/kvm/vm.c
+++ b/arch/loongarch/kvm/vm.c
@@ -49,8 +49,9 @@ static void kvm_vm_init_features(struct kvm *kvm)
 		kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PMU);
 
 	/* Enable all PV features by default */
-	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI);
+	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI) | BIT(KVM_FEATURE_CRASH);
 	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);
+	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_CRASH);
 	if (kvm_pvtime_supported()) {
 		kvm->arch.pv_features |= BIT(KVM_FEATURE_PREEMPT);
 		kvm->arch.pv_features |= BIT(KVM_FEATURE_STEAL_TIME);

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.39.3

Re: [PATCH] LoongArch: KVM: Add hypercall crash support

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The KVM_LOONGARCH_VM_FEAT_CRASH capability cannot be discovered by userspace due to a missing case in kvm_vm_feature_has_attr().
- [High] The KVM_FEATURE_CRASH capability is silently enabled by default, violating KVM cross-architecture rules and breaking live migration with older VMMs.
--

commit db8910e8d85912033e28dc04e11026a25b4bdbb8
Author: Bibo Mao <maobibo@loongson.cn>

LoongArch: KVM: Add hypercall crash support
    
This commit adds a generic pvpanic-like hypercall for LoongArch KVM to
notify the VMM about VM crashes. It provides a direct, low-level crash
method that is useful when the CPU hardware context or kernel stack is
corrupted.

> diff --git a/arch/loongarch/include/uapi/asm/kvm.h b/arch/loongarch/include/uapi/asm/kvm.h
> index cd0b5c11ca9c2..b222bfc480427 100644
> --- a/arch/loongarch/include/uapi/asm/kvm.h
> +++ b/arch/loongarch/include/uapi/asm/kvm.h
> @@ -106,6 +106,7 @@ struct kvm_fpu {
>  #define  KVM_LOONGARCH_VM_FEAT_PTW		8
>  #define  KVM_LOONGARCH_VM_FEAT_MSGINT		9
>  #define  KVM_LOONGARCH_VM_FEAT_PV_PREEMPT	10
> +#define  KVM_LOONGARCH_VM_FEAT_CRASH		11

[Severity: High]
Does this omission prevent userspace from discovering the capability?

This feature is defined here, but it appears to be missing from the
switch statement in kvm_vm_feature_has_attr() in arch/loongarch/kvm/vm.c.
If a VMM queries this via KVM_HAS_DEVICE_ATTR, won't it hit the default
branch and return -ENXIO, falsely indicating the feature is unavailable?

[ ... ]

> diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
> index 6dabb227a7321..e5d10ceb5e67f 100644
> --- a/arch/loongarch/kvm/vm.c
> +++ b/arch/loongarch/kvm/vm.c
> @@ -49,8 +49,9 @@ static void kvm_vm_init_features(struct kvm *kvm)
>  		kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PMU);
>  
>  	/* Enable all PV features by default */
> -	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI);
> +	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI) | BIT(KVM_FEATURE_CRASH);
>  	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);
> +	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_CRASH);

[Severity: High]
Could this regression break live migration with older VMMs?

Currently, KVM_FEATURE_CRASH is unconditionally enabled for all new VMs.
If an older VMM that does not support the crash hypercall runs on this
kernel, and the guest executes KVM_HCALL_CRASH, the VMM will receive an
unrecognized KVM_EXIT_SYSTEM_EVENT of type KVM_SYSTEM_EVENT_CRASH.

This usually causes an older VMM to ungracefully abort the VM. KVM
cross-architecture rules require new guest-visible features and exit
reasons to be off by default, relying on explicit VMM opt-in during
capability negotiation.

>  	if (kvm_pvtime_supported()) {
>  		kvm->arch.pv_features |= BIT(KVM_FEATURE_PREEMPT);
>  		kvm->arch.pv_features |= BIT(KVM_FEATURE_STEAL_TIME);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909085350.2046788-1-maobibo@loongson.cn?part=1

Re: [PATCH] LoongArch: KVM: Add hypercall crash support

[Bibo Mao]

On 2026/9/9 下午5:13, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] The KVM_LOONGARCH_VM_FEAT_CRASH capability cannot be discovered by userspace due to a missing case in kvm_vm_feature_has_attr().
> - [High] The KVM_FEATURE_CRASH capability is silently enabled by default, violating KVM cross-architecture rules and breaking live migration with older VMMs.
> --
> 
> commit db8910e8d85912033e28dc04e11026a25b4bdbb8
> Author: Bibo Mao <maobibo@loongson.cn>
> 
> LoongArch: KVM: Add hypercall crash support
>      
> This commit adds a generic pvpanic-like hypercall for LoongArch KVM to
> notify the VMM about VM crashes. It provides a direct, low-level crash
> method that is useful when the CPU hardware context or kernel stack is
> corrupted.
> 
>> diff --git a/arch/loongarch/include/uapi/asm/kvm.h b/arch/loongarch/include/uapi/asm/kvm.h
>> index cd0b5c11ca9c2..b222bfc480427 100644
>> --- a/arch/loongarch/include/uapi/asm/kvm.h
>> +++ b/arch/loongarch/include/uapi/asm/kvm.h
>> @@ -106,6 +106,7 @@ struct kvm_fpu {
>>   #define  KVM_LOONGARCH_VM_FEAT_PTW		8
>>   #define  KVM_LOONGARCH_VM_FEAT_MSGINT		9
>>   #define  KVM_LOONGARCH_VM_FEAT_PV_PREEMPT	10
>> +#define  KVM_LOONGARCH_VM_FEAT_CRASH		11
> 
> [Severity: High]
> Does this omission prevent userspace from discovering the capability?
> 
> This feature is defined here, but it appears to be missing from the
> switch statement in kvm_vm_feature_has_attr() in arch/loongarch/kvm/vm.c.
> If a VMM queries this via KVM_HAS_DEVICE_ATTR, won't it hit the default
> branch and return -ENXIO, falsely indicating the feature is unavailable?
yes, one line patch is missing in kvm_vm_feature_has_attr(), such as
diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
index e5d10ceb5e67..9bf4b3bb8f25 100644
--- a/arch/loongarch/kvm/vm.c
+++ b/arch/loongarch/kvm/vm.c
@@ -164,6 +164,7 @@ static int kvm_vm_feature_has_attr(struct kvm *kvm, 
struct kvm_device_attr *attr
         case KVM_LOONGARCH_VM_FEAT_PV_IPI:
         case KVM_LOONGARCH_VM_FEAT_PV_PREEMPT:
         case KVM_LOONGARCH_VM_FEAT_PV_STEALTIME:
+       case KVM_LOONGARCH_VM_FEAT_CRASH:
                 if (kvm_vm_support(&kvm->arch, attr->attr))
                         return 0;
                 return -ENXIO;

> 
> [ ... ]
> 
>> diff --git a/arch/loongarch/kvm/vm.c b/arch/loongarch/kvm/vm.c
>> index 6dabb227a7321..e5d10ceb5e67f 100644
>> --- a/arch/loongarch/kvm/vm.c
>> +++ b/arch/loongarch/kvm/vm.c
>> @@ -49,8 +49,9 @@ static void kvm_vm_init_features(struct kvm *kvm)
>>   		kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PMU);
>>   
>>   	/* Enable all PV features by default */
>> -	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI);
>> +	kvm->arch.pv_features |= BIT(KVM_FEATURE_IPI) | BIT(KVM_FEATURE_CRASH);
>>   	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);
>> +	kvm->arch.kvm_features |= BIT(KVM_LOONGARCH_VM_FEAT_CRASH);
> 
> [Severity: High]
> Could this regression break live migration with older VMMs?
> 
> Currently, KVM_FEATURE_CRASH is unconditionally enabled for all new VMs.
> If an older VMM that does not support the crash hypercall runs on this
> kernel, and the guest executes KVM_HCALL_CRASH, the VMM will receive an
pv_features is enabled by default, VMM can detect kernel capability and 
set pv_features before booting VM.

Regards
Bibo Mao
> unrecognized KVM_EXIT_SYSTEM_EVENT of type KVM_SYSTEM_EVENT_CRASH.
> 
> This usually causes an older VMM to ungracefully abort the VM. KVM
> cross-architecture rules require new guest-visible features and exit
> reasons to be off by default, relying on explicit VMM opt-in during
> capability negotiation.
> 
>>   	if (kvm_pvtime_supported()) {
>>   		kvm->arch.pv_features |= BIT(KVM_FEATURE_PREEMPT);
>>   		kvm->arch.pv_features |= BIT(KVM_FEATURE_STEAL_TIME);
>