[PATCH 0/3] KVM: VMX: Harden against interpreting TDX vCPU as vcpu_vmx

[PATCH 0/3] KVM: VMX: Harden against interpreting TDX vCPU as vcpu_vmx

[Sean Christopherson]

Move vmx_handle_exit_irqoff() and all its helpers to main.c, and then poison
to_vmx() for the common .c files to harden KVM against misinterpreting a TDX
vCPU as a VMX vCPU, i.e. consuming to_vmx() on a TDX vCPU.  Spotted when
working through the bus lock series.

TDX changes are compile-tested only (one of these days I'll track down a host
that's fully TDX-capable).

Sean Christopherson (3):
  KVM: VMX: Move the shared "IRQs off" exit handler(s) to common code
  KVM: VMX: Disallowing using to_vmx() in common VT code
  KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

 arch/x86/kvm/vmx/common.h      |  6 +++
 arch/x86/kvm/vmx/main.c        | 75 +++++++++++++++++++++++++++++++-
 arch/x86/kvm/vmx/posted_intr.c | 18 ++++----
 arch/x86/kvm/vmx/posted_intr.h |  8 ++--
 arch/x86/kvm/vmx/tdx.c         |  4 +-
 arch/x86/kvm/vmx/vmx.c         | 78 +---------------------------------
 arch/x86/kvm/vmx/x86_ops.h     |  1 -
 7 files changed, 97 insertions(+), 93 deletions(-)


base-commit: 1b731e5ded480bd1e5546aed35584238661ce72e
-- 
2.55.0.691.gc56d675ccc-goog

[PATCH 1/3] KVM: VMX: Move the shared "IRQs off" exit handler(s) to common code

[Sean Christopherson]

Move vmx_handle_exit_irqoff() and its helpers to common.h / main.c to
capture that it's a common handler and to allow guarding against incorrectly
using to_vmx(), and to allow for

Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Kai Huang <kai.huang@intel.com>
Cc: Yan Zhao <yan.y.zhao@intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/common.h  |  6 ++++
 arch/x86/kvm/vmx/main.c    | 69 +++++++++++++++++++++++++++++++++++
 arch/x86/kvm/vmx/vmx.c     | 74 --------------------------------------
 arch/x86/kvm/vmx/x86_ops.h |  1 -
 4 files changed, 75 insertions(+), 75 deletions(-)

diff --git a/arch/x86/kvm/vmx/common.h b/arch/x86/kvm/vmx/common.h
index 08005676702c..88f637c81353 100644
--- a/arch/x86/kvm/vmx/common.h
+++ b/arch/x86/kvm/vmx/common.h
@@ -74,6 +74,12 @@ static __always_inline bool is_td_vcpu(struct kvm_vcpu *vcpu) { return false; }
 
 #endif
 
+static inline bool is_xfd_nm_fault(struct kvm_vcpu *vcpu)
+{
+	return vcpu->arch.guest_fpu.fpstate->xfd &&
+	       !kvm_is_cr0_bit_set(vcpu, X86_CR0_TS);
+}
+
 static inline bool vt_is_tdx_private_gpa(struct kvm *kvm, gpa_t gpa)
 {
 	/* For TDX the direct mask is the shared mask. */
diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index 0ff3230fd95e..aa5b44bb212b 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
+#include <linux/entry-common.h>
 #include <linux/moduleparam.h>
 
 #include "x86_ops.h"
@@ -876,6 +877,74 @@ static int vt_gmem_max_mapping_level(struct kvm *kvm, kvm_pfn_t pfn,
 #define vt_op_tdx_only(name) NULL
 #endif /* CONFIG_KVM_INTEL_TDX */
 
+static void handle_nm_fault_irqoff(struct kvm_vcpu *vcpu)
+{
+	/*
+	 * Save xfd_err to guest_fpu before interrupt is enabled, so the
+	 * MSR value is not clobbered by the host activity before the guest
+	 * has chance to consume it.
+	 *
+	 * Update the guest's XFD_ERR if and only if XFD is enabled, as the #NM
+	 * interception may have been caused by L1 interception.  Per the SDM,
+	 * XFD_ERR is not modified for non-XFD #NM, i.e. if CR0.TS=1.
+	 *
+	 * Note, XFD_ERR is updated _before_ the #NM interception check, i.e.
+	 * unlike CR2 and DR6, the value is not a payload that is attached to
+	 * the #NM exception.
+	 */
+	if (is_xfd_nm_fault(vcpu))
+		rdmsrq(MSR_IA32_XFD_ERR, vcpu->arch.guest_fpu.xfd_err);
+}
+
+static void handle_exception_irqoff(struct kvm_vcpu *vcpu, u32 intr_info)
+{
+	/* if exit due to PF check for async PF */
+	if (is_page_fault(intr_info))
+		vcpu->arch.apf.host_apf_flags = kvm_read_and_reset_apf_flags();
+	/* if exit due to NM, handle before interrupts are enabled */
+	else if (is_nm_fault(intr_info))
+		handle_nm_fault_irqoff(vcpu);
+	/* Handle machine checks before interrupts are enabled */
+	else if (is_machine_check(intr_info))
+		kvm_machine_check();
+}
+
+static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu,
+					     u32 intr_info)
+{
+	unsigned int vector = intr_info & INTR_INFO_VECTOR_MASK;
+
+	if (KVM_BUG(!is_external_intr(intr_info), vcpu->kvm,
+	    "unexpected VM-Exit interrupt info: 0x%x", intr_info))
+		return;
+
+	kvm_before_interrupt(vcpu, KVM_HANDLING_IRQ);
+	x86_entry_from_kvm(EVENT_TYPE_EXTINT, vector);
+	kvm_after_interrupt(vcpu);
+
+	vcpu->arch.at_instruction_boundary = true;
+}
+
+static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)
+{
+	if (to_vt(vcpu)->emulation_required)
+		return;
+
+	switch (vmx_get_exit_reason(vcpu).basic) {
+	case EXIT_REASON_EXTERNAL_INTERRUPT:
+		handle_external_interrupt_irqoff(vcpu, vmx_get_intr_info(vcpu));
+		break;
+	case EXIT_REASON_EXCEPTION_NMI:
+		handle_exception_irqoff(vcpu, vmx_get_intr_info(vcpu));
+		break;
+	case EXIT_REASON_MCE_DURING_VMENTRY:
+		kvm_machine_check();
+		break;
+	default:
+		break;
+	}
+}
+
 #define VMX_REQUIRED_APICV_INHIBITS				\
 	(BIT(APICV_INHIBIT_REASON_DISABLED) |			\
 	 BIT(APICV_INHIBIT_REASON_ABSENT) |			\
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index e3bfe6aca1a0..aa0098723976 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5379,12 +5379,6 @@ bool vmx_guest_inject_ac(struct kvm_vcpu *vcpu)
 	       (kvm_get_rflags(vcpu) & X86_EFLAGS_AC);
 }
 
-static bool is_xfd_nm_fault(struct kvm_vcpu *vcpu)
-{
-	return vcpu->arch.guest_fpu.fpstate->xfd &&
-	       !kvm_is_cr0_bit_set(vcpu, X86_CR0_TS);
-}
-
 static int vmx_handle_page_fault(struct kvm_vcpu *vcpu, u32 error_code)
 {
 	unsigned long cr2 = vmx_get_exit_qual(vcpu);
@@ -7143,74 +7137,6 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 	vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
 }
 
-static void handle_nm_fault_irqoff(struct kvm_vcpu *vcpu)
-{
-	/*
-	 * Save xfd_err to guest_fpu before interrupt is enabled, so the
-	 * MSR value is not clobbered by the host activity before the guest
-	 * has chance to consume it.
-	 *
-	 * Update the guest's XFD_ERR if and only if XFD is enabled, as the #NM
-	 * interception may have been caused by L1 interception.  Per the SDM,
-	 * XFD_ERR is not modified for non-XFD #NM, i.e. if CR0.TS=1.
-	 *
-	 * Note, XFD_ERR is updated _before_ the #NM interception check, i.e.
-	 * unlike CR2 and DR6, the value is not a payload that is attached to
-	 * the #NM exception.
-	 */
-	if (is_xfd_nm_fault(vcpu))
-		rdmsrq(MSR_IA32_XFD_ERR, vcpu->arch.guest_fpu.xfd_err);
-}
-
-static void handle_exception_irqoff(struct kvm_vcpu *vcpu, u32 intr_info)
-{
-	/* if exit due to PF check for async PF */
-	if (is_page_fault(intr_info))
-		vcpu->arch.apf.host_apf_flags = kvm_read_and_reset_apf_flags();
-	/* if exit due to NM, handle before interrupts are enabled */
-	else if (is_nm_fault(intr_info))
-		handle_nm_fault_irqoff(vcpu);
-	/* Handle machine checks before interrupts are enabled */
-	else if (is_machine_check(intr_info))
-		kvm_machine_check();
-}
-
-static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu,
-					     u32 intr_info)
-{
-	unsigned int vector = intr_info & INTR_INFO_VECTOR_MASK;
-
-	if (KVM_BUG(!is_external_intr(intr_info), vcpu->kvm,
-	    "unexpected VM-Exit interrupt info: 0x%x", intr_info))
-		return;
-
-	kvm_before_interrupt(vcpu, KVM_HANDLING_IRQ);
-	x86_entry_from_kvm(EVENT_TYPE_EXTINT, vector);
-	kvm_after_interrupt(vcpu);
-
-	vcpu->arch.at_instruction_boundary = true;
-}
-
-void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)
-{
-	if (to_vt(vcpu)->emulation_required)
-		return;
-
-	switch (vmx_get_exit_reason(vcpu).basic) {
-	case EXIT_REASON_EXTERNAL_INTERRUPT:
-		handle_external_interrupt_irqoff(vcpu, vmx_get_intr_info(vcpu));
-		break;
-	case EXIT_REASON_EXCEPTION_NMI:
-		handle_exception_irqoff(vcpu, vmx_get_intr_info(vcpu));
-		break;
-	case EXIT_REASON_MCE_DURING_VMENTRY:
-		kvm_machine_check();
-		break;
-	default:
-		break;
-	}
-}
-
 /*
  * The kvm parameter can be NULL (module initialization, or invocation before
  * VM creation). Be sure to check the kvm parameter before using it.
diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
index cdb38d940cfb..4dcaa36bbd8c 100644
--- a/arch/x86/kvm/vmx/x86_ops.h
+++ b/arch/x86/kvm/vmx/x86_ops.h
@@ -27,7 +27,6 @@ void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
 void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu);
 void vmx_vcpu_put(struct kvm_vcpu *vcpu);
 int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath);
-void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu);
 int vmx_skip_emulated_instruction(struct kvm_vcpu *vcpu);
 void vmx_update_emulated_instruction(struct kvm_vcpu *vcpu);
 bool vmx_unhandleable_emulation_required(struct kvm_vcpu *vcpu);
-- 
2.55.0.691.gc56d675ccc-goog

[PATCH 2/3] KVM: VMX: Disallowing using to_vmx() in common VT code

[Sean Christopherson]

Poison to_vmx() in main.c and posted_intr.c so that attempting to interpret
the vCPU as a VMX vCPU will fail at compile time, as opposed to failing at
runtime, or worse corrupting state without outright failing.

Note, to_tdx() is buried in tdx.c, i.e. isn't broadly reachable, and so
doesn't need the same treatment as to_vmx().

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/main.c        | 2 ++
 arch/x86/kvm/vmx/posted_intr.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index aa5b44bb212b..95d89d809c19 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -11,6 +11,8 @@
 #include "tdx.h"
 #include "tdx_arch.h"
 
+#pragma GCC poison to_vmx
+
 #ifdef CONFIG_KVM_INTEL_TDX
 static_assert(offsetof(struct vcpu_vmx, vt) == offsetof(struct vcpu_tdx, vt));
 
diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 4a6d9a17da23..24221ba553be 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -14,6 +14,8 @@
 #include "vmx.h"
 #include "tdx.h"
 
+#pragma GCC poison to_vmx
+
 /*
  * Maintain a per-CPU list of vCPUs that need to be awakened by wakeup_handler()
  * when a WAKEUP_VECTOR interrupted is posted.  vCPUs are added to the list when
-- 
2.55.0.691.gc56d675ccc-goog

[PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Sean Christopherson]

Rename all common posted interrupt APIs that use a "vmx" prefix to instead
use a "vt" prefix to capture that they are used for both VMX and TDX vCPUs.

No functional change intended.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/main.c        |  4 ++--
 arch/x86/kvm/vmx/posted_intr.c | 16 ++++++++--------
 arch/x86/kvm/vmx/posted_intr.h |  8 ++++----
 arch/x86/kvm/vmx/tdx.c         |  4 ++--
 arch/x86/kvm/vmx/vmx.c         |  4 ++--
 5 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index 95d89d809c19..9a113613a1f9 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -1075,8 +1075,8 @@ struct kvm_x86_ops vt_x86_ops __initdata = {
 
 	.update_cpu_dirty_logging = vt_op(update_cpu_dirty_logging),
 
-	.pi_update_irte = vmx_pi_update_irte,
-	.pi_start_bypass = vmx_pi_start_bypass,
+	.pi_update_irte = vt_pi_update_irte,
+	.pi_start_bypass = vt_pi_start_bypass,
 
 #ifdef CONFIG_X86_64
 	.set_hv_timer = vt_op(set_hv_timer),
diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 24221ba553be..7a6a44587044 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -56,7 +56,7 @@ static int pi_try_set_control(struct pi_desc *pi_desc, u64 *pold, u64 new)
 	return 0;
 }
 
-void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
+void vt_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
 {
 	struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 	struct vcpu_vt *vt = to_vt(vcpu);
@@ -146,7 +146,7 @@ void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
 		pi_set_on(pi_desc);
 }
 
-static bool vmx_can_use_vtd_pi(struct kvm *kvm)
+static bool vt_can_use_vtd_pi(struct kvm *kvm)
 {
 	/*
 	 * Note, reading the number of possible bypass IRQs can race with a
@@ -219,10 +219,10 @@ static bool vmx_needs_pi_wakeup(struct kvm_vcpu *vcpu)
 	 * back to the pi_wakeup_handler() function.
 	 */
 	return (vmx_can_use_ipiv(vcpu) && !is_td_vcpu(vcpu)) ||
-		vmx_can_use_vtd_pi(vcpu->kvm);
+		vt_can_use_vtd_pi(vcpu->kvm);
 }
 
-void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
+void vt_vcpu_pi_put(struct kvm_vcpu *vcpu)
 {
 	struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 
@@ -294,17 +294,17 @@ bool pi_has_pending_interrupt(struct kvm_vcpu *vcpu)
 /*
  * Kick all vCPUs when the first possible bypass IRQ is attached to a VM, as
  * blocking vCPUs may scheduled out without reconfiguring PID.NV to the wakeup
- * vector, i.e. if the bypass IRQ came along after vmx_vcpu_pi_put().
+ * vector, i.e. if the bypass IRQ came along after vt_vcpu_pi_put().
  */
-void vmx_pi_start_bypass(struct kvm *kvm)
+void vt_pi_start_bypass(struct kvm *kvm)
 {
-	if (WARN_ON_ONCE(!vmx_can_use_vtd_pi(kvm)))
+	if (WARN_ON_ONCE(!vt_can_use_vtd_pi(kvm)))
 		return;
 
 	kvm_make_all_cpus_request(kvm, KVM_REQ_UNBLOCK);
 }
 
-int vmx_pi_update_irte(struct kvm_kernel_irqfd *irqfd, struct kvm *kvm,
+int vt_pi_update_irte(struct kvm_kernel_irqfd *irqfd, struct kvm *kvm,
 		       unsigned int host_irq, uint32_t guest_irq,
 		       struct kvm_vcpu *vcpu, u32 vector)
 {
diff --git a/arch/x86/kvm/vmx/posted_intr.h b/arch/x86/kvm/vmx/posted_intr.h
index a4af39948cf0..c5860ea828ae 100644
--- a/arch/x86/kvm/vmx/posted_intr.h
+++ b/arch/x86/kvm/vmx/posted_intr.h
@@ -8,16 +8,16 @@
 
 #include <asm/posted_intr.h>
 
-void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu);
-void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu);
+void vt_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu);
+void vt_vcpu_pi_put(struct kvm_vcpu *vcpu);
 void pi_wakeup_handler(void);
 void __init pi_init_cpu(int cpu);
 void pi_apicv_pre_state_restore(struct kvm_vcpu *vcpu);
 bool pi_has_pending_interrupt(struct kvm_vcpu *vcpu);
-int vmx_pi_update_irte(struct kvm_kernel_irqfd *irqfd, struct kvm *kvm,
+int vt_pi_update_irte(struct kvm_kernel_irqfd *irqfd, struct kvm *kvm,
 		       unsigned int host_irq, uint32_t guest_irq,
 		       struct kvm_vcpu *vcpu, u32 vector);
-void vmx_pi_start_bypass(struct kvm *kvm);
+void vt_pi_start_bypass(struct kvm *kvm);
 
 static inline int pi_find_highest_vector(struct pi_desc *pi_desc)
 {
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index b272c20586a7..6e7a2acb3f92 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -716,7 +716,7 @@ void tdx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
 	struct vcpu_tdx *tdx = to_tdx(vcpu);
 
-	vmx_vcpu_pi_load(vcpu, cpu);
+	vt_vcpu_pi_load(vcpu, cpu);
 	if (vcpu->cpu == cpu || !is_hkid_assigned(to_kvm_tdx(vcpu->kvm)))
 		return;
 
@@ -826,7 +826,7 @@ static void tdx_prepare_switch_to_host(struct kvm_vcpu *vcpu)
 
 void tdx_vcpu_put(struct kvm_vcpu *vcpu)
 {
-	vmx_vcpu_pi_put(vcpu);
+	vt_vcpu_pi_put(vcpu);
 	tdx_prepare_switch_to_host(vcpu);
 }
 
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index aa0098723976..40bae81bc041 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1577,12 +1577,12 @@ void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 
 	vmx_vcpu_load_vmcs(vcpu, cpu);
 
-	vmx_vcpu_pi_load(vcpu, cpu);
+	vt_vcpu_pi_load(vcpu, cpu);
 }
 
 void vmx_vcpu_put(struct kvm_vcpu *vcpu)
 {
-	vmx_vcpu_pi_put(vcpu);
+	vt_vcpu_pi_put(vcpu);
 
 	vmx_prepare_switch_to_host(to_vmx(vcpu));
 }
-- 
2.55.0.691.gc56d675ccc-goog

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Low] The function `vmx_needs_pi_wakeup()` was not renamed to `vt_needs_pi_wakeup()`.
- [Low] The shared inline API `__vmx_deliver_posted_interrupt()` was not renamed to `__vt_deliver_posted_interrupt()`.
- [Low] A comment inside `vt_can_use_vtd_pi()` references the old `vmx_pi_start_bypass()` function name.
--

--- Patch [3]: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt" ---
commit 735ede2af83c20ffbbfab70a4d63203f6ab6beab
Author: Sean Christopherson <seanjc@google.com>

KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

Rename all common posted interrupt APIs that use a "vmx" prefix to instead
use a "vt" prefix to capture that they are used for both VMX and TDX vCPUs.

[Severity: Low]
This isn't a bug, but should __vmx_deliver_posted_interrupt() in
arch/x86/kvm/vmx/common.h also be renamed? It appears to be a common API
used by TDX code (tdx_deliver_interrupt() in arch/x86/kvm/vmx/tdx.c).

No functional change intended.

Signed-off-by: Sean Christopherson <seanjc@google.com>

> diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
> index 24221ba553be1..7a6a445870442 100644
> --- a/arch/x86/kvm/vmx/posted_intr.c
> +++ b/arch/x86/kvm/vmx/posted_intr.c

[ ... ]

> @@ -146,7 +146,7 @@ void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
>  		pi_set_on(pi_desc);
>  }
>  
> -static bool vmx_can_use_vtd_pi(struct kvm *kvm)
> +static bool vt_can_use_vtd_pi(struct kvm *kvm)
>  {
>  	/*
>  	 * Note, reading the number of possible bypass IRQs can race with a

[Severity: Low]
This isn't a bug, but the comment just below this line still references the
old name: "vmx_pi_start_bypass() ensures blockng vCPUs will see...". Should
this be updated to vt_pi_start_bypass()?

[ ... ]

> @@ -219,10 +219,10 @@ static bool vmx_needs_pi_wakeup(struct kvm_vcpu *vcpu)
>  	 * back to the pi_wakeup_handler() function.
>  	 */
>  	return (vmx_can_use_ipiv(vcpu) && !is_td_vcpu(vcpu)) ||
> -		vmx_can_use_vtd_pi(vcpu->kvm);
> +		vt_can_use_vtd_pi(vcpu->kvm);
>  }

[Severity: Low]
This isn't a bug, but should vmx_needs_pi_wakeup() also be renamed to
vt_needs_pi_wakeup()? It explicitly handles both VMX and TDX cases by
checking is_td_vcpu(vcpu).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814161129.2177118-1-seanjc@google.com?part=3

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Sean Christopherson]

On Fri, Aug 14, 2026, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
> - [Low] The function `vmx_needs_pi_wakeup()` was not renamed to `vt_needs_pi_wakeup()`.
> - [Low] The shared inline API `__vmx_deliver_posted_interrupt()` was not renamed to `__vt_deliver_posted_interrupt()`.
> - [Low] A comment inside `vt_can_use_vtd_pi()` references the old `vmx_pi_start_bypass()` function name.
> --

I also missed vmx_handle_nmi() and __vmx_handle_ept_violation().

I'll also add a blurb in the changelog for patch 1 to explain that keeping the
vmx_ prefix is intentional so that vt_op() doesn't require a one-line forwarder
when CONFIG_KVM_INTEL_TDX=y.

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Sean Christopherson]

On Fri, Aug 14, 2026, Sean Christopherson wrote:
> I'll also add a blurb in the changelog for patch 1 to explain that keeping the
> vmx_ prefix is intentional so that vt_op() doesn't require a one-line forwarder
> when CONFIG_KVM_INTEL_TDX=y.

/facepalm

The callback is wired up directly, i.e. it can simply use a "vt" prefix.  IIRC,
I was playing around using vt_op() to address the wait_for_sept_zap issue and
forgot to revisit the change when I discarded that idea.

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Xiaoyao Li]

On 8/15/2026 1:02 AM, Sean Christopherson wrote:
> On Fri, Aug 14, 2026,sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
>> - [Low] The function `vmx_needs_pi_wakeup()` was not renamed to `vt_needs_pi_wakeup()`.
>> - [Low] The shared inline API `__vmx_deliver_posted_interrupt()` was not renamed to `__vt_deliver_posted_interrupt()`.
>> - [Low] A comment inside `vt_can_use_vtd_pi()` references the old `vmx_pi_start_bypass()` function name.
>> --
> I also missed vmx_handle_nmi() and __vmx_handle_ept_violation().

So for TDX VMDoS series, I need to rename __vmx_handle_notify() to 
vt_handle_notify() and extract handle_bus_lock_vmexit() from vmx.c to 
main.c as vt_handle_bus_lock_vmexit() or just inline function in common.h?

Re: [PATCH 1/3] KVM: VMX: Move the shared "IRQs off" exit handler(s) to common code

[Binbin Wu]

On 8/15/2026 12:11 AM, Sean Christopherson wrote:
> Move vmx_handle_exit_irqoff() and its helpers to common.h / main.c to
> capture that it's a common handler and to allow guarding against incorrectly
> using to_vmx(), and to allow for
                                   ^
It appears to have been abruptly truncated here?

> 
> Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
> Cc: Xiaoyao Li <xiaoyao.li@intel.com>
> Cc: Binbin Wu <binbin.wu@linux.intel.com>
> Cc: Kai Huang <kai.huang@intel.com>
> Cc: Yan Zhao <yan.y.zhao@intel.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>

[...]

> +
> +static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)

Since it's moved to the common code, is it better to rename it
to vt_handle_exit_irqoff()?

[...]

Re: [PATCH 2/3] KVM: VMX: Disallowing using to_vmx() in common VT code

[Binbin Wu]

On 8/15/2026 12:11 AM, Sean Christopherson wrote:
> Poison to_vmx() in main.c and posted_intr.c so that attempting to interpret
> the vCPU as a VMX vCPU will fail at compile time, as opposed to failing at
> runtime, or worse corrupting state without outright failing.
> 
> Note, to_tdx() is buried in tdx.c, i.e. isn't broadly reachable, and so
> doesn't need the same treatment as to_vmx().
> 
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Nit:
About the short log, use "Disallow using" instead of "Disallowing using"?

Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>> ---
>  arch/x86/kvm/vmx/main.c        | 2 ++
>  arch/x86/kvm/vmx/posted_intr.c | 2 ++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
> index aa5b44bb212b..95d89d809c19 100644
> --- a/arch/x86/kvm/vmx/main.c
> +++ b/arch/x86/kvm/vmx/main.c
> @@ -11,6 +11,8 @@
>  #include "tdx.h"
>  #include "tdx_arch.h"
>  
> +#pragma GCC poison to_vmx
> +
>  #ifdef CONFIG_KVM_INTEL_TDX
>  static_assert(offsetof(struct vcpu_vmx, vt) == offsetof(struct vcpu_tdx, vt));
>  
> diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
> index 4a6d9a17da23..24221ba553be 100644
> --- a/arch/x86/kvm/vmx/posted_intr.c
> +++ b/arch/x86/kvm/vmx/posted_intr.c
> @@ -14,6 +14,8 @@
>  #include "vmx.h"
>  #include "tdx.h"
>  
> +#pragma GCC poison to_vmx
> +
>  /*
>   * Maintain a per-CPU list of vCPUs that need to be awakened by wakeup_handler()
>   * when a WAKEUP_VECTOR interrupted is posted.  vCPUs are added to the list when

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Binbin Wu]

On 8/15/2026 12:11 AM, Sean Christopherson wrote:

[...]

>  
> @@ -294,17 +294,17 @@ bool pi_has_pending_interrupt(struct kvm_vcpu *vcpu)
>  /*
>   * Kick all vCPUs when the first possible bypass IRQ is attached to a VM, as
>   * blocking vCPUs may scheduled out without reconfiguring PID.NV to the wakeup
                        ^
It's a pre-existing issue, which is missing "be" here.
Maybe it could be fixed up opportunistically?

Re: [PATCH 1/3] KVM: VMX: Move the shared "IRQs off" exit handler(s) to common code

[Sean Christopherson]

On Mon, Aug 17, 2026, Binbin Wu wrote:
> On 8/15/2026 12:11 AM, Sean Christopherson wrote:
> > Move vmx_handle_exit_irqoff() and its helpers to common.h / main.c to
> > capture that it's a common handler and to allow guarding against incorrectly
> > using to_vmx(), and to allow for
>                                    ^
> It appears to have been abruptly truncated here?

Ya, apparently I saw something shiny and forgot to get back to this.  In hindsight,
I probably should have spammed v2 right away given how egregious some of these
goofs were, it probably would have been a net positive.  Anyways, this is what I
ended up with for a full changelog:

  KVM: VMX: Move the shared "IRQs off" exit handler(s) to common code
  
  Move vmx_handle_exit_irqoff() and its helpers to common.h / main.c to
  capture that it's a common handler and to allow guarding against incorrectly
  using to_vmx().
  
  Opportunistically use a "vt" prefix instead of "vmx" to communicate that
  it's a shared handler.
  
  No functional change intended.

> > Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
> > Cc: Xiaoyao Li <xiaoyao.li@intel.com>
> > Cc: Binbin Wu <binbin.wu@linux.intel.com>
> > Cc: Kai Huang <kai.huang@intel.com>
> > Cc: Yan Zhao <yan.y.zhao@intel.com>
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> 
> [...]
> 
> > +
> > +static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu)
> 
> Since it's moved to the common code, is it better to rename it
> to vt_handle_exit_irqoff()?

Yeah, Sashiko pointed out that I was being dense as well.

Re: [PATCH 3/3] KVM: VMX: Rename posted interrupt prefixes from "vmx" to "vt"

[Sean Christopherson]

On Mon, Aug 17, 2026, Xiaoyao Li wrote:
> On 8/15/2026 1:02 AM, Sean Christopherson wrote:
> > On Fri, Aug 14, 2026,sashiko-bot@kernel.org wrote:
> > > Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
> > > - [Low] The function `vmx_needs_pi_wakeup()` was not renamed to `vt_needs_pi_wakeup()`.
> > > - [Low] The shared inline API `__vmx_deliver_posted_interrupt()` was not renamed to `__vt_deliver_posted_interrupt()`.
> > > - [Low] A comment inside `vt_can_use_vtd_pi()` references the old `vmx_pi_start_bypass()` function name.
> > > --
> > I also missed vmx_handle_nmi() and __vmx_handle_ept_violation().
> 
> So for TDX VMDoS series, I need to rename __vmx_handle_notify() to
> vt_handle_notify() and extract handle_bus_lock_vmexit() from vmx.c to main.c
> as vt_handle_bus_lock_vmexit() or just inline function in common.h?

Yes please.  Though I think it probably makes sense to go with __vt_handle_notify()
to capture that it's an inner helper?  E.g. that's my plan for
__vt_handle_ept_violation().

Regardling handle_bus_lock_vmexit(), put it in main.c.  to_vt() currently lives
in vmx.h, which means it's impossible to inline vt_handle_bus_lock_vmexit() in
common.h because it can't get from "struct kvm_vcpu *vcpu" to "struct vcpu_vt *vt"
to update exit_reason.bus_lock_detected.

v2 of this series will address that (I coded everything up and tested it all last
week, just need to post it), but (a) juggling those dependencies isn't your
responsibility and (b) we don't want to take a dependency on the cleanups for a
fix that is destined for stable@.

Then I'll do one of three things: post a new version of this series to move
vt_handle_bus_lock_vmexit() to common.h, post a standalone patch to do the same,
or simply leave it in main.c (it's going to require a non-inline implementation
for at VMX since it's wired up to a function table, and it should be a rare path
so inlining for performance reasons is a non-goal).

Thanks!