Re: [PATCH v3 3/4] KVM: TDX: Don't assume exit_reason[31:16] as all-0 in tdx_to_vmx_exit_reason()

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Wed, 2026-08-12 at 17:07 +0800, Xiaoyao Li wrote:
> > In tdx_get_exit_info(), it evaluates against the full 32-bit exit reason:
> > 
> >       *reason = tdx->vt.exit_reason.full;
> >       if (*reason != TDX_INVALID_EXIT_REASON) {
> >           *info1 = vmx_get_exit_qual(vcpu);
> >           ...
> > 
> > Since TDX_INVALID_EXIT_REASON is the 16-bit 0xFFFF, this check will pass if
> > any upper bits are set, even if the basic reason was marked invalid,
> > incorrectly exposing meaningless hardware state.
> 
> Oh, I should have called it out it's intentional to check the full 32 
> bits Exit Reason instead of checking the lower 16 bits .basic field as 
> what it did in the v2.
> 
> The purpose here is to return zero value for info1/info2/intr_info when 
> there is no real Exit Reason, i.e., no real VM-Enter has happened. "Full 
> 32 bits Exit Reason equals TDX_INVALID_EXIT_REASON" indicates the case 
> of no real Exit Reason.
> 
> There is one exception though: when real EPT_MISCONFIG happens without 
> bus_lock_detected being 1. In this case, it's a false positive and KVM 
> should go to the else path to read the info1/info2/intr_info. As noted 
> in patch 2 under "---", this is an pre-existing issue and it will be 
> address in a future series.
> 
> For the case that Sashiko cares, the only possible one is that real 
> EPT_MISCONFIG happens when bus_lock_detected. In this case, passing the 
> check of (*reason != TDX_INVALID_EXIT_REASON) to read the value of 
> info1/info2/intr_info happens to be what we expect. (However, the exit 
> reason is 0xFFFF instead of EPT_MISCONFIG). Anyway, it won't expose 
> meaningless hardware state.
> 
> So, considering that the false-positive on EPT_MISCONFIG cannot be fully 
> addressed with either checking the full 32 bits or checking the 16 bits 
> basic field, and checking the full 32 bits can ensure identifying the no 
> real Exit Reason cases. I just leave it as-is instead of changing it to 
> check the basic field.

Oh, I was about to comment the same thing. Is not expected, but the code just
stands out as wrong looking too. Still, the patch is an overall improvement and
clears the way for the more important fix. So I'm ok with calling it good
enough.

Side note. I really dislike how tangled this area is for something that seems
like it should be much more straightforward. Deriving partially I think from the
overloading of the TDVMCALL leafs with the exit reasons. So we have things like:
...
	case EXIT_REASON_EPT_VIOLATION:
		return EXIT_REASON_EPT_MISCONFIG;
...