Re: [PATCH v3 1/2] KVM: TDX: Allow userspace to return errors to guest for MAPGPA

[Michael Roth <michael.roth@amd.com>]

On Tue, Feb 17, 2026 at 12:45:52PM -0600, Tom Lendacky wrote:
> On 2/17/26 12:05, Michael Roth wrote:
> > On Fri, Feb 06, 2026 at 10:28:28PM +0000, Sagi Shahar wrote:
> >> From: Vishal Annapurve <vannapurve@google.com>
> >>
> >> MAPGPA request from TDX VMs gets split into chunks by KVM using a loop
> >> of userspace exits until the complete range is handled.
> >>
> >> In some cases userspace VMM might decide to break the MAPGPA operation
> >> and continue it later. For example: in the case of intrahost migration
> >> userspace might decide to continue the MAPGPA operation after the
> >> migration is completed.
> >>
> >> Allow userspace to signal to TDX guests that the MAPGPA operation should
> >> be retried the next time the guest is scheduled.
> >>
> >> This is potentially a breaking change since if userspace sets
> >> hypercall.ret to a value other than EBUSY or EINVAL an EINVAL error code
> >> will be returned to userspace. As of now QEMU never sets hypercall.ret
> >> to a non-zero value after handling KVM_EXIT_HYPERCALL so this change
> >> should be safe.
> >>
> >> Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> >> Co-developed-by: Sagi Shahar <sagis@google.com>
> >> Signed-off-by: Sagi Shahar <sagis@google.com>
> >> ---
> >>  Documentation/virt/kvm/api.rst |  3 +++
> >>  arch/x86/kvm/vmx/tdx.c         | 15 +++++++++++++--
> >>  arch/x86/kvm/x86.h             |  6 ++++++
> >>  3 files changed, 22 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> >> index 01a3abef8abb..9978cd9d897e 100644
> >> --- a/Documentation/virt/kvm/api.rst
> >> +++ b/Documentation/virt/kvm/api.rst
> >> @@ -8679,6 +8679,9 @@ block sizes is exposed in KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES as a
> >>  
> >>  This capability, if enabled, will cause KVM to exit to userspace
> >>  with KVM_EXIT_HYPERCALL exit reason to process some hypercalls.
> >> +Userspace may fail the hypercall by setting hypercall.ret to EINVAL
> >> +or may request the hypercall to be retried the next time the guest run
> >> +by setting hypercall.ret to EAGAIN.
> >>  
> >>  Calling KVM_CHECK_EXTENSION for this capability will return a bitmask
> >>  of hypercalls that can be configured to exit to userspace.
> >> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> >> index 2d7a4d52ccfb..056a44b9d78b 100644
> >> --- a/arch/x86/kvm/vmx/tdx.c
> >> +++ b/arch/x86/kvm/vmx/tdx.c
> >> @@ -1186,10 +1186,21 @@ static void __tdx_map_gpa(struct vcpu_tdx *tdx);
> >>  
> >>  static int tdx_complete_vmcall_map_gpa(struct kvm_vcpu *vcpu)
> >>  {
> >> +	u64 hypercall_ret = READ_ONCE(vcpu->run->hypercall.ret);
> >>  	struct vcpu_tdx *tdx = to_tdx(vcpu);
> >>  
> >> -	if (vcpu->run->hypercall.ret) {
> >> -		tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
> >> +	if (hypercall_ret) {
> >> +		if (hypercall_ret == EAGAIN) {
> >> +			tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_RETRY);
> >> +		} else if (vcpu->run->hypercall.ret == EINVAL) {
> >> +			tdvmcall_set_return_code(
> >> +				vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
> >> +		} else {
> >> +			WARN_ON_ONCE(
> >> +				kvm_is_valid_map_gpa_range_ret(hypercall_ret));
> >> +			return -EINVAL;
> >> +		}
> >> +
> >>  		tdx->vp_enter_args.r11 = tdx->map_gpa_next;
> >>  		return 1;
> >>  	}
> > 
> > Maybe slightly more readable?
> > 
> >     switch (hypercall_ret) {
> >     case EAGAIN:
> >         tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_RETRY);
> >         /* fallthrough */
> 
> I think you want a break here, not a fallthrough, so that you don't set
> the return code twice with the last one not being correct for EAGAIN.

Doh, thanks for the catch. I guess a break for the EINVAL case as well would
be more consistent then.

    switch (hypercall_ret) {
    case EAGAIN:
        tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_RETRY);
        break;
    case EINVAL:
        tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
        break;
    case 0:
        break;
    case default:
        WARN_ON_ONCE(kvm_is_valid_map_gpa_range_ret(hypercall_ret));
        return -EINVAL;
    }
  
    tdx->vp_enter_args.r11 = tdx->map_gpa_next;
    return 1;

Thanks,

Mike

> >     switch (hypercall_ret) {
> >     case EAGAIN:
> >         tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_RETRY);
> >         /* fallthrough */
> 
> I think you want a break here, not a fallthrough, so that you don't set
> the return code twice with the last one not being correct for EAGAIN.
> 
> Thanks,
> Tom
> 
> >     case EINVAL:
> >         tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
> >         /* fallthrough */
> >     case 0:
> >         break;
> >     case default:
> >         WARN_ON_ONCE(kvm_is_valid_map_gpa_range_ret(hypercall_ret));
> >         return -EINVAL;
> >     }
> > 
> >     tdx->vp_enter_args.r11 = tdx->map_gpa_next;
> >     return 1;
> 
> Thanks,
> Tom
> 
> >     case EINVAL:
> >         tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
> >         /* fallthrough */
> >     case 0:
> >         break;
> >     case default:
> >         WARN_ON_ONCE(kvm_is_valid_map_gpa_range_ret(hypercall_ret));
> >         return -EINVAL;
> >     }
> > 
> >     tdx->vp_enter_args.r11 = tdx->map_gpa_next;
> >     return 1;
> > 
> > Either way:
> > 
> > Reviewed-by: Michael Roth <michael.roth@amd.com>
> > 
> >> diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> >> index fdab0ad49098..3d464d12423a 100644
> >> --- a/arch/x86/kvm/x86.h
> >> +++ b/arch/x86/kvm/x86.h
> >> @@ -706,6 +706,12 @@ int kvm_sev_es_string_io(struct kvm_vcpu *vcpu, unsigned int size,
> >>  			 unsigned int port, void *data,  unsigned int count,
> >>  			 int in);
> >>  
> >> +static inline bool kvm_is_valid_map_gpa_range_ret(u64 hypercall_ret)
> >> +{
> >> +	return !hypercall_ret || hypercall_ret == EINVAL ||
> >> +	       hypercall_ret == EAGAIN;
> >> +}
> >> +
> >>  static inline bool user_exit_on_hypercall(struct kvm *kvm, unsigned long hc_nr)
> >>  {
> >>  	return kvm->arch.hypercall_exit_enabled & BIT(hc_nr);
> >> -- 
> >> 2.53.0.rc2.204.g2597b5adb4-goog
> >>
>