[PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[Mukesh Rathor]

MSVC compiler, used to compile the Microsoft Hyper-V hypervisor currently,
has an assert intrinsic that uses interrupt vector 0x29 to create an
exception. This will cause hypervisor to then crash and collect core. As
such, if this interrupt number is assigned to a device by linux and the
device generates it, hypervisor will crash. There are two other such
vectors hard coded in the hypervisor, 0x2C and 0x2D for debug purposes.
Fortunately, the three vectors are part of the kernel driver space and
that makes it feasible to reserve them early so they are not assigned
later.

Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
---

v1: Add ifndef CONFIG_X86_FRED (thanks hpa)

 arch/x86/kernel/cpu/mshyperv.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index 579fb2c64cfd..8ef4ca6733ac 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -478,6 +478,27 @@ int hv_get_hypervisor_version(union hv_hypervisor_version_info *info)
 }
 EXPORT_SYMBOL_GPL(hv_get_hypervisor_version);
 
+#ifndef CONFIG_X86_FRED
+/*
+ * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
+ * will crash or hang or break into debugger.
+ */
+static void hv_reserve_irq_vectors(void)
+{
+	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
+	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
+	#define HYPERV_DBG_SERVICE_VECTOR	0x2D
+
+	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
+	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
+	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
+		BUG();
+
+	pr_info("Hyper-V:reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,
+		HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);
+}
+#endif          /* CONFIG_X86_FRED */
+
 static void __init ms_hyperv_init_platform(void)
 {
 	int hv_max_functions_eax, eax;
@@ -510,6 +531,11 @@ static void __init ms_hyperv_init_platform(void)
 
 	hv_identify_partition_type();
 
+#ifndef CONFIG_X86_FRED
+	if (hv_root_partition())
+		hv_reserve_irq_vectors();
+#endif  /* CONFIG_X86_FRED */
+
 	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
 		ms_hyperv.hints |= HV_DEPRECATING_AEOI_RECOMMENDED;
 
-- 
2.51.2.vfs.0.1

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[Wei Liu]

On Fri, Jan 02, 2026 at 02:02:08PM -0800, Mukesh Rathor wrote:
> MSVC compiler, used to compile the Microsoft Hyper-V hypervisor currently,
> has an assert intrinsic that uses interrupt vector 0x29 to create an
> exception. This will cause hypervisor to then crash and collect core. As
> such, if this interrupt number is assigned to a device by linux and the
> device generates it, hypervisor will crash. There are two other such
> vectors hard coded in the hypervisor, 0x2C and 0x2D for debug purposes.
> Fortunately, the three vectors are part of the kernel driver space and
> that makes it feasible to reserve them early so they are not assigned
> later.
> 
> Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
> ---
> 
> v1: Add ifndef CONFIG_X86_FRED (thanks hpa)
> 
>  arch/x86/kernel/cpu/mshyperv.c | 26 ++++++++++++++++++++++++++
>  1 file changed, 26 insertions(+)
> 
> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
> index 579fb2c64cfd..8ef4ca6733ac 100644
> --- a/arch/x86/kernel/cpu/mshyperv.c
> +++ b/arch/x86/kernel/cpu/mshyperv.c
> @@ -478,6 +478,27 @@ int hv_get_hypervisor_version(union hv_hypervisor_version_info *info)
>  }
>  EXPORT_SYMBOL_GPL(hv_get_hypervisor_version);
>  
> +#ifndef CONFIG_X86_FRED

I briefly looked up FRED and checked the code. I understand that once it
is enabled, Linux kernel doesn't setup the IDT anymore (code in
arch/x86/kernel/traps.c).

My question is, do we need to do anything when FRED is enabled?

Wei

> +/*
> + * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
> + * will crash or hang or break into debugger.
> + */
> +static void hv_reserve_irq_vectors(void)
> +{
> +	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
> +	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
> +	#define HYPERV_DBG_SERVICE_VECTOR	0x2D
> +
> +	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
> +		BUG();
> +
> +	pr_info("Hyper-V:reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,
> +		HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);
> +}
> +#endif          /* CONFIG_X86_FRED */
> +
>  static void __init ms_hyperv_init_platform(void)
>  {
>  	int hv_max_functions_eax, eax;
> @@ -510,6 +531,11 @@ static void __init ms_hyperv_init_platform(void)
>  
>  	hv_identify_partition_type();
>  
> +#ifndef CONFIG_X86_FRED
> +	if (hv_root_partition())
> +		hv_reserve_irq_vectors();
> +#endif  /* CONFIG_X86_FRED */
> +
>  	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
>  		ms_hyperv.hints |= HV_DEPRECATING_AEOI_RECOMMENDED;
>  
> -- 
> 2.51.2.vfs.0.1
> 

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[Mukesh R]

On 1/14/26 23:25, Wei Liu wrote:
> On Fri, Jan 02, 2026 at 02:02:08PM -0800, Mukesh Rathor wrote:
>> MSVC compiler, used to compile the Microsoft Hyper-V hypervisor currently,
>> has an assert intrinsic that uses interrupt vector 0x29 to create an
>> exception. This will cause hypervisor to then crash and collect core. As
>> such, if this interrupt number is assigned to a device by linux and the
>> device generates it, hypervisor will crash. There are two other such
>> vectors hard coded in the hypervisor, 0x2C and 0x2D for debug purposes.
>> Fortunately, the three vectors are part of the kernel driver space and
>> that makes it feasible to reserve them early so they are not assigned
>> later.
>>
>> Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
>> ---
>>
>> v1: Add ifndef CONFIG_X86_FRED (thanks hpa)
>>
>>   arch/x86/kernel/cpu/mshyperv.c | 26 ++++++++++++++++++++++++++
>>   1 file changed, 26 insertions(+)
>>
>> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
>> index 579fb2c64cfd..8ef4ca6733ac 100644
>> --- a/arch/x86/kernel/cpu/mshyperv.c
>> +++ b/arch/x86/kernel/cpu/mshyperv.c
>> @@ -478,6 +478,27 @@ int hv_get_hypervisor_version(union hv_hypervisor_version_info *info)
>>   }
>>   EXPORT_SYMBOL_GPL(hv_get_hypervisor_version);
>>   
>> +#ifndef CONFIG_X86_FRED
> 
> I briefly looked up FRED and checked the code. I understand that once it
> is enabled, Linux kernel doesn't setup the IDT anymore (code in
> arch/x86/kernel/traps.c).
> 
> My question is, do we need to do anything when FRED is enabled?

Yeah, at first glance my thought was it probably has greater
implications (in terms of double checking exceptions), and so
when time allows do deeper investigation and perhaps run it by
the hypervisor team to see if there is any other work we need to
do.

Thanks,
-Mukesh


> Wei
> 
>> +/*
>> + * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
>> + * will crash or hang or break into debugger.
>> + */
>> +static void hv_reserve_irq_vectors(void)
>> +{
>> +	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
>> +	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
>> +	#define HYPERV_DBG_SERVICE_VECTOR	0x2D
>> +
>> +	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
>> +	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
>> +	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
>> +		BUG();
>> +
>> +	pr_info("Hyper-V:reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,
>> +		HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);
>> +}
>> +#endif          /* CONFIG_X86_FRED */
>> +
>>   static void __init ms_hyperv_init_platform(void)
>>   {
>>   	int hv_max_functions_eax, eax;
>> @@ -510,6 +531,11 @@ static void __init ms_hyperv_init_platform(void)
>>   
>>   	hv_identify_partition_type();
>>   
>> +#ifndef CONFIG_X86_FRED
>> +	if (hv_root_partition())
>> +		hv_reserve_irq_vectors();
>> +#endif  /* CONFIG_X86_FRED */
>> +
>>   	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
>>   		ms_hyperv.hints |= HV_DEPRECATING_AEOI_RECOMMENDED;
>>   
>> -- 
>> 2.51.2.vfs.0.1
>>

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[H. Peter Anvin]

On 2026-01-14 23:25, Wei Liu wrote:
> 
> I briefly looked up FRED and checked the code. I understand that once it
> is enabled, Linux kernel doesn't setup the IDT anymore (code in
> arch/x86/kernel/traps.c).
> 
> My question is, do we need to do anything when FRED is enabled?
> 

Assuming you don't need them handled in any specific way, then you don't. INT
instructions are treated completely separately from hardware interrupts in
FRED, and so they cannot be confused.

By default they will emulate a #GP(0) just as if an INT instruction had been
executed in user space with the DPL of the corresponding interrupt gate < 3;
this is currently the case for interrupt vectors other than 3, 4, and 0x80
(which are handled in fred_intx).

Any INT instruction in kernel space will end up in fred_bad_type().

	-hpa

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[Mukesh R]

On 1/2/26 14:02, Mukesh Rathor wrote:
> MSVC compiler, used to compile the Microsoft Hyper-V hypervisor currently,
> has an assert intrinsic that uses interrupt vector 0x29 to create an
> exception. This will cause hypervisor to then crash and collect core. As
> such, if this interrupt number is assigned to a device by linux and the
> device generates it, hypervisor will crash. There are two other such
> vectors hard coded in the hypervisor, 0x2C and 0x2D for debug purposes.
> Fortunately, the three vectors are part of the kernel driver space and
> that makes it feasible to reserve them early so they are not assigned
> later.
> 
> Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
> ---
> 
> v1: Add ifndef CONFIG_X86_FRED (thanks hpa)
> 
>   arch/x86/kernel/cpu/mshyperv.c | 26 ++++++++++++++++++++++++++
>   1 file changed, 26 insertions(+)
> 
> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
> index 579fb2c64cfd..8ef4ca6733ac 100644
> --- a/arch/x86/kernel/cpu/mshyperv.c
> +++ b/arch/x86/kernel/cpu/mshyperv.c
> @@ -478,6 +478,27 @@ int hv_get_hypervisor_version(union hv_hypervisor_version_info *info)
>   }
>   EXPORT_SYMBOL_GPL(hv_get_hypervisor_version);
>   
> +#ifndef CONFIG_X86_FRED
> +/*
> + * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
> + * will crash or hang or break into debugger.
> + */
> +static void hv_reserve_irq_vectors(void)
> +{
> +	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
> +	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
> +	#define HYPERV_DBG_SERVICE_VECTOR	0x2D
> +
> +	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
> +		BUG();
> +
> +	pr_info("Hyper-V:reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,
> +		HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);
> +}
> +#endif          /* CONFIG_X86_FRED */
> +
>   static void __init ms_hyperv_init_platform(void)
>   {
>   	int hv_max_functions_eax, eax;
> @@ -510,6 +531,11 @@ static void __init ms_hyperv_init_platform(void)
>   
>   	hv_identify_partition_type();
>   
> +#ifndef CONFIG_X86_FRED
> +	if (hv_root_partition())
> +		hv_reserve_irq_vectors();
> +#endif  /* CONFIG_X86_FRED */
> +
>   	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
>   		ms_hyperv.hints |= HV_DEPRECATING_AEOI_RECOMMENDED;
>   


Hi Wei,

Ping on this one... this is show stopper. Are we waiting for an ack
from someone else on x86 side? If so, pl lmk  if you know best person
to ping.

Thanks,
-Mukesh

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[H. Peter Anvin]

On 2026-01-02 14:02, Mukesh Rathor wrote:
> 
> v1: Add ifndef CONFIG_X86_FRED (thanks hpa)
> 

It just clicked in my brain.

This must be cpu_feature_enabled() not a static #ifndef. Just because the
kernel is compiled with FRED support doesn't mean that it is *using* FRED!

	-hpa


>  arch/x86/kernel/cpu/mshyperv.c | 26 ++++++++++++++++++++++++++
>  1 file changed, 26 insertions(+)
> 
> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
> index 579fb2c64cfd..8ef4ca6733ac 100644
> --- a/arch/x86/kernel/cpu/mshyperv.c
> +++ b/arch/x86/kernel/cpu/mshyperv.c
> @@ -478,6 +478,27 @@ int hv_get_hypervisor_version(union hv_hypervisor_version_info *info)
>  }
>  EXPORT_SYMBOL_GPL(hv_get_hypervisor_version);
>  
> +#ifndef CONFIG_X86_FRED
> +/*
> + * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
> + * will crash or hang or break into debugger.
> + */
> +static void hv_reserve_irq_vectors(void)
> +{
> +	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
> +	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
> +	#define HYPERV_DBG_SERVICE_VECTOR	0x2D
> +
> +	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
> +		BUG();
> +
> +	pr_info("Hyper-V:reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,
> +		HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);
> +}
> +#endif          /* CONFIG_X86_FRED */
> +
>  static void __init ms_hyperv_init_platform(void)
>  {
>  	int hv_max_functions_eax, eax;
> @@ -510,6 +531,11 @@ static void __init ms_hyperv_init_platform(void)
>  
>  	hv_identify_partition_type();
>  
> +#ifndef CONFIG_X86_FRED
> +	if (hv_root_partition())
> +		hv_reserve_irq_vectors();
> +#endif  /* CONFIG_X86_FRED */
> +
>  	if (cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
>  		ms_hyperv.hints |= HV_DEPRECATING_AEOI_RECOMMENDED;
>  

Re: [PATCH v1] x86/hyperv: Reserve 3 interrupt vectors used exclusively by mshv

[Thomas Gleixner]

On Fri, Jan 02 2026 at 14:02, Mukesh Rathor wrote:
>  
> +#ifndef CONFIG_X86_FRED

This #ifndef is broken. A FRED enabled kernel is no guarantee that the
CPU has FRED. So this has to be unconditional.

> + * Reserve vectors hard coded in the hypervisor. If used outside, the hypervisor
> + * will crash or hang or break into debugger.
> + */
> +static void hv_reserve_irq_vectors(void)
> +{
> +	#define HYPERV_DBG_FASTFAIL_VECTOR	0x29
> +	#define HYPERV_DBG_ASSERT_VECTOR	0x2C
> +	#define HYPERV_DBG_SERVICE_VECTOR	0x2D

As FRED does not need this bit fiddling you want:

        if (cpu_feature_enabled(X86_FEATURE_FRED))
        	return;

right here.

> +	if (test_and_set_bit(HYPERV_DBG_ASSERT_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_SERVICE_VECTOR, system_vectors) ||
> +	    test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
> +		BUG();
> +

Thanks,

        tglx