[PATCH 1/2] KVM: nSVM: Set NMI_VECTOR in synthesized NMI exit_int_info

[PATCH 1/2] KVM: nSVM: Set NMI_VECTOR in synthesized NMI exit_int_info

[Jim Mattson]

Include NMI_VECTOR (2) in the vector field when synthesizing exit_int_info
for a pending injected NMI in nested_save_pending_event_to_vmcb12(),
matching nested VMX's idt_vectoring_info_field synthesis and the APM.

Per AMD's APM (Vol. 2, "Intercepts During IDT Interrupt Delivery", Figure
"EXITINTINFO" and Table "Guest Exception or Interrupt Types", and "Event
Injection"), bits 7:0 of EXITINTINFO hold the 8-bit IDT vector of the
interrupt or exception, and injected events are recorded in EXITINTINFO as
though they had occurred normally in the guest.  Although hardware ignores
EVENTINJ.VECTOR on VMRUN when TYPE is NMI, EXITINTINFO records vector 2
(#NMI) if a #VMEXIT occurs during NMI delivery.

Commit 36e2e98363e6 ("KVM: nSVM: synthesize correct EXITINTINFO on vmexit")
replaced the raw copy of vmcb02->control.exit_int_info (where hardware
populates vector 2) with nested_vmcb_save_pending_event(), now
nested_save_pending_event_to_vmcb12(), which sets only SVM_EVTINJ_VALID |
SVM_EVTINJ_TYPE_NMI and leaves the vector field as 0.  As a result, L1
hypervisors that check EXITINTINFO.VECTOR == 2 for NMIs (e.g. FreeBSD's
bhyve) or inspect the vector field of exit_int_info observe an invalid
vector 0 on nested #VMEXIT.

Fixes: 36e2e98363e6 ("KVM: nSVM: synthesize correct EXITINTINFO on vmexit")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/svm/nested.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index af0ef678433d..9b62113f0cf6 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -673,7 +673,7 @@ static void nested_save_pending_event_to_vmcb12(struct vcpu_svm *svm,
 		}
 
 	} else if (vcpu->arch.nmi_injected) {
-		exit_int_info = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
+		exit_int_info = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI | NMI_VECTOR;
 
 	} else if (vcpu->arch.interrupt.injected) {
 		nr = vcpu->arch.interrupt.nr;

base-commit: dea4f6380f4ec96e8f3b0aaf2343764bd0d25ef4
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH 2/2] KVM: SVM: Set NMI_VECTOR in event_inj in svm_inject_nmi()

[Jim Mattson]

Include NMI_VECTOR (2) in svm->vmcb->control.event_inj when injecting an
NMI in svm_inject_nmi(), matching vmx_inject_nmi().

Although hardware ignores EVENTINJ.VECTOR on VMRUN when TYPE is NMI (APM
Vol. 2, "Event Injection"), omitting NMI_VECTOR causes
svm_get_entry_info() to report vector 0 instead of 2 to the kvm_entry
tracepoint, and causes svm_cancel_injection() to copy an exit_int_info
value with vector 0 into the active VMCB.

Fixes: 95ba82731374 ("KVM: SVM: Add NMI injection support")
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/svm/svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 136069dfcd44..41e85702b380 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3914,7 +3914,7 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
-	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
+	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI | NMI_VECTOR;
 
 	if (svm->nmi_l1_to_l2)
 		return;
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH 1/2] KVM: nSVM: Set NMI_VECTOR in synthesized NMI exit_int_info

[Sean Christopherson]

I'm mildly disappointed you didn't go with:

  KVM: nSVM: Really synthesize correct EXITINTINFO on vmexit

:-D

On Wed, Oct 28, 2026, Jim Mattson wrote:
> Include NMI_VECTOR (2) in the vector field when synthesizing exit_int_info
> for a pending injected NMI in nested_save_pending_event_to_vmcb12(),
> matching nested VMX's idt_vectoring_info_field synthesis and the APM.
> 
> Per AMD's APM (Vol. 2, "Intercepts During IDT Interrupt Delivery", Figure
> "EXITINTINFO" and Table "Guest Exception or Interrupt Types", and "Event
> Injection"), bits 7:0 of EXITINTINFO hold the 8-bit IDT vector of the
> interrupt or exception, and injected events are recorded in EXITINTINFO as
> though they had occurred normally in the guest.  Although hardware ignores
> EVENTINJ.VECTOR on VMRUN when TYPE is NMI, EXITINTINFO records vector 2
> (#NMI) if a #VMEXIT occurs during NMI delivery.
> 
> Commit 36e2e98363e6 ("KVM: nSVM: synthesize correct EXITINTINFO on vmexit")
> replaced the raw copy of vmcb02->control.exit_int_info (where hardware
> populates vector 2) with nested_vmcb_save_pending_event(), now
> nested_save_pending_event_to_vmcb12(), which sets only SVM_EVTINJ_VALID |
> SVM_EVTINJ_TYPE_NMI and leaves the vector field as 0.  As a result, L1
> hypervisors that check EXITINTINFO.VECTOR == 2 for NMIs (e.g. FreeBSD's
> bhyve) or inspect the vector field of exit_int_info observe an invalid
> vector 0 on nested #VMEXIT.
> 
> Fixes: 36e2e98363e6 ("KVM: nSVM: synthesize correct EXITINTINFO on vmexit")
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/svm/nested.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index af0ef678433d..9b62113f0cf6 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -673,7 +673,7 @@ static void nested_save_pending_event_to_vmcb12(struct vcpu_svm *svm,
>  		}
>  
>  	} else if (vcpu->arch.nmi_injected) {
> -		exit_int_info = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
> +		exit_int_info = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI | NMI_VECTOR;
>  
>  	} else if (vcpu->arch.interrupt.injected) {
>  		nr = vcpu->arch.interrupt.nr;
> 
> base-commit: dea4f6380f4ec96e8f3b0aaf2343764bd0d25ef4
> -- 
> 2.56.0.307.g5fe7bd680c-goog
>