From: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> commit 7321f47eada53a395fb3086d49297eebb19e8e58 upstream. When TLB flush hypercalls (HVCALL_FLUSH_VIRTUAL_ADDRESS_{LIST,SPACE}_EX are issued in 'XMM fast' mode, the maximum number of allowed sparse_banks is not 'HV_HYPERCALL_MAX_XMM_REGISTERS - 1' (5) but twice as many (10) as each XMM register is 128 bit long and can hold two 64 bit long banks. Cc: stable@xxxxxxxxxxxxxxx # 5.14.x Fixes: 5974565bc26d ("KVM: x86: kvm_hv_flush_tlb use inputs from XMM registers") Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> Message-Id: <20220222154642.684285-4-vkuznets@xxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kvm/hyperv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -1820,7 +1820,8 @@ static u64 kvm_hv_flush_tlb(struct kvm_v if (!all_cpus) { if (hc->fast) { - if (sparse_banks_len > HV_HYPERCALL_MAX_XMM_REGISTERS - 1) + /* XMM0 is already consumed, each XMM holds two sparse banks. */ + if (sparse_banks_len > 2 * (HV_HYPERCALL_MAX_XMM_REGISTERS - 1)) return HV_STATUS_INVALID_HYPERCALL_INPUT; for (i = 0; i < sparse_banks_len; i += 2) { sparse_banks[i] = sse128_lo(hc->xmm[i / 2 + 1]); Patches currently in stable-queue which might be from vkuznets@xxxxxxxxxx are queue-5.15/kvm-x86-hyper-v-drop-redundant-ex-parameter-from-kvm_hv_flush_tlb.patch queue-5.15/kvm-x86-hyper-v-hvcall_send_ipi_ex-is-an-xmm-fast-hypercall.patch queue-5.15/kvm-x86-hyper-v-fix-the-maximum-number-of-sparse-banks-for-xmm-fast-tlb-flush-hypercalls.patch queue-5.15/kvm-x86-hyper-v-drop-redundant-ex-parameter-from-kvm_hv_send_ipi.patch