Define KVM_HC_VBS_VTL_CALL (hypercall 15) in the UAPI header and wire
it into the KVM x86 hypercall exit path so it reaches QEMU userspace.

This hypercall is used by the plane-0 guest VBS subsystem to issue
synchronous calls to the plane-1 secure kernel via a shared calling-area
(CAA) page, following the same pattern as KVM_HC_VM_PLANES_CONFIG/
ACTIVATE.

Changes:
- include/uapi/linux/kvm_para.h: Define KVM_HC_VBS_VTL_CALL = 15
- arch/x86/kvm/x86.c: Add to KVM_EXIT_HYPERCALL_VALID_MASK and to the
  userspace-exit case in ____kvm_emulate_hypercall()
- security/vbs/kvm_planes.c: Remove local #define of KVM_HC_VBS_VTL_CALL,
  add #include <linux/kvm_para.h> to pick up the UAPI definition
---
 arch/x86/kvm/x86.c            | 6 ++++--
 include/uapi/linux/kvm_para.h | 1 +
 security/vbs/kvm_planes.c     | 8 +-------
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index b7256f155bea..4b99016fe536 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -121,7 +121,8 @@ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
 
 #define KVM_EXIT_HYPERCALL_VALID_MASK (BIT(KVM_HC_MAP_GPA_RANGE) | \
 					 BIT(KVM_HC_VM_PLANES_CONFIG) | \
-					 BIT(KVM_HC_VM_PLANES_ACTIVATE))
+					 BIT(KVM_HC_VM_PLANES_ACTIVATE) | \
+					 BIT(KVM_HC_VBS_VTL_CALL))
 
 #define KVM_CAP_PMU_VALID_MASK KVM_PMU_CAP_DISABLE
 
@@ -10533,7 +10534,8 @@ int ____kvm_emulate_hypercall(struct kvm_vcpu *vcpu, int cpl,
 		return 0;
 	}
 	case KVM_HC_VM_PLANES_CONFIG:
-	case KVM_HC_VM_PLANES_ACTIVATE: {
+	case KVM_HC_VM_PLANES_ACTIVATE:
+	case KVM_HC_VBS_VTL_CALL: {
 		ret = -KVM_ENOSYS;
 		if (!user_exit_on_hypercall(vcpu->kvm, nr))
 			break;
diff --git a/include/uapi/linux/kvm_para.h b/include/uapi/linux/kvm_para.h
index 1b097f7ed937..1703238952fb 100644
--- a/include/uapi/linux/kvm_para.h
+++ b/include/uapi/linux/kvm_para.h
@@ -32,6 +32,7 @@
 #define KVM_HC_MAP_GPA_RANGE		12
 #define KVM_HC_VM_PLANES_CONFIG		13
 #define KVM_HC_VM_PLANES_ACTIVATE	14
+#define KVM_HC_VBS_VTL_CALL		15
 
 /*
  * hypercalls use architecture specific
diff --git a/security/vbs/kvm_planes.c b/security/vbs/kvm_planes.c
index 3eec3abb56ee..07a004712e9f 100644
--- a/security/vbs/kvm_planes.c
+++ b/security/vbs/kvm_planes.c
@@ -22,15 +22,9 @@
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/io.h>
+#include <linux/kvm_para.h>
 #include <asm/kvm_para.h>
 
-/* ── hypercall numbers for VBS VTL calls (plane-0 → plane-1) ──────────── */
-/*
- * These extend the existing KVM_HC_* numbering.  The host (KVM + QEMU)
- * intercepts them and routes them to the secure-kernel plane.
- */
-#define KVM_HC_VBS_VTL_CALL		15
-
 /* ── shared-memory calling area (modelled after the SVSM CAA) ─────── */
 
 /*
-- 
2.55.0