RFC KVM: SVM: Add support for SEV-SNP Secure AVIC

This is RFC v3 of the patches adding KVM support for Secure AVIC. RFC v2:
http://lore.kernel.org/r/[email protected]

There are significant changes throughout the series since the last RFC, with some of the highlights being:
- Integrate with AVIC code since Secure AVIC is APICv, but for protected APIC guests. This aligns with TDX which also requires APICv and enables reuse of APICv code paths in KVM. Patches #8 to #14.
- Mandate use of split irqchip, and drop changes related to the KVM IOAPIC. KVM PIC/PIT can't be supported (described more fully in the commit log of the relevant patches). Patch #24.
- Enable use of SVM_AVIC_INCOMPLETE_IPI VMGEXIT for vCPU notification request from the guest. Patch #22.
- Utilize vNMI injection path for NMI handling. Patch #23.
- Introduce a new kvm_x86_op to distinguish need for injectable interrupts vs. IPI notifications. Patches #18 and #19.
- Retain KVM PV ops, and instead require guests to opt-in/disable. Patch #3.

Patches #1 to #4 are changes to the guest x2APIC Secure AVIC driver.

These patches apply on top of Sean's recent fixes changing AVIC init code (since I was carrying a similar patch):
http://lore.kernel.org/r/[email protected]

There are still some rough edges to iron out, but I wanted to get some feedback on the overall direction. Please let me know if you see any major red flags.

Thanks,
- Naveen

Kishon Vijay Abraham I (2):
KVM: SVM: Set VGIF in VMSA area for Secure AVIC guests
KVM: SVM: Do not inject exceptions for Secure AVIC

Naveen N Rao (AMD) (20):
x86/apic: Drop savic_eoi() in favor of native_apic_msr_eoi() for
Secure AVIC
x86/kvm: Disable PV_SEND_IPI if Secure AVIC is enabled x86/apic: Use AVIC_INCOMPLETE_IPI VMGEXIT for Secure AVIC IPI handling
KVM: SVM: Add helper to check if Secure AVIC is enabled for a guest
KVM: SVM: Set guest_apic_protected if Secure AVIC is enabled
kvm: irqfd: Have kvm_arch_has_irq_bypass() take struct kvm pointer
KVM: SVM: Disable IRQ bypass for Secure AVIC
KVM: SVM: Add avic_ipiv_is_soft_disabled() as a wrapper around
enable_ipiv
KVM: SVM: Disable IPIv for Secure AVIC
KVM: SVM: Short-circuit a few AVIC flows for Secure AVIC
KVM: SVM: Warn if we ever receive AVIC_UNACCELERATED_ACCESS #VMEXIT
KVM: SVM: Do not inhibit AVIC for SEV-SNP guests if Secure AVIC is
enabled
KVM: x86: Add a new kvm_x86_op protected_apic_has_injectable_intr()
KVM: SVM: Implement kvm_x86_ops->protected_apic_has_injectable_intr()
for Secure AVIC
KVM: SVM: Implement kvm_x86_ops->protected_apic_has_interrupt() for
Secure AVIC
KVM: SVM: Add interrupt delivery support for Secure AVIC guests
KVM: SVM: Add support for incomplete IPI handling for Secure AVIC
KVM: SVM: Add support for injecting NMIs for Secure AVIC guests
KVM: SVM: Mandate use of split irqchip for Secure AVIC
KVM: SVM: Advertise Secure AVIC support for SEV-SNP guests

Neeraj Upadhyay (5):
x86/apic: Propagate APIC_SPIV writes to hv for Secure AVIC x86/cpufeatures: Add Secure AVIC CPU feature
KVM: SVM: Add handler for VMGEXIT Secure AVIC NAE event
KVM: SVM: Do not intercept SECURE_AVIC_CONTROL MSR for Secure AVIC
guests
KVM: SVM: Do not intercept exceptions for Secure AVIC guests

 arch/arm64/include/asm/kvm_host.h   |   2 +-
 arch/x86/include/asm/cpufeatures.h  |   1 +
 arch/x86/include/asm/kvm-x86-ops.h  |   1 +
 arch/x86/include/asm/kvm_host.h     |   9 +-
 arch/x86/include/asm/svm.h          |   9 +-
 arch/x86/include/uapi/asm/svm.h     |   1 +
 arch/x86/kvm/svm/svm.h              |  12 ++
 include/linux/kvm_host.h            |   2 +-
 arch/powerpc/kvm/powerpc.c          |   2 +-
 arch/x86/coco/sev/core.c            |  18 ++-
 arch/x86/kernel/apic/x2apic_savic.c |  36 +-----
 arch/x86/kernel/kvm.c               |   3 +-
 arch/x86/kvm/irq.c                  |   5 +-
 arch/x86/kvm/svm/avic.c             | 105 ++++++++++++++++--
 arch/x86/kvm/svm/sev.c              | 164 +++++++++++++++++++++++++++-
 arch/x86/kvm/svm/svm.c              |  59 ++++++++--
 arch/x86/kvm/vmx/posted_intr.c      |   2 +-
 arch/x86/kvm/x86.c                  |  21 +++-
 virt/kvm/eventfd.c                  |   2 +-
 19 files changed, 382 insertions(+), 72 deletions(-)

base-commit: 50406d35f5635e1cc523e61409d57e851b5f5df8
prerequisite-patch-id: 1428b4903537b426ee3822a74adf29fbbbeb8e02
prerequisite-patch-id: c88b0c2cb26fb85fc7ef07409aeaf643565b8600
prerequisite-patch-id: a3f8fc507b7809645b001e9394a51f8b299aae47

2.54.0