KVM: SVM: Handle HLT intercept when Restricted Injection is enabled.
A message that is not in the archive (sent off-list or not yet received): [email protected]
RFC PATCH v5 6/8 KVM: SVM: Handle HLT intercept when Restricted Injection is enabled.
With SEV-SNP Restricted Injection enabled, #HV events are delivered without regard to interrupt shadows, causing guests to lose control over the interaction between HLT and interrupts. Under this convention, a guest entering a halt state executes HLT with interrupts disabled rather than checking pending interrupt state or enabling interrupts first. If the host intercepts HLT while the guest has any interrupts or non-maskable events pending, KVM must immediately re-enter the guest.
Intercept HLT when Restricted Injection is enabled, immediately re-enter the guest if any pending events including the pending events in the HV doorbell page exist.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/svm/sev.c | 19 +++++++++++++ arch/x86/kvm/svm/svm.c | 44 ++++++++++++++++++++++++++++++ arch/x86/kvm/svm/svm.h | 2 ++ arch/x86/kvm/x86.c | 3 ++ 6 files changed, 70 insertions(+)
arch/x86/include/asm/kvm-x86-ops.h +1 -0
@@ -98,6 +98,7 @@ KVM_X86_OP_OPTIONAL_RET0(set_identity_map_addr) KVM_X86_OP_OPTIONAL_RET0(get_mt_mask) KVM_X86_OP_OPTIONAL_RET0(tdp_has_smep) KVM_X86_OP_OPTIONAL_RET0(is_noack_required) +KVM_X86_OP_OPTIONAL_RET0(hv_doorbell_has_events) KVM_X86_OP(load_mmu_pgd) KVM_X86_OP_OPTIONAL_RET0(set_external_spte) KVM_X86_OP_OPTIONAL(free_external_spt)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -1620,6 +1620,7 @@ struct kvm_x86_ops {void (*enable_irq_window)(struct kvm_vcpu *vcpu);void (*update_cr8_intercept)(struct kvm_vcpu *vcpu,int tpr,int irr);bool (*is_noack_required)(struct kvm_vcpu *vcpu); +bool (*hv_doorbell_has_events)(struct kvm_vcpu *vcpu);const bool x2apic_icr_is_split;const unsigned long required_apicv_inhibits;bool allow_apicv_in_x2apic_without_x2apic_virtualization;
arch/x86/kvm/svm/sev.c +19 -0
@@ -5748,3 +5748,22 @@ void sev_snp_update_ri_status(struct kvm_vcpu *vcpu)unmap_hvdb (vcpu, &hvdb_map); } + +bool sev_snp_hvdb_has_events (struct kvm_vcpu *vcpu) +{ +struct kvm_host_map hvdb_map; +struct hvdb *hvdb; +bool has_events; + + hvdb =map_hvdb (vcpu, &hvdb_map); +if (!hvdb) { +WARN_ONCE (1 ,"Restricted Injection enabled, hvdb page mapping failed\n" ); +return false; + } + + has_events = hvdb->events.vector || hvdb->events.nmi || hvdb->events.mce; + +unmap_hvdb (vcpu, &hvdb_map); + +return has_events; +}
arch/x86/kvm/svm/svm.c +44 -0
56 lines not on this page · raw message
arch/x86/kvm/svm/svm.h +2 -0
@@ -1035,6 +1035,7 @@ void sev_snp_cancel_injection(struct kvm_vcpu *vcpu);bool sev_snp_blocked (enum inject_type type,struct kvm_vcpu *vcpu);void sev_snp_update_ri_status (struct kvm_vcpu *vcpu);void sev_snp_handle_ri_ack (struct kvm_vcpu *vcpu,struct hvdb *hvdb,int num_pending); +bool sev_snp_hvdb_has_events (struct kvm_vcpu *vcpu);static inline bool sev_snp_is_rinj_active (struct kvm_vcpu *vcpu) {struct kvm_sev_info *sev =to_kvm_sev_info (vcpu->kvm);
@@ -1076,6 +1077,7 @@ static inline void sev_snp_cancel_injection(struct kvm_vcpu *vcpu) {}static inline bool sev_snp_blocked (enum inject_type type,struct kvm_vcpu *vcpu) {return false; }static inline void sev_snp_update_ri_status (struct kvm_vcpu *vcpu)i {};static inline void sev_snp_handle_ri_ack (struct kvm_vcpu *vcpu,struct hvdb *hvdb,int num_pending) {}; +static inline bool sev_snp_hvdb_has_events (struct kvm_vcpu *vcpu) {return false; }static inline bool sev_snp_is_rinj_active (struct kvm_vcpu *vcpu) {return false; }#endif
arch/x86/kvm/x86.c +3 -0
@@ -8515,6 +8515,9 @@ static bool kvm_vcpu_running(struct kvm_vcpu *vcpu)bool kvm_vcpu_has_events (struct kvm_vcpu *vcpu) { +if (kvm_x86_call (hv_doorbell_has_events)(vcpu)) +return true; +if (!list_empty_careful (&vcpu->async_pf.done))return true;
Signature · 1 line
2.43.0