TDX only

Author: Jenna Goddard

openhcl/virt_mshv_vtl/src/lib.rs

@@ -1945,10 +1945,17 @@ impl UhPartition {
     }
 
     /// Trigger the LINT1 interrupt vector on the LAPIC of the BSP.
-    #[cfg(guest_arch = "x86_64")]
     pub fn assert_debug_interrupt(&self, vtl: u8) {
-        let bsp_index = VpIndex::new(0);
-        self.pulse_lint(bsp_index, Vtl::try_from(vtl).unwrap(), 1)
+        #[cfg(guest_arch = "x86_64")]
+        match self.inner.isolation {
+            IsolationType::Snp => {
+                tracing::error!(?vtl, "Debug interrupts cannot be injected into SNP VMs",);
+            }
+            _ => {
+                let bsp_index = VpIndex::new(0);
+                self.pulse_lint(bsp_index, Vtl::try_from(vtl).unwrap(), 1)
+            }
+        }
     }
 
     /// Enables or disables the PM timer assist.

openhcl/virt_mshv_vtl/src/processor/hardware_cvm/apic.rs

@@ -5,7 +5,6 @@
 
 use crate::UhProcessor;
 use crate::processor::HardwareIsolatedBacking;
-use crate::processor::NMI_SUPPRESS_LINT1_REQUESTED;
 use cvm_tracing::CVM_ALLOWED;
 use hcl::GuestVtl;
 use virt::Processor;
@@ -29,8 +28,6 @@ pub(crate) trait ApicBacking<'b, B: HardwareIsolatedBacking> {
     fn handle_extint(&mut self, vtl: GuestVtl) {
         tracelimit::warn_ratelimited!(CVM_ALLOWED, ?vtl, "extint not supported");
     }
-
-    fn supports_nmi_masking(&mut self) -> bool;
 }
 
 pub(crate) fn poll_apic_core<'b, B: HardwareIsolatedBacking, T: ApicBacking<'b, B>>(
@@ -56,7 +53,6 @@ pub(crate) fn poll_apic_core<'b, B: HardwareIsolatedBacking, T: ApicBacking<'b,
         extint,
         sipi,
         nmi,
-        lint1,
         interrupt,
     } = vp.backing.cvm_state_mut().lapics[vtl]
         .lapic
@@ -97,21 +93,10 @@ pub(crate) fn poll_apic_core<'b, B: HardwareIsolatedBacking, T: ApicBacking<'b,
     }
 
     // Interrupts are ignored while waiting for SIPI.
-    let supports_nmi_masking = apic_backing.supports_nmi_masking();
     let lapic = &mut apic_backing.vp().backing.cvm_state_mut().lapics[vtl];
     if lapic.activity != MpState::WaitForSipi {
-        if lint1 {
-            if supports_nmi_masking || !lapic.cross_vtl_nmi_requested {
-                lapic.nmi_suppression |= NMI_SUPPRESS_LINT1_REQUESTED;
-                lapic.nmi_pending = true;
-            }
-        }
-
-        if nmi {
+        if nmi || lapic.nmi_pending {
             lapic.nmi_pending = true;
-        }
-
-        if lapic.nmi_pending {
             apic_backing.handle_nmi(vtl);
         }
 

openhcl/virt_mshv_vtl/src/processor/hardware_cvm/mod.rs

@@ -2766,17 +2766,6 @@ impl<T, B: HardwareIsolatedBacking> hv1_hypercall::AssertVirtualInterrupt
             return Err(HvError::InvalidParameter);
         }
 
-        if matches!(
-            interrupt_control.interrupt_type(),
-            HvInterruptType::HvX64InterruptTypeNmi
-        ) {
-            // Note whether this is a cross-VTL NMI request.  If so, this must be
-            // visible before any NMIs are requested.
-            if self.intercepted_vtl == GuestVtl::Vtl1 && target_vtl == GuestVtl::Vtl0 {
-                self.vp.backing.cvm_state_mut().lapics[target_vtl].cross_vtl_nmi_requested = true;
-            }
-        }
-
         self.vp.partition.request_msi(
             target_vtl,
             MsiRequest::new_x86(

openhcl/virt_mshv_vtl/src/processor/mod.rs

@@ -154,21 +154,12 @@ impl VtlsTlbLocked {
     }
 }
 
-// NMI suppression state to prevent duplicate NMI
-#[cfg(guest_arch = "x86_64")]
-const NMI_SUPPRESS_LINT1_DELIVERED: u32 = 1;
-#[cfg(guest_arch = "x86_64")]
-const NMI_SUPPRESS_LINT1_REQUESTED: u32 = 1 << 1;
-
 #[cfg(guest_arch = "x86_64")]
 #[derive(Inspect)]
 pub(crate) struct LapicState {
     lapic: LocalApic,
     activity: MpState,
     nmi_pending: bool,
-    lint1_pending: bool,
-    nmi_suppression: u32,
-    cross_vtl_nmi_requested: bool,
 }
 
 #[cfg(guest_arch = "x86_64")]
@@ -178,9 +169,6 @@ impl LapicState {
             lapic,
             activity,
             nmi_pending: false,
-            lint1_pending: false,
-            nmi_suppression: 0,
-            cross_vtl_nmi_requested: false,
         }
     }
 }

openhcl/virt_mshv_vtl/src/processor/snp/mod.rs

@@ -22,8 +22,6 @@ use crate::UhCvmVpState;
 use crate::UhPartitionInner;
 use crate::UhPartitionNewParams;
 use crate::WakeReason;
-use crate::processor::NMI_SUPPRESS_LINT1_DELIVERED;
-use crate::processor::NMI_SUPPRESS_LINT1_REQUESTED;
 use crate::processor::UhHypercallHandler;
 use crate::processor::UhProcessor;
 use crate::processor::hardware_cvm::apic::ApicBacking;
@@ -886,20 +884,6 @@ impl<'b> ApicBacking<'b, SnpBacked> for UhProcessor<'b, SnpBacked> {
         // TODO SNP: support virtual NMI injection
         // For now, just inject an NMI and hope for the best.
         // Don't forget to update handle_cross_vtl_interrupts if this code changes.
-
-        if (self.backing.cvm.lapics[vtl].nmi_suppression & NMI_SUPPRESS_LINT1_DELIVERED) != 0 {
-            //  Cancel this NMI request since it cannot be delivered.
-            self.backing.cvm.lapics[vtl].nmi_pending = false;
-            return;
-        }
-
-        if (self.backing.cvm.lapics[vtl].nmi_suppression & NMI_SUPPRESS_LINT1_REQUESTED) != 0 {
-            // If a LINT1 NMI has been requested, then it is being delivered now,
-            // so no further NMIs can be delivered.
-            self.backing.cvm.lapics[vtl].nmi_suppression &= !NMI_SUPPRESS_LINT1_REQUESTED;
-            self.backing.cvm.lapics[vtl].nmi_suppression |= NMI_SUPPRESS_LINT1_DELIVERED;
-        }
-
         let mut vmsa = self.runner.vmsa_mut(vtl);
 
         // TODO GUEST VSM: Don't inject the NMI if there's already an event
@@ -921,10 +905,6 @@ impl<'b> ApicBacking<'b, SnpBacked> for UhProcessor<'b, SnpBacked> {
         vmsa.set_rip(0);
         self.backing.cvm.lapics[vtl].activity = MpState::Running;
     }
-
-    fn supports_nmi_masking(&mut self) -> bool {
-        false
-    }
 }
 
 impl UhProcessor<'_, SnpBacked> {

openhcl/virt_mshv_vtl/src/processor/tdx/mod.rs

@@ -1459,10 +1459,6 @@ impl<'b> hardware_cvm::apic::ApicBacking<'b, TdxBacked> for TdxApicScanner<'_, '
         self.vp.backing.vtls[vtl].private_regs.rip = 0;
         self.vp.backing.cvm.lapics[vtl].activity = MpState::Running;
     }
-
-    fn supports_nmi_masking(&mut self) -> bool {
-        true
-    }
 }
 
 impl UhProcessor<'_, TdxBacked> {

vmm_core/virt_support_apic/src/lib.rs

@@ -123,7 +123,6 @@ struct Stats {
     eoi_level: Counter,
     spurious_eoi: Counter,
     lazy_eoi: Counter,
-    lint1: Counter,
     interrupt: Counter,
     nmi: Counter,
     extint: Counter,
@@ -231,8 +230,7 @@ struct WorkFlags {
     sipi_vector: u8,
     extint: bool,
     nmi: bool,
-    lint1: bool,
-    #[bits(19)]
+    #[bits(20)]
     _rsvd: u32,
 }
 
@@ -442,23 +440,13 @@ impl LocalApicSet {
                     // Don't know how to manage remote IRR.
                     return;
                 }
-                if lint_index == 1 {
-                    slot.request_lint1(
-                        DeliveryMode(lvt.delivery_mode()),
-                        lvt.vector(),
-                        lvt.trigger_mode_level(),
-                        false,
-                        wake,
-                    );
-                } else {
-                    slot.request_interrupt(
-                        DeliveryMode(lvt.delivery_mode()),
-                        lvt.vector(),
-                        lvt.trigger_mode_level(),
-                        false,
-                        wake,
-                    );
-                }
+                slot.request_interrupt(
+                    DeliveryMode(lvt.delivery_mode()),
+                    lvt.vector(),
+                    lvt.trigger_mode_level(),
+                    false,
+                    wake,
+                );
             }
         }
     }
@@ -1235,38 +1223,6 @@ impl SharedState {
             _ => false,
         }
     }
-
-    /// Returns true if the VP should be woken up to scan the APIC.
-    #[must_use]
-    fn request_lint1(
-        &self,
-        software_enabled: bool,
-        delivery_mode: DeliveryMode,
-        vector: u8,
-        level_triggered: bool,
-        auto_eoi: bool,
-    ) -> bool {
-        match delivery_mode {
-            DeliveryMode::NMI => {
-                let old = self
-                    .work
-                    .fetch_update(Ordering::Release, Ordering::Relaxed, |w| {
-                        Some(WorkFlags::from(w).with_lint1(true).into())
-                    })
-                    .unwrap();
-                old == 0
-            }
-            _ => {
-                return self.request_interrupt(
-                    software_enabled,
-                    delivery_mode,
-                    vector,
-                    level_triggered,
-                    auto_eoi,
-                );
-            }
-        }
-    }
 }
 
 impl MutableGlobalState {
@@ -1327,29 +1283,6 @@ impl ApicSlot {
             }
         }
     }
-
-    fn request_lint1(
-        &self,
-        delivery_mode: DeliveryMode,
-        vector: u8,
-        level_triggered: bool,
-        auto_eoi: bool,
-        wake: impl FnOnce(VpIndex),
-    ) {
-        if let Some(shared) = &self.shared {
-            if self.hardware_enabled
-                && shared.request_lint1(
-                    self.software_enabled,
-                    delivery_mode,
-                    vector,
-                    level_triggered,
-                    auto_eoi,
-                )
-            {
-                wake(shared.vp_index);
-            }
-        }
-    }
 }
 
 /// Work to do as a result of [`LocalApic::scan`] or [`LocalApic::flush`].
@@ -1372,8 +1305,6 @@ pub struct ApicWork {
     pub extint: bool,
     /// An NMI was requested.
     pub nmi: bool,
-    /// LINT1 was requested.
-    pub lint1: bool,
     /// A fixed interrupt was requested.
     ///
     /// Call [`LocalApic::acknowledge_interrupt`] after it has been injected.
@@ -1643,10 +1574,6 @@ impl LocalApic {
             self.stats.nmi.increment();
             r.nmi = true;
         }
-        if work.lint1() {
-            self.stats.lint1.increment();
-            r.lint1 = true;
-        }
         if work.extint() {
             self.stats.extint.increment();
             r.extint = true;