On Mon, Dec 13, 2021, Maxim Levitsky wrote:
> @@ -1486,6 +1485,12 @@ struct kvm_x86_ops {
> int (*complete_emulated_msr)(struct kvm_vcpu *vcpu, int err);
>
> void (*vcpu_deliver_sipi_vector)(struct kvm_vcpu *vcpu, u8 vector);
> +
> + /*
> + * Returns false if for some reason APICv (e.g guest mode)
> + * must be inhibited on this vCPU
Comment is wrong, code returns 'true' if AVIC is inhibited due to is_guest_mode().
Even better, rename the hook to something that's more self-documenting.
vcpu_is_apicv_inhibited() jumps to mind, but that's a bad name since it's not
called by kvm_vcpu_apicv_active(). Maybe vcpu_has_apicv_inhibit_condition()?
> + */
> + bool (*apicv_check_inhibit)(struct kvm_vcpu *vcpu);
> };
>
> struct kvm_x86_nested_ops {
> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c
> index 34f62da2fbadd..5a8304938f51e 100644
> --- a/arch/x86/kvm/svm/avic.c
> +++ b/arch/x86/kvm/svm/avic.c
> @@ -734,6 +734,11 @@ int svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
> return 0;
> }
>
> +bool avic_is_vcpu_inhibited(struct kvm_vcpu *vcpu)
This should follow whatever wording we decide on for the kvm_x86_ops hook. In
isolation, this name is too close to kvm_vcpu_apicv_active() and could be wrongly
assumed to mean that APICv is not inhibited for _any_ reason on this vCPU if it
returns false.
> +{
> + return is_guest_mode(vcpu);
> +}
> +
> bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
> {
> return false;
...
> @@ -4486,6 +4493,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = {
> .complete_emulated_msr = svm_complete_emulated_msr,
>
> .vcpu_deliver_sipi_vector = svm_vcpu_deliver_sipi_vector,
> + .apicv_check_inhibit = avic_is_vcpu_inhibited,
This can technically be NULL if nested=0.
> };
>
> /*
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index daa8ca84afccd..545684ea37353 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -590,6 +590,7 @@ void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
> void svm_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr);
> void svm_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr);
> int svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec);
> +bool avic_is_vcpu_inhibited(struct kvm_vcpu *vcpu);
> bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu);
> int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
> uint32_t guest_irq, bool set);
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 81a74d86ee5eb..125599855af47 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -9161,6 +9161,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool *req_immediate_exit)
> r = kvm_check_nested_events(vcpu);
> if (r < 0)
> goto out;
> +
> + /* Nested VM exit might need to update APICv status */
> + if (kvm_check_request(KVM_REQ_APICV_UPDATE, vcpu))
> + kvm_vcpu_update_apicv(vcpu);
> }
>
> /* try to inject new event if pending */
> @@ -9538,6 +9542,10 @@ void kvm_vcpu_update_apicv(struct kvm_vcpu *vcpu)
> down_read(&vcpu->kvm->arch.apicv_update_lock);
>
> activate = kvm_apicv_activated(vcpu->kvm);
> +
> + if (kvm_x86_ops.apicv_check_inhibit)
> + activate = activate && !kvm_x86_ops.apicv_check_inhibit(vcpu);
Might as well use Use static_call(). This would also be a candidate for
DEFINE_STATIC_CALL_RET0, though that's overkill if this is the only call site.
> +
> if (vcpu->arch.apicv_active == activate)
> goto out;
>
> @@ -9935,7 +9943,10 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
> * per-VM state, and responsing vCPUs must wait for the update
> * to complete before servicing KVM_REQ_APICV_UPDATE.
> */
> - WARN_ON_ONCE(kvm_apicv_activated(vcpu->kvm) != kvm_vcpu_apicv_active(vcpu));
> + if (!is_guest_mode(vcpu))
> + WARN_ON_ONCE(kvm_apicv_activated(vcpu->kvm) != kvm_vcpu_apicv_active(vcpu));
> + else
> + WARN_ON(kvm_vcpu_apicv_active(vcpu));
Won't this fire on VMX?
>
> exit_fastpath = static_call(kvm_x86_run)(vcpu);
> if (likely(exit_fastpath != EXIT_FASTPATH_REENTER_GUEST))
> --
> 2.26.3
>
