On Thu, Feb 06, 2025 at 10:27:12PM +0000, Vishal Annapurve wrote:
> Direct HLT instruction execution causes #VEs for TDX VMs which is routed
> to hypervisor via TDCALL. safe_halt() routines execute HLT in STI-shadow
> so IRQs need to remain disabled until the TDCALL to ensure that pending
> IRQs are correctly treated as wake events. So "sti;hlt" sequence needs to
> be replaced with "TDCALL; raw_local_irq_enable()" for TDX VMs.
>
> Commit bfe6ed0c6727 ("x86/tdx: Add HLT support for TDX guests")
> prevented the idle routines from using "sti;hlt". But it missed the
> paravirt routine which can be reached like this as an example:
> acpi_safe_halt() =>
> raw_safe_halt() =>
> arch_safe_halt() =>
> irq.safe_halt() =>
> pv_native_safe_halt()
>
> Modify tdx_safe_halt() to implement the sequence "TDCALL;
> raw_local_irq_enable()" and invoke tdx_halt() from idle routine which just
> executes TDCALL without changing state of interrupts.
>
> If CONFIG_PARAVIRT_XXL is disabled, "sti;hlt" sequences can still get
> executed from TDX VMs via paths like:
> acpi_safe_halt() =>
> raw_safe_halt() =>
> arch_safe_halt() =>
> native_safe_halt()
> There is a long term plan to fix these paths by carving out
> irq.safe_halt() outside paravirt framework.
I don't think it is acceptable to keep !PARAVIRT_XXL (read no-Xen) config
broken.
We need either move irq.safe_halt() out of PARAVIRT_XXL now or make
non-paravirt arch_safe_halt() to use TDCALL. Or if we don't care about
performance of !PARAVIRT_XXL config, special-case HLT in
exc_virtualization_exception().
--
Kiryl Shutsemau / Kirill A. Shutemov
