[RFC PATCH v5 4/8] KVM: SVM: Inject NMIs when Restricted Injection is active

[Melody Wang <huibo.wang@amd.com>]

When Restricted Injection is active, only #HV exceptions can be injected
into the SEV-SNP guest.

Detect that, and then follow the #HV doorbell communication from the GHCB
specification to inject NMIs.

Co-developed-by: Thomas Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Thomas Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Melody Wang <huibo.wang@amd.com>
---
 arch/x86/kvm/svm/sev.c | 14 +++++++++++---
 arch/x86/kvm/svm/svm.c |  8 ++++++++
 arch/x86/kvm/svm/svm.h |  1 +
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index e4a074df7434..f80dfd876d5e 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -5565,8 +5565,12 @@ static void __sev_snp_inject(enum inject_type type, struct kvm_vcpu *vcpu)
 		return;
 	}
 
-	hvdb->events.vector = vcpu->arch.interrupt.nr;
-	svm->sev_es.pending_vector = vcpu->arch.interrupt.nr;
+	if (type == INJECT_NMI) {
+		hvdb->events.nmi = 1;
+	} else if (type == INJECT_IRQ) {
+		hvdb->events.vector = vcpu->arch.interrupt.nr;
+		svm->sev_es.pending_vector = vcpu->arch.interrupt.nr;
+	}
 
 	prepare_hv_injection(svm, hvdb);
 
@@ -5675,6 +5679,8 @@ void sev_snp_cancel_injection(struct kvm_vcpu *vcpu)
 	if (hvdb->events.vector)
 		svm->vmcb->control.event_inj |= hvdb->events.vector |
 						SVM_EVTINJ_TYPE_INTR;
+	if (hvdb->events.nmi)
+		svm->vmcb->control.event_inj |= SVM_EVTINJ_TYPE_NMI;
 
 	hvdb->events.no_further_signal = 0;
 	svm->sev_es.cancel_flag = true;
@@ -5696,7 +5702,9 @@ bool sev_snp_blocked(enum inject_type type, struct kvm_vcpu *vcpu)
 		return true;
 
 	/* Indicate interrupts blocked based on guest acknowledgment */
-	if (type == INJECT_IRQ) {
+	if (type == INJECT_NMI)
+		blocked = hvdb->events.nmi;
+	else if (type == INJECT_IRQ) {
 		irq = kvm_cpu_get_interrupt(vcpu);
 		if (irq < hvdb->events.vector && hvdb->events.vector)
 			blocked = !!hvdb->events.vector;
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 601807a8f2fa..75e86592f1c9 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3795,6 +3795,9 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
+	if (sev_snp_inject(INJECT_NMI, vcpu))
+		goto status;
+
 	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
 
 	if (svm->nmi_l1_to_l2)
@@ -3809,6 +3812,8 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 		svm->nmi_masked = true;
 		svm_set_iret_intercept(svm);
 	}
+
+status:
 	++vcpu->stat.nmi_injections;
 }
 
@@ -4025,6 +4030,9 @@ bool svm_nmi_blocked(struct kvm_vcpu *vcpu)
 	if (!gif_set(svm))
 		return true;
 
+	if (sev_snp_is_rinj_active(vcpu))
+		return sev_snp_blocked(INJECT_NMI, vcpu);
+
 	if (is_guest_mode(vcpu) && nested_exit_on_nmi(svm))
 		return false;
 
diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index f0db48d62fcf..2909f57508de 100644
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -60,6 +60,7 @@ extern struct kvm_x86_ops svm_x86_ops __initdata;
 
 enum inject_type {
 	INJECT_IRQ,
+	INJECT_NMI,
 };
 
 /*
-- 
2.43.0