• Nadav Har'El's avatar
    KVM: nVMX: Correct handling of interrupt injection · b6f1250e
    Nadav Har'El authored
    The code in this patch correctly emulates external-interrupt injection
    while a nested guest L2 is running.
    
    Because of this code's relative un-obviousness, I include here a longer-than-
    usual justification for what it does - much longer than the code itself ;-)
    
    To understand how to correctly emulate interrupt injection while L2 is
    running, let's look first at what we need to emulate: How would things look
    like if the extra L0 hypervisor layer is removed, and instead of L0 injecting
    an interrupt, we had hardware delivering an interrupt?
    
    Now we have L1 running on bare metal with a guest L2, and the hardware
    generates an interrupt. Assuming that L1 set PIN_BASED_EXT_INTR_MASK to 1, and
    VM_EXIT_ACK_INTR_ON_EXIT to 0 (we'll revisit these assumptions below), what
    happens now is this: The processor exits from L2 to L1, with an external-
    interrupt exit reason but without an interrupt vector. L1 runs, with
    interrupts disabled, and it doesn't yet know what the interrupt was. Soon
    after, it enables interrupts and only at that moment, it gets the interrupt
    from the processor. when L1 is KVM, Linux handles this interrupt.
    
    Now we need exactly the same thing to happen when that L1->L2 system runs
    on top of L0, instead of real hardware. This is how we do this:
    
    When L0 wants to inject an interrupt, it needs to exit from L2 to L1, with
    external-interrupt exit reason (with an invalid interrupt vector), and run L1.
    Just like in the bare metal case, it likely can't deliver the interrupt to
    L1 now because L1 is running with interrupts disabled, in which case it turns
    on the interrupt window when running L1 after the exit. L1 will soon enable
    interrupts, and at that point L0 will gain control again and inject the
    interrupt to L1.
    
    Finally, there is an extra complication in the code: when nested_run_pending,
    we cannot return to L1 now, and must launch L2. We need to remember the
    interrupt we wanted to inject (and not clear it now), and do it on the
    next exit.
    
    The above explanation shows that the relative strangeness of the nested
    interrupt injection code in this patch, and the extra interrupt-window
    exit incurred, are in fact necessary for accurate emulation, and are not
    just an unoptimized implementation.
    
    Let's revisit now the two assumptions made above:
    
    If L1 turns off PIN_BASED_EXT_INTR_MASK (no hypervisor that I know
    does, by the way), things are simple: L0 may inject the interrupt directly
    to the L2 guest - using the normal code path that injects to any guest.
    We support this case in the code below.
    
    If L1 turns on VM_EXIT_ACK_INTR_ON_EXIT, things look very different from the
    description above: L1 expects to see an exit from L2 with the interrupt vector
    already filled in the exit information, and does not expect to be interrupted
    again with this interrupt. The current code does not (yet) support this case,
    so we do not allow the VM_EXIT_ACK_INTR_ON_EXIT exit-control to be turned on
    by L1.
    Signed-off-by: default avatarNadav Har'El <nyh@il.ibm.com>
    Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
    b6f1250e
vmx.c 197 KB