NMI for CVM in OpenHCL #2049
NMI for CVM in OpenHCL #2049
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR implements NMI support for CVM (Confidential Virtual Machine) in OpenHCL by adding LINT1 interrupt handling capability. The implementation allows for debug interrupt injection through the Guest Emulation Transport (GET) protocol.
Key changes include:
- Added LINT1 interrupt support to the Local APIC implementation
- Extended GET protocol with debug interrupt notification capability
- Implemented NMI masking and suppression logic for hardware-backed CVMs
Reviewed Changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| vmm_core/virt_support_apic/src/lib.rs | Added LINT1 interrupt support including statistics, work flags, and request handling |
| vm/devices/get/guest_emulation_transport/src/process_loop.rs | Added debug interrupt notification handling and callback storage |
| vm/devices/get/guest_emulation_transport/src/client.rs | Added client method to set debug interrupt callback |
| vm/devices/get/get_protocol/src/lib.rs | Extended protocol with InjectDebugInterruptNotification structure |
| openhcl/virt_mshv_vtl/src/processor/tdx/mod.rs | Added NMI masking support for TDX processors |
| openhcl/virt_mshv_vtl/src/processor/snp/mod.rs | Added NMI suppression logic for SNP processors |
| openhcl/virt_mshv_vtl/src/processor/mod.rs | Added LAPIC state fields for NMI and LINT1 handling |
| openhcl/virt_mshv_vtl/src/processor/hardware_cvm/mod.rs | Added cross-VTL NMI tracking |
| openhcl/virt_mshv_vtl/src/processor/hardware_cvm/apic.rs | Implemented LINT1 and NMI handling with masking support |
| openhcl/virt_mshv_vtl/src/lib.rs | Added assert_debug_interrupt method to trigger LINT1 |
| openhcl/underhill_core/src/worker.rs | Connected GET callback to partition's debug interrupt method |
Comments suppressed due to low confidence (1)
vm/devices/get/guest_emulation_transport/src/process_loop.rs:1
- Corrected duplicate word 'the the' to 'the'.
// Copyright (c) Microsoft Corporation.
| ); | ||
| } | ||
|
|
||
| // Set the the callback in GET to trigger the debug interrupt. |
There was a problem hiding this comment.
Corrected duplicate word 'the the' to 'the'.
| // Set the the callback in GET to trigger the debug interrupt. | |
| // Set the callback in GET to trigger the debug interrupt. |
Copilot uses AI. Check for mistakes.
|
|
||
| /// Trigger the LINT1 interrupt vector on the LAPIC of the BSP. | ||
| pub fn assert_debug_interrupt(&self, _vtl: u8) { | ||
| #[cfg(guest_arch = "x86_64")] |
There was a problem hiding this comment.
This whole function should be cfg'd, instead of just the inside, since by definition it requires x86 hardware.
| auto_eoi: bool, | ||
| ) -> bool { | ||
| match delivery_mode { | ||
| DeliveryMode::NMI => { |
There was a problem hiding this comment.
Could all this code duplication be removed if we just passed lint_index down through to request_interrupt and put an if in the NMI branch? Would that be cleaner?
| ); | ||
|
|
||
| if notification.vtl != 0 { | ||
| return Err(FatalError::InjectDebugInterruptError { |
There was a problem hiding this comment.
Does this really need to be a fatal condition? That would result in tearing down the vm.
There was a problem hiding this comment.
Also can we not support injection into VTL 1?
| } | ||
|
|
||
| // Trigger the LINT1 interrupt vector on the LAPIC of the BSP. | ||
| self.set_debug_interrupt |
There was a problem hiding this comment.
If no callback has been set we should probably trace a warning or something instead of silently doing nothing?
|
|
||
| // NMI suppression state to prevent duplicate NMI | ||
| #[cfg(guest_arch = "x86_64")] | ||
| const NMI_SUPPRESS_LINT1_DELIVERED: u32 = 1; |
There was a problem hiding this comment.
These and nmi_suppression should be combined into a bitfield type
| // If a LINT1 NMI has been requested, then it is being delivered now, | ||
| // so no further NMIs can be delivered. | ||
| self.backing.cvm.lapics[vtl].nmi_suppression &= !NMI_SUPPRESS_LINT1_REQUESTED; | ||
| self.backing.cvm.lapics[vtl].nmi_suppression |= NMI_SUPPRESS_LINT1_DELIVERED; |
There was a problem hiding this comment.
Maybe I missed it, but where do we clear DELIVERED?
No description provided.