From: Naveen N Rao <naveen@kernel.org>
To: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Sean Christopherson <seanjc@google.com>,
Borislav Petkov <bp@alien8.de>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Paolo Bonzini <pbonzini@redhat.com>,
Nikunj A Dadhania <nikunj@amd.com>,
Neeraj Upadhyay <neeraj.upadhyay@amd.com>,
Tianyu Lan <tiala@microsoft.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Thomas Gleixner <tglx@kernel.org>
Subject: Re: [RFC PATCH v3 03/27] x86/kvm: Disable PV_SEND_IPI if Secure AVIC is enabled
Date: Tue, 14 Jul 2026 15:12:57 +0530 [thread overview]
Message-ID: <alX7QbNjf7FkXVRR@blrnaveerao1> (raw)
In-Reply-To: <c2712047-cf0d-43de-be42-fa7ae80277a4@amd.com>
On Mon, Jul 13, 2026 at 12:52:06PM -0500, Tom Lendacky wrote:
> On 7/8/26 01:32, Naveen N Rao (AMD) wrote:
> > In Secure AVIC mode, Linux does not allow IPIs to be injected as the
> > hypervisor is untrusted. This is achieved by not setting the IPI vector
> > in SAVIC_ALLOWED_IRR in the Secure AVIC guest APIC Backing page. Due to
> > this, PV_SEND_IPI cannot work since it needs KVM to be able to inject
> > IPIs into the guest. Disable the same.
>
> Another guest patch...
>
> Does this have an impact on the hypervisor? Is the injected IPI just
> ignored because of the SAVIC_ALLOWED_IRR? How would the hypervisor know
> that it needs to schedule the target vCPU if not using this, a write to
> the ICR?
No impact on the hypervisor. Previous KVM implementation relied on
disabling these at the hypervisor level, which is ok too. But, this
really should be a guest policy since PV_SEND_IPI can work if the guest
chooses to allow IPIs (via SAVIC_ALLOWED_IRR).
In the absence of this, guest will use the regular IPI path and go
through the savic driver, which will do a SVM_EXIT_MSR VMGEXIT to
request hypervisor assistance for IPI delivery.
- Naveen
next prev parent reply other threads:[~2026-07-14 9:51 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-08 6:31 [RFC PATCH v3 00/27] KVM: SVM: Add support for SEV-SNP Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:31 ` [RFC PATCH v3 01/27] x86/apic: Propagate APIC_SPIV writes to hv for " Naveen N Rao (AMD)
2026-07-10 2:03 ` Borislav Petkov
2026-07-10 15:02 ` Naveen N Rao
2026-07-11 4:37 ` Borislav Petkov
2026-07-13 17:38 ` Tom Lendacky
2026-07-14 8:57 ` Naveen N Rao
2026-07-08 6:32 ` [RFC PATCH v3 02/27] x86/apic: Drop savic_eoi() in favor of native_apic_msr_eoi() " Naveen N Rao (AMD)
2026-07-13 17:43 ` Tom Lendacky
2026-07-14 9:02 ` Naveen N Rao
2026-07-08 6:32 ` [RFC PATCH v3 03/27] x86/kvm: Disable PV_SEND_IPI if Secure AVIC is enabled Naveen N Rao (AMD)
2026-07-13 17:52 ` Tom Lendacky
2026-07-14 9:42 ` Naveen N Rao [this message]
2026-07-08 6:32 ` [RFC PATCH v3 04/27] x86/apic: Use AVIC_INCOMPLETE_IPI VMGEXIT for Secure AVIC IPI handling Naveen N Rao (AMD)
2026-07-13 17:59 ` Tom Lendacky
2026-07-14 10:03 ` Naveen N Rao
2026-07-08 6:32 ` [RFC PATCH v3 05/27] x86/cpufeatures: Add Secure AVIC CPU feature Naveen N Rao (AMD)
2026-07-13 18:32 ` Tom Lendacky
2026-07-08 6:32 ` [RFC PATCH v3 06/27] KVM: SVM: Add helper to check if Secure AVIC is enabled for a guest Naveen N Rao (AMD)
2026-07-13 18:35 ` Tom Lendacky
2026-07-08 6:32 ` [RFC PATCH v3 07/27] KVM: SVM: Set guest_apic_protected if Secure AVIC is enabled Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 08/27] kvm: irqfd: Have kvm_arch_has_irq_bypass() take struct kvm pointer Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 09/27] KVM: SVM: Disable IRQ bypass for Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 10/27] KVM: SVM: Add avic_ipiv_is_soft_disabled() as a wrapper around enable_ipiv Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 11/27] KVM: SVM: Disable IPIv for Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 12/27] KVM: SVM: Short-circuit a few AVIC flows " Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 13/27] KVM: SVM: Warn if we ever receive AVIC_UNACCELERATED_ACCESS #VMEXIT Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 14/27] KVM: SVM: Do not inhibit AVIC for SEV-SNP guests if Secure AVIC is enabled Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 15/27] KVM: SVM: Set VGIF in VMSA area for Secure AVIC guests Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 16/27] KVM: SVM: Add handler for VMGEXIT Secure AVIC NAE event Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 17/27] KVM: SVM: Do not intercept SECURE_AVIC_CONTROL MSR for Secure AVIC guests Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 18/27] KVM: x86: Add a new kvm_x86_op protected_apic_has_injectable_intr() Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 19/27] KVM: SVM: Implement kvm_x86_ops->protected_apic_has_injectable_intr() for Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 20/27] KVM: SVM: Implement kvm_x86_ops->protected_apic_has_interrupt() " Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 21/27] KVM: SVM: Add interrupt delivery support for Secure AVIC guests Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 22/27] KVM: SVM: Add support for incomplete IPI handling for Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 23/27] KVM: SVM: Add support for injecting NMIs for Secure AVIC guests Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 24/27] KVM: SVM: Mandate use of split irqchip for Secure AVIC Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 25/27] KVM: SVM: Do not inject exceptions " Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 26/27] KVM: SVM: Do not intercept exceptions for Secure AVIC guests Naveen N Rao (AMD)
2026-07-08 6:32 ` [RFC PATCH v3 27/27] KVM: SVM: Advertise Secure AVIC support for SEV-SNP guests Naveen N Rao (AMD)
2026-07-08 9:20 ` [RFC PATCH v3 00/27] KVM: SVM: Add support for SEV-SNP Secure AVIC Naveen N Rao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alX7QbNjf7FkXVRR@blrnaveerao1 \
--to=naveen@kernel.org \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=neeraj.upadhyay@amd.com \
--cc=nikunj@amd.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=tglx@kernel.org \
--cc=thomas.lendacky@amd.com \
--cc=tiala@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.