[RFC PATCH v3 03/27] x86/kvm: Disable PV_SEND_IPI if Secure AVIC is enabled

[Naveen N Rao (AMD)]

In Secure AVIC mode, Linux does not allow IPIs to be injected as the
hypervisor is untrusted. This is achieved by not setting the IPI vector
in SAVIC_ALLOWED_IRR in the Secure AVIC guest APIC Backing page. Due to
this, PV_SEND_IPI cannot work since it needs KVM to be able to inject
IPIs into the guest. Disable the same.

On a related note, PV_EOI does not need to be disabled since the
behavior is exactly the same as AVIC: though it is advertised, KVM never
"enables" it since APICv is always enabled for Secure AVIC SEV-SNP
guests.

Fixes: c4074ab87f34 ("x86/apic: Enable Secure AVIC in the control MSR")
Signed-off-by: Naveen N Rao (AMD) <naveen@xxxxxxxxxx>
---
 arch/x86/kernel/kvm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 29226d112029..e2dad507f2a4 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -495,7 +495,8 @@ static bool pv_tlb_flush_supported(void)
 static bool pv_ipi_supported(void)
 {
 	return (kvm_para_has_feature(KVM_FEATURE_PV_SEND_IPI) &&
-	       (num_possible_cpus() != 1));
+		(num_possible_cpus() != 1) &&
+		!cc_platform_has(CC_ATTR_SNP_SECURE_AVIC));
 }
 
 static bool pv_sched_yield_supported(void)
-- 
2.54.0