Take some refactorings and add a dirty hack

openhcl/underhill_mem/src/lib.rs

@@ -375,13 +375,24 @@ struct HypercallOverlay {
     permissions: GpaVtlPermissions,
 }
 
+// TODO CVM GUEST VSM: This needs to go away, but resolving the layering with
+// hv1_emulator is complicated.
+struct NoOpTlbFlushLockAccess;
+impl TlbFlushLockAccess for NoOpTlbFlushLockAccess {
+    fn flush(&mut self, _vtl: GuestVtl) {}
+    fn flush_entire(&mut self) {}
+    fn set_wait_for_tlb_locks(&mut self, _vtl: GuestVtl) {}
+}
+
 impl VtlProtectHypercallOverlay for HypercallOverlayProtector {
     fn change_overlay(&self, gpn: u64) {
-        self.protector.change_hypercall_overlay(self.vtl, gpn)
+        self.protector
+            .change_hypercall_overlay(self.vtl, gpn, &mut NoOpTlbFlushLockAccess)
     }
 
     fn disable_overlay(&self) {
-        self.protector.disable_hypercall_overlay(self.vtl)
+        self.protector
+            .disable_hypercall_overlay(self.vtl, &mut NoOpTlbFlushLockAccess)
     }
 }
 
@@ -834,7 +845,7 @@ impl ProtectIsolatedMemory for HardwareIsolatedMemoryProtector {
             .apply_protections_from_flags(
                 MemoryRange::new(gpn * HV_PAGE_SIZE..(gpn + 1) * HV_PAGE_SIZE),
                 vtl,
-                HV_MAP_GPA_PERMISSIONS_ALL,
+                HV_MAP_GPA_PERMISSIONS_ALL.with_writable(false),
             )
             .expect("applying vtl protections should succeed");
 

openhcl/virt_mshv_vtl/src/processor/hardware_cvm/mod.rs

@@ -29,12 +29,14 @@ use hvdef::HvMapGpaFlags;
 use hvdef::HvRegisterVsmPartitionConfig;
 use hvdef::HvRegisterVsmVpSecureVtlConfig;
 use hvdef::HvResult;
+use hvdef::HvSynicSint;
 use hvdef::HvVtlEntryReason;
 use hvdef::HvX64RegisterName;
 use hvdef::Vtl;
 use std::iter::zip;
 use virt::io::CpuIo;
 use virt::vp::AccessVpState;
+use virt::x86::MsrError;
 use virt::Processor;
 use virt_support_x86emu::emulate::TranslateGvaSupport;
 use virt_support_x86emu::translate::TranslateCachingInfo;
@@ -1194,6 +1196,33 @@ impl<B: HardwareIsolatedBacking> UhProcessor<'_, B>
 where
     Self: TlbFlushLockAccess,
 {
+    pub(crate) fn write_msr_cvm(
+        &mut self,
+        msr: u32,
+        value: u64,
+        vtl: GuestVtl,
+    ) -> Result<(), MsrError> {
+        let hv = &mut self.backing.cvm_state_mut().hv[vtl];
+        // If updated is Synic MSR, then check if its proxy or previous was proxy
+        // in either case, we need to update the `proxy_irr_blocked`
+        let mut irr_filter_update = false;
+        if matches!(msr, hvdef::HV_X64_MSR_SINT0..=hvdef::HV_X64_MSR_SINT15) {
+            let sint_curr = HvSynicSint::from(hv.synic.sint((msr - hvdef::HV_X64_MSR_SINT0) as u8));
+            let sint_new = HvSynicSint::from(value);
+            if sint_curr.proxy() || sint_new.proxy() {
+                irr_filter_update = true;
+            }
+        }
+        let r = hv.msr_write(msr, value);
+        if !matches!(r, Err(MsrError::Unknown)) {
+            // Check if proxy filter update was required (in case of SINT writes)
+            if irr_filter_update {
+                self.update_proxy_irr_filter(vtl);
+            }
+        }
+        r
+    }
+
     fn set_vsm_partition_config(
         &mut self,
         value: HvRegisterVsmPartitionConfig,

openhcl/virt_mshv_vtl/src/processor/mod.rs

@@ -950,30 +950,6 @@ impl<'a, T: Backing> UhProcessor<'a, T> {
 
     #[cfg(guest_arch = "x86_64")]
     fn write_msr(&mut self, msr: u32, value: u64, vtl: GuestVtl) -> Result<(), MsrError> {
-        if msr & 0xf0000000 == 0x40000000 {
-            if let Some(hv) = self.backing.hv_mut(vtl).as_mut() {
-                // If updated is Synic MSR, then check if its proxy or previous was proxy
-                // in either case, we need to update the `proxy_irr_blocked`
-                let mut irr_filter_update = false;
-                if matches!(msr, hvdef::HV_X64_MSR_SINT0..=hvdef::HV_X64_MSR_SINT15) {
-                    let sint_curr =
-                        HvSynicSint::from(hv.synic.sint((msr - hvdef::HV_X64_MSR_SINT0) as u8));
-                    let sint_new = HvSynicSint::from(value);
-                    if sint_curr.proxy() || sint_new.proxy() {
-                        irr_filter_update = true;
-                    }
-                }
-                let r = hv.msr_write(msr, value);
-                if !matches!(r, Err(MsrError::Unknown)) {
-                    // Check if proxy filter update was required (in case of SINT writes)
-                    if irr_filter_update {
-                        self.update_proxy_irr_filter(vtl);
-                    }
-                    return r;
-                }
-            }
-        }
-
         match msr {
             hvdef::HV_X64_MSR_GUEST_CRASH_CTL => {
                 self.crash_control = hvdef::GuestCrashCtl::from(value);

openhcl/virt_mshv_vtl/src/processor/snp/mod.rs

@@ -1037,9 +1037,10 @@ impl UhProcessor<'_, SnpBacked> {
                             vtl: entered_from_vtl,
                         })
                         .msr_write(msr, value)
+                        .or_else_if_unknown(|| self.write_msr_cvm(msr, value, entered_from_vtl))
                         .or_else_if_unknown(|| self.write_msr(msr, value, entered_from_vtl))
                         .or_else_if_unknown(|| {
-                            self.write_msr_cvm(dev, msr, value, entered_from_vtl)
+                            self.write_msr_snp(dev, msr, value, entered_from_vtl)
                         });
 
                     match r {
@@ -2101,7 +2102,7 @@ impl UhProcessor<'_, SnpBacked> {
         Ok(value)
     }
 
-    fn write_msr_cvm(
+    fn write_msr_snp(
         &mut self,
         _dev: &impl CpuIo,
         msr: u32,

openhcl/virt_mshv_vtl/src/processor/tdx/mod.rs

@@ -1601,8 +1601,9 @@ impl UhProcessor<'_, TdxBacked> {
                         vtl: intercepted_vtl,
                     })
                     .msr_write(msr, value)
+                    .or_else_if_unknown(|| self.write_msr_cvm(msr, value, intercepted_vtl))
                     .or_else_if_unknown(|| self.write_msr(msr, value, intercepted_vtl))
-                    .or_else_if_unknown(|| self.write_msr_cvm(msr, value, intercepted_vtl));
+                    .or_else_if_unknown(|| self.write_msr_tdx(msr, value, intercepted_vtl));
 
                 let inject_gp = match result {
                     Ok(()) => false,
@@ -2109,7 +2110,7 @@ impl UhProcessor<'_, TdxBacked> {
         }
     }
 
-    fn write_msr_cvm(&mut self, msr: u32, value: u64, vtl: GuestVtl) -> Result<(), MsrError> {
+    fn write_msr_tdx(&mut self, msr: u32, value: u64, vtl: GuestVtl) -> Result<(), MsrError> {
         let state = &mut self.backing.vtls[vtl].private_regs;
 
         match msr {