KVM: nVMX: Emulate HLT in L2 if it's not intercepted

Extend VMX's nested intercept logic for emulated instructions to handle
HLT interception, primarily for testing purposes.  Failure to allow
emulation of HLT isn't all that interesting, as emulating HLT while L2 is
active either requires forced emulation (and no #UD intercept in L1), TLB
games in the guest to coerce KVM into emulating the wrong instruction, or
a bug elsewhere in KVM.

E.g. without commit 47ef3ef843c0 ("KVM: VMX: Handle event vectoring
error in check_emulate_instruction()"), KVM can end up trying to emulate
HLT if RIP happens to point at a HLT when a vectored event arrives with
L2's IDT pointing at emulated MMIO.

Note, vmx_check_intercept() is still broken when L1 wants to intercept an
instruction, as KVM injects a #UD instead of synthesizing a nested VM-Exit.
That issue extends far beyond HLT, punt on it for now.

Link: https://lore.kernel.org/r/20250201015518.689704-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index f03d1dc63de05d1ddefe58af078f4a7cad27e4a4..c844107e046662ac4de4616ab79d5785f744c15f 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8083,6 +8083,11 @@ int vmx_check_intercept(struct kvm_vcpu *vcpu,
                /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED.  */
                break;
 
+       case x86_intercept_hlt:
+               if (!nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING))
+                       return X86EMUL_CONTINUE;
+               break;
+
        case x86_intercept_pause:
                /*
                 * PAUSE is a single-byte NOP with a REPE prefix, i.e. collides