Interrupt Security for Virtual Machines and Guest Environments: AMD SEV-SNP Restricted and Alternate Interrupt Injection

Abstract

Encrypting a virtual machine's memory addresses only one dimension of the confidential computing security problem. When the hypervisor retains architectural control over interrupt delivery, a malicious or compromised hypervisor can exploit interrupt injection to undermine the confidentiality and integrity guarantees that confidential virtual machines are designed to provide. Guest operating systems carry deep assumptions about interrupt behavior rooted in bare-metal execution, and violating those assumptions, even for a single instruction cycle, can place the guest kernel in states that neither hardware designers nor operating system developers planned for. AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) confronts this problem through two mutually exclusive hardware-enforced mechanisms: Restricted Interrupt Injection and Alternate Interrupt Injection. This article examines the architectural motivation for interrupt security, the design of the HV Doorbell Page (HVDB), the full interrupt delivery flow from the KVM hypervisor through to the Linux guest kernel, interrupt shadow handling, system vector dispatch optimization, preemption issues causing guest hangs at interrupt exit, and nested exception detection. The treatment connects each mechanism to published attacks, including the HECKLER interrupt injection exploit, and addresses the specific difficulties that have so far prevented upstream Linux kernel acceptance of the Restricted Injection implementation.