MIME-Version: 1.0
References: <20211207043100.3357474-1-marcorr@google.com> <c8889028-9c4e-cade-31b6-ea92a32e4f66@amd.com>
 <CAA03e5E7-ns7w9B9Tu7pSWzCo0Nh7Ba5jwQXcn_XYPf_reRq9Q@mail.gmail.com>
 <5e69c0ca-389c-3ace-7559-edd901a0ab3c@amd.com> <Ya+NIxO5pIkB8057@google.com>
In-Reply-To: <Ya+NIxO5pIkB8057@google.com>
From:   Marc Orr <marcorr@google.com>
Date:   Tue, 7 Dec 2021 09:28:29 -0800
Message-ID: <CAA03e5FYm1ZZc+OEiKjdDj6jnhvgcU_fwOpV5RxofChPEHp-+Q@mail.gmail.com>
Subject: Re: [PATCH] KVM: x86: Always set kvm_run->if_flag
To:     Sean Christopherson <seanjc@google.com>
Cc:     Tom Lendacky <Thomas.Lendacky@amd.com>, pbonzini@redhat.com,
        vkuznets@redhat.com, wanpengli@tencent.com, jmattson@google.com,
        joro@8bytes.org, tglx@linutronix.de, mingo@redhat.com,
        bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org,
        hpa@zytor.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Dec 7, 2021 at 8:34 AM Sean Christopherson <seanjc@google.com> wrote:
>
> On Tue, Dec 07, 2021, Tom Lendacky wrote:
> > On 12/7/21 9:14 AM, Marc Orr wrote:
> > > On Tue, Dec 7, 2021 at 6:43 AM Tom Lendacky <thomas.lendacky@amd.com> wrote:
> > > > > +static bool svm_get_if_flag(struct kvm_vcpu *vcpu)
> > > > > +{
> > > > > +     struct vmcb *vmcb = to_svm(vcpu)->vmcb;
> > > > > +
> > > > > +     return !!(vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK);
> > > >
> > > > I'm not sure if this is always valid to use for non SEV-ES guests. Maybe
> > > > the better thing would be:
> > > >
> > > >          return sev_es_guest(vcpu->kvm) ? vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK
> > > >                                         : kvm_get_rflags(vcpu) & X86_EFLAGS_IF;
> > > >
> > > > (Since this function returns a bool, I don't think you need the !!)
> > >
> > > I had the same reservations when writing the patch. (Why fix what's
> > > not broken.) The reason I wrote the patch this way is based on what I
> > > read in APM vol2: Appendix B Layout of VMCB: "GUEST_INTERRUPT_MASK -
> > > Value of the RFLAGS.IF bit for the guest."
> >
> > I just verified with the hardware team that this flag is indeed only set for
> > a guest with protected state (SEV-ES / SEV-SNP). An update to the APM will
> > be made.
>
> svm_interrupt_blocked() should be modified to use the new svm_get_if_flag()
> helper so that the SEV-{ES,SN} behavior is contained in a single location, e.g.
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 208566f63bce..fef04e9fa9c9 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3583,14 +3583,10 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu)
>         if (!gif_set(svm))
>                 return true;
>
> -       if (sev_es_guest(vcpu->kvm)) {
> -               /*
> -                * SEV-ES guests to not expose RFLAGS. Use the VMCB interrupt mask
> -                * bit to determine the state of the IF flag.
> -                */
> -               if (!(vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK))
> +       if (!is_guest_mode(vcpu)) {
> +               if (!svm_get_if_flag(vcpu))
>                         return true;
> -       } else if (is_guest_mode(vcpu)) {
> +       } else {
>                 /* As long as interrupts are being delivered...  */
>                 if ((svm->nested.ctl.int_ctl & V_INTR_MASKING_MASK)
>                     ? !(svm->vmcb01.ptr->save.rflags & X86_EFLAGS_IF)
> @@ -3600,9 +3596,6 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu)
>                 /* ... vmexits aren't blocked by the interrupt shadow  */
>                 if (nested_exit_on_intr(svm))
>                         return false;
> -       } else {
> -               if (!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF))
> -                       return true;
>         }
>
>         return (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK);

Agreed. This is a nice change. I'll incorporate it into v2. Thanks!