Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
Date:   Tue, 10 Oct 2023 07:46:19 -0700
In-Reply-To: <e348e75dac85efce9186b6b10a6da1c6532a3378.camel@redhat.com>
Mime-Version: 1.0
References: <20231009212919.221810-1-seanjc@google.com> <e348e75dac85efce9186b6b10a6da1c6532a3378.camel@redhat.com>
Message-ID: <ZSVju-lerDbxwamL@google.com>
Subject: Re: [PATCH] KVM: SVM: Don't intercept IRET when injecting NMI and
 vNMI is enabled
From:   Sean Christopherson <seanjc@google.com>
To:     Maxim Levitsky <mlevitsk@redhat.com>
Cc:     Paolo Bonzini <pbonzini@redhat.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Santosh Shukla <santosh.shukla@amd.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, Oct 10, 2023, Maxim Levitsky wrote:
> =D0=A3 =D0=BF=D0=BD, 2023-10-09 =D1=83 14:29 -0700, Sean Christopherson =
=D0=BF=D0=B8=D1=88=D0=B5:
> > Note, per the APM, hardware sets the BLOCKING flag when software direct=
ly
> > directly injects an NMI:
> >=20
> >   If Event Injection is used to inject an NMI when NMI Virtualization i=
s
> >   enabled, VMRUN sets V_NMI_MASK in the guest state.
>=20
> I think that this comment is not needed in the commit message. It describ=
es
> a different unrelated concern and can be put somewhere in the code but
> not in the commit message.

I strongly disagree, this blurb in the APM directly affects the patch.  If =
hardware
didn't set V_NMI_MASK, then the patch would need to be at least this:

--
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index b7472ad183b9..d34ee3b8293e 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3569,8 +3569,12 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 	if (svm->nmi_l1_to_l2)
 		return;
=20
-	svm->nmi_masked =3D true;
-	svm_set_iret_intercept(svm);
+	if (is_vnmi_enabled(svm)) {
+		svm->vmcb->control.int_ctl |=3D V_NMI_BLOCKING_MASK;
+	} else {
+		svm->nmi_masked =3D true;
+		svm_set_iret_intercept(svm);
+	}
 	++vcpu->stat.nmi_injections;
 }
=20

base-commit: 86701e115030e020a052216baa942e8547e0b487
--=20

and maybe even more to deal with canceled injection.