Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Message-ID: <a18658e5-3788-b3f3-db0d-1ab29ea89f88@amd.com>
Date:   Sat, 14 Oct 2023 15:46:14 +0530
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH] KVM: SVM: Don't intercept IRET when injecting NMI and
 vNMI is enabled
To:     Sean Christopherson <seanjc@google.com>,
        Maxim Levitsky <mlevitsk@redhat.com>
Cc:     Paolo Bonzini <pbonzini@redhat.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20231009212919.221810-1-seanjc@google.com>
 <e348e75dac85efce9186b6b10a6da1c6532a3378.camel@redhat.com>
 <ZSVju-lerDbxwamL@google.com>
Content-Language: en-US
From:   Santosh Shukla <santosh.shukla@amd.com>
In-Reply-To: <ZSVju-lerDbxwamL@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SFdOdjRTMkJZdWMzZVljLzdPMC9tWnpjdk1tb000cTNMaDZ3cjh0TCtUM1FM?=
 =?utf-8?B?bEJlL2hnaFNYNllOa0VNbDkzbGZQVnpzTDUwa1lraGJ1NEtxMENkS1JCRzYz?=
 =?utf-8?B?Zkh6MjB3bllIM2FNOU5DVCtySlA3eUM5MzlHY3M2ZXJua0p6TmpoOGtvcm9s?=
 =?utf-8?B?UW9XS1dUR1NxNmhTUDlST2FjUmJQakI0ZGZQVDNhS1FjaDJubkp0YVY1cC9H?=
 =?utf-8?B?MEZhVUpjZGVqMjJLaTJMbWNEdE4zR1U4T1B1MVFBQ1FNclJCWi93OGNSYllx?=
 =?utf-8?B?YkxRUmFiN2FhN2t4NWJvNy8rUlJqRzZpNVZrYlVrSmxlK1lUYkRCVVRjb1NI?=
 =?utf-8?B?UzZWd1QzZk01RnUwRkxQK24xeVpKWjJkQWpSekJudVI1TExITm1CUkpxbTdD?=
 =?utf-8?B?UDJNUGgrVUNBWVQ5Q2FUemlaQmpvM1l2R2N5TE1HVjh1VWhMam54N2lyTEo5?=
 =?utf-8?B?eVBXZTB6c2hnM25MaFZYUm5wK1NXUEpXdWVuT0RmYnhUNjh1NGs3NVQ2ak01?=
 =?utf-8?B?enhNb0ZsUW5aSVZFUHUwcDFETkNINjlNcWsvaG9CQkZsVCs2RFAwR1llNi92?=
 =?utf-8?B?eHM1a2JTUWtOQVRzMU1hMGJYckpXaU1ic3RQR0hDbUluUGcyWG1MbkZXcVE0?=
 =?utf-8?B?NEN0VzI0Tk9hc29SSmppdzZObXhib2hNRUxUd3RwcTNuQWJKbXpuOVZjSVFy?=
 =?utf-8?B?UU44WlNuZ05ueC9Dd2VYMmxzU3M0bnlqL3YzNHdGTlhjUnROc201MExVSHRt?=
 =?utf-8?B?c25iUER3cC9JZDdCMFFvaHhVN1FsM09HN29wZjBPMyt6WU51Q3M0RmRTeGd4?=
 =?utf-8?B?aWt3dloxOW42ZGdDZ043M0VuSktSSFNoRUM1Y3RaSWdSak4xT0lEUXZoSUFE?=
 =?utf-8?B?LzR2QVlPdUt1K1FobU5rVG9abDJZZUZIQ0ZTaFZwcktmT3hBN3hRb1Ztd0Qy?=
 =?utf-8?B?ZU16NktZVTdpaWpQOVlhQmxtUmExcmI3MDhPMUJheDR0UHpVNlZraW9pYjZa?=
 =?utf-8?B?aU1FdUtrNHFlSkUrWktYTVUxWUpDbExwTzBwK1FyMGZuOTR6ejFzZXFCWG9I?=
 =?utf-8?B?Q3RJaDQ4YWFWbU0yWXdXNnM1Lys3QzEyZE1YYjF2VEJnZXlyMm5wWjcvcmh2?=
 =?utf-8?B?QzRaRyt6QlFPM2RkaWdya2lpYllGS0FlTXZ0TU1rTkhVUVR2WTRUQWt2dW5B?=
 =?utf-8?B?QVB2TXBsWm1mRGF6T2JReWNDYTAyK0RGRERhUFgwS2MxUjRPYTVuZ2t3ZkM1?=
 =?utf-8?B?NnpzWlBYdFpNZW1OZVE4QzI3NUovbmk4WEhWTnJUOU1VaFRtemp0Z1F1azhm?=
 =?utf-8?B?SiszdVQ1Wk9qekdtRGl6ajZaRDhYTzZUdlNDTnRDK1VIZ2huZ3B1M1BoZGxN?=
 =?utf-8?B?WkJpM0lNekNrN296aFptZlJyWFdrWUhrWlRkbmpjbU4rYUh4cVJZNG81UXdB?=
 =?utf-8?B?eXMvL3Y1V3krbUoxNWdJb1g1YjQ4cEwvWDFmMjM4WTdLc1FwSHcvdzhBZXBz?=
 =?utf-8?B?dC9YVjlpVXZYMGRFYU9aM0h1QVR6UjU5UUVaTE9FVS9abGg1ZS9rem9rWEFU?=
 =?utf-8?B?aGZmOTVqb0M5UEFXWThNalh3c2loWkwyeDZPbkJXM2g5SkxOUzU2NmZDbTU4?=
 =?utf-8?B?ME1EVUNWai9LcFFENXpFc3d5YlNndnF0SCszM3dzS3R4bTJaWlIzK215N0NL?=
 =?utf-8?B?M0FTTlgyK2V2Tmh6a205OUVKQ3BrL3Q3a3I5S3lZWS9iVzBFajhlOGlONmRJ?=
 =?utf-8?B?dy95UEVXT3ROa2Y0ZzZVM3QwWUttOW1zQmxjR3FOOWJ5K2JXTDVxako1ZFNH?=
 =?utf-8?B?RGRHUGhDVDg1Uk15NHRpQ2NiYml5cEpzZmdXaTlzZ3VVa3cvbTRzeDNhc0s2?=
 =?utf-8?B?L0NRYjhFWE8wQmhINVJFY1grN21XbHZQc01BclF2VUI1V3RpWGIzVXp2WGNP?=
 =?utf-8?B?aFdvZ3A5RGxqR2t5VmRPY0JBeVczM3Z3ZHlBMWFRT015RklRT2hTd1dtZnhm?=
 =?utf-8?B?a1JGZUtocStqWUozOFBJdllHdDVjc0Fhd2lvZUlNSzJvMkswZWw0ekM5WGty?=
 =?utf-8?B?R2tEb1ZLM053RkVueXYzZU8yNFFCRWhHdzR3VWFoa01hMUpFK3hNMTZQTDBQ?=
 =?utf-8?Q?lV2EcrezZ8oLaxXloEkV9rHQG?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2154c900-491b-4a0a-de83-08dbcc9e9fc7
X-MS-Exchange-CrossTenant-AuthSource: CY5PR12MB6323.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Oct 2023 10:16:27.3031
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: yrd0zAdcsovD74F7kmwYsuHw1+hCVJHdrrxtqO/geVH2NvMXmTTq7KS4gphYiHuj2Pbi8xd0SSSs8AG+7awsyA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB7883
X-Spam-Status: No, score=-4.2 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Sat, 14 Oct 2023 03:16:48 -0700 (PDT)


On 10/10/2023 8:16 PM, Sean Christopherson wrote:
> On Tue, Oct 10, 2023, Maxim Levitsky wrote:
>> У пн, 2023-10-09 у 14:29 -0700, Sean Christopherson пише:
>>> Note, per the APM, hardware sets the BLOCKING flag when software directly
>>> directly injects an NMI:
>>>
>>>   If Event Injection is used to inject an NMI when NMI Virtualization is
>>>   enabled, VMRUN sets V_NMI_MASK in the guest state.
>>
>> I think that this comment is not needed in the commit message. It describes
>> a different unrelated concern and can be put somewhere in the code but
>> not in the commit message.
> 
> I strongly disagree, this blurb in the APM directly affects the patch.  If hardware
> didn't set V_NMI_MASK, then the patch would need to be at least this:
> 
> --
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index b7472ad183b9..d34ee3b8293e 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3569,8 +3569,12 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
>  	if (svm->nmi_l1_to_l2)
>  		return;
>  
> -	svm->nmi_masked = true;
> -	svm_set_iret_intercept(svm);
> +	if (is_vnmi_enabled(svm)) {
> +		svm->vmcb->control.int_ctl |= V_NMI_BLOCKING_MASK;
> +	} else {
> +		svm->nmi_masked = true;
> +		svm_set_iret_intercept(svm);
> +	}
>  	++vcpu->stat.nmi_injections;
>  }
>  
>

quick testing worked fine, KUT test ran fine and tested for non-nested mode so far.
Will do more nested testing and share the feedback.

Thanks,
Santosh

> base-commit: 86701e115030e020a052216baa942e8547e0b487