KVM: VMX: blocked-by-sti must not defer NMI injections
PATCH 1/1 KVM: VMX: blocked-by-sti must not defer NMI injections
As the processor may not consider GUEST_INTR_STATE_STI as a reason for blocking NMI, it could return immediately with EXIT_REASON_NMI_WINDOW when we asked for it. But as we consider this state as NMI-blocking, we can run into an endless loop.
Resolve this by allowing NMI injection if just GUEST_INTR_STATE_STI is active (originally suggested by Gleb). Intel confirmed that this is safe, the processor will never complain about NMI injection in this state.
KVM-Stable-Tag
--- arch/x86/kvm/vmx.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx.c +1 -2
@@ -2824,8 +2824,7 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)return 0 ;return !(vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & - (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS | -GUEST_INTR_STATE_NMI )); + (GUEST_INTR_STATE_MOV_SS |GUEST_INTR_STATE_NMI )); }static bool vmx_get_nmi_mask (struct kvm_vcpu *vcpu)
Quoted 11 lines · Jan Kiszka
As the processor may not consider
GUEST_INTR_STATE_STIas a reason for blocking NMI, it could return immediately withEXIT_REASON_NMI_WINDOWwhen we asked for it. But as we consider this state as NMI-blocking, we can run into an endless loop.Resolve this by allowing NMI injection if just
GUEST_INTR_STATE_STIis active (originally suggested by Gleb). Intel confirmed that this is safe, the processor will never complain about NMI injection in this state.Signed-off-by Jan Kiszka <[email protected]>
Quoted 10 lines
KVM-Stable-Tag
--- arch/x86/kvm/vmx.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)arch/x86/kvm/vmx.c +0
-0
arch/x86/kvm/vmx.c static int vmx_nmi_allowed(struct kvm_vcpu *vcpu) · line 2830
Quoted 9 lines
arch/x86/kvm/vmx.c +1
-2@@ -2824,8 +2824,7 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)return 0 ;return !(vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & - (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS | -GUEST_INTR_STATE_NMI )); + (GUEST_INTR_STATE_MOV_SS |GUEST_INTR_STATE_NMI )); }static bool vmx_get_nmi_mask (struct kvm_vcpu *vcpu)
--
Gleb.
Marcelo Tosatti
AppliedQuoted 10 lines · Jan Kiszka
As the processor may not consider
GUEST_INTR_STATE_STIas a reason for blocking NMI, it could return immediately withEXIT_REASON_NMI_WINDOWwhen we asked for it. But as we consider this state as NMI-blocking, we can run into an endless loop.Resolve this by allowing NMI injection if just
GUEST_INTR_STATE_STIis active (originally suggested by Gleb). Intel confirmed that this is safe, the processor will never complain about NMI injection in this state.
Quoted 5 lines
Signed-off-by Jan Kiszka <[email protected]>KVM-Stable-Tag
--- arch/x86/kvm/vmx.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)
Applied, thanks.