Patch "KVM: SVM: Don't defer NMI unblocking until next exit for SEV-ES guests" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    KVM: SVM: Don't defer NMI unblocking until next exit for SEV-ES guests

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-svm-don-t-defer-nmi-unblocking-until-next-exit-f.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2e811765550d5ff39fa876ca7ad0309fd92e9d41
Author: Sean Christopherson <seanjc@xxxxxxxxxx>
Date:   Thu Jun 15 16:37:56 2023 +1000

    KVM: SVM: Don't defer NMI unblocking until next exit for SEV-ES guests
    
    [ Upstream commit 389fbbec261b2842fd0e34b26a2b288b122cc406 ]
    
    Immediately mark NMIs as unmasked in response to #VMGEXIT(NMI complete)
    instead of setting awaiting_iret_completion and waiting until the *next*
    VM-Exit to unmask NMIs.  The whole point of "NMI complete" is that the
    guest is responsible for telling the hypervisor when it's safe to inject
    an NMI, i.e. there's no need to wait.  And because there's no IRET to
    single-step, the next VM-Exit could be a long time coming, i.e. KVM could
    incorrectly hold an NMI pending for far longer than what is required and
    expected.
    
    Opportunistically fix a stale reference to HF_IRET_MASK.
    
    Fixes: 916b54a7688b ("KVM: x86: Move HF_NMI_MASK and HF_IRET_MASK into "struct vcpu_svm"")
    Fixes: 4444dfe4050b ("KVM: SVM: Add NMI support for an SEV-ES guest")
    Cc: Tom Lendacky <thomas.lendacky@xxxxxxx>
    Link: https://lore.kernel.org/r/20230615063757.3039121-9-aik@xxxxxxx
    Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index d3aec1f2cad20..42630f5b11875 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -2881,7 +2881,10 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 					    svm->sev_es.ghcb_sa);
 		break;
 	case SVM_VMGEXIT_NMI_COMPLETE:
-		ret = svm_invoke_exit_handler(vcpu, SVM_EXIT_IRET);
+		++vcpu->stat.nmi_window_exits;
+		svm->nmi_masked = false;
+		kvm_make_request(KVM_REQ_EVENT, vcpu);
+		ret = 1;
 		break;
 	case SVM_VMGEXIT_AP_HLT_LOOP:
 		ret = kvm_emulate_ap_reset_hold(vcpu);
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index d4bfdc607fe7f..dfb8a3f504322 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2510,12 +2510,13 @@ static int iret_interception(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
+	WARN_ON_ONCE(sev_es_guest(vcpu->kvm));
+
 	++vcpu->stat.nmi_window_exits;
 	svm->awaiting_iret_completion = true;
 
 	svm_clr_iret_intercept(svm);
-	if (!sev_es_guest(vcpu->kvm))
-		svm->nmi_iret_rip = kvm_rip_read(vcpu);
+	svm->nmi_iret_rip = kvm_rip_read(vcpu);
 
 	kvm_make_request(KVM_REQ_EVENT, vcpu);
 	return 1;
@@ -3918,12 +3919,11 @@ static void svm_complete_interrupts(struct kvm_vcpu *vcpu)
 	svm->soft_int_injected = false;
 
 	/*
-	 * If we've made progress since setting HF_IRET_MASK, we've
+	 * If we've made progress since setting awaiting_iret_completion, we've
 	 * executed an IRET and can allow NMI injection.
 	 */
 	if (svm->awaiting_iret_completion &&
-	    (sev_es_guest(vcpu->kvm) ||
-	     kvm_rip_read(vcpu) != svm->nmi_iret_rip)) {
+	    kvm_rip_read(vcpu) != svm->nmi_iret_rip) {
 		svm->awaiting_iret_completion = false;
 		svm->nmi_masked = false;
 		kvm_make_request(KVM_REQ_EVENT, vcpu);