AMD Preparing To Finally Support Virtual NMI With Their CPUs (VNMI)

It appears that with upcoming AMD Zen 4 processors there will finally be Virtual NMI (VNMI) support for virtualization, a feature Intel CPUs have supported for well more than the past decade.

AMD engineers on Thursday sent out the initial Linux kernel patches for enabling Virtual NMI (Non-Maskable Interrupt) support when supported by the processor. The presence of VNMI support is detected by a CPU ID feature bit but given the timing they are either horribly late in supporting it for existing CPUs and not talked about its presence until now, or more than likely: VNMI is being introduced with upcoming AMD Zen 4 processors.

AMD's Santosh Shukla sums up their Virtual NMI implementation as:

Currently, NMI is delivered to the guest using the Event Injection mechanism. The Event Injection mechanism does not block the delivery of subsequent NMIs. So the Hypervisor needs to track the NMI delivery and its completion (by intercepting IRET) before sending a new NMI.

Virtual NMI (VNMI) allows the hypervisor to inject the NMI into the guest w/o using Event Injection mechanism meaning not required to track the guest NMI and intercepting the IRET. To achieve that, VNMI feature provides virtualized NMI and NMI_MASK capability bits in
VMCB intr_control -
V_NMI(11) - Indicates whether a virtual NMI is pending in the guest.
V_NMI_MASK(12) - Indicates whether virtual NMI is masked in the guest.
V_NMI_ENABLE(26) - Enables the NMI virtualization feature for the guest.

When Hypervisor wants to inject NMI, it will set V_NMI bit, Processor will clear the V_NMI bit and Set the V_NMI_MASK which means the Guest is handling NMI, After the guest handled the NMI, The processor will clear the V_NMI_MASK on the successful completion of IRET instruction Or if VMEXIT occurs while delivering the virtual NMI.

Basically VNMI amounts to an efficiency optimization with AMD virtualized guests will not need to track the guest's NMI state and worrying about intercepting the IRET for the NMI completion handling. Virtual NMI has long been supported by Intel CPUs - Intel's Linux kernel code for virtualization in fact requires it and has been plumbed into the kernel on Intel's side since 2008.

Given the timing of this Linux patch series, VNMI will presumably premiere with next-generation Zen 4 Ryzen 7000 and AMD EPYC 7004 series hardware.