[PATCH] KVM: VMX: Load the EOI-exit bitmap into vmcs01, not the active VMCS

[Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>]

vmx_load_eoi_exitmap() writes EOI_EXIT_BITMAP0..3 directly with
vmcs_write64() and, unlike its siblings vmx_hwapic_isr_update() and
vmx_sync_pir_to_irr(),
does not take guard(vmx_vmcs01).  The EOI-exit bitmap belongs to L1's APIC,
but with nested virtual-interrupt-delivery an L2 can be active when KVM
refreshes it (e.g. via kvm_vcpu_reload_apic_access_page() /
vcpu_scan_ioapic()), so the writes land in vmcs02 instead of vmcs01: L2's
EOI-exit bitmap is corrupted and vmcs01's is left stale until the next L1
refresh.

Add guard(vmx_vmcs01), matching the sibling APICv callbacks.

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/vmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index b341af4c6..1f802cdbe 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7082,6 +7082,13 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 	if (!kvm_vcpu_apicv_active(vcpu))
 		return;
 
+	/*
+	 * The EOI-exit bitmap tracks L1's APIC, so it must land in vmcs01, not
+	 * whichever VMCS is currently loaded; a nested VID L2 can be active
+	 * here.  Mirror vmx_hwapic_isr_update()/vmx_sync_pir_to_irr().
+	 */
+	guard(vmx_vmcs01)(vcpu);
+
 	vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
 	vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
 	vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
-- 
2.54.0 (Apple Git-157)