[PATCH] KVM: VMX: Load the EOI-exit bitmap into vmcs01, not the active VMCS

[PATCH] KVM: VMX: Load the EOI-exit bitmap into vmcs01, not the active VMCS

[Amirmohammad Eftekhar]

vmx_load_eoi_exitmap() writes EOI_EXIT_BITMAP0..3 directly with
vmcs_write64() and, unlike its siblings vmx_hwapic_isr_update() and
vmx_sync_pir_to_irr(),
does not take guard(vmx_vmcs01).  The EOI-exit bitmap belongs to L1's APIC,
but with nested virtual-interrupt-delivery an L2 can be active when KVM
refreshes it (e.g. via kvm_vcpu_reload_apic_access_page() /
vcpu_scan_ioapic()), so the writes land in vmcs02 instead of vmcs01: L2's
EOI-exit bitmap is corrupted and vmcs01's is left stale until the next L1
refresh.

Add guard(vmx_vmcs01), matching the sibling APICv callbacks.

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/vmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index b341af4c6..1f802cdbe 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7082,6 +7082,13 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 	if (!kvm_vcpu_apicv_active(vcpu))
 		return;
 
+	/*
+	 * The EOI-exit bitmap tracks L1's APIC, so it must land in vmcs01, not
+	 * whichever VMCS is currently loaded; a nested VID L2 can be active
+	 * here.  Mirror vmx_hwapic_isr_update()/vmx_sync_pir_to_irr().
+	 */
+	guard(vmx_vmcs01)(vcpu);
+
 	vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
 	vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
 	vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
-- 
2.54.0 (Apple Git-157)

Re: [PATCH] KVM: VMX: Load the EOI-exit bitmap into vmcs01, not the active VMCS

[Amirmohammad Eftekhar]

Thanks, and agreed on all of it.

You're right that it isn't reachable in normal operation. The deferral
(load_eoi_exitmap_pending) is what kept it off the L2 path, and ripping that
out reads cleaner than adding the guard alone, so your version is the better
fix. My changelog was wrong about the trigger and about vmx_sync_pir_to_irr();
sorry for the noise there.

Thanks for the Reported-by. Would you like me to test your version (nested VID
with APICv active, deferral removed) before it goes in?

Thanks,
Amirmohammad