Fix a bug where KVM injects L2's nested posted interrupt into L1 as a
nested VM-Exit instead of triggering PI processing. The actual bug is
technically a generic nested posted interrupts problem, but due to the
way that KVM handles interrupt delivery, I'm 99.9% certain the issue is
limited to IPI virtualization being enabled.
Found by the nested posted interrupt KUT test on SPR.
If it weren't for an annoying TOCTOU bug waiting to happen, the fix would
be quite simple, e.g. it's really just:
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index f7dde74ff565..b07805daedf5 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4288,6 +4288,15 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
return -EBUSY;
if (!nested_exit_on_intr(vcpu))
goto no_vmexit;
+
+ if (nested_cpu_has_posted_intr(get_vmcs12(vcpu)) &&
+ kvm_apic_has_interrupt(vcpu) == vmx->nested.posted_intr_nv) {
+ vmx->nested.pi_pending = true;
+ kvm_apic_clear_irr(vcpu, vmx->nested.posted_intr_nv);
+ goto no_vmexit;
+ }
+
nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
return 0;
}
Gory details in the last patch.
Sean Christopherson (6):
KVM: nVMX: Get to-be-acknowledge IRQ for nested VM-Exit at injection
site
KVM: nVMX: Suppress external interrupt VM-Exit injection if there's no
IRQ
KVM: x86: Don't move VMX's nested PI notification vector from IRR to
ISR
KVM: nVMX: Track nested_vmx.posted_intr_nv as a signed int
KVM: nVMX: Explicitly invalidate posted_intr_nv if PI is disabled at
VM-Enter
KVM: nVMX: Detect nested posted interrupt NV at nested VM-Exit
injection
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/irq.c | 6 ++---
arch/x86/kvm/lapic.c | 12 +++++++--
arch/x86/kvm/lapic.h | 2 +-
arch/x86/kvm/vmx/nested.c | 43 ++++++++++++++++++++++++---------
arch/x86/kvm/vmx/vmx.h | 2 +-
arch/x86/kvm/x86.c | 2 +-
7 files changed, 49 insertions(+), 20 deletions(-)
base-commit: 332d2c1d713e232e163386c35a3ba0c1b90df83f
--
2.45.2.1089.g2a221341d9-goog
