[PATCH] KVM: nVMX: Fix direct injection of interrupts from L0 to L2

[Jan Kiszka <jan.kiszka@web.de>]

From: Jan Kiszka <jan.kiszka@siemens.com>

If L1 does not set PIN_BASED_EXT_INTR_MASK, we incorrectly skipped
vmx_complete_interrupts on L2 exits. This is required because, with
direct interrupt injection from L0 to L2, L0 has to update its pending
events.

Also, we need to allow vmx_cancel_injection when entering L2 in we left
to L0. This condition is indirectly derived from the absence of valid
vectoring info in vmcs12. We no explicitly clear it if we find out that
the L2 exit is not targeting L1 but L0.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 arch/x86/kvm/vmx.c |   43 +++++++++++++++++++++++++++----------------
 1 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 68a045ae..464b6a5 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -624,6 +624,7 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
 			    struct kvm_segment *var, int seg);
 static bool guest_state_valid(struct kvm_vcpu *vcpu);
 static u32 vmx_segment_access_rights(struct kvm_segment *var);
+static void vmx_complete_interrupts(struct vcpu_vmx *vmx);
 
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
 static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
@@ -6213,9 +6214,19 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 	else
 		vmx->nested.nested_run_pending = 0;
 
-	if (is_guest_mode(vcpu) && nested_vmx_exit_handled(vcpu)) {
-		nested_vmx_vmexit(vcpu);
-		return 1;
+	if (is_guest_mode(vcpu)) {
+		if (nested_vmx_exit_handled(vcpu)) {
+			nested_vmx_vmexit(vcpu);
+			return 1;
+		}
+		/*
+		 * Now it's clear, we are leaving to L0. Perform the postponed
+		 * interrupt completion and clear L1's vectoring info field so
+		 * that we do not overwrite what L0 wants to inject on
+		 * re-entry.
+		 */
+		vmx_complete_interrupts(vmx);
+		get_vmcs12(vcpu)->idt_vectoring_info_field = 0;
 	}
 
 	if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
@@ -6495,8 +6506,6 @@ static void __vmx_complete_interrupts(struct vcpu_vmx *vmx,
 
 static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
 {
-	if (is_guest_mode(&vmx->vcpu))
-		return;
 	__vmx_complete_interrupts(vmx, vmx->idt_vectoring_info,
 				  VM_EXIT_INSTRUCTION_LEN,
 				  IDT_VECTORING_ERROR_CODE);
@@ -6504,7 +6513,9 @@ static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
 
 static void vmx_cancel_injection(struct kvm_vcpu *vcpu)
 {
-	if (is_guest_mode(vcpu))
+	if (is_guest_mode(vcpu) &&
+	    get_vmcs12(vcpu)->idt_vectoring_info_field &
+			VECTORING_INFO_VALID_MASK)
 		return;
 	__vmx_complete_interrupts(to_vmx(vcpu),
 				  vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
@@ -6710,6 +6721,14 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
 
 	vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
 
+	vmx->loaded_vmcs->launched = 1;
+
+	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
+	trace_kvm_exit(vmx->exit_reason, vcpu, KVM_ISA_VMX);
+
+	vmx_complete_atomic_exit(vmx);
+	vmx_recover_nmi_blocking(vmx);
+
 	if (is_guest_mode(vcpu)) {
 		struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
 		vmcs12->idt_vectoring_info_field = vmx->idt_vectoring_info;
@@ -6719,16 +6738,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
 			vmcs12->vm_exit_instruction_len =
 				vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
 		}
-	}
-
-	vmx->loaded_vmcs->launched = 1;
-
-	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
-	trace_kvm_exit(vmx->exit_reason, vcpu, KVM_ISA_VMX);
-
-	vmx_complete_atomic_exit(vmx);
-	vmx_recover_nmi_blocking(vmx);
-	vmx_complete_interrupts(vmx);
+	} else
+		vmx_complete_interrupts(vmx);
 }
 
 static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
-- 
1.7.3.4