[PATCH 1/2] KVM: nVMX: Save shadow VMCS when getting nested state iff L2 is active

[Sean Christopherson <seanjc@google.com>]

When getting nested state, copy the shadow VMCS to the userspace buffer if
and only if the vCPU is in L2, as that is the only scenario where the
shadow VMCS is "active" and thus needs to be explicitly save/restored via
KVM_GET_NESTED_STATE.  If the vCPU is in L1, then the shadow VMCS isn't
active/cached by KVM, i.e. is just a pointer to memory, and doesn't need
to be saved/restored (userspace is responsible for saving/restore guest
memory as needed).

This fixes a bug where KVM would save the shadow VMCS, but not account the
size of the shadow VMCS, as the accounting correctly checks for L2 being
active.  Note, the restore path also consumes the shadow VMCS payload if
and only if L2 is active.

In practice, writing more bytes than are reported is likely benign, as KVM
correctly reports the maximum size for KVM_CAP_NESTED_STATE, and no known
VMM invokes KVM_GET_NESTED_STATE twice on every save to precisely allocate
its buffer, e.g. QEMU and Google's VMM both allocate the maximum size when
the vCPU is first created/allocated.

Fixes: fa58a9fa7497 ("KVM: nVMX: include shadow vmcs12 in nested state")
Reported-by: Josef Bacik <josef@toxicpanda.com>
Cc: Chris Mason <mason@kernel.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/nested.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 9b0bfa2f854c..c2586bc9ebb5 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -6875,7 +6875,7 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
 	if (copy_to_user(user_vmx_nested_state->vmcs12, vmcs12, VMCS12_SIZE))
 		return -EFAULT;
 
-	if (nested_cpu_has_shadow_vmcs(vmcs12) &&
+	if (is_guest_mode(vcpu) && nested_cpu_has_shadow_vmcs(vmcs12) &&
 	    vmcs12->vmcs_link_pointer != INVALID_GPA) {
 		if (copy_to_user(user_vmx_nested_state->shadow_vmcs12,
 				 get_shadow_vmcs12(vcpu), VMCS12_SIZE))
-- 
2.56.0.218.g1ec904b173-goog