[PATCH] KVM: x86: Leave nested if vendor specific logic fails on RSM to L2

[Sean Christopherson <seanjc@google.com>]

Force the vCPU into L1 before synthesizing SHUTDOWN if RSM to L2 fails due
to vendor specific checks, e.g. because SMRAM was corrupted with illegal
state, and the bad state was detected *after* starting the transition back
to L2.  Architecturally, any fatal error when loading CPU state during RSM
is supposed to send the CPU into SHUTDOWN *before* switching to guest mode,
and leaving the vCPU in L2 is all but guaranteed to effectively corrupt
vCPU state (which doesn't matter for the guest since it's already hosed,
but matters if userspace misbehaves and ignores the SHUTDOWN, i.e. runs the
vCPU even though it's in a bad state).

Fixes: 3f6821aa147b ("KVM: x86: Forcibly leave nested if RSM to L2 hits shutdown")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/smm.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/smm.c b/arch/x86/kvm/smm.c
index 656a38dad7e7..23cb8211ec74 100644
--- a/arch/x86/kvm/smm.c
+++ b/arch/x86/kvm/smm.c
@@ -639,8 +639,10 @@ int emulator_leave_smm(struct x86_emulate_ctxt *ctxt)
 	 * reasons), and so nSVM/nVMX would clobber state that is loaded from
 	 * SMRAM and from the VMCS/VMCB.
 	 */
-	if (kvm_x86_call(leave_smm)(vcpu, &smram))
-		return X86EMUL_UNHANDLEABLE;
+	if (kvm_x86_call(leave_smm)(vcpu, &smram)) {
+		ret = X86EMUL_UNHANDLEABLE;
+		goto out;
+	}
 
 #ifdef CONFIG_X86_64
 	if (guest_cpu_cap_has(vcpu, X86_FEATURE_LM))
@@ -661,6 +663,7 @@ int emulator_leave_smm(struct x86_emulate_ctxt *ctxt)
 	 * the shutdown, so that L1 enters shutdown instead of seeing a VM-Exit
 	 * that architecturally shouldn't be possible.
 	 */
+out:
 	if (ret != X86EMUL_CONTINUE && is_guest_mode(vcpu))
 		kvm_leave_nested(vcpu);
 	return ret;

base-commit: d21eef2084a9af87ac2a783bc7c2b175ba114e4e
-- 
2.56.1.703.gf848ed807c-goog