[stable-6.12 v2 0/3] 3 SEV fixes backport

[stable-6.12 v2 0/3] 3 SEV fixes backport

[Jack Wang]

Hi Greg, hi Sasha,

Please consider to apply these 3 fixes failed to apply to stable-6.12,
I've tested it on EPYC Turin/Milan with kvm-unit-tests and basic Confidential VM
functional test.

Regards!
Jack Wang @ IONOS Cloud

v2->v1: fix the bugs noticed by Tom for first 2 patches

Sean Christopherson (3):
  KVM: SEV: Ignore MMIO requests of length '0'
  KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
  KVM: SEV: Ignore Port I/O requests of length '0'

 arch/x86/kvm/svm/sev.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

-- 
2.43.0

[stable-6.12 v2 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.

Explicitly ignore MMIO requests of length '0', so that setting up the
software scratch area (and other code) doesn't have to worry about
underflowing the length, and to allow for special casing '0' in the
future.

Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 115c59c86f44..0a01971e33f0 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4347,6 +4347,9 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 	exit_code = kvm_ghcb_get_sw_exit_code(control);
 	switch (exit_code) {
 	case SVM_VMGEXIT_MMIO_READ:
+		if (!control->exit_info_2)
+			return 1;
+
 		ret = setup_vmgexit_scratch(svm, true, control->exit_info_2);
 		if (ret)
 			break;
@@ -4357,6 +4360,9 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 					   svm->sev_es.ghcb_sa);
 		break;
 	case SVM_VMGEXIT_MMIO_WRITE:
+		if (!control->exit_info_2)
+			return 1;
+
 		ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
 		if (ret)
 			break;
-- 
2.43.0

[stable-6.12 v2 2/3] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit dcf1b2d4b0564a27e4ca7c654871aab4f9620046 upstream.

When using GHCB v2+, reject MMIO requests that are larger than 8 bytes.
Per the GHCB spec:

  SW_EXITINFO2 must be less than or equal to 0x7fffffff for version 1 and
  less than or equal to 0x8 for all other versions.

Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 0a01971e33f0..497a6e705135 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4350,6 +4350,13 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 		if (!control->exit_info_2)
 			return 1;
 
+		if (to_kvm_sev_info(vcpu->kvm)->ghcb_version >= 2 &&
+		    control->exit_info_2 > 8) {
+			ghcb_set_sw_exit_info_1(svm->sev_es.ghcb, 2);
+			ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, GHCB_ERR_INVALID_INPUT);
+			return 1;
+		}
+
 		ret = setup_vmgexit_scratch(svm, true, control->exit_info_2);
 		if (ret)
 			break;
@@ -4363,6 +4370,13 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 		if (!control->exit_info_2)
 			return 1;
 
+		if (to_kvm_sev_info(vcpu->kvm)->ghcb_version >= 2 &&
+		    control->exit_info_2 > 8) {
+			ghcb_set_sw_exit_info_1(svm->sev_es.ghcb, 2);
+			ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, GHCB_ERR_INVALID_INPUT);
+			return 1;
+		}
+
 		ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
 		if (ret)
 			break;
-- 
2.43.0

[stable-6.12 v2 3/3] KVM: SEV: Ignore Port I/O requests of length '0'

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream.

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that
setting up the software scratch area (and other code) doesn't have to
worry about underflowing the length, and to allow for WARNing on trying
to configure the scratch area with len==0.

Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-5-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 497a6e705135..73e493177351 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4459,6 +4459,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 			    control->exit_info_1, control->exit_info_2);
 		ret = -EINVAL;
 		break;
+	case SVM_EXIT_IOIO:
+		if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT))
+			return 1;
+
+		fallthrough;
 	default:
 		ret = svm_invoke_exit_handler(vcpu, exit_code);
 	}
@@ -4479,6 +4484,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
 	if (unlikely(check_mul_overflow(count, size, &bytes)))
 		return -EINVAL;
 
+	if (!bytes)
+		return 1;
+
 	r = setup_vmgexit_scratch(svm, in, bytes);
 	if (r)
 		return r;
-- 
2.43.0

Re: [stable-6.12 v2 0/3] 3 SEV fixes backport

[Sasha Levin]

On Fri, 26 Jun 2026 21:28 +0200, Jack Wang <jinpu.wang@ionos.com> wrote:
> [stable-6.12 v2 0/3] 3 SEV fixes backport

Queued the v2 series for 6.12.

-- 
Thanks,
Sasha

Re: [stable-6.12 v2 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Sean Christopherson]

On Fri, Jun 26, 2026, Jack Wang wrote:
> From: Sean Christopherson <seanjc@google.com>
> 
> commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.
> 
> Explicitly ignore MMIO requests of length '0', so that setting up the
> software scratch area (and other code) doesn't have to worry about
> underflowing the length, and to allow for special casing '0' in the
> future.
> 
> Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
> Cc: stable@vger.kernel.org
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20260501202250.2115252-3-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

When sending backports, please document what was changed.  Doing so saves
maintainer time and is very helpful in case there's a problem with the backport.

[Jack: Duplicate the fix to the split READ/WRITE paths]

> Signed-off-by: Jack Wang <jinpu.wang@ionos.com>

Acked-by: Sean Christopherson <seanjc@google.com>

Re: [stable-6.12 v2 2/3] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+

[Sean Christopherson]

On Fri, Jun 26, 2026, Jack Wang wrote:
> From: Sean Christopherson <seanjc@google.com>
> 
> commit dcf1b2d4b0564a27e4ca7c654871aab4f9620046 upstream.
> 
> When using GHCB v2+, reject MMIO requests that are larger than 8 bytes.
> Per the GHCB spec:
> 
>   SW_EXITINFO2 must be less than or equal to 0x7fffffff for version 1 and
>   less than or equal to 0x8 for all other versions.
> 
> Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version")
> Cc: stable@vger.kernel.org
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20260501202250.2115252-4-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Same comment about documentation the changes.

[Jack: Open code response as svm_vmgexit_bad_input() doesn't exist in 6.12,
       nor does GHCB_HV_RESP_MALFORMED_INPUT (the literal '2').  Duplicate
       fix to split READ/WRITE paths. ]

> Signed-off-by: Jack Wang <jinpu.wang@ionos.com>

Acked-by: Sean Christopherson <seanjc@google.com>

Re: [stable-6.12 v2 3/3] KVM: SEV: Ignore Port I/O requests of length '0'

[Sean Christopherson]

On Fri, Jun 26, 2026, Jack Wang wrote:
> From: Sean Christopherson <seanjc@google.com>
> 
> commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream.
> 
> Explicitly ignore Port I/O requests of length '0' (or count '0'), so that
> setting up the software scratch area (and other code) doesn't have to
> worry about underflowing the length, and to allow for WARNing on trying
> to configure the scratch area with len==0.
> 
> Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT")
> Cc: stable@vger.kernel.org
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20260501202250.2115252-5-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
> ---

Acked-by: Sean Christopherson <seanjc@google.com>

Re: [stable-6.12 v2 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Jinpu Wang]

On Tue, Jun 30, 2026 at 4:42 PM Sean Christopherson <seanjc@google.com> wrote:
>
> On Fri, Jun 26, 2026, Jack Wang wrote:
> > From: Sean Christopherson <seanjc@google.com>
> >
> > commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.
> >
> > Explicitly ignore MMIO requests of length '0', so that setting up the
> > software scratch area (and other code) doesn't have to worry about
> > underflowing the length, and to allow for special casing '0' in the
> > future.
> >
> > Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
> > Cc: stable@vger.kernel.org
> > Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > Message-ID: <20260501202250.2115252-3-seanjc@google.com>
> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>
> When sending backports, please document what was changed.  Doing so saves
> maintainer time and is very helpful in case there's a problem with the backport.
>
> [Jack: Duplicate the fix to the split READ/WRITE paths]
>
> > Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
>
> Acked-by: Sean Christopherson <seanjc@google.com>
Hi Sean,

Understood, I'll make sure to document changes in future backports.
Thanks for the heads up.

Thx!