[stable-6.12 0/3] 3 SEV fixes backport

[stable-6.12 0/3] 3 SEV fixes backport

[Jack Wang]

Hi Greg, hi Sasha,

Please consider to apply these 3 fixes failed to apply to stable-6.12,
I've tested it on EPYC Turin/Milan with kvm-unit-tests and basic Confidential VM
functional test.

Regards!
Jack Wang @ IONOS Cloud

Sean Christopherson (3):
  KVM: SEV: Ignore MMIO requests of length '0'
  KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
  KVM: SEV: Ignore Port I/O requests of length '0'

 arch/x86/kvm/svm/sev.c | 32 ++++++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 6 deletions(-)

-- 
2.43.0

[stable-6.12 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.

Explicitly ignore MMIO requests of length '0', so that setting up the
software scratch area (and other code) doesn't have to worry about
underflowing the length, and to allow for special casing '0' in the
future.

Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 115c59c86f44..9374b1a93df8 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4356,16 +4356,22 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 					   control->exit_info_2,
 					   svm->sev_es.ghcb_sa);
 		break;
-	case SVM_VMGEXIT_MMIO_WRITE:
-		ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
+			break;
+
+	case SVM_VMGEXIT_MMIO_WRITE: {
+		u64 len = control->exit_info_2;
+
+		if (!len)
+			return 1;
+
+		ret = setup_vmgexit_scratch(svm, false, len);
 		if (ret)
 			break;
 
-		ret = kvm_sev_es_mmio_write(vcpu,
-					    control->exit_info_1,
-					    control->exit_info_2,
-					    svm->sev_es.ghcb_sa);
+		ret = kvm_sev_es_mmio_write(vcpu, control->exit_info_1, len,
+				      svm->sev_es.ghcb_sa);
 		break;
+		}
 	case SVM_VMGEXIT_NMI_COMPLETE:
 		++vcpu->stat.nmi_window_exits;
 		svm->nmi_masked = false;
-- 
2.43.0

[stable-6.12 2/3] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit dcf1b2d4b0564a27e4ca7c654871aab4f9620046 upstream.

When using GHCB v2+, reject MMIO requests that are larger than 8 bytes.
Per the GHCB spec:

  SW_EXITINFO2 must be less than or equal to 0x7fffffff for version 1 and
  less than or equal to 0x8 for all other versions.

Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 9374b1a93df8..82b26899b9a4 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4364,6 +4364,12 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 		if (!len)
 			return 1;
 
+		if (to_kvm_sev_info(vcpu->kvm)->ghcb_version >= 2 && len > 8) {
+			ghcb_set_sw_exit_info_1(svm->sev_es.ghcb, 2);
+			ghcb_set_sw_exit_info_2(svm->sev_es.ghcb, GHCB_ERR_INVALID_INPUT);
+			return 1;
+		}
+
 		ret = setup_vmgexit_scratch(svm, false, len);
 		if (ret)
 			break;
-- 
2.43.0

[stable-6.12 3/3] KVM: SEV: Ignore Port I/O requests of length '0'

[Jack Wang]

From: Sean Christopherson <seanjc@google.com>

commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream.

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that
setting up the software scratch area (and other code) doesn't have to
worry about underflowing the length, and to allow for WARNing on trying
to configure the scratch area with len==0.

Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT")
Cc: stable@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260501202250.2115252-5-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
---
 arch/x86/kvm/svm/sev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 82b26899b9a4..7e8b5acc2133 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -4451,6 +4451,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
 			    control->exit_info_1, control->exit_info_2);
 		ret = -EINVAL;
 		break;
+	case SVM_EXIT_IOIO:
+		if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT))
+			return 1;
+
+		fallthrough;
 	default:
 		ret = svm_invoke_exit_handler(vcpu, exit_code);
 	}
@@ -4471,6 +4476,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
 	if (unlikely(check_mul_overflow(count, size, &bytes)))
 		return -EINVAL;
 
+	if (!bytes)
+		return 1;
+
 	r = setup_vmgexit_scratch(svm, in, bytes);
 	if (r)
 		return r;
-- 
2.43.0

Re: [stable-6.12 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Tom Lendacky]

On 6/26/26 07:42, Jack Wang wrote:
> From: Sean Christopherson <seanjc@google.com>
> 
> commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.
> 
> Explicitly ignore MMIO requests of length '0', so that setting up the
> software scratch area (and other code) doesn't have to worry about
> underflowing the length, and to allow for special casing '0' in the
> future.
> 
> Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
> Cc: stable@vger.kernel.org
> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20260501202250.2115252-3-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
> ---
>  arch/x86/kvm/svm/sev.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 115c59c86f44..9374b1a93df8 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -4356,16 +4356,22 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
>  					   control->exit_info_2,
>  					   svm->sev_es.ghcb_sa);
>  		break;
> -	case SVM_VMGEXIT_MMIO_WRITE:
> -		ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
> +			break;
> +
> +	case SVM_VMGEXIT_MMIO_WRITE: {
> +		u64 len = control->exit_info_2;
> +
> +		if (!len)
> +			return 1;
> +
> +		ret = setup_vmgexit_scratch(svm, false, len);
>  		if (ret)
>  			break;
>  
> -		ret = kvm_sev_es_mmio_write(vcpu,
> -					    control->exit_info_1,
> -					    control->exit_info_2,
> -					    svm->sev_es.ghcb_sa);
> +		ret = kvm_sev_es_mmio_write(vcpu, control->exit_info_1, len,
> +				      svm->sev_es.ghcb_sa);
>  		break;
> +		}

This isn't right...

After I apply this I get the following code:

4349         case SVM_VMGEXIT_MMIO_READ:
4350                 ret = setup_vmgexit_scratch(svm, true, control->exit_info_2);
4351                 if (ret)
4352                         break;
4353                 
4354                 ret = kvm_sev_es_mmio_read(vcpu,
4355                                            control->exit_info_1,
4356                                            control->exit_info_2,
4357                                            svm->sev_es.ghcb_sa);
4358                 break;  
4359                         break;  
4360                 
4361         case SVM_VMGEXIT_MMIO_WRITE: {
4362                 u64 len = control->exit_info_2;
4363         
4364                 if (!len)
4365                         return 1;
4366         
4367                 ret = setup_vmgexit_scratch(svm, false, len);
4368                 if (ret)
4369                         break;
4370                         
4371                 ret = kvm_sev_es_mmio_write(vcpu, control->exit_info_1, len,
4372                                       svm->sev_es.ghcb_sa);
4373                 break;
4374                 }

So we end up with an extra break at line 4359 and the length check is only
applied to the MMIO_WRITE path. This patch should just add the length check
to both MMIO operations before the call to setup_vmgexit_scratch().

This will need to be re-worked, as will the second patch.

Thanks,
Tom

>  	case SVM_VMGEXIT_NMI_COMPLETE:
>  		++vcpu->stat.nmi_window_exits;
>  		svm->nmi_masked = false;

Re: [stable-6.12 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Sasha Levin]

> [stable-6.12 1/3] KVM: SEV: Ignore MMIO requests of length '0'

Two concerns on the 6.12 adaptation: upstream guards a merged MMIO_READ/WRITE
case, but 6.12 has separate cases and the !len guard was added only to
MMIO_WRITE (READ left unguarded); and there's a stray extra break; (two in
a row) in the READ case.

-- 
Thanks,
Sasha

Re: [stable-6.12 1/3] KVM: SEV: Ignore MMIO requests of length '0'

[Jinpu Wang]

On Fri, Jun 26, 2026 at 5:37 PM Tom Lendacky <thomas.lendacky@amd.com> wrote:
>
> On 6/26/26 07:42, Jack Wang wrote:
> > From: Sean Christopherson <seanjc@google.com>
> >
> > commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 upstream.
> >
> > Explicitly ignore MMIO requests of length '0', so that setting up the
> > software scratch area (and other code) doesn't have to worry about
> > underflowing the length, and to allow for special casing '0' in the
> > future.
> >
> > Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
> > Cc: stable@vger.kernel.org
> > Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > Message-ID: <20260501202250.2115252-3-seanjc@google.com>
> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> > Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
> > ---
> >  arch/x86/kvm/svm/sev.c | 18 ++++++++++++------
> >  1 file changed, 12 insertions(+), 6 deletions(-)
> >
> > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> > index 115c59c86f44..9374b1a93df8 100644
> > --- a/arch/x86/kvm/svm/sev.c
> > +++ b/arch/x86/kvm/svm/sev.c
> > @@ -4356,16 +4356,22 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
> >                                          control->exit_info_2,
> >                                          svm->sev_es.ghcb_sa);
> >               break;
> > -     case SVM_VMGEXIT_MMIO_WRITE:
> > -             ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
> > +                     break;
> > +
> > +     case SVM_VMGEXIT_MMIO_WRITE: {
> > +             u64 len = control->exit_info_2;
> > +
> > +             if (!len)
> > +                     return 1;
> > +
> > +             ret = setup_vmgexit_scratch(svm, false, len);
> >               if (ret)
> >                       break;
> >
> > -             ret = kvm_sev_es_mmio_write(vcpu,
> > -                                         control->exit_info_1,
> > -                                         control->exit_info_2,
> > -                                         svm->sev_es.ghcb_sa);
> > +             ret = kvm_sev_es_mmio_write(vcpu, control->exit_info_1, len,
> > +                                   svm->sev_es.ghcb_sa);
> >               break;
> > +             }
>
> This isn't right...
>
> After I apply this I get the following code:
>
> 4349         case SVM_VMGEXIT_MMIO_READ:
> 4350                 ret = setup_vmgexit_scratch(svm, true, control->exit_info_2);
> 4351                 if (ret)
> 4352                         break;
> 4353
> 4354                 ret = kvm_sev_es_mmio_read(vcpu,
> 4355                                            control->exit_info_1,
> 4356                                            control->exit_info_2,
> 4357                                            svm->sev_es.ghcb_sa);
> 4358                 break;
> 4359                         break;
> 4360
> 4361         case SVM_VMGEXIT_MMIO_WRITE: {
> 4362                 u64 len = control->exit_info_2;
> 4363
> 4364                 if (!len)
> 4365                         return 1;
> 4366
> 4367                 ret = setup_vmgexit_scratch(svm, false, len);
> 4368                 if (ret)
> 4369                         break;
> 4370
> 4371                 ret = kvm_sev_es_mmio_write(vcpu, control->exit_info_1, len,
> 4372                                       svm->sev_es.ghcb_sa);
> 4373                 break;
> 4374                 }
>
> So we end up with an extra break at line 4359 and the length check is only
> applied to the MMIO_WRITE path. This patch should just add the length check
> to both MMIO operations before the call to setup_vmgexit_scratch().
>
> This will need to be re-worked, as will the second patch.

Hi Tom,

Thanks for catch it, will send v2.
>
> Thanks,
> Tom
Regards!
Jack
>
> >       case SVM_VMGEXIT_NMI_COMPLETE:
> >               ++vcpu->stat.nmi_window_exits;
> >               svm->nmi_masked = false;
>