Re: [PATCH 00/14] KVM: x86: Emulator MMIO fix and cleanups

[Tom Lendacky]

On 2/25/26 14:19, Tom Lendacky wrote:
> On 2/24/26 19:20, Sean Christopherson wrote:
>> Fix a UAF stack bug where KVM references a stack pointer around an exit to
>> userspace, and then clean up the related code to try to make it easier to
>> maintain (not necessarily "easy", but "easier").
>>
>> The SEV-ES and TDX changes are compile-tested only.
>>
>> Sean Christopherson (14):
>>   KVM: x86: Use scratch field in MMIO fragment to hold small write
>>     values
>>   KVM: x86: Open code handling of completed MMIO reads in
>>     emulator_read_write()
>>   KVM: x86: Trace unsatisfied MMIO reads on a per-page basis
>>   KVM: x86: Use local MMIO fragment variable to clean up
>>     emulator_read_write()
>>   KVM: x86: Open code read vs. write userspace MMIO exits in
>>     emulator_read_write()
>>   KVM: x86: Move MMIO write tracing into vcpu_mmio_write()
>>   KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free
>>   KVM: x86: Dedup kvm_sev_es_mmio_{read,write}()
>>   KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API
>>   KVM: x86: Bury emulator read/write ops in
>>     emulator_{read,write}_emulated()
>>   KVM: x86: Fold emulator_write_phys() into write_emulate()
>>   KVM: x86: Rename .read_write_emulate() to .read_write_guest()
>>   KVM: x86: Don't panic the kernel if completing userspace I/O / MMIO
>>     goes sideways
>>   KVM: x86: Add helpers to prepare kvm_run for userspace MMIO exit
>>
>>  arch/x86/include/asm/kvm_host.h |   3 -
>>  arch/x86/kvm/emulate.c          |  13 ++
>>  arch/x86/kvm/svm/sev.c          |  20 +--
>>  arch/x86/kvm/vmx/tdx.c          |  14 +-
>>  arch/x86/kvm/x86.c              | 287 ++++++++++++++------------------
>>  arch/x86/kvm/x86.h              |  30 +++-
>>  include/linux/kvm_host.h        |   3 +-
>>  7 files changed, 178 insertions(+), 192 deletions(-)
> 
> A quick boot test was fine. I'm scheduling it to run through our CI to
> see if anything pops up.

Nothing popped up in our SEV CI, so...

Tested-by: Tom Lendacky <thomas.lendacky@xxxxxxxxx>

Thanks,
Tom

> 
> Thanks,
> Tom
> 
>>
>>
>> base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
>