On Thu, Oct 21, 2021, Paolo Bonzini wrote:

On 13/10/21 18:56, Paolo Bonzini wrote:

quoted

This series, namely patches 1 and 8, fix two bugs in string I/O
emulation for SEV-ES:

- first, the length is completely off for "rep ins" and "rep outs"
   operation of size > 1.  After setup_vmgexit_scratch, svm->ghcb_sa_len
   is in bytes, but kvm_sev_es_string_io expects the number of PIO
   operations.

- second, the size of the GHCB buffer can exceed the size of
   vcpu->arch.pio_data.  If that happens, we need to go over the GHCB
   buffer in multiple passes.

The second bug was reported by Felix Wilhelm.  The first was found by
me by code inspection; on one hand it seems *too* egregious so I'll be
gladly proven wrong on this, on the other hand... I know I'm bad at code
review, but not _that_ bad.

String I/O was completely busted on the Linux guest side as well, I wouldn't be
the least bit surprised if KVM were completely broken as well (reviewing now...).