This is a note to let you know that I've just added the patch titled x86/sev-es: Invalidate the GHCB after completing VMGEXIT to the 5.12-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: x86-sev-es-invalidate-the-ghcb-after-completing-vmgexit.patch and it can be found in the queue-5.12 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From a50c5bebc99c525e7fbc059988c6a5ab8680cb76 Mon Sep 17 00:00:00 2001 From: Tom Lendacky <thomas.lendacky@xxxxxxx> Date: Mon, 17 May 2021 12:42:33 -0500 Subject: x86/sev-es: Invalidate the GHCB after completing VMGEXIT From: Tom Lendacky <thomas.lendacky@xxxxxxx> commit a50c5bebc99c525e7fbc059988c6a5ab8680cb76 upstream. Since the VMGEXIT instruction can be issued from userspace, invalidate the GHCB after performing VMGEXIT processing in the kernel. Invalidation is only required after userspace is available, so call vc_ghcb_invalidate() from sev_es_put_ghcb(). Update vc_ghcb_invalidate() to additionally clear the GHCB exit code so that it is always presented as 0 when VMGEXIT has been issued by anything else besides the kernel. Fixes: 0786138c78e79 ("x86/sev-es: Add a Runtime #VC Exception Handler") Signed-off-by: Tom Lendacky <thomas.lendacky@xxxxxxx> Signed-off-by: Borislav Petkov <bp@xxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Link: https://lkml.kernel.org/r/5a8130462e4f0057ee1184509cd056eedd78742b.1621273353.git.thomas.lendacky@xxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kernel/sev-es-shared.c | 1 + arch/x86/kernel/sev-es.c | 5 +++++ 2 files changed, 6 insertions(+) --- a/arch/x86/kernel/sev-es-shared.c +++ b/arch/x86/kernel/sev-es-shared.c @@ -63,6 +63,7 @@ static bool sev_es_negotiate_protocol(vo static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) { + ghcb->save.sw_exit_code = 0; memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap)); } --- a/arch/x86/kernel/sev-es.c +++ b/arch/x86/kernel/sev-es.c @@ -430,6 +430,11 @@ static __always_inline void sev_es_put_g data->backup_ghcb_active = false; state->ghcb = NULL; } else { + /* + * Invalidate the GHCB so a VMGEXIT instruction issued + * from userspace won't appear to be valid. + */ + vc_ghcb_invalidate(ghcb); data->ghcb_active = false; } } Patches currently in stable-queue which might be from thomas.lendacky@xxxxxxx are queue-5.12/x86-sev-es-move-sev_es_put_ghcb-in-prep-for-follow-on-patch.patch queue-5.12/x86-sev-es-invalidate-the-ghcb-after-completing-vmgexit.patch