From nobody Sun Jun 14 01:45:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A2E33E3C70; Mon, 4 May 2026 16:52:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913532; cv=none; b=Ft/W6FjMJjLrG0XCT9mCsKV5nnSESIVSbCLH7oq/u+Xz+72YOaN31N2DvaeppKPPyMNoOuUTvKgLq89uubKLR0NU6RXonNyatwjT73RjohhLSRKDv7ZYYSNgFZLc0V9I1K5yOC9ZHIuPyqt9TFWxbFZJJGywU61myDuLbzEfHwc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913532; c=relaxed/simple; bh=HM4Br/QU/g7NoeMZmnTUdN191ndbVU+zKKGtXB13CoQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZJVKXdUQmjGbrDJ95yLIek/NMmdNVghfE8CrBoYMuPPCusaOruXTvGhuKvRaj444rVVjaNj4au3yXwBY7N/85JAjpEeHbvxajGihSMFm0Gl1nuJd/NeqxCrWO0EaY4Y2aXqWp0FUF2bpObyFQruu1q/Xd+gMhxd4gnGHsPtvsNU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=uHamJ/8t; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="uHamJ/8t" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B57CC2BCF4; Mon, 4 May 2026 16:52:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777913531; bh=HM4Br/QU/g7NoeMZmnTUdN191ndbVU+zKKGtXB13CoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uHamJ/8tqsKHEQud6yGtQP0kwVTKrDuf7sutK8SebaIwuDnCJ3zJsWyoyh6LmZF+6 hSq7F2yH0hrCnwiiRU0qtQioGjttWad4Ec8x16fgk0pUXTCGToqIsacUUSoIIXln0r oUDBZW/QrqT0Kh6xWHzB/wk0lRzwcL3KFnTE0iPWmDxLSr+pMeMk9EP0em9Tj3h8OO 16C2kg4/CaMmAxPn/Zk6Ulj3oa36tMKz1dJbbHbKxiJE47GwKUlE8qowKS/HUNaV/t RH3wkEqZRsc0jSWYZlXDQcVd+muqscImDUc07VGjx0Gx0C2u1Spc5s14Ph/YTS+UDb u4DeYJPjlHdVw== From: Tycho Andersen To: Tom Lendacky , John Allen , Herbert Xu , "David S. Miller" , Ashish Kalra Cc: "Borislav Petkov (AMD)" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Brijesh Singh , Michael Roth , Alexey Kardashevskiy , Dan Williams , "Tycho Andersen (AMD)" , stable@vger.kernel.org Subject: [PATCH v2 1/4] crypto/ccp: Do not initialize SNP for SEV ioctls Date: Mon, 4 May 2026 10:51:44 -0600 Message-ID: <20260504165147.1615643-2-tycho@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260504165147.1615643-1-tycho@kernel.org> References: <20260504165147.1615643-1-tycho@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Tycho Andersen (AMD)" Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could= a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash t= he > host? sev_move_to_init_state() is called for ioctls requiring only SEV firmware: SEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, and SEV_PDH_CERT_EXPORT. After the firmware command, it does SEV_SHUTDOWN on the SEV firmware. Since these commands do not require SNP to be initialized, skip it by calling __sev_platform_init_locked() which only initializes the SEV firmware. This way SNP is not Initialized at all, and HSAVE_PA is not cleared. The previous code saved any SEV initialization firmware error to init_args.error and then threw it away and hardcoded the return value of INVALID_PLATFORM_STATE regardless of the real firmware error. This patch changes it to surface the underlying error, which is hopefully both more useful and doesn't cause any problems. Note that it is still safe to call __sev_firmware_shutdown() directly: it calls __sev_snp_shutdown_locked(), which skips SNP shutdown if SNP was not initialized. Fixes: ceac7fb89e8d ("crypto: ccp - Ensure implicit SEV/SNP init and shutdo= wn in ioctls") Reported-by: Sashiko Assisted-by: Gemini:gemini-3.1-pro-preview Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kerne= l.org CC: Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky --- drivers/crypto/ccp/sev-dev.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index d1e9e0ac63b6..6891b90bbb88 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -1716,14 +1716,11 @@ static int sev_get_platform_state(int *state, int *= error) =20 static int sev_move_to_init_state(struct sev_issue_cmd *argp, bool *shutdo= wn_required) { - struct sev_platform_init_args init_args =3D {0}; int rc; =20 - rc =3D _sev_platform_init_locked(&init_args); - if (rc) { - argp->error =3D SEV_RET_INVALID_PLATFORM_STATE; + rc =3D __sev_platform_init_locked(&argp->error); + if (rc) return rc; - } =20 *shutdown_required =3D true; =20 --=20 2.54.0 From nobody Sun Jun 14 01:45:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C2A9224AF7; Mon, 4 May 2026 16:52:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913533; cv=none; b=gKuzQh/jakHL015/3+CQhrHQo9LFb4v+T0BaPSFgQ8S3UxyDp2HvW8WFRehPNVPo/1vMqrWxSw8XxD+xhUJgnFoVPIB7W3Fwu1V9KuQHnfaT43VbF1ytNkBLcZhI81UyEY9bk+G5Uc2hQavJuFNJWZjQdgH40AWOwNNXhSqnQ1k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913533; c=relaxed/simple; bh=Lv+TqzO/rGkX/kppshZNP2Od+4IjMGCBAoZI2YoaDfk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MkjF8+wQQPJVrIqBRSSKPH6A4NeEdIQWJ0vemQCzOMiflZoikLUZuJgTfjsY41qJcJnJHswmYhSHBBDr1myRDh8FXfdRwqxHW9j1ez9S9lUDemPbQjd/TL9lUPsJaR0vveEiNhbdl/D1MreoW2Et2PoiHr3vf38bU0XRGw8MJVk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=qEXxR1Kb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qEXxR1Kb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 006BBC2BCF5; Mon, 4 May 2026 16:52:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777913533; bh=Lv+TqzO/rGkX/kppshZNP2Od+4IjMGCBAoZI2YoaDfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qEXxR1Kb36bo9McYs/H4C1rw0lyFRvJVH7+nif1ofpW8zzQHVJejMywdMcsSt9a6Y 4xHb7x46gXGGvjTiwRPzT6h3ErQr/fP/ojC8QczE0E+6aWH3p36E3R1r2a/ovW3R5G xDyJckeYxAVJRQuCa/hcJtW0ucrZ1w8We0+8XzljLkZQvK49Wj/l9H73S2LKmb+hSc UKkWbHSrfKopq41hW08zUc60dS4cdV5JqCqMqX+TXqqH1gSmJwwbLJvOSn0ghExj0F s+HlpP2PibH2x56eWY6I6i1ARcrG3xVbOdpMqUIhX6A+7KErshHuyVrzcW1RttHQUN rzH8wn9LfazLw== From: Tycho Andersen To: Tom Lendacky , John Allen , Herbert Xu , "David S. Miller" , Ashish Kalra Cc: "Borislav Petkov (AMD)" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Brijesh Singh , Michael Roth , Alexey Kardashevskiy , Dan Williams , "Tycho Andersen (AMD)" , stable@vger.kernel.org Subject: [PATCH v2 2/4] crypto/ccp: Do not initialize SNP for ioctl(SNP_COMMIT) Date: Mon, 4 May 2026 10:51:45 -0600 Message-ID: <20260504165147.1615643-3-tycho@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260504165147.1615643-1-tycho@kernel.org> References: <20260504165147.1615643-1-tycho@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Tycho Andersen (AMD)" Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could= a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash t= he > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that. Fixes: ceac7fb89e8d ("crypto: ccp - Ensure implicit SEV/SNP init and shutdo= wn in ioctls") Reported-by: Sashiko Assisted-by: Gemini:gemini-3.1-pro-preview Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kerne= l.org CC: Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky --- drivers/crypto/ccp/sev-dev.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 6891b90bbb88..572f06368d4b 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -2437,24 +2437,13 @@ static int sev_ioctl_do_snp_platform_status(struct = sev_issue_cmd *argp) =20 static int sev_ioctl_do_snp_commit(struct sev_issue_cmd *argp) { - struct sev_device *sev =3D psp_master->sev_data; struct sev_data_snp_commit buf; - bool shutdown_required =3D false; - int ret, error; - - if (!sev->snp_initialized) { - ret =3D snp_move_to_init_state(argp, &shutdown_required); - if (ret) - return ret; - } + int ret; =20 buf.len =3D sizeof(buf); =20 ret =3D __sev_do_cmd_locked(SEV_CMD_SNP_COMMIT, &buf, &argp->error); =20 - if (shutdown_required) - __sev_snp_shutdown_locked(&error, false); - return ret; } =20 --=20 2.54.0 From nobody Sun Jun 14 01:45:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC7063E3D9C; Mon, 4 May 2026 16:52:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913537; cv=none; b=oUeIdT4DTPtdiPmjaWeRSxM1mAb12Jk5uyHZO4a7gz4XGlZzDoey9BbB7KWCqUirBL3syx5supoRIgmhPY3ggwYRwj5GGF37Jd2I9dpUFYq48TQ8Z1oZCJUPcKyxk+t0SJ7ozsgB6TuKUs+fTJ+oqXqQ/AGGdNXdzCkdo3/hmQY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913537; c=relaxed/simple; bh=YgNEz2GgxfbZjC06CdBKMrFbR54U7WwWhBedkxltfjk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fbLsSjs4AkdbS/Cb8Boaqkw0rJYkh8YWFkrLCVVSNJ8abCCDjYT9Rb3L/LEaJvsaIz6M89PMbjKj0MH85arKzX8iGWia4lQG0nq6RXq/fJH/7LljdWLPDi2KuYQU3S62czHClRf56xVtlrhV3f20b9UYMW2tWfvVKYgl1JvBoLA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kK0P+s/l; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kK0P+s/l" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4DD9C2BCB8; Mon, 4 May 2026 16:52:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777913535; bh=YgNEz2GgxfbZjC06CdBKMrFbR54U7WwWhBedkxltfjk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kK0P+s/luF5NmD6qMIJgQBr6wP4XN/hxoq4VOSBObtkUEqiUiivmMBOMpo/6pfulF jw4mmZfQ6VyGkoBsFlinKUz1Izxy80OdUd6CyWlFCRYDbhuO0Cp3DImd1Ur0R6ivjk bwdeFAo2wi9dQoPiELiz96IjCD3+KEN/FelQv11+XsW6yacuFLcXoCrOKtQy1q2Xnn aaFdONApOJ+H/Hp5TICMnmvzSJmGYy/cT6qRgMz60qE/UwoFztYyM6BIoPdW3ZV3qH t7LDDz/fELPmqmryXh73DyZwtur6h6HUlY2BHsFRpycfgoXqWqXwMjWTzBCEvU+96B Ml5eWb68j8A7Q== From: Tycho Andersen To: Tom Lendacky , John Allen , Herbert Xu , "David S. Miller" , Ashish Kalra Cc: "Borislav Petkov (AMD)" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Brijesh Singh , Michael Roth , Alexey Kardashevskiy , Dan Williams , "Tycho Andersen (AMD)" , stable@vger.kernel.org Subject: [PATCH v2 3/4] crypto/ccp: Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Date: Mon, 4 May 2026 10:51:46 -0600 Message-ID: <20260504165147.1615643-4-tycho@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260504165147.1615643-1-tycho@kernel.org> References: <20260504165147.1615643-1-tycho@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Tycho Andersen (AMD)" Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could= a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash t= he > host? The SEV firmware docs for SNP_VLEK_LOAD note: > On SNP_SHUTDOWN, the VLEK is deleted. That is, the initialization/shutdown wrapper here is pointless, because the firmware immediately throws away the key anyway. Instead, refuse to do anything if SNP has not been previously initialized. This is an ABI break: before, this was a no-op and almost certainly a mistake by userspace, and now it returns -ENODEV. ABI compatibility could be maintained here by simply returning 0 in the check instead. Fixes: ceac7fb89e8d ("crypto: ccp - Ensure implicit SEV/SNP init and shutdo= wn in ioctls") Reported-by: Sashiko Assisted-by: Gemini:gemini-3.1-pro-preview Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kerne= l.org CC: Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky --- drivers/crypto/ccp/sev-dev.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 572f06368d4b..ad6c2525a305 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -2481,9 +2481,8 @@ static int sev_ioctl_do_snp_vlek_load(struct sev_issu= e_cmd *argp, bool writable) { struct sev_device *sev =3D psp_master->sev_data; struct sev_user_data_snp_vlek_load input; - bool shutdown_required =3D false; - int ret, error; void *blob; + int ret; =20 if (!argp->data) return -EINVAL; @@ -2491,6 +2490,9 @@ static int sev_ioctl_do_snp_vlek_load(struct sev_issu= e_cmd *argp, bool writable) if (!writable) return -EPERM; =20 + if (!sev->snp_initialized) + return -ENODEV; + if (copy_from_user(&input, u64_to_user_ptr(argp->data), sizeof(input))) return -EFAULT; =20 @@ -2504,18 +2506,7 @@ static int sev_ioctl_do_snp_vlek_load(struct sev_iss= ue_cmd *argp, bool writable) =20 input.vlek_wrapped_address =3D __psp_pa(blob); =20 - if (!sev->snp_initialized) { - ret =3D snp_move_to_init_state(argp, &shutdown_required); - if (ret) - goto cleanup; - } - ret =3D __sev_do_cmd_locked(SEV_CMD_SNP_VLEK_LOAD, &input, &argp->error); - - if (shutdown_required) - __sev_snp_shutdown_locked(&error, false); - -cleanup: kfree(blob); =20 return ret; --=20 2.54.0 From nobody Sun Jun 14 01:45:34 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E9D93E3C69; Mon, 4 May 2026 16:52:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913538; cv=none; b=brm1pGoWvAJhe397SIVPugQ5E4A3X8xZ8cOuzEu6M9fENZmPPi2fWBzhrxUhaVKFO5joMGdaA8AlVsYD2cLTCEG6p7Kh6TGuoU47nLGGDZknyMpdst25aCL9gMyiOUZ8KhQmkozLmZYxuL4GBtKIR3k0HBV9FOaQzJW2xOSYfwU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777913538; c=relaxed/simple; bh=Fw7svH/liofO4kK7H0XxtvP07i4I2IoOHIbSEEO2pUE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Yx1DYlVd3RdRy9txe5JDFTGqLLx+mv2cN/hAeDbYnpNiKFSIIDvNkVXViShU7MF7eEqyQKjMIps2pZCoKyeeXyIIDHiCI+Rl5i5POhUazpfGh8FRBBn6xE73qnivApepYzjXZA9qx11cyBmEyAjZYBDYHDojfcYUrrbAgjuzWQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YIC7msaE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YIC7msaE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 970AEC2BCC4; Mon, 4 May 2026 16:52:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777913537; bh=Fw7svH/liofO4kK7H0XxtvP07i4I2IoOHIbSEEO2pUE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YIC7msaEJqzjuUdGOvWonpjck6LcAUPwDpqJWnKoYPnAbQOUNyK80/4bRbAXFhpND 0gbhYkeZOH6sWURLwUEVd5yUnEfV73sobDXdIgNZ0bcxFEmoCVaQuei0gr9eZKF32Z Th6kiYIwYPW/jVLI+meNn5K09EjMxzkOarXvuS2uZr1fYnyL6TihgZivmiYmW+bc/o bdWYllnEpgiiPBHb5X2vI3hzSJzvf4HVq4V1Y4G03Ne+iw2WUpgBy5O7g/M/EECt1S ZFTtqUEvFXVYGhIredWFkyEJ+q1WRD6cFqR/iKgyXubGTCjpi0yhF2vRL+0cE2K6pI 9zfWur7PNCazA== From: Tycho Andersen To: Tom Lendacky , John Allen , Herbert Xu , "David S. Miller" , Ashish Kalra Cc: "Borislav Petkov (AMD)" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Brijesh Singh , Michael Roth , Alexey Kardashevskiy , Dan Williams , "Tycho Andersen (AMD)" , stable@vger.kernel.org Subject: [PATCH v2 4/4] crypto/ccp: Do not initialize SNP for ioctl(SNP_CONFIG) Date: Mon, 4 May 2026 10:51:47 -0600 Message-ID: <20260504165147.1615643-5-tycho@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260504165147.1615643-1-tycho@kernel.org> References: <20260504165147.1615643-1-tycho@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Tycho Andersen (AMD)" Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could= a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash t= he > host? Refuse to re-try initialization if SNP is not already initialized for SNP_CONFIG. This is technically an ABI break: before if SNP initialization failed it could be transparently retriggered by this ioctl, and if no VMs were running, everything worked fine. Hopefully this is enough of a corner case that nobody will notice, but someone does, there are a few options: * do something like symbol_get() for kvm and refuse to initialize if KVM is loaded * check each cpu's HSAVE_PA for non-zero data before re-initializing * once initialization has failed, continue to refuse to initialize until the ccp module is unloaded Fixes: ceac7fb89e8d ("crypto: ccp - Ensure implicit SEV/SNP init and shutdo= wn in ioctls") Reported-by: Sashiko Assisted-by: Gemini:gemini-3.1-pro-preview Link: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kerne= l.org CC: Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky --- drivers/crypto/ccp/sev-dev.c | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index ad6c2525a305..7c4dd57fabb9 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -1727,21 +1727,6 @@ static int sev_move_to_init_state(struct sev_issue_c= md *argp, bool *shutdown_req return 0; } =20 -static int snp_move_to_init_state(struct sev_issue_cmd *argp, bool *shutdo= wn_required) -{ - int error, rc; - - rc =3D __sev_snp_init_locked(&error, 0); - if (rc) { - argp->error =3D SEV_RET_INVALID_PLATFORM_STATE; - return rc; - } - - *shutdown_required =3D true; - - return 0; -} - static int sev_ioctl_do_reset(struct sev_issue_cmd *argp, bool writable) { int state, rc; @@ -2451,8 +2436,6 @@ static int sev_ioctl_do_snp_set_config(struct sev_iss= ue_cmd *argp, bool writable { struct sev_device *sev =3D psp_master->sev_data; struct sev_user_data_snp_config config; - bool shutdown_required =3D false; - int ret, error; =20 if (!argp->data) return -EINVAL; @@ -2460,21 +2443,13 @@ static int sev_ioctl_do_snp_set_config(struct sev_i= ssue_cmd *argp, bool writable if (!writable) return -EPERM; =20 + if (!sev->snp_initialized) + return -ENODEV; + if (copy_from_user(&config, (void __user *)argp->data, sizeof(config))) return -EFAULT; =20 - if (!sev->snp_initialized) { - ret =3D snp_move_to_init_state(argp, &shutdown_required); - if (ret) - return ret; - } - - ret =3D __sev_do_cmd_locked(SEV_CMD_SNP_CONFIG, &config, &argp->error); - - if (shutdown_required) - __sev_snp_shutdown_locked(&error, false); - - return ret; + return __sev_do_cmd_locked(SEV_CMD_SNP_CONFIG, &config, &argp->error); } =20 static int sev_ioctl_do_snp_vlek_load(struct sev_issue_cmd *argp, bool wri= table) --=20 2.54.0