[PATCH 6.12.y 0/4] crypto: ccp, KVM: SVM - missing SEV/SNP platform-init dependency + 2 bugfixes

From: Jack Wang <[email protected]>

Hello Greg, hello Sasha

Backport of 4 upstream commits to 6.12.y (applies on stable-rc
queue/6.12), Option 3 of stable-kernel-rules.rst (no Cc: stable tag
upstream).

Patches 1-2 are the missing dependencies of commit 3f8f0133a5fc
("crypto: ccp - Move SEV/SNP Platform initialization to KVM"), already
queued as of 6.12.97 (bb1c8464702540 on queue/6.12). That commit
dropped SEV/SNP platform init from the CCP driver's probe path,
expecting KVM to take over, but the counterpart commits that give KVM
that responsibility were never queued alongside it. Net effect:
6.12.97+ has no code path left that initializes SEV/SNP, so starting a
SEV-SNP guest crashes the host.

1) crypto: ccp - Add new SEV/SNP platform shutdown API
   Upstream f7b86e0e75bc234751cb7a82d888083a57ef28b2

2) KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
   Upstream 6f1d5a3513c2370bbd6115dd430906bc2f4bdc53

Patches 3-4 are unrelated, independent bugfixes:

3) crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
   Upstream ed53a5050f42a3243a7ed8dfa49030e54034b952
   Context deviation: 6.12.y lacks the SEV_CMD_SNP_FEATURE_INFO case
   the upstream hunk anchors on (added later, not queued here), so
   the new case was placed after SEV_CMD_SNP_COMMIT instead. No
   functional difference; noted as [Jack: ...] in the commit.

4) crypto: ccp - Abort doing SEV INIT if SNP INIT fails
   Upstream 6131e119f5799bec55535530fa2fc44f5c7be1f1
   Fixes SEV INIT succeeding to be issued (and failing) even when SNP
   host support is enabled and SNP_INIT(_EX) hasn't succeeded.

Patches 1, 2 and 4 applied clean; only patch 3 needed the context
adjustment above. Please consider queue them for future release.

Thanks,
Jack Wang @ IONOS Cloud

Ashish Kalra (3):
  crypto: ccp - Add new SEV/SNP platform shutdown API
  KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
  crypto: ccp - Abort doing SEV INIT if SNP INIT fails

Michael Roth (1):
  crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length

 arch/x86/kvm/svm/sev.c       | 12 ++++++++++++
 drivers/crypto/ccp/sev-dev.c | 17 ++++++++++++-----
 include/linux/psp-sev.h      |  3 +++
 3 files changed, 27 insertions(+), 5 deletions(-)

-- 
2.43.0