KVM: SEV: Save the SEV policy if and only if LAUNCH_START succeeds

Wait until LAUNCH_START fully succeeds to set a VM's SEV/SNP policy so
that KVM doesn't keep a potentially stale policy.  In practice, the issue
is benign as the policy is only used to detect if the VMSA can be
decrypted, and the VMSA only needs to be decrypted if LAUNCH_UPDATE and
thus LAUNCH_START succeeded.

Fixes: 962e2b6152ef ("KVM: SVM: Decrypt SEV VMSA in dump_vmcb() if debugging is enabled")
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Kim Phillips <kim.phillips@amd.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20250821213841.3462339-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 86fd270a1d6ed9933269dd3aa430e3e82a347b69..a95b862afa23987a5efef8f397a822996bf61d34 100644 (file)
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -583,8 +583,6 @@ static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
        if (copy_from_user(&params, u64_to_user_ptr(argp->data), sizeof(params)))
                return -EFAULT;
 
-       sev->policy = params.policy;
-
        memset(&start, 0, sizeof(start));
 
        dh_blob = NULL;
@@ -632,6 +630,7 @@ static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
                goto e_free_session;
        }
 
+       sev->policy = params.policy;
        sev->handle = start.handle;
        sev->fd = argp->sev_fd;
 
@@ -2205,8 +2204,6 @@ static int snp_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
                start.desired_tsc_khz = kvm->arch.default_tsc_khz;
        }
 
-       sev->policy = params.policy;
-
        sev->snp_context = snp_context_create(kvm, argp);
        if (!sev->snp_context)
                return -ENOTTY;
@@ -2222,6 +2219,7 @@ static int snp_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
                goto e_free_context;
        }
 
+       sev->policy = params.policy;
        sev->fd = argp->sev_fd;
        rc = snp_bind_asid(kvm, &argp->error);
        if (rc) {