diff mbox series

[v3,06/15] sev: Update launch_update_data functions to use Error handling

Message ID cac4ababee3bfed7658a501d5d5810379ac90512.1718979106.git.roy.hopkins@suse.com
State New
Headers show
Series Introduce support for IGVM files | expand

Commit Message

Roy Hopkins June 21, 2024, 2:29 p.m. UTC 
The class function and implementations for updating launch data return
a code in case of error. In some cases an error message is generated and
in other cases, just the error return value is used.

This small refactor adds an 'Error **errp' parameter to all functions
which consistently set an error condition if a non-zero value is
returned.

Signed-off-by: Roy Hopkins <roy.hopkins@suse.com>
---
 target/i386/sev.c | 67 +++++++++++++++++++++++++----------------------
 1 file changed, 35 insertions(+), 32 deletions(-)

Comments

Stefano Garzarella June 27, 2024, 12:48 p.m. UTC | #1 
On Fri, Jun 21, 2024 at 03:29:09PM GMT, Roy Hopkins wrote:
>The class function and implementations for updating launch data return
>a code in case of error. In some cases an error message is generated and
>in other cases, just the error return value is used.
>
>This small refactor adds an 'Error **errp' parameter to all functions
>which consistently set an error condition if a non-zero value is
>returned.
>
>Signed-off-by: Roy Hopkins <roy.hopkins@suse.com>
>---
> target/i386/sev.c | 67 +++++++++++++++++++++++++----------------------
> 1 file changed, 35 insertions(+), 32 deletions(-)
>
>diff --git a/target/i386/sev.c b/target/i386/sev.c
>index 30b83f1d77..1900c3d9b4 100644
>--- a/target/i386/sev.c
>+++ b/target/i386/sev.c
>@@ -121,7 +121,8 @@ struct SevCommonStateClass {
>                                        Error **errp);
>     int (*launch_start)(SevCommonState *sev_common);
>     void (*launch_finish)(SevCommonState *sev_common);
>-    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, uint64_t len);
>+    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa,
>+                              uint8_t *ptr, uint64_t len, Error **errp);
>     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
> };
>
>@@ -942,14 +943,17 @@ out:
>     return ret;
> }
>
>-static int
>-sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t *addr, uint64_t len)
>+static int sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
>+                                  uint8_t *addr, uint64_t len, Error **errp)
> {
>     int ret, fw_error;
>     struct kvm_sev_launch_update_data update;
>
>     if (!addr || !len) {
>-        return 1;

Why were we returning 1 before? Was that a mistake?
Maybe we should mention it in the patch or fix it in another patch.

>+        error_setg(errp,
>+                   "%s: Invalid parameters provided for updating 
>launch data.",
>+                   __func__);
>+        return -1;
>     }
>
>     update.uaddr = (uintptr_t)addr;
>@@ -958,8 +962,8 @@ sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t *addr, ui
>     ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
>                     &update, &fw_error);
>     if (ret) {
>-        error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
>-                __func__, ret, fw_error, fw_error_to_str(fw_error));
>+        error_setg(errp, "%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", __func__,
>+                   ret, fw_error, fw_error_to_str(fw_error));
>     }
>
>     return ret;
>@@ -1087,9 +1091,8 @@ sev_launch_finish(SevCommonState *sev_common)
>     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
> }
>
>-static int
>-snp_launch_update_data(uint64_t gpa, void *hva,
>-                       uint32_t len, int type)
>+static int snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len,
>+                                  int type, Error **errp)
> {
>     SevLaunchUpdateData *data;
>
>@@ -1104,13 +1107,12 @@ snp_launch_update_data(uint64_t gpa, void *hva,
>     return 0;
> }
>
>-static int
>-sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
>-                           uint8_t *ptr, uint64_t len)
>+static int sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
>+                                      uint8_t *ptr, uint64_t len, Error **errp)
> {
>-       int ret = snp_launch_update_data(gpa, ptr, len,
>-                                         KVM_SEV_SNP_PAGE_TYPE_NORMAL);
>-       return ret;
>+    int ret = snp_launch_update_data(gpa, ptr, len,
>+                                     KVM_SEV_SNP_PAGE_TYPE_NORMAL, errp);
>+    return ret;

Pre-existing, but while we're at it maybe we can remove ret.

> }
>
> static int
>@@ -1162,8 +1164,8 @@ sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
>     return 0;
> }
>
>-static int
>-snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
>+static int snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva,
>+                                   uint32_t cpuid_len, Error **errp)
> {
>     KvmCpuidInfo kvm_cpuid_info = {0};
>     SnpCpuidInfo snp_cpuid_info;
>@@ -1180,26 +1182,26 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
>     } while (ret == -E2BIG);
>
>     if (ret) {
>-        error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'",
>-                     strerror(-ret));
>-        return 1;
>+        error_setg(errp, "SEV-SNP: unable to query CPUID values for CPU: '%s'",
>+                   strerror(-ret));
>+        return -1;
>     }
>
>     ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info);
>     if (ret) {
>-        error_report("SEV-SNP: failed to generate CPUID table information");
>-        return 1;
>+        error_setg(errp, "SEV-SNP: failed to generate CPUID table information");
>+        return -1;

Ditto for the 2 changes, although IIUC we never check the return value 
of snp_launch_update_cpuid().

>     }
>
>     memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info));
>
>     return snp_launch_update_data(cpuid_addr, hva, cpuid_len,
>-                                  KVM_SEV_SNP_PAGE_TYPE_CPUID);
>+                                  KVM_SEV_SNP_PAGE_TYPE_CPUID, errp);
> }
>
>-static int
>-snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
>-                                void *hva, uint32_t len)
>+static int snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp,
>+                                           uint32_t addr, void *hva,
>+                                           uint32_t len, Error **errp)
> {
>     int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
>     if (sev_snp->parent_obj.kernel_hashes) {
>@@ -1211,7 +1213,7 @@ snp_launch_update_kernel_hashes(SevSnpGuestState 
>*sev_snp, uint32_t addr,
>                sizeof(*sev_snp->kernel_hashes_data));
>         type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
>     }
>-    return snp_launch_update_data(addr, hva, len, type);
>+    return snp_launch_update_data(addr, hva, len, type, errp);
> }
>
> static int
>@@ -1249,12 +1251,14 @@ snp_populate_metadata_pages(SevSnpGuestState 
>*sev_snp,
>         }
>
>         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
>-            ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
>+            ret = snp_launch_update_cpuid(desc->base, hva, desc->len,
>+                                          &error_fatal);
>         } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
>             ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
>-                                                  desc->len);
>+                                                  desc->len, &error_fatal);
>         } else {
>-            ret = snp_launch_update_data(desc->base, hva, desc->len, type);
>+            ret = snp_launch_update_data(desc->base, hva, desc->len, type,
>+                                         &error_fatal);
>         }
>
>         if (ret) {
>@@ -1541,9 +1545,8 @@ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
>     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
>         int ret;
>
>-        ret = klass->launch_update_data(sev_common, gpa, ptr, len);
>+        ret = klass->launch_update_data(sev_common, gpa, ptr, len, errp);
>         if (ret < 0) {
>-            error_setg(errp, "SEV: Failed to encrypt pflash rom");
>             return ret;
>         }
>     }
>-- 
>2.43.0
>
Roy Hopkins June 28, 2024, 11:20 a.m. UTC | #2 
On Thu, 2024-06-27 at 14:48 +0200, Stefano Garzarella wrote:
> On Fri, Jun 21, 2024 at 03:29:09PM GMT, Roy Hopkins wrote:
> > The class function and implementations for updating launch data return
> > a code in case of error. In some cases an error message is generated and
> > in other cases, just the error return value is used.
> > 
> > This small refactor adds an 'Error **errp' parameter to all functions
> > which consistently set an error condition if a non-zero value is
> > returned.
> > 
> > Signed-off-by: Roy Hopkins <roy.hopkins@suse.com>
> > ---
> > target/i386/sev.c | 67 +++++++++++++++++++++++++----------------------
> > 1 file changed, 35 insertions(+), 32 deletions(-)
> > 
> > diff --git a/target/i386/sev.c b/target/i386/sev.c
> > index 30b83f1d77..1900c3d9b4 100644
> > --- a/target/i386/sev.c
> > +++ b/target/i386/sev.c
> > @@ -121,7 +121,8 @@ struct SevCommonStateClass {
> >                                        Error **errp);
> >     int (*launch_start)(SevCommonState *sev_common);
> >     void (*launch_finish)(SevCommonState *sev_common);
> > -    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa,
> > uint8_t *ptr, uint64_t len);
> > +    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa,
> > +                              uint8_t *ptr, uint64_t len, Error **errp);
> >     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
> > };
> > 
> > @@ -942,14 +943,17 @@ out:
> >     return ret;
> > }
> > 
> > -static int
> > -sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t
> > *addr, uint64_t len)
> > +static int sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
> > +                                  uint8_t *addr, uint64_t len, Error
> > **errp)
> > {
> >     int ret, fw_error;
> >     struct kvm_sev_launch_update_data update;
> > 
> >     if (!addr || !len) {
> > -        return 1;
> 
> Why were we returning 1 before? Was that a mistake?
> Maybe we should mention it in the patch or fix it in another patch.
> 
> > +        error_setg(errp,
> > +                   "%s: Invalid parameters provided for updating 
> > launch data.",
> > +                   __func__);
> > +        return -1;
> >     }
> > 
> >     update.uaddr = (uintptr_t)addr;
> > @@ -958,8 +962,8 @@ sev_launch_update_data(SevCommonState *sev_common,
> > hwaddr gpa, uint8_t *addr, ui
> >     ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
> >                     &update, &fw_error);
> >     if (ret) {
> > -        error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
> > -                __func__, ret, fw_error, fw_error_to_str(fw_error));
> > +        error_setg(errp, "%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
> > __func__,
> > +                   ret, fw_error, fw_error_to_str(fw_error));
> >     }
> > 
> >     return ret;
> > @@ -1087,9 +1091,8 @@ sev_launch_finish(SevCommonState *sev_common)
> >     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
> > }
> > 
> > -static int
> > -snp_launch_update_data(uint64_t gpa, void *hva,
> > -                       uint32_t len, int type)
> > +static int snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len,
> > +                                  int type, Error **errp)
> > {
> >     SevLaunchUpdateData *data;
> > 
> > @@ -1104,13 +1107,12 @@ snp_launch_update_data(uint64_t gpa, void *hva,
> >     return 0;
> > }
> > 
> > -static int
> > -sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
> > -                           uint8_t *ptr, uint64_t len)
> > +static int sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr
> > gpa,
> > +                                      uint8_t *ptr, uint64_t len, Error
> > **errp)
> > {
> > -       int ret = snp_launch_update_data(gpa, ptr, len,
> > -                                         KVM_SEV_SNP_PAGE_TYPE_NORMAL);
> > -       return ret;
> > +    int ret = snp_launch_update_data(gpa, ptr, len,
> > +                                     KVM_SEV_SNP_PAGE_TYPE_NORMAL, errp);
> > +    return ret;
> 
> Pre-existing, but while we're at it maybe we can remove ret.
> 
> > }
> > 
> > static int
> > @@ -1162,8 +1164,8 @@ sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
> >     return 0;
> > }
> > 
> > -static int
> > -snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
> > +static int snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva,
> > +                                   uint32_t cpuid_len, Error **errp)
> > {
> >     KvmCpuidInfo kvm_cpuid_info = {0};
> >     SnpCpuidInfo snp_cpuid_info;
> > @@ -1180,26 +1182,26 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void
> > *hva, uint32_t cpuid_len)
> >     } while (ret == -E2BIG);
> > 
> >     if (ret) {
> > -        error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'",
> > -                     strerror(-ret));
> > -        return 1;
> > +        error_setg(errp, "SEV-SNP: unable to query CPUID values for CPU:
> > '%s'",
> > +                   strerror(-ret));
> > +        return -1;
> >     }
> > 
> >     ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info);
> >     if (ret) {
> > -        error_report("SEV-SNP: failed to generate CPUID table
> > information");
> > -        return 1;
> > +        error_setg(errp, "SEV-SNP: failed to generate CPUID table
> > information");
> > +        return -1;
> 
> Ditto for the 2 changes, although IIUC we never check the return value 
> of snp_launch_update_cpuid().

The error returns were changed to -1 for consistency, but on reflection, without
changing every return in this file it had the reverse effect. I'll revert these
back to the original return values.

I did however spot a pre-existing bug when reverting this though.
sev_encrypt_firmware() only considers a negative result from launch_update() as
an error, but the function returns 1 on some errors. I've added a new patch in
v4 that fixes this error.

> 
> >     }
> > 
> >     memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info));
> > 
> >     return snp_launch_update_data(cpuid_addr, hva, cpuid_len,
> > -                                  KVM_SEV_SNP_PAGE_TYPE_CPUID);
> > +                                  KVM_SEV_SNP_PAGE_TYPE_CPUID, errp);
> > }
> > 
> > -static int
> > -snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
> > -                                void *hva, uint32_t len)
> > +static int snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp,
> > +                                           uint32_t addr, void *hva,
> > +                                           uint32_t len, Error **errp)
> > {
> >     int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
> >     if (sev_snp->parent_obj.kernel_hashes) {
> > @@ -1211,7 +1213,7 @@ snp_launch_update_kernel_hashes(SevSnpGuestState 
> > *sev_snp, uint32_t addr,
> >                sizeof(*sev_snp->kernel_hashes_data));
> >         type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
> >     }
> > -    return snp_launch_update_data(addr, hva, len, type);
> > +    return snp_launch_update_data(addr, hva, len, type, errp);
> > }
> > 
> > static int
> > @@ -1249,12 +1251,14 @@ snp_populate_metadata_pages(SevSnpGuestState 
> > *sev_snp,
> >         }
> > 
> >         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
> > -            ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
> > +            ret = snp_launch_update_cpuid(desc->base, hva, desc->len,
> > +                                          &error_fatal);
> >         } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
> >             ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
> > -                                                  desc->len);
> > +                                                  desc->len, &error_fatal);
> >         } else {
> > -            ret = snp_launch_update_data(desc->base, hva, desc->len, type);
> > +            ret = snp_launch_update_data(desc->base, hva, desc->len, type,
> > +                                         &error_fatal);
> >         }
> > 
> >         if (ret) {
> > @@ -1541,9 +1545,8 @@ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t
> > len, Error **errp)
> >     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
> >         int ret;
> > 
> > -        ret = klass->launch_update_data(sev_common, gpa, ptr, len);
> > +        ret = klass->launch_update_data(sev_common, gpa, ptr, len, errp);
> >         if (ret < 0) {
> > -            error_setg(errp, "SEV: Failed to encrypt pflash rom");
> >             return ret;
> >         }
> >     }
> > -- 
> > 2.43.0
> > 
>
diff mbox series

Patch

diff --git a/target/i386/sev.c b/target/i386/sev.c
index 30b83f1d77..1900c3d9b4 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -121,7 +121,8 @@  struct SevCommonStateClass {
                                        Error **errp);
     int (*launch_start)(SevCommonState *sev_common);
     void (*launch_finish)(SevCommonState *sev_common);
-    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, uint64_t len);
+    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa,
+                              uint8_t *ptr, uint64_t len, Error **errp);
     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
 };
 
@@ -942,14 +943,17 @@  out:
     return ret;
 }
 
-static int
-sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t *addr, uint64_t len)
+static int sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
+                                  uint8_t *addr, uint64_t len, Error **errp)
 {
     int ret, fw_error;
     struct kvm_sev_launch_update_data update;
 
     if (!addr || !len) {
-        return 1;
+        error_setg(errp,
+                   "%s: Invalid parameters provided for updating launch data.",
+                   __func__);
+        return -1;
     }
 
     update.uaddr = (uintptr_t)addr;
@@ -958,8 +962,8 @@  sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t *addr, ui
     ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
                     &update, &fw_error);
     if (ret) {
-        error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
-                __func__, ret, fw_error, fw_error_to_str(fw_error));
+        error_setg(errp, "%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", __func__,
+                   ret, fw_error, fw_error_to_str(fw_error));
     }
 
     return ret;
@@ -1087,9 +1091,8 @@  sev_launch_finish(SevCommonState *sev_common)
     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
 }
 
-static int
-snp_launch_update_data(uint64_t gpa, void *hva,
-                       uint32_t len, int type)
+static int snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len,
+                                  int type, Error **errp)
 {
     SevLaunchUpdateData *data;
 
@@ -1104,13 +1107,12 @@  snp_launch_update_data(uint64_t gpa, void *hva,
     return 0;
 }
 
-static int
-sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
-                           uint8_t *ptr, uint64_t len)
+static int sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
+                                      uint8_t *ptr, uint64_t len, Error **errp)
 {
-       int ret = snp_launch_update_data(gpa, ptr, len,
-                                         KVM_SEV_SNP_PAGE_TYPE_NORMAL);
-       return ret;
+    int ret = snp_launch_update_data(gpa, ptr, len,
+                                     KVM_SEV_SNP_PAGE_TYPE_NORMAL, errp);
+    return ret;
 }
 
 static int
@@ -1162,8 +1164,8 @@  sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
     return 0;
 }
 
-static int
-snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
+static int snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva,
+                                   uint32_t cpuid_len, Error **errp)
 {
     KvmCpuidInfo kvm_cpuid_info = {0};
     SnpCpuidInfo snp_cpuid_info;
@@ -1180,26 +1182,26 @@  snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
     } while (ret == -E2BIG);
 
     if (ret) {
-        error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'",
-                     strerror(-ret));
-        return 1;
+        error_setg(errp, "SEV-SNP: unable to query CPUID values for CPU: '%s'",
+                   strerror(-ret));
+        return -1;
     }
 
     ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info);
     if (ret) {
-        error_report("SEV-SNP: failed to generate CPUID table information");
-        return 1;
+        error_setg(errp, "SEV-SNP: failed to generate CPUID table information");
+        return -1;
     }
 
     memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info));
 
     return snp_launch_update_data(cpuid_addr, hva, cpuid_len,
-                                  KVM_SEV_SNP_PAGE_TYPE_CPUID);
+                                  KVM_SEV_SNP_PAGE_TYPE_CPUID, errp);
 }
 
-static int
-snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
-                                void *hva, uint32_t len)
+static int snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp,
+                                           uint32_t addr, void *hva,
+                                           uint32_t len, Error **errp)
 {
     int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
     if (sev_snp->parent_obj.kernel_hashes) {
@@ -1211,7 +1213,7 @@  snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
                sizeof(*sev_snp->kernel_hashes_data));
         type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
     }
-    return snp_launch_update_data(addr, hva, len, type);
+    return snp_launch_update_data(addr, hva, len, type, errp);
 }
 
 static int
@@ -1249,12 +1251,14 @@  snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
         }
 
         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
-            ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
+            ret = snp_launch_update_cpuid(desc->base, hva, desc->len,
+                                          &error_fatal);
         } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
             ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
-                                                  desc->len);
+                                                  desc->len, &error_fatal);
         } else {
-            ret = snp_launch_update_data(desc->base, hva, desc->len, type);
+            ret = snp_launch_update_data(desc->base, hva, desc->len, type,
+                                         &error_fatal);
         }
 
         if (ret) {
@@ -1541,9 +1545,8 @@  sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
         int ret;
 
-        ret = klass->launch_update_data(sev_common, gpa, ptr, len);
+        ret = klass->launch_update_data(sev_common, gpa, ptr, len, errp);
         if (ret < 0) {
-            error_setg(errp, "SEV: Failed to encrypt pflash rom");
             return ret;
         }
     }