From: Atish Patra The intra-host migration feature is not fully implemented for SEV-SNP VMs which require additional SNP-specific state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be transferred or initialized on the destination. Reject SNP source VMs in sev_vm_move_enc_context_from() until proper SNP state transfer is implemented. Fixes: 0b020f5af092 ("KVM: SEV: Add support for SEV-ES intra host migration") Reported-by: Chris Mason Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Atish Patra --- arch/x86/kvm/svm/sev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c2126b3c3072..aff6a0cf5bfe 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2142,7 +2142,8 @@ int sev_vm_move_enc_context_from(struct kvm *kvm, unsigned int source_fd) return ret; if (kvm->arch.vm_type != source_kvm->arch.vm_type || - sev_guest(kvm) || !sev_guest(source_kvm)) { + sev_guest(kvm) || !sev_guest(source_kvm) || + sev_snp_guest(source_kvm)) { ret = -EINVAL; goto out_unlock; } -- 2.53.0-Meta From: Atish Patra __sev_platform_init_handle_init_ex_path() called rmp_mark_pages_firmware() with locked=false but while the parent function of init_ex_path already acquired the sev_cmd_mutex. In case of a rmpupdate failure for any page after the first, the cleanup path would invoke reclaim pages which would result in a deadlock in sev_do_cmd. Pass locked=true to honor the lock status of the parent function. Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled") Reported-by: Chris Mason Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Atish Patra --- drivers/crypto/ccp/sev-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index d1e9e0ac63b6..3d4793e8e34b 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -1557,7 +1557,7 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev) unsigned long npages; npages = 1UL << get_order(NV_LENGTH); - if (rmp_mark_pages_firmware(__pa(sev_init_ex_buffer), npages, false)) { + if (rmp_mark_pages_firmware(__pa(sev_init_ex_buffer), npages, true)) { dev_err(sev->dev, "SEV: INIT_EX NV memory page state change failed.\n"); return -ENOMEM; } -- 2.53.0-Meta