Control: tags -1 + moreinfo upstream
Hi Andrew,
On Sat, Aug 22, 2026 at 09:55:11AM -0400, Andrew Wilson wrote:
> Hi Debian Kernel Team,
>
> With the help of Gemini to help me interpret my results, I have completed a
> bisect on the upstream 6.12.y branch to pinpoint the exact commit causing
> this SEV-ES launch failure regression. My journey wasn't as clean and
> surgical as I would have liked (so it took longer), but I THINK I got
> there.
>
> The failure was introduced by:
> Commit: bb1c84647025 ("crypto: ccp - Move SEV/SNP Platform initialization
> to KVM")
> Upstream commit: 3f8f0133a5fc9b32d0c308530320c3f2430ba5ab
>
> ---
> ### Verification & Bisect Details:
> * LAST WORKING COMMIT: 8a599f4f74d4
> * FIRST BROKEN COMMIT: bb1c84647025 (which landed in 6.12.97+)
> * Verified on 6.12.101: Cleanly reverting commit bb1c84647025 on top of
> 6.12.101 immediately fixes the issue and allows SEV-ES VMs to launch and
> run without errors.
>
> ---
> ### Failure Mechanism:
> Commit bb1c84647025 removed `sev_platform_init(&args)` from
> `sev_pci_init()` in `drivers/crypto/ccp/sev-dev.c` under the assumption
> that KVM would handle initialization on-demand.
>
> In practice on bare metal, the PSP firmware is left uninitialized (never
> transitions to SEV_STATE_INIT at probe time). When QEMU initializes the KVM
> accelerator and probes host SEV-ES capabilities, the ioctl fails with
> -EPERM, producing the error:
>
> qemu-system-x86_64: -accel kvm: sev_common_kvm_init: guest policy
> requires SEV-ES, but host SEV-ES support unavailable
> qemu-system-x86_64: -accel kvm: failed to initialize kvm: Operation not
> permitted
>
> Reverting bb1c84647025 restores the probe-time initialization and resolves
> the regression.
>
> Please let me know if you need any additional hardware traces or logs. I
> have the time and resources to run tests if I can help - I have Milan, Rome
> and even Naples (nothing newer) servers and I can try to do some trials if
> it's helpful.
>
> THANK YOU for your wonderful work. I have never rebooted a supermicro
> server as much in my life as I have on this. LOL. I HOPE this is useful.
Now that you isolated the commit, can you report it upstream and keep
us (and this bug in the loop please). I'm asking you to forward it
directly as I expect upstream might have additional questions and/or
asking you to test a patch. So we do not need the overhead of looping
back trough us first. But we want to keep track on progress.
So as the 'culprit' is bb1c84647025 ("crypto: ccp - Move SEV/SNP
Platform initialization to KVM") make sure to include:
Ashish Kalra <[email protected]>
Sean Christopherson <[email protected]>
Alexey Kardashevskiy <[email protected]>
Herbert Xu <[email protected]>
Additionally the stable and regression lists:
[email protected]
[email protected]
and
Tom Lendacky <[email protected]>
John Allen <[email protected]>
"David S. Miller" <[email protected]>
[email protected]
[email protected]
Please report back here so we can link the upstream report with the
Debian bug.
Regards,
Salvatore
