Re: Bug#1145026: [REGRESSION] [6.12.y] crypto: ccp - Move SEV/SNP Platform initialization to KVM breaks SEV-ES VM launch

[Salvatore Bonaccorso]

Source: linux
Source-Version: 6.12.105-1

Hi,

On Wed, Sep 02, 2026 at 03:14:48PM -0400, Andrew Wilson wrote:
> Hi Sean, Salvatore,
> 
> Tested-by: Andrew Wilson <your.email@xxxxxxxxxxx>
> 
> (With strong assistance from Gemini guiding me through builds, module
> DKMS rebuilds, and interpreting logs!)
> 
> I can confirm that commit 6b748c39d18e completely resolves the issue,
> and SEV, SEV-ES, AND SEV-SNP are fully functional on official Debian
> packages (tested on EPYC Rome and EPYC Milan servers).
> 
> Here are the test results from bare-metal hardware:
> 
> 1. Upstream v6.12.104 (Source build) on AMD EPYC (Rome):
>    * Tested SEV-ES: Functional, VMs launch cleanly.
> 
> 2. Debian 6.12.107-1 (linux-image-6.12.107+deb13-amd64) on AMD EPYC (Rome):
>    * Tested SEV & SEV-ES: Functional.
>    [    3.676036] kvm_amd: SEV enabled (ASIDs 16 - 253)
>    [    3.690542] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)
>    [    3.735896] ccp 0000:26:00.1: SEV API:0.24 build:22
> 
> 3. Debian 6.12.107-1 (linux-image-6.12.107+deb13-amd64) on AMD EPYC (Milan):
>    * Tested SEV-SNP: Fully functional!
>    * Host log:
>      [    4.678767] kvm_amd: SEV enabled (ASIDs 256 - 509)
>      [    4.684694] kvm_amd: SEV-ES enabled (ASIDs 1 - 255)
>      [    4.690563] kvm_amd: SEV-SNP enabled (ASIDs 1 - 255)
>      [    6.212275] ccp 0000:47:00.1: SEV-SNP API:1.58 build:2
>    * Guest dmesg:
>      [    0.908804] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
>      [    0.908820] SEV: Status: SEV SEV-ES SEV-SNP
>      [    2.109524] SEV: SNP running at VMPL0.
>      [    3.439649] sev-guest sev-guest: Initialized SEV guest driver
> (using VMPCK0 communication key)
> 
> Because Debian builds KVM as a module (CONFIG_KVM_AMD=m), we avoid the
> built-in CONFIG_KVM_AMD=y SNP race on 6.12.y, so both SEV-ES and
> SEV-SNP are completely working out-of-the-box on 6.12.107-1.
> 
> Salvatore: Debian bug #1145026 can be marked fully resolved by
> linux-image-6.12.107-1.

Thanks for the confirmation, thanks Sean for checking the report!

On Debian's side I'm thus closing the bugreport.

Regards,
Salvatore