[PATCH 6.18 169/198] KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

Greg Kroah-Hartman
2026-04-20T16:04:29Z

From: Sean Christopherson <seanjc@google.com>

commit cb923ee6a80f4e604e6242a4702b59251e61a380 upstream.

Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as
allowing userspace to manipulate and/or run a vCPU while its state is being
synchronized would at best corrupt vCPU state, and at worst crash the host
kernel.

Opportunistically assert that vcpu->mutex is held when synchronizing its
VMSA (the SEV-ES path already locks vCPUs).

Fixes: ad27ce155566 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_FINISH command")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260310234829.2608037-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/sev.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)

--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -871,6 +871,8 @@ static int sev_es_sync_vmsa(struct vcpu_
u8 *d;
int i;

+ lockdep_assert_held(&vcpu->mutex);
+
if (vcpu->arch.guest_state_protected)
return -EINVAL;

@@ -2452,6 +2454,10 @@ static int snp_launch_update_vmsa(struct
if (kvm_is_vcpu_creation_in_progress(kvm))
return -EBUSY;

+ ret = kvm_lock_all_vcpus(kvm);
+ if (ret)
+ return ret;
+
data.gctx_paddr = __psp_pa(sev->snp_context);
data.page_type = SNP_PAGE_TYPE_VMSA;

@@ -2461,12 +2467,12 @@ static int snp_launch_update_vmsa(struct

ret = sev_es_sync_vmsa(svm);
if (ret)
- return ret;
+ goto out;

/* Transition the VMSA page to a firmware state. */
ret = rmp_make_private(pfn, INITIAL_VMSA_GPA, PG_LEVEL_4K, sev->asid, true);
if (ret)
- return ret;
+ goto out;

/* Issue the SNP command to encrypt the VMSA */
data.address = __sme_pa(svm->sev_es.vmsa);
@@ -2475,7 +2481,7 @@ static int snp_launch_update_vmsa(struct
if (ret) {
snp_page_reclaim(kvm, pfn);

- return ret;
+ goto out;
}

svm->vcpu.arch.guest_state_protected = true;
@@ -2489,7 +2495,9 @@ static int snp_launch_update_vmsa(struct
svm_enable_lbrv(vcpu);
}

- return 0;
+out:
+ kvm_unlock_all_vcpus(kvm);
+ return ret;
}

static int snp_launch_finish(struct kvm *kvm, struct kvm_sev_cmd *argp)