My preference would be to take this through the KVM tree, with acks on the
crypto patches. I'd also be a-ok with a stable branch/tag of the crypto
changes.
In the words of Tycho:
Recent SEV firmware [1] does not support SEV-ES VMs when SNP is enabled.
Expose this by revoking VM-types that are not supported by the current
configurations either from firmware restrictions or ASID configuration.
My previous version of this patch series [2] used SNP_VERIFY_MITIGATION
to test for a mitigation bit. While AMD-SB-3023 says that there is a
mitigation bit (3) for CVE-2025-48514, bit 3 corresponds to an unrelated
issue. The correct way to check for this is to use the SVN/SPL from the
TCB. We are in the process of updating the SB to reflect this.
v3:
- Relocate the supported_vm_types updates to sev_hardware_setup.
- Report unusable VM types as such in dmesg.
v2:
- https://lore.kernel.org/all/20260324194034.1442133-1-tycho@kernel.org
- compare SVN as above
- fix commit message prefixes
- supported_vm_types local is a u32
- move crypto stuff before KVM stuff in the event of patch tetris
[1]: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3023.html
[2]: https://lore.kernel.org/all/20260303191509.1565629-1-tycho@kernel.org
Sean Christopherson (3):
KVM: SEV: Set supported SEV+ VM types during sev_hardware_setup()
KVM: SEV: Consolidate logic for printing state of SEV{,-ES,-SNP}
enabling
KVM: SEV: Don't advertise support for unusable VM types
Tycho Andersen (4):
crypto/ccp: hoist kernel part of SNP_PLATFORM_STATUS
crypto/ccp: export firmware supported vm types
KVM: SEV: Don't advertise VM types that are disabled by firmware
KVM: selftests: Teach sev_*_test about revoking VM types
arch/x86/kvm/svm/sev.c | 40 ++++---
drivers/crypto/ccp/sev-dev.c | 101 ++++++++++++++++--
include/linux/psp-sev.h | 37 +++++++
.../selftests/kvm/x86/sev_init2_tests.c | 14 ++-
.../selftests/kvm/x86/sev_migrate_tests.c | 2 +-
.../selftests/kvm/x86/sev_smoke_test.c | 4 +-
6 files changed, 163 insertions(+), 35 deletions(-)
base-commit: 6b802031877a995456c528095c41d1948546bf45
--
2.54.0.rc1.513.gad8abe7a5a-goog