[RFC PATCH 1/4] KVM: SEV: Publish supported SEV-SNP policy bits

Tom Lendacky posted 4 patches 1 month, 1 week ago
There is a newer version of this series
[RFC PATCH 1/4] KVM: SEV: Publish supported SEV-SNP policy bits
Posted by Tom Lendacky 1 month, 1 week ago
Define the set of policy bits that KVM currently knows as not requiring
any implementation support within KVM. Provide this value to userspace
via the KVM_GET_DEVICE_ATTR ioctl.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
 arch/x86/include/uapi/asm/kvm.h |  1 +
 arch/x86/kvm/svm/sev.c          | 11 ++++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index 0f15d683817d..90e9c4551fa6 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -468,6 +468,7 @@ struct kvm_sync_regs {
 /* vendor-specific groups and attributes for system fd */
 #define KVM_X86_GRP_SEV			1
 #  define KVM_X86_SEV_VMSA_FEATURES	0
+#  define KVM_X86_SNP_POLICY_BITS	1
 
 struct kvm_vmx_nested_state_data {
 	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 2fbdebf79fbb..7e6ce092628a 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -78,6 +78,8 @@ static u64 sev_supported_vmsa_features;
 					 SNP_POLICY_MASK_DEBUG		| \
 					 SNP_POLICY_MASK_SINGLE_SOCKET)
 
+static u64 snp_supported_policy_bits;
+
 #define INITIAL_VMSA_GPA 0xFFFFFFFFF000
 
 static u8 sev_enc_bit;
@@ -2113,6 +2115,10 @@ int sev_dev_get_attr(u32 group, u64 attr, u64 *val)
 		*val = sev_supported_vmsa_features;
 		return 0;
 
+	case KVM_X86_SNP_POLICY_BITS:
+		*val = snp_supported_policy_bits;
+		return 0;
+
 	default:
 		return -ENXIO;
 	}
@@ -2177,7 +2183,7 @@ static int snp_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
 	if (params.flags)
 		return -EINVAL;
 
-	if (params.policy & ~SNP_POLICY_MASK_VALID)
+	if (params.policy & ~snp_supported_policy_bits)
 		return -EINVAL;
 
 	/* Check for policy bits that must be set */
@@ -3054,6 +3060,9 @@ void __init sev_hardware_setup(void)
 			sev_supported = sev_es_supported = sev_snp_supported = false;
 		else if (sev_snp_supported)
 			sev_snp_supported = is_sev_snp_initialized();
+
+		if (sev_snp_supported)
+			snp_supported_policy_bits = SNP_POLICY_MASK_VALID;
 	}
 
 	if (boot_cpu_has(X86_FEATURE_SEV))
-- 
2.46.2
Re: [RFC PATCH 1/4] KVM: SEV: Publish supported SEV-SNP policy bits
Posted by Sean Christopherson 3 weeks, 2 days ago
On Fri, Aug 22, 2025, Tom Lendacky wrote:
> Define the set of policy bits that KVM currently knows as not requiring
> any implementation support within KVM. Provide this value to userspace
> via the KVM_GET_DEVICE_ATTR ioctl.
> 
> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
>  arch/x86/include/uapi/asm/kvm.h |  1 +
>  arch/x86/kvm/svm/sev.c          | 11 ++++++++++-
>  2 files changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 0f15d683817d..90e9c4551fa6 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -468,6 +468,7 @@ struct kvm_sync_regs {
>  /* vendor-specific groups and attributes for system fd */
>  #define KVM_X86_GRP_SEV			1
>  #  define KVM_X86_SEV_VMSA_FEATURES	0
> +#  define KVM_X86_SNP_POLICY_BITS	1
>  
>  struct kvm_vmx_nested_state_data {
>  	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 2fbdebf79fbb..7e6ce092628a 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -78,6 +78,8 @@ static u64 sev_supported_vmsa_features;
>  					 SNP_POLICY_MASK_DEBUG		| \
>  					 SNP_POLICY_MASK_SINGLE_SOCKET)
>  
> +static u64 snp_supported_policy_bits;

This can be __ro_after_init.  Hmm, off topic, but I bet we can give most of the
variables confifugred by sev_hardware_setup() the same treatment.  And really
off topic, I have a patch somewhere to convert a bunch of KVM variables from
__read_mostly to __ro_after_init...
Re: [RFC PATCH 1/4] KVM: SEV: Publish supported SEV-SNP policy bits
Posted by Tom Lendacky 3 weeks, 2 days ago
On 9/10/25 14:19, Sean Christopherson wrote:
> On Fri, Aug 22, 2025, Tom Lendacky wrote:
>> Define the set of policy bits that KVM currently knows as not requiring
>> any implementation support within KVM. Provide this value to userspace
>> via the KVM_GET_DEVICE_ATTR ioctl.
>>
>> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
>> ---
>>  arch/x86/include/uapi/asm/kvm.h |  1 +
>>  arch/x86/kvm/svm/sev.c          | 11 ++++++++++-
>>  2 files changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
>> index 0f15d683817d..90e9c4551fa6 100644
>> --- a/arch/x86/include/uapi/asm/kvm.h
>> +++ b/arch/x86/include/uapi/asm/kvm.h
>> @@ -468,6 +468,7 @@ struct kvm_sync_regs {
>>  /* vendor-specific groups and attributes for system fd */
>>  #define KVM_X86_GRP_SEV			1
>>  #  define KVM_X86_SEV_VMSA_FEATURES	0
>> +#  define KVM_X86_SNP_POLICY_BITS	1
>>  
>>  struct kvm_vmx_nested_state_data {
>>  	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
>> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
>> index 2fbdebf79fbb..7e6ce092628a 100644
>> --- a/arch/x86/kvm/svm/sev.c
>> +++ b/arch/x86/kvm/svm/sev.c
>> @@ -78,6 +78,8 @@ static u64 sev_supported_vmsa_features;
>>  					 SNP_POLICY_MASK_DEBUG		| \
>>  					 SNP_POLICY_MASK_SINGLE_SOCKET)
>>  
>> +static u64 snp_supported_policy_bits;
> 
> This can be __ro_after_init.  Hmm, off topic, but I bet we can give most of the

In the current form, I agree. If/when we support dynamic SEV firmware
updates, we may want to re-evaluate the supported policy bits since
newer SEV firmware could have made new bits available.

Maybe instead we move the call to get the current SEV firmware supported
bits and ANDing of the KVM supported bits into sev_dev_get_attr() and
snp_launch_start()? The downside is it is possible that the supported
policy bits could change between the two calls by the VMM.

Thanks,
Tom

> variables confifugred by sev_hardware_setup() the same treatment.  And really
> off topic, I have a patch somewhere to convert a bunch of KVM variables from
> __read_mostly to __ro_after_init...