1. Patchew
  2. linux
  3. [PATCH v3 0/4] SEV-SNP guest policy bit support updates
  4. View patch

[PATCH v3 3/4] crypto: ccp - Add an API to return the supported SEV-SNP policy bits

Tom Lendacky posted 4 patches 3 months, 2 weeks ago
There is a newer version of this series
[PATCH v3 3/4] crypto: ccp - Add an API to return the supported SEV-SNP policy bits
Posted by Tom Lendacky 3 months, 2 weeks ago 
Supported policy bits are dependent on the level of SEV firmware that is
currently running. Create an API to return the supported policy bits for
a given level of firmware. KVM will AND that value with the KVM supported
policy bits to generate the actual supported policy bits.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
---
 arch/x86/kvm/svm/sev.c       |  3 ++-
 drivers/crypto/ccp/sev-dev.c | 37 ++++++++++++++++++++++++++++++++++++
 include/linux/psp-sev.h      | 20 +++++++++++++++++++
 3 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 45e87d756e15..24167178bf05 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -3099,7 +3099,8 @@ void __init sev_hardware_setup(void)
 			sev_snp_supported = is_sev_snp_initialized();
 
 		if (sev_snp_supported) {
-			snp_supported_policy_bits = KVM_SNP_POLICY_MASK_VALID;
+			snp_supported_policy_bits = sev_get_snp_policy_bits();
+			snp_supported_policy_bits &= KVM_SNP_POLICY_MASK_VALID;
 			nr_ciphertext_hiding_asids = init_args.max_snp_asid;
 		}
 
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 0d13d47c164b..db7c7c50cebc 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -2777,6 +2777,43 @@ void sev_platform_shutdown(void)
 }
 EXPORT_SYMBOL_GPL(sev_platform_shutdown);
 
+u64 sev_get_snp_policy_bits(void)
+{
+	struct psp_device *psp = psp_master;
+	struct sev_device *sev;
+	u64 policy_bits;
+
+	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
+		return 0;
+
+	if (!psp || !psp->sev_data)
+		return 0;
+
+	sev = psp->sev_data;
+
+	policy_bits = SNP_POLICY_MASK_BASE;
+
+	if (sev->snp_plat_status.feature_info) {
+		if (sev->snp_feat_info_0.ecx & SNP_RAPL_DISABLE_SUPPORTED)
+			policy_bits |= SNP_POLICY_MASK_RAPL_DIS;
+
+		if (sev->snp_feat_info_0.ecx & SNP_CIPHER_TEXT_HIDING_SUPPORTED)
+			policy_bits |= SNP_POLICY_MASK_CIPHERTEXT_HIDING_DRAM;
+
+		if (sev->snp_feat_info_0.ecx & SNP_AES_256_XTS_POLICY_SUPPORTED)
+			policy_bits |= SNP_POLICY_MASK_MEM_AES_256_XTS;
+
+		if (sev->snp_feat_info_0.ecx & SNP_CXL_ALLOW_POLICY_SUPPORTED)
+			policy_bits |= SNP_POLICY_MASK_CXL_ALLOW;
+
+		if (sev_version_greater_or_equal(1, 58))
+			policy_bits |= SNP_POLICY_MASK_PAGE_SWAP_DISABLE;
+	}
+
+	return policy_bits;
+}
+EXPORT_SYMBOL_GPL(sev_get_snp_policy_bits);
+
 void sev_dev_destroy(struct psp_device *psp)
 {
 	struct sev_device *sev = psp->sev_data;
diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h
index 27c92543bf38..1b4c68ec5c65 100644
--- a/include/linux/psp-sev.h
+++ b/include/linux/psp-sev.h
@@ -32,6 +32,20 @@
 #define SNP_POLICY_MASK_MIGRATE_MA		BIT_ULL(18)
 #define SNP_POLICY_MASK_DEBUG			BIT_ULL(19)
 #define SNP_POLICY_MASK_SINGLE_SOCKET		BIT_ULL(20)
+#define SNP_POLICY_MASK_CXL_ALLOW		BIT_ULL(21)
+#define SNP_POLICY_MASK_MEM_AES_256_XTS		BIT_ULL(22)
+#define SNP_POLICY_MASK_RAPL_DIS		BIT_ULL(23)
+#define SNP_POLICY_MASK_CIPHERTEXT_HIDING_DRAM	BIT_ULL(24)
+#define SNP_POLICY_MASK_PAGE_SWAP_DISABLE	BIT_ULL(25)
+
+/* Base SEV-SNP policy bitmask for minimum supported SEV firmware version */
+#define SNP_POLICY_MASK_BASE	(SNP_POLICY_MASK_API_MINOR		| \
+				 SNP_POLICY_MASK_API_MAJOR		| \
+				 SNP_POLICY_MASK_SMT			| \
+				 SNP_POLICY_MASK_RSVD_MBO		| \
+				 SNP_POLICY_MASK_MIGRATE_MA		| \
+				 SNP_POLICY_MASK_DEBUG			| \
+				 SNP_POLICY_MASK_SINGLE_SOCKET)
 
 #define SEV_FW_BLOB_MAX_SIZE	0x4000	/* 16KB */
 
@@ -868,7 +882,10 @@ struct snp_feature_info {
 	u32 edx;
 } __packed;
 
+#define SNP_RAPL_DISABLE_SUPPORTED		BIT(2)
 #define SNP_CIPHER_TEXT_HIDING_SUPPORTED	BIT(3)
+#define SNP_AES_256_XTS_POLICY_SUPPORTED	BIT(4)
+#define SNP_CXL_ALLOW_POLICY_SUPPORTED		BIT(5)
 
 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
 
@@ -1014,6 +1031,7 @@ void *snp_alloc_firmware_page(gfp_t mask);
 void snp_free_firmware_page(void *addr);
 void sev_platform_shutdown(void);
 bool sev_is_snp_ciphertext_hiding_supported(void);
+u64 sev_get_snp_policy_bits(void);
 
 #else	/* !CONFIG_CRYPTO_DEV_SP_PSP */
 
@@ -1052,6 +1070,8 @@ static inline void sev_platform_shutdown(void) { }
 
 static inline bool sev_is_snp_ciphertext_hiding_supported(void) { return false; }
 
+static inline u64 sev_get_snp_policy_bits(void) { return 0; }
+
 #endif	/* CONFIG_CRYPTO_DEV_SP_PSP */
 
 #endif	/* __PSP_SEV_H__ */
-- 
2.51.1
Re: [PATCH v3 3/4] crypto: ccp - Add an API to return the supported SEV-SNP policy bits
Posted by Sean Christopherson 3 months, 2 weeks ago 
On Wed, Oct 22, 2025, Tom Lendacky wrote:
> Supported policy bits are dependent on the level of SEV firmware that is
> currently running. Create an API to return the supported policy bits for
> a given level of firmware. KVM will AND that value with the KVM supported

Given "KVM will AND" and the shortlog, I expected a _future_ patch to have the 
           ^^^^
KVM changes.

That's partly a PEBKAC on my end (I mean, it's literally the first diff), but I
do think it highlights that we should probably separate the KVM change from the
PSP support. 

Hmm, actually, the patch ordering is bad.  There shouldn't need to be a separate
KVM change after this commit, because as things are ordered now, there will be an
ABI change between patch 1 and this patch.

So I think what you want is:

  1. KVM: SEV: Consolidate the SEV policy bits in a single header file
  2. crypto: ccp - Add an API to return the supported SEV-SNP policy bits
  3. KVM: SEV: Publish supported SEV-SNP policy bits
  4. KVM: SEV: Add known supported SEV-SNP policy bits

where #3 uses sev_get_snp_policy_bits() straightaway.

> policy bits to generate the actual supported policy bits.
> 
> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
>  arch/x86/kvm/svm/sev.c       |  3 ++-
>  drivers/crypto/ccp/sev-dev.c | 37 ++++++++++++++++++++++++++++++++++++
>  include/linux/psp-sev.h      | 20 +++++++++++++++++++
>  3 files changed, 59 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 45e87d756e15..24167178bf05 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3099,7 +3099,8 @@ void __init sev_hardware_setup(void)
>  			sev_snp_supported = is_sev_snp_initialized();
>  
>  		if (sev_snp_supported) {
> -			snp_supported_policy_bits = KVM_SNP_POLICY_MASK_VALID;
> +			snp_supported_policy_bits = sev_get_snp_policy_bits();
> +			snp_supported_policy_bits &= KVM_SNP_POLICY_MASK_VALID;

I vote for:

			snp_supported_policy_bits = sev_get_snp_policy_bits() &
						    KVM_SNP_POLICY_MASK_VALID;

which makes it visually easier to see the policy bits logic.
	
>  			nr_ciphertext_hiding_asids = init_args.max_snp_asid;
>  		}
Re: [PATCH v3 3/4] crypto: ccp - Add an API to return the supported SEV-SNP policy bits
Posted by Tom Lendacky 3 months, 2 weeks ago 
On 10/23/25 11:37, Sean Christopherson wrote:
> On Wed, Oct 22, 2025, Tom Lendacky wrote:
>> Supported policy bits are dependent on the level of SEV firmware that is
>> currently running. Create an API to return the supported policy bits for
>> a given level of firmware. KVM will AND that value with the KVM supported
> 
> Given "KVM will AND" and the shortlog, I expected a _future_ patch to have the 
>            ^^^^
> KVM changes.
> 
> That's partly a PEBKAC on my end (I mean, it's literally the first diff), but I
> do think it highlights that we should probably separate the KVM change from the
> PSP support. 
> 
> Hmm, actually, the patch ordering is bad.  There shouldn't need to be a separate
> KVM change after this commit, because as things are ordered now, there will be an
> ABI change between patch 1 and this patch.
> 
> So I think what you want is:
> 
>   1. KVM: SEV: Consolidate the SEV policy bits in a single header file
>   2. crypto: ccp - Add an API to return the supported SEV-SNP policy bits
>   3. KVM: SEV: Publish supported SEV-SNP policy bits
>   4. KVM: SEV: Add known supported SEV-SNP policy bits
> 
> where #3 uses sev_get_snp_policy_bits() straightaway.

Ok, let me rearrange things, resend, and see how it looks.

> 
>> policy bits to generate the actual supported policy bits.
>>
>> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
>> ---
>>  arch/x86/kvm/svm/sev.c       |  3 ++-
>>  drivers/crypto/ccp/sev-dev.c | 37 ++++++++++++++++++++++++++++++++++++
>>  include/linux/psp-sev.h      | 20 +++++++++++++++++++
>>  3 files changed, 59 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
>> index 45e87d756e15..24167178bf05 100644
>> --- a/arch/x86/kvm/svm/sev.c
>> +++ b/arch/x86/kvm/svm/sev.c
>> @@ -3099,7 +3099,8 @@ void __init sev_hardware_setup(void)
>>  			sev_snp_supported = is_sev_snp_initialized();
>>  
>>  		if (sev_snp_supported) {
>> -			snp_supported_policy_bits = KVM_SNP_POLICY_MASK_VALID;
>> +			snp_supported_policy_bits = sev_get_snp_policy_bits();
>> +			snp_supported_policy_bits &= KVM_SNP_POLICY_MASK_VALID;
> 
> I vote for:
> 
> 			snp_supported_policy_bits = sev_get_snp_policy_bits() &
> 						    KVM_SNP_POLICY_MASK_VALID;
> 
> which makes it visually easier to see the policy bits logic.

Will do.

Thanks,
Tom

> 	
>>  			nr_ciphertext_hiding_asids = init_args.max_snp_asid;
>>  		}

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.