Re: SNP guest policy support

[Sean Christopherson <seanjc@google.com>]

On Wed, Aug 13, 2025, Tom Lendacky wrote:
> Paolo/Sean,
> 
> I'm looking to expand the supported set of policy bits that the VMM can
> supply on an SNP guest launch (e.g. requiring ciphertext hiding, etc.).
> 
> Right now we have the SNP_POLICY_MASK_VALID bitmask that is used to
> check for KVM supported policy bits. From the previous patches I
> submitted to add the SMT and SINGLE_SOCKET policy bit support, there was
> some thought of possibly providing supported policy bits to userspace.
> 
> Should we just update the mask as we add support for new policy bits? Or
> should we do something similar to the sev_supported_vmsa_features
> support and add a KVM_X86_SEV_POLICY_SUPPORT attribute to the
> KVM_X86_GRP_SEV? Or...?

I think adding KVM_X86_SEV_POLICY_SUPPORT to KVM_X86_GRP_SEV makes the most sense.

If we allow new bits, then we definitely need a way to enumerate support to
userspace.  Even if we made KVM fully permissive, we'd need/want a way to communicate
_that_ to userspace, which means adding a capability or something similar.

In other words, we need new uAPI, and if we need new uAPI, then I'd much prefer
to retain control in KVM just in case a policy comes along that we don't want to
(or can't) support for whatever reason.