Re: [PATCH v3 5/7] KVM: SEV: Don't advertise support for unusable VM types

Tom Lendacky
2026-04-17T14:37:53Z

On 4/16/26 18:23, Sean Christopherson wrote:
> Commit 0aa6b90ef9d7 ("KVM: SVM: Add support for allowing zero SEV ASIDs")
> made it possible to make it impossible to use SEV VMs by not allocating
> them any ASIDs.
>
> Commit 6c7c620585c6 ("KVM: SEV: Add SEV-SNP CipherTextHiding support") did
> the same thing for SEV-ES.
>
> Do not export KVM_X86_SEV(_ES)_VM as supported types if in either of these
> situations, so that userspace can use them to determine what is actually
> supported by the current kernel configuration.
>
> Also move the buildup to a local variable so it is easier to add additional
> masking in future patches.
>
> Link: https://lore.kernel.org/all/aZyLIWtffvEnmtYh@google.com/
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
> [sean: land code in sev_hardware_setup()]
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>

> ---
> arch/x86/kvm/svm/sev.c | 19 +++++++++++--------
> 1 file changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index dfeb660b8f5d..0971cf652b0b 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3062,6 +3062,7 @@ void __init sev_hardware_setup(void)
> bool sev_snp_supported = false;
> bool sev_es_supported = false;
> bool sev_supported = false;
> + u32 vm_types = 0;
>
> if (!sev_enabled || !npt_enabled || !nrips)
> goto out;
> @@ -3195,24 +3196,26 @@ void __init sev_hardware_setup(void)
> }
> }
>
> - if (sev_supported)
> - kvm_caps.supported_vm_types |= BIT(KVM_X86_SEV_VM);
> - if (sev_es_supported)
> - kvm_caps.supported_vm_types |= BIT(KVM_X86_SEV_ES_VM);
> + if (sev_supported && min_sev_asid <= max_sev_asid)
> + vm_types |= BIT(KVM_X86_SEV_VM);
> + if (sev_es_supported && min_sev_es_asid <= max_sev_es_asid)
> + vm_types |= BIT(KVM_X86_SEV_ES_VM);
> if (sev_snp_supported)
> - kvm_caps.supported_vm_types |= BIT(KVM_X86_SNP_VM);
> + vm_types |= BIT(KVM_X86_SNP_VM);
> +
> + kvm_caps.supported_vm_types |= vm_types;
>
> if (boot_cpu_has(X86_FEATURE_SEV))
> pr_info("SEV %s (ASIDs %u - %u)\n",
> - sev_str_feature_state(sev_supported, min_sev_asid <= max_sev_asid),
> + sev_str_feature_state(sev_supported, vm_types & BIT(KVM_X86_SEV_VM)),
> min_sev_asid, max_sev_asid);
> if (boot_cpu_has(X86_FEATURE_SEV_ES))
> pr_info("SEV-ES %s (ASIDs %u - %u)\n",
> - sev_str_feature_state(sev_es_supported, min_sev_es_asid <= max_sev_es_asid),
> + sev_str_feature_state(sev_es_supported, vm_types & BIT(KVM_X86_SEV_ES_VM)),
> min_sev_es_asid, max_sev_es_asid);
> if (boot_cpu_has(X86_FEATURE_SEV_SNP))
> pr_info("SEV-SNP %s (ASIDs %u - %u)\n",
> - sev_str_feature_state(sev_snp_supported, true),
> + sev_str_feature_state(sev_snp_supported, vm_types & BIT(KVM_X86_SNP_VM)),
> min_snp_asid, max_snp_asid);
>
> sev_enabled = sev_supported;