[PATCH v3 0/7] KVM: SEV: Don't advertise unusable VM types

[Sean Christopherson <seanjc@google.com>]

My preference would be to take this through the KVM tree, with acks on the
crypto patches.  I'd also be a-ok with a stable branch/tag of the crypto
changes.

In the words of Tycho:

Recent SEV firmware [1] does not support SEV-ES VMs when SNP is enabled.
Expose this by revoking VM-types that are not supported by the current
configurations either from firmware restrictions or ASID configuration.

My previous version of this patch series [2] used SNP_VERIFY_MITIGATION
to test for a mitigation bit. While AMD-SB-3023 says that there is a
mitigation bit (3) for CVE-2025-48514, bit 3 corresponds to an unrelated
issue. The correct way to check for this is to use the SVN/SPL from the
TCB. We are in the process of updating the SB to reflect this.

v3:
 - Relocate the supported_vm_types updates to sev_hardware_setup.
 - Report unusable VM types as such in dmesg.

v2:
 - https://lore.kernel.org/all/20260324194034.1442133-1-tycho@kernel.org
 - compare SVN as above
 - fix commit message prefixes
 - supported_vm_types local is a u32
 - move crypto stuff before KVM stuff in the event of patch tetris

[1]: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3023.html
[2]: https://lore.kernel.org/all/20260303191509.1565629-1-tycho@kernel.org

Sean Christopherson (3):
  KVM: SEV: Set supported SEV+ VM types during sev_hardware_setup()
  KVM: SEV: Consolidate logic for printing state of SEV{,-ES,-SNP}
    enabling
  KVM: SEV: Don't advertise support for unusable VM types

Tycho Andersen (4):
  crypto/ccp: hoist kernel part of SNP_PLATFORM_STATUS
  crypto/ccp: export firmware supported vm types
  KVM: SEV: Don't advertise VM types that are disabled by firmware
  KVM: selftests: Teach sev_*_test about revoking VM types

 arch/x86/kvm/svm/sev.c                        |  40 ++++---
 drivers/crypto/ccp/sev-dev.c                  | 101 ++++++++++++++++--
 include/linux/psp-sev.h                       |  37 +++++++
 .../selftests/kvm/x86/sev_init2_tests.c       |  14 ++-
 .../selftests/kvm/x86/sev_migrate_tests.c     |   2 +-
 .../selftests/kvm/x86/sev_smoke_test.c        |   4 +-
 6 files changed, 163 insertions(+), 35 deletions(-)


base-commit: 6b802031877a995456c528095c41d1948546bf45
-- 
2.54.0.rc1.513.gad8abe7a5a-goog