Re: [PATCH v3 5/7] KVM: SEV: Don't advertise support for unusable VM types

[Tom Lendacky]

On 4/16/26 18:23, Sean Christopherson wrote:
> Commit 0aa6b90ef9d7 ("KVM: SVM: Add support for allowing zero SEV ASIDs")
> made it possible to make it impossible to use SEV VMs by not allocating
> them any ASIDs.
> 
> Commit 6c7c620585c6 ("KVM: SEV: Add SEV-SNP CipherTextHiding support") did
> the same thing for SEV-ES.
> 
> Do not export KVM_X86_SEV(_ES)_VM as supported types if in either of these
> situations, so that userspace can use them to determine what is actually
> supported by the current kernel configuration.
> 
> Also move the buildup to a local variable so it is easier to add additional
> masking in future patches.
> 
> Link: https://lore.kernel.org/all/aZyLIWtffvEnmtYh@xxxxxxxxxx/
> Suggested-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> Signed-off-by: Tycho Andersen (AMD) <tycho@xxxxxxxxxx>
> [sean: land code in sev_hardware_setup()]
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>

Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>

> ---
>  arch/x86/kvm/svm/sev.c | 19 +++++++++++--------
>  1 file changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index dfeb660b8f5d..0971cf652b0b 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3062,6 +3062,7 @@ void __init sev_hardware_setup(void)
>  	bool sev_snp_supported = false;
>  	bool sev_es_supported = false;
>  	bool sev_supported = false;
> +	u32 vm_types = 0;
>  
>  	if (!sev_enabled || !npt_enabled || !nrips)
>  		goto out;
> @@ -3195,24 +3196,26 @@ void __init sev_hardware_setup(void)
>  		}
>  	}
>  
> -	if (sev_supported)
> -		kvm_caps.supported_vm_types |= BIT(KVM_X86_SEV_VM);
> -	if (sev_es_supported)
> -		kvm_caps.supported_vm_types |= BIT(KVM_X86_SEV_ES_VM);
> +	if (sev_supported && min_sev_asid <= max_sev_asid)
> +		vm_types |= BIT(KVM_X86_SEV_VM);
> +	if (sev_es_supported && min_sev_es_asid <= max_sev_es_asid)
> +		vm_types |= BIT(KVM_X86_SEV_ES_VM);
>  	if (sev_snp_supported)
> -		kvm_caps.supported_vm_types |= BIT(KVM_X86_SNP_VM);
> +		vm_types |= BIT(KVM_X86_SNP_VM);
> +
> +	kvm_caps.supported_vm_types |= vm_types;
>  
>  	if (boot_cpu_has(X86_FEATURE_SEV))
>  		pr_info("SEV %s (ASIDs %u - %u)\n",
> -			sev_str_feature_state(sev_supported, min_sev_asid <= max_sev_asid),
> +			sev_str_feature_state(sev_supported, vm_types & BIT(KVM_X86_SEV_VM)),
>  			min_sev_asid, max_sev_asid);
>  	if (boot_cpu_has(X86_FEATURE_SEV_ES))
>  		pr_info("SEV-ES %s (ASIDs %u - %u)\n",
> -			sev_str_feature_state(sev_es_supported, min_sev_es_asid <= max_sev_es_asid),
> +			sev_str_feature_state(sev_es_supported, vm_types & BIT(KVM_X86_SEV_ES_VM)),
>  			min_sev_es_asid, max_sev_es_asid);
>  	if (boot_cpu_has(X86_FEATURE_SEV_SNP))
>  		pr_info("SEV-SNP %s (ASIDs %u - %u)\n",
> -			sev_str_feature_state(sev_snp_supported, true),
> +			sev_str_feature_state(sev_snp_supported, vm_types & BIT(KVM_X86_SNP_VM)),
>  			min_snp_asid, max_snp_asid);
>  
>  	sev_enabled = sev_supported;