On Wed, Aug 13, 2025, Tom Lendacky wrote: > Paolo/Sean, > > I'm looking to expand the supported set of policy bits that the VMM can > supply on an SNP guest launch (e.g. requiring ciphertext hiding, etc.). > > Right now we have the SNP_POLICY_MASK_VALID bitmask that is used to > check for KVM supported policy bits. From the previous patches I > submitted to add the SMT and SINGLE_SOCKET policy bit support, there was > some thought of possibly providing supported policy bits to userspace. > > Should we just update the mask as we add support for new policy bits? Or > should we do something similar to the sev_supported_vmsa_features > support and add a KVM_X86_SEV_POLICY_SUPPORT attribute to the > KVM_X86_GRP_SEV? Or...? I think adding KVM_X86_SEV_POLICY_SUPPORT to KVM_X86_GRP_SEV makes the most sense. If we allow new bits, then we definitely need a way to enumerate support to userspace. Even if we made KVM fully permissive, we'd need/want a way to communicate _that_ to userspace, which means adding a capability or something similar. In other words, we need new uAPI, and if we need new uAPI, then I'd much prefer to retain control in KVM just in case a policy comes along that we don't want to (or can't) support for whatever reason.
