Re: [PATCH v2 0/4] Only export SME/SEV/SEV_ES features when activated

[Tom Lendacky]

On 2/11/22 15:02, Mario Limonciello wrote:
> Currently SME/SEV/SEV_ES feature flags will export if the CPU supports
> them but even if the kernel has not enabled the features for any reason.
>
> To let userspace react to these feature flags, only set them when the
> kernel has activated them.

You really need to wait for more feedback before issuing a new version so 
quickly. Especially since you asked a question about doing this just for 
SME to which I agreed.

Also, you've used cc_platform_has() incorrectly in patches 1 and 2, so SEV 
support is broke in the hypervisor with these changes.

Please just fix the SME concern that you have.

Thanks,
Tom

> changes from v1->v2:
>   * Squash old patches 1/2 together
>   * Add new patches to KVM/CCP code to use `cc_platform_has` instead
>   * Don't use `cc_platform_has` in the early code, just check `sme_me_mask`
>     and `sev_status` directly.
>   * Split out SME and SEV/SEV_ES clearing as separate patches in case
>     SEV/SEV_ES need other more involved work that what is in this series so
>     far.
>
> Mario Limonciello (4):
>    crypto: ccp: Use cc_platform_has to determine SEV presence
>    KVM: SVM: Use cc_platform_has instead of CPU feature flags
>    x86/cpu: clear SME features when not in use
>    x86/cpu: clear SEV/SEV_ES features when not in use
>
>   arch/x86/kernel/cpu/amd.c    | 10 ++++++++++
>   arch/x86/kernel/process.c    |  5 ++++-
>   arch/x86/kvm/svm/sev.c       |  4 ++--
>   drivers/crypto/ccp/sev-dev.c |  2 +-
>   4 files changed, 17 insertions(+), 4 deletions(-)