Currently SME/SEV/SEV_ES feature flags will export if the CPU supports
them but even if the kernel has not enabled the features for any reason.

To let userspace react to these feature flags, only set them when the
kernel has activated them.

changes from v1->v2:
 * Squash old patches 1/2 together
 * Add new patches to KVM/CCP code to use `cc_platform_has` instead
 * Don't use `cc_platform_has` in the early code, just check `sme_me_mask`
   and `sev_status` directly.
 * Split out SME and SEV/SEV_ES clearing as separate patches in case
   SEV/SEV_ES need other more involved work that what is in this series so
   far.

Mario Limonciello (4):
  crypto: ccp: Use cc_platform_has to determine SEV presence
  KVM: SVM: Use cc_platform_has instead of CPU feature flags
  x86/cpu: clear SME features when not in use
  x86/cpu: clear SEV/SEV_ES features when not in use

 arch/x86/kernel/cpu/amd.c    | 10 ++++++++++
 arch/x86/kernel/process.c    |  5 ++++-
 arch/x86/kvm/svm/sev.c       |  4 ++--
 drivers/crypto/ccp/sev-dev.c |  2 +-
 4 files changed, 17 insertions(+), 4 deletions(-)

-- 
2.34.1

On 2/11/22 15:02, Mario Limonciello wrote:
> Currently SME/SEV/SEV_ES feature flags will export if the CPU supports
> them but even if the kernel has not enabled the features for any reason.
> 
> To let userspace react to these feature flags, only set them when the
> kernel has activated them.
> 

You really need to wait for more feedback before issuing a new version so 
quickly. Especially since you asked a question about doing this just for 
SME to which I agreed.

Also, you've used cc_platform_has() incorrectly in patches 1 and 2, so SEV 
support is broke in the hypervisor with these changes.

Please just fix the SME concern that you have.

Thanks,
Tom

> changes from v1->v2:
>   * Squash old patches 1/2 together
>   * Add new patches to KVM/CCP code to use `cc_platform_has` instead
>   * Don't use `cc_platform_has` in the early code, just check `sme_me_mask`
>     and `sev_status` directly.
>   * Split out SME and SEV/SEV_ES clearing as separate patches in case
>     SEV/SEV_ES need other more involved work that what is in this series so
>     far.
> 
> Mario Limonciello (4):
>    crypto: ccp: Use cc_platform_has to determine SEV presence
>    KVM: SVM: Use cc_platform_has instead of CPU feature flags
>    x86/cpu: clear SME features when not in use
>    x86/cpu: clear SEV/SEV_ES features when not in use
> 
>   arch/x86/kernel/cpu/amd.c    | 10 ++++++++++
>   arch/x86/kernel/process.c    |  5 ++++-
>   arch/x86/kvm/svm/sev.c       |  4 ++--
>   drivers/crypto/ccp/sev-dev.c |  2 +-
>   4 files changed, 17 insertions(+), 4 deletions(-)
>