Skip to contentSkip to conversation

SECC-ES: Cleanups

PATCH Applied Borislav Petkov 3 participants 8 messages Mar 18, 2023 – Mar 30, 2023

Subsystems (4)
x86 x86 MM Hyper-V/Azure core and drivers x86 trust domain extensions (TDX)
lore
Share & tools
lore

Borislav Petkov

author maintainer
#0 lore raw

cover SECC-ES: Cleanups

From: "Borislav Petkov (AMD)" <[email protected]>

Hi,

as part of recent parallel CPU bringup needs, here are two cleanups.

Thx.

Borislav Petkov (AMD) (2):
x86/coco: Export cc_vendor
x86/sev: Get rid of special sev_es_enable_key

 arch/x86/coco/core.c               | 15 +++++----------
 arch/x86/coco/tdx/tdx.c            |  2 +-
 arch/x86/include/asm/coco.h        |  2 +-
 arch/x86/include/asm/sev.h         | 11 +++++++----
 arch/x86/kernel/cpu/mshyperv.c     |  2 +-
 arch/x86/kernel/sev.c              |  5 -----
 arch/x86/mm/mem_encrypt_identity.c |  2 +-
 7 files changed, 16 insertions(+), 23 deletions(-)
Signature · 1 line
2.35.1
author maintainer
#1 lore raw

PATCH 1/2 x86/coco: Export cc_vendor

From: "Borislav Petkov (AMD)" <[email protected]>

It will be used in different checks in future changes. Export it directly and drop the setter as it is a __ro_after_init variable.

No functional changes.

Signed-off-by Borislav Petkov (AMD) <[email protected]>
---
 arch/x86/coco/core.c               | 13 ++++---------
 arch/x86/coco/tdx/tdx.c            |  2 +-
 arch/x86/include/asm/coco.h        |  2 +-
 arch/x86/kernel/cpu/mshyperv.c     |  2 +-
 arch/x86/mm/mem_encrypt_identity.c |  2 +-
 5 files changed, 8 insertions(+), 13 deletions(-)
arch/x86/coco/core.c +4 -9
index 49b44f881484..684f0a910475 100644
@@ -13,7 +13,7 @@
 #include <asm/coco.h>
 #include <asm/processor.h>
 
-static enum cc_vendor vendor __ro_after_init;
+enum cc_vendor cc_vendor __ro_after_init;
 static u64 cc_mask __ro_after_init;
 
 static bool intel_cc_platform_has(enum cc_attr attr)

@@ -83,7 +83,7 @@ static bool hyperv_cc_platform_has(enum cc_attr attr)
 
 bool cc_platform_has(enum cc_attr attr)
 {
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return amd_cc_platform_has(attr);
 	case CC_VENDOR_INTEL:

@@ -105,7 +105,7 @@ u64 cc_mkenc(u64 val)
 	 * - for AMD, bit *set* means the page is encrypted
 	 * - for Intel *clear* means encrypted.
 	 */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val | cc_mask;
 	case CC_VENDOR_INTEL:

@@ -118,7 +118,7 @@ u64 cc_mkenc(u64 val)
 u64 cc_mkdec(u64 val)
 {
 	/* See comment in cc_mkenc() */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val & ~cc_mask;
 	case CC_VENDOR_INTEL:

@@ -129,11 +129,6 @@ u64 cc_mkdec(u64 val)
 }
 EXPORT_SYMBOL_GPL(cc_mkdec);
 
-__init void cc_set_vendor(enum cc_vendor v)
-{
-	vendor = v;
-}
-
 __init void cc_set_mask(u64 mask)
 {
 	cc_mask = mask;
arch/x86/coco/tdx/tdx.c +1 -1
index 055300e08fb3..bab29cbc6680 100644
@@ -852,7 +852,7 @@ void __init tdx_early_init(void)
 
 	setup_force_cpu_cap(X86_FEATURE_TDX_GUEST);
 
-	cc_set_vendor(CC_VENDOR_INTEL);
+	cc_vendor = CC_VENDOR_INTEL;
 	tdx_parse_tdinfo(&cc_mask);
 	cc_set_mask(cc_mask);
arch/x86/include/asm/coco.h +1 -1
index 3d98c3a60d34..84fbf419989f 100644
@@ -11,7 +11,7 @@ enum cc_vendor {
 	CC_VENDOR_INTEL,
 };
 
-void cc_set_vendor(enum cc_vendor v);
+extern enum cc_vendor cc_vendor;
 void cc_set_mask(u64 mask);
 
 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
arch/x86/kernel/cpu/mshyperv.c +1 -1
index f36dc2f796c5..9f3fad3e69d5 100644
@@ -412,7 +412,7 @@ static void __init ms_hyperv_init_platform(void)
 		/* Isolation VMs are unenlightened SEV-based VMs, thus this check: */
 		if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
 			if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE)
-				cc_set_vendor(CC_VENDOR_HYPERV);
+				cc_vendor = CC_VENDOR_HYPERV;
 		}
 	}
arch/x86/mm/mem_encrypt_identity.c +1 -1
index 88cccd65029d..f54497b8be4b 100644
@@ -611,7 +611,7 @@ void __init sme_enable(struct boot_params *bp)
 out:
 	if (sme_me_mask) {
 		physical_mask &= ~sme_me_mask;
-		cc_set_vendor(CC_VENDOR_AMD);
+		cc_vendor = CC_VENDOR_AMD;
 		cc_set_mask(sme_me_mask);
 	}
 }
Signature · 1 line
2.35.1
merge bot Applied
#2 lore raw

[tip: x86/sev] x86/coco: Export cc_vendor

The following commit has been merged into the x86/sev branch of tip:

The following commit has been merged into the x86/sev branch of tip:

Commit-ID:     5ae57743f578725a5dadb6f31d7798ee55e6e967
Gitweb:        https://git.kernel.org/tip/5ae57743f578725a5dadb6f31d7798ee55e6e967
Author:        Borislav Petkov (AMD) <[email protected]>
AuthorDate:    Sat, 18 Mar 2023 12:56:33 +01:00
Committer:     Borislav Petkov (AMD) <[email protected]>
CommitterDate: Tue, 28 Mar 2023 14:52:51 +02:00

x86/coco: Export cc_vendor

It will be used in different checks in future changes. Export it directly and drop the setter as it is a __ro_after_init variable anyway.

No functional changes.

Signed-off-by Borislav Petkov (AMD) <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
---
 arch/x86/coco/core.c               | 13 ++++---------
 arch/x86/coco/tdx/tdx.c            |  2 +-
 arch/x86/hyperv/ivm.c              |  2 +-
 arch/x86/include/asm/coco.h        |  2 +-
 arch/x86/mm/mem_encrypt_identity.c |  2 +-
 5 files changed, 8 insertions(+), 13 deletions(-)
arch/x86/coco/core.c +4 -9
index f4f0625..73f8323 100644
@@ -13,7 +13,7 @@
 #include <asm/coco.h>
 #include <asm/processor.h>
 
-static enum cc_vendor vendor __ro_after_init;
+enum cc_vendor cc_vendor __ro_after_init;
 static u64 cc_mask __ro_after_init;
 
 static bool intel_cc_platform_has(enum cc_attr attr)

@@ -99,7 +99,7 @@ static bool amd_cc_platform_has(enum cc_attr attr)
 
 bool cc_platform_has(enum cc_attr attr)
 {
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return amd_cc_platform_has(attr);
 	case CC_VENDOR_INTEL:

@@ -119,7 +119,7 @@ u64 cc_mkenc(u64 val)
 	 * - for AMD, bit *set* means the page is encrypted
 	 * - for AMD with vTOM and for Intel, *clear* means encrypted
 	 */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		if (sev_status & MSR_AMD64_SNP_VTOM)
 			return val & ~cc_mask;

@@ -135,7 +135,7 @@ u64 cc_mkenc(u64 val)
 u64 cc_mkdec(u64 val)
 {
 	/* See comment in cc_mkenc() */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		if (sev_status & MSR_AMD64_SNP_VTOM)
 			return val | cc_mask;

@@ -149,11 +149,6 @@ u64 cc_mkdec(u64 val)
 }
 EXPORT_SYMBOL_GPL(cc_mkdec);
 
-__init void cc_set_vendor(enum cc_vendor v)
-{
-	vendor = v;
-}
-
 __init void cc_set_mask(u64 mask)
 {
 	cc_mask = mask;
arch/x86/coco/tdx/tdx.c +1 -1
index 055300e..bab29cb 100644
@@ -852,7 +852,7 @@ void __init tdx_early_init(void)
 
 	setup_force_cpu_cap(X86_FEATURE_TDX_GUEST);
 
-	cc_set_vendor(CC_VENDOR_INTEL);
+	cc_vendor = CC_VENDOR_INTEL;
 	tdx_parse_tdinfo(&cc_mask);
 	cc_set_mask(cc_mask);
arch/x86/hyperv/ivm.c +1 -1
index f6a020c..4395d2f 100644
@@ -364,7 +364,7 @@ void __init hv_vtom_init(void)
 	 * Set it here to indicate a vTOM VM.
 	 */
 	sev_status = MSR_AMD64_SNP_VTOM;
-	cc_set_vendor(CC_VENDOR_AMD);
+	cc_vendor = CC_VENDOR_AMD;
 	cc_set_mask(ms_hyperv.shared_gpa_boundary);
 	physical_mask &= ms_hyperv.shared_gpa_boundary - 1;
arch/x86/include/asm/coco.h +1 -1
index d2c6a2e..61fc7c1 100644
@@ -10,7 +10,7 @@ enum cc_vendor {
 	CC_VENDOR_INTEL,
 };
 
-void cc_set_vendor(enum cc_vendor v);
+extern enum cc_vendor cc_vendor;
 void cc_set_mask(u64 mask);
 
 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
arch/x86/mm/mem_encrypt_identity.c +1 -1
index c6efcf5..bfe22fd 100644
@@ -612,7 +612,7 @@ void __init sme_enable(struct boot_params *bp)
 out:
 	if (sme_me_mask) {
 		physical_mask &= ~sme_me_mask;
-		cc_set_vendor(CC_VENDOR_AMD);
+		cc_vendor = CC_VENDOR_AMD;
 		cc_set_mask(sme_me_mask);
 	}
 }
merge bot Applied
#3 lore raw

[tip: x86/cc] x86/coco: Export cc_vendor

In reply to Borislav Petkov
The following commit has been merged into the x86/cc branch of tip:

The following commit has been merged into the x86/cc branch of tip:

Commit-ID:     52e490dcb9e47e8dcf9d915214c6b9d79580d03e
Gitweb:        https://git.kernel.org/tip/52e490dcb9e47e8dcf9d915214c6b9d79580d03e
Author:        Borislav Petkov (AMD) <[email protected]>
AuthorDate:    Sat, 18 Mar 2023 12:56:33 +01:00
Committer:     Thomas Gleixner <[email protected]>
CommitterDate: Thu, 30 Mar 2023 11:59:58 +02:00

x86/coco: Export cc_vendor

It will be used in different checks in future changes. Export it directly and drop the setter as it is a __ro_after_init variable anyway.

No functional changes.

[ tglx: Add accessor function ]

Signed-off-by Borislav Petkov (AMD) <[email protected]>
Signed-off-by Thomas Gleixner <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
---
 arch/x86/coco/core.c               | 13 ++++---------
 arch/x86/coco/tdx/tdx.c            |  2 +-
 arch/x86/include/asm/coco.h        | 16 +++++++++++++---
 arch/x86/kernel/cpu/mshyperv.c     |  2 +-
 arch/x86/mm/mem_encrypt_identity.c |  2 +-
 5 files changed, 20 insertions(+), 15 deletions(-)
arch/x86/coco/core.c +4 -9
index 49b44f8..684f0a9 100644
@@ -13,7 +13,7 @@
 #include <asm/coco.h>
 #include <asm/processor.h>
 
-static enum cc_vendor vendor __ro_after_init;
+enum cc_vendor cc_vendor __ro_after_init;
 static u64 cc_mask __ro_after_init;
 
 static bool intel_cc_platform_has(enum cc_attr attr)

@@ -83,7 +83,7 @@ static bool hyperv_cc_platform_has(enum cc_attr attr)
 
 bool cc_platform_has(enum cc_attr attr)
 {
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return amd_cc_platform_has(attr);
 	case CC_VENDOR_INTEL:

@@ -105,7 +105,7 @@ u64 cc_mkenc(u64 val)
 	 * - for AMD, bit *set* means the page is encrypted
 	 * - for Intel *clear* means encrypted.
 	 */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val | cc_mask;
 	case CC_VENDOR_INTEL:

@@ -118,7 +118,7 @@ u64 cc_mkenc(u64 val)
 u64 cc_mkdec(u64 val)
 {
 	/* See comment in cc_mkenc() */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val & ~cc_mask;
 	case CC_VENDOR_INTEL:

@@ -129,11 +129,6 @@ u64 cc_mkdec(u64 val)
 }
 EXPORT_SYMBOL_GPL(cc_mkdec);
 
-__init void cc_set_vendor(enum cc_vendor v)
-{
-	vendor = v;
-}
-
 __init void cc_set_mask(u64 mask)
 {
 	cc_mask = mask;
arch/x86/coco/tdx/tdx.c +1 -1
index 055300e..bab29cb 100644
@@ -852,7 +852,7 @@ void __init tdx_early_init(void)
 
 	setup_force_cpu_cap(X86_FEATURE_TDX_GUEST);
 
-	cc_set_vendor(CC_VENDOR_INTEL);
+	cc_vendor = CC_VENDOR_INTEL;
 	tdx_parse_tdinfo(&cc_mask);
 	cc_set_mask(cc_mask);
arch/x86/include/asm/coco.h +13 -3
index 3d98c3a..35d7aa9 100644
@@ -11,13 +11,23 @@ enum cc_vendor {
 	CC_VENDOR_INTEL,
 };
 
-void cc_set_vendor(enum cc_vendor v);
-void cc_set_mask(u64 mask);
-
 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
+extern enum cc_vendor cc_vendor;
+
+static inline enum cc_vendor cc_get_vendor(void)
+{
+	return cc_vendor;
+}
+
+void cc_set_mask(u64 mask);
 u64 cc_mkenc(u64 val);
 u64 cc_mkdec(u64 val);
 #else
+static inline enum cc_vendor cc_get_vendor(void)
+{
+	return CC_VENDOR_NONE;
+}
+
 static inline u64 cc_mkenc(u64 val)
 {
 	return val;
arch/x86/kernel/cpu/mshyperv.c +1 -1
index f36dc2f..9f3fad3 100644
@@ -412,7 +412,7 @@ static void __init ms_hyperv_init_platform(void)
 		/* Isolation VMs are unenlightened SEV-based VMs, thus this check: */
 		if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
 			if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE)
-				cc_set_vendor(CC_VENDOR_HYPERV);
+				cc_vendor = CC_VENDOR_HYPERV;
 		}
 	}
arch/x86/mm/mem_encrypt_identity.c +1 -1
index c6efcf5..bfe22fd 100644
@@ -612,7 +612,7 @@ void __init sme_enable(struct boot_params *bp)
 out:
 	if (sme_me_mask) {
 		physical_mask &= ~sme_me_mask;
-		cc_set_vendor(CC_VENDOR_AMD);
+		cc_vendor = CC_VENDOR_AMD;
 		cc_set_mask(sme_me_mask);
 	}
 }
merge bot Applied
#4 lore raw

[tip: x86/cc] x86/coco: Export cc_vendor

In reply to Borislav Petkov
The following commit has been merged into the x86/cc branch of tip:

The following commit has been merged into the x86/cc branch of tip:

Commit-ID:     3d91c537296794d5d0773f61abbe7b63f2f132d8
Gitweb:        https://git.kernel.org/tip/3d91c537296794d5d0773f61abbe7b63f2f132d8
Author:        Borislav Petkov (AMD) <[email protected]>
AuthorDate:    Sat, 18 Mar 2023 12:56:33 +01:00
Committer:     Thomas Gleixner <[email protected]>
CommitterDate: Thu, 30 Mar 2023 14:06:28 +02:00

x86/coco: Export cc_vendor

It will be used in different checks in future changes. Export it directly and provide accessor functions and stubs so this can be used in general code when CONFIG_ARCH_HAS_CC_PLATFORM is not set.

No functional changes.

[ tglx: Add accessor functions ]

Signed-off-by Borislav Petkov (AMD) <[email protected]>
Signed-off-by Thomas Gleixner <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
---
 arch/x86/coco/core.c        | 13 ++++---------
 arch/x86/include/asm/coco.h | 23 ++++++++++++++++++++---
 2 files changed, 24 insertions(+), 12 deletions(-)
arch/x86/coco/core.c +4 -9
index 49b44f8..684f0a9 100644
@@ -13,7 +13,7 @@
 #include <asm/coco.h>
 #include <asm/processor.h>
 
-static enum cc_vendor vendor __ro_after_init;
+enum cc_vendor cc_vendor __ro_after_init;
 static u64 cc_mask __ro_after_init;
 
 static bool intel_cc_platform_has(enum cc_attr attr)

@@ -83,7 +83,7 @@ static bool hyperv_cc_platform_has(enum cc_attr attr)
 
 bool cc_platform_has(enum cc_attr attr)
 {
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return amd_cc_platform_has(attr);
 	case CC_VENDOR_INTEL:

@@ -105,7 +105,7 @@ u64 cc_mkenc(u64 val)
 	 * - for AMD, bit *set* means the page is encrypted
 	 * - for Intel *clear* means encrypted.
 	 */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val | cc_mask;
 	case CC_VENDOR_INTEL:

@@ -118,7 +118,7 @@ u64 cc_mkenc(u64 val)
 u64 cc_mkdec(u64 val)
 {
 	/* See comment in cc_mkenc() */
-	switch (vendor) {
+	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
 		return val & ~cc_mask;
 	case CC_VENDOR_INTEL:

@@ -129,11 +129,6 @@ u64 cc_mkdec(u64 val)
 }
 EXPORT_SYMBOL_GPL(cc_mkdec);
 
-__init void cc_set_vendor(enum cc_vendor v)
-{
-	vendor = v;
-}
-
 __init void cc_set_mask(u64 mask)
 {
 	cc_mask = mask;
arch/x86/include/asm/coco.h +20 -3
index 3d98c3a..91b9448 100644
@@ -11,13 +11,30 @@ enum cc_vendor {
 	CC_VENDOR_INTEL,
 };
 
-void cc_set_vendor(enum cc_vendor v);
-void cc_set_mask(u64 mask);
-
 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM
+extern enum cc_vendor cc_vendor;
+
+static inline enum cc_vendor cc_get_vendor(void)
+{
+	return cc_vendor;
+}
+
+static inline void cc_set_vendor(enum cc_vendor vendor)
+{
+	cc_vendor = vendor;
+}
+
+void cc_set_mask(u64 mask);
 u64 cc_mkenc(u64 val);
 u64 cc_mkdec(u64 val);
 #else
+static inline enum cc_vendor cc_get_vendor(void)
+{
+	return CC_VENDOR_NONE;
+}
+
+static inline void cc_set_vendor(enum cc_vendor vendor) { }
+
 static inline u64 cc_mkenc(u64 val)
 {
 	return val;
author maintainer
#5 lore raw

PATCH 2/2 x86/sev: Get rid of special sev_es_enable_key

In reply to Borislav Petkov

From: "Borislav Petkov (AMD)" <[email protected]>

A SEV-ES guest is active on AMD when CC_ATTR_GUEST_STATE_ENCRYPT is set. I.e., MSR_AMD64_SEV, bit 1, SEV_ES_Enabled. So no need for a special static key.

No functional changes.

Signed-off-by Borislav Petkov (AMD) <[email protected]>
---
 arch/x86/coco/core.c       |  2 +-
 arch/x86/include/asm/sev.h | 11 +++++++----
 arch/x86/kernel/sev.c      |  5 -----
 3 files changed, 8 insertions(+), 10 deletions(-)
arch/x86/coco/core.c +1 -1
index 684f0a910475..17f2b690a485 100644
@@ -81,7 +81,7 @@ static bool hyperv_cc_platform_has(enum cc_attr attr)
 	return attr == CC_ATTR_GUEST_MEM_ENCRYPT;
 }
 
-bool cc_platform_has(enum cc_attr attr)
+bool noinstr cc_platform_has(enum cc_attr attr)
 {
 	switch (cc_vendor) {
 	case CC_VENDOR_AMD:
arch/x86/include/asm/sev.h +7 -4
index ebc271bb6d8e..1335781e4976 100644
@@ -12,6 +12,7 @@
 #include <asm/insn.h>
 #include <asm/sev-common.h>
 #include <asm/bootparam.h>
+#include <asm/coco.h>
 
 #define GHCB_PROTOCOL_MIN	1ULL
 #define GHCB_PROTOCOL_MAX	2ULL

@@ -134,24 +135,26 @@ struct snp_secrets_page_layout {
 } __packed;
 
 #ifdef CONFIG_AMD_MEM_ENCRYPT
-extern struct static_key_false sev_es_enable_key;
 extern void __sev_es_ist_enter(struct pt_regs *regs);
 extern void __sev_es_ist_exit(void);
 static __always_inline void sev_es_ist_enter(struct pt_regs *regs)
 {
-	if (static_branch_unlikely(&sev_es_enable_key))
+	if (cc_vendor == CC_VENDOR_AMD &&
+	    cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
 		__sev_es_ist_enter(regs);
 }
 static __always_inline void sev_es_ist_exit(void)
 {
-	if (static_branch_unlikely(&sev_es_enable_key))
+	if (cc_vendor == CC_VENDOR_AMD &&
+	    cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
 		__sev_es_ist_exit();
 }
 extern int sev_es_setup_ap_jump_table(struct real_mode_header *rmh);
 extern void __sev_es_nmi_complete(void);
 static __always_inline void sev_es_nmi_complete(void)
 {
-	if (static_branch_unlikely(&sev_es_enable_key))
+	if (cc_vendor == CC_VENDOR_AMD &&
+	    cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT))
 		__sev_es_nmi_complete();
 }
 extern int __init sev_es_efi_map_ghcbs(pgd_t *pgd);
arch/x86/kernel/sev.c +0 -5
index 679026a640ef..4fdba49b6e38 100644
@@ -111,8 +111,6 @@ struct ghcb_state {
 };
 
 static DEFINE_PER_CPU(struct sev_es_runtime_data*, runtime_data);
-DEFINE_STATIC_KEY_FALSE(sev_es_enable_key);
-
 static DEFINE_PER_CPU(struct sev_es_save_area *, sev_vmsa);
 
 struct sev_config {

@@ -1393,9 +1391,6 @@ void __init sev_es_init_vc_handling(void)
 			sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED);
 	}
 
-	/* Enable SEV-ES special handling */
-	static_branch_enable(&sev_es_enable_key);
-
 	/* Initialize per-cpu GHCB pages */
 	for_each_possible_cpu(cpu) {
 		alloc_runtime_data(cpu);
Signature · 1 line
2.35.1
#6 lore raw

Re: [PATCH 2/2] x86/sev: Get rid of special sev_es_enable_key

arch/x86/coco/core.c static bool hyperv_cc_platform_has(enum cc_attr attr) · line 84

Quoted 2 lines · Borislav Petkov
arch/x86/coco/core.c +1 -1
-bool cc_platform_has(enum cc_attr attr)
+bool noinstr cc_platform_has(enum cc_attr attr)

That's not sufficient. This function invokes static functions which the compiler can rightfully put out of line resulting in a noinstr violation.

Thanks,

tglx

author maintainer
#7 lore raw

Re: [PATCH 2/2] x86/sev: Get rid of special sev_es_enable_key

Quoted 2 lines · Thomas Gleixner

That's not sufficient. This function invokes static functions which the compiler can rightfully put out of line resulting in a noinstr violation.

Right, as mentioned on IRC, if we're going to use the cc_platform_has() thing to do simple arch-agnostic confidential guests checks, perhaps we should make it and the underlying functions it calls simply __always_inline so that the compiler can optimize stuff even more and not have function calls for such simple tests...

Signature · 4 lines
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette