On Wed, Dec 06, 2023 at 02:35:28PM -0600, Kalra, Ashish wrote:
> The main use case for the probe parameter is to control if we want to do
> legacy SEV/SEV-ES INIT during probe. There is a usage case where we want to
> delay legacy SEV INIT till an actual SEV/SEV-ES guest is being launched. So
> essentially the probe parameter controls if we want to
> execute __sev_do_init_locked() or not.
>
> We always want to do SNP INIT at probe time.
Here's what I mean (diff ontop):
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index fae1fd45eccd..830d74fcf950 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -479,11 +479,16 @@ static inline int __sev_do_init_locked(int *psp_ret)
return __sev_init_locked(psp_ret);
}
-static int ___sev_platform_init_locked(int *error, bool probe)
+/*
+ * Legacy guests cannot be running while SNP_INIT(_EX) is executing,
+ * so perform SEV-SNP initialization at probe time.
+ */
+static int __sev_platform_init_snp_locked(int *error)
{
- int rc, psp_ret = SEV_RET_NO_FW_CALL;
+
struct psp_device *psp = psp_master;
struct sev_device *sev;
+ int rc;
if (!psp || !psp->sev_data)
return -ENODEV;
@@ -493,10 +498,6 @@ static int ___sev_platform_init_locked(int *error, bool probe)
if (sev->state == SEV_STATE_INIT)
return 0;
- /*
- * Legacy guests cannot be running while SNP_INIT(_EX) is executing,
- * so perform SEV-SNP initialization at probe time.
- */
rc = __sev_snp_init_locked(error);
if (rc && rc != -ENODEV) {
/*
@@ -506,8 +507,21 @@ static int ___sev_platform_init_locked(int *error, bool probe)
dev_err(sev->dev, "SEV-SNP: failed to INIT rc %d, error %#x\n", rc, *error);
}
- /* Delay SEV/SEV-ES support initialization */
- if (probe && !psp_init_on_probe)
+ return rc;
+}
+
+static int __sev_platform_init_locked(int *error)
+{
+ int rc, psp_ret = SEV_RET_NO_FW_CALL;
+ struct psp_device *psp = psp_master;
+ struct sev_device *sev;
+
+ if (!psp || !psp->sev_data)
+ return -ENODEV;
+
+ sev = psp->sev_data;
+
+ if (sev->state == SEV_STATE_INIT)
return 0;
if (!sev_es_tmr) {
@@ -563,33 +577,32 @@ static int ___sev_platform_init_locked(int *error, bool probe)
return 0;
}
-static int __sev_platform_init_locked(int *error)
-{
- return ___sev_platform_init_locked(error, false);
-}
-
-int sev_platform_init(int *error)
+static int _sev_platform_init_locked(int *error, bool probe)
{
int rc;
- mutex_lock(&sev_cmd_mutex);
- rc = __sev_platform_init_locked(error);
- mutex_unlock(&sev_cmd_mutex);
+ rc = __sev_platform_init_snp_locked(error);
+ if (rc)
+ return rc;
- return rc;
+ /* Delay SEV/SEV-ES support initialization */
+ if (probe && !psp_init_on_probe)
+ return 0;
+
+ return __sev_platform_init_locked(error);
}
-EXPORT_SYMBOL_GPL(sev_platform_init);
-static int sev_platform_init_on_probe(int *error)
+int sev_platform_init(int *error)
{
int rc;
mutex_lock(&sev_cmd_mutex);
- rc = ___sev_platform_init_locked(error, true);
+ rc = _sev_platform_init_locked(error, false);
mutex_unlock(&sev_cmd_mutex);
return rc;
}
+EXPORT_SYMBOL_GPL(sev_platform_init);
static int __sev_platform_shutdown_locked(int *error)
{
@@ -691,7 +704,7 @@ static int sev_ioctl_do_pek_pdh_gen(int cmd, struct sev_issue_cmd *argp, bool wr
return -EPERM;
if (sev->state == SEV_STATE_UNINIT) {
- rc = __sev_platform_init_locked(&argp->error);
+ rc = _sev_platform_init_locked(&argp->error, false);
if (rc)
return rc;
}
@@ -734,7 +747,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)
cmd:
if (sev->state == SEV_STATE_UNINIT) {
- ret = __sev_platform_init_locked(&argp->error);
+ ret = _sev_platform_init_locked(&argp->error, false);
if (ret)
goto e_free_blob;
}
@@ -1115,7 +1128,7 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable)
/* If platform is not in INIT state then transition it to INIT */
if (sev->state != SEV_STATE_INIT) {
- ret = __sev_platform_init_locked(&argp->error);
+ ret = _sev_platform_init_locked(&argp->error, false);
if (ret)
goto e_free_oca;
}
@@ -1246,7 +1259,7 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
if (!writable)
return -EPERM;
- ret = __sev_platform_init_locked(&argp->error);
+ ret = _sev_platform_init_locked(&argp->error, false);
if (ret)
return ret;
}
@@ -1608,7 +1621,9 @@ void sev_pci_init(void)
}
/* Initialize the platform */
- rc = sev_platform_init_on_probe(&error);
+ mutex_lock(&sev_cmd_mutex);
+ rc = _sev_platform_init_locked(&error, true);
+ mutex_unlock(&sev_cmd_mutex);
if (rc)
dev_err(sev->dev, "SEV: failed to INIT error %#x, rc %d\n",
error, rc);
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
