From patchwork Sat Feb 3 10:50:36 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 196238 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:9bc1:b0:106:209c:c626 with SMTP id op1csp955264dyc; Sat, 3 Feb 2024 02:51:13 -0800 (PST) X-Google-Smtp-Source: AGHT+IFkuNxftcYcchJwTPwJGEre1HrEo1foVw4lfhLV4WyMSjIGHXm8vns3y5zEDm7jDD8g/EeP X-Received: by 2002:a05:6a20:a1a0:b0:19c:af95:96ec with SMTP id r32-20020a056a20a1a000b0019caf9596ecmr6505524pzk.35.1706957473290; Sat, 03 Feb 2024 02:51:13 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706957473; cv=pass; d=google.com; s=arc-20160816; b=hrJ8eRWFr7fqOEgnUCLNWZUIMC9pCms5E4xycR6dQ1jeTe8iVj6vJoRHfhdzEvVfol S1DhbZ1qbjz2w2G4V/Yp0jYKkXyzgo0FsbreEJKwXXFiDd9jO2YNicmUmGwyODMiP/rt NJwiqHSDxeUgiD1BVTIyNeforEZ1NT7M+iy9dEOU8xPVR3tvtVneHwWeMflYjvvt7srg i0lbzVzJlPo2ASu1+3Hvrkui+bC0UCMPWngwPMDKmVe9Wb17AzJOyU/HpV5y2LXGTmIj Omu6HAGrJqaRpZf167XRmaHsmqzn5euyyJPdMxm8jR7hZq2BsTJaAWJFjRe8xNhVQy8y EW+w== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:precedence:robot-unsubscribe:robot-id :message-id:mime-version:list-unsubscribe:list-subscribe:list-id :precedence:references:in-reply-to:cc:subject:to:reply-to:sender :from:dkim-signature:dkim-signature:date; bh=gyh1JhiZGi5lj23tgwc8yNz5zZZRzxKAF+TVSPG7Ksg=; fh=Fiw2PEcQ46Ysyk2rugjceYta2UW/Fl5OXzq4ps0g9Ko=; b=eJ95x9Lsbt7PnFLr38/fiYyseWYl5JiVXHaNa7yPDPWDTpumMFo6ePjrXMF/MJasNi M7UMNwyqG91kRwGDGphEf9/pmBzef/+s0WPVlAS26JaJq7yY+m/VFGTu08rm+4z0pITe FKgnBq92NRNHVcFToCgD8u8n9xBM+/0EUZ1gvQWTuZtGF5a59kiYPERIhqS5ek9djn6g T8HH69HZsaaApLHz+sA8fzLh4j33xE9kKjXVvUQfaNImhCPcR9O0/Yfm6RyxTosuJIOH z3SdYXrA1CsZPZ1enkV+YEL1PQatqtwC+Ngch6MOXdo0aU0tue2uJ2wAaofy1p7TUSgG SbmA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=hcUo2l21; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; arc=pass (i=1 spf=pass spfdomain=linutronix.de dkim=pass dkdomain=linutronix.de dmarc=pass fromdomain=linutronix.de); spf=pass (google.com: domain of linux-kernel+bounces-51031-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51031-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de X-Forwarded-Encrypted: i=1; AJvYcCUfXSxMr6ka6CvR+z8/f/TJWGEFdl72D+3Rm/r10ebPFK1lpQ8M1dcgjCCI1MuQ5nsQmiDNw6aRQI+Kfc9ChohpMHo/Hw== Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id t20-20020a17090b019400b002960647b16esi1390702pjs.42.2024.02.03.02.51.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 02:51:13 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-51031-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=hcUo2l21; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; arc=pass (i=1 spf=pass spfdomain=linutronix.de dkim=pass dkdomain=linutronix.de dmarc=pass fromdomain=linutronix.de); spf=pass (google.com: domain of linux-kernel+bounces-51031-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51031-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 1022E2894B8 for ; Sat, 3 Feb 2024 10:51:13 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 01E235DF0F; Sat, 3 Feb 2024 10:50:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="hcUo2l21"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="XHTn6rBH" Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6AC65D739; Sat, 3 Feb 2024 10:50:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957442; cv=none; b=VYhyYebeYuo3S+26VQJyPAXm6hLlxUxG2E8f1YL0fNOgW4xemdivCXWMFlqmQDTXGV/EYIBpQqtjPLDf3FYRL7g9ui1t85/gw3vKl6X2/SB9CJg3IcAJsUrGqVClXf0husaT9gJd3Sf74udT/xysFYb2gnuUJsu1TVddIvL6JWc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957442; c=relaxed/simple; bh=dzHJap9rPE5jUz+rvGprwuJX3FXOWKJCXQsyjAmr+fs=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=EhsT4cjfOYoLZHh1MG7+T4Yhc7WXVPnS5+XUx68dwHVQMBFsrjOZxwTns0BRN7Rm1EZx8nvMy0JfuS8Gzx46aRsfWnqXhMuOsMz4viNCMGLIj/ZpkrOE5GkaA78NHOyzpmZ1ns8t/pp8661QNWc6/+uCbhHayJJbvi2nYue2hm8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=hcUo2l21; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=XHTn6rBH; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Date: Sat, 03 Feb 2024 10:50:36 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1706957437; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gyh1JhiZGi5lj23tgwc8yNz5zZZRzxKAF+TVSPG7Ksg=; b=hcUo2l21Te2tZtSuoofeUVQsWOJm5HPlyJl+D7awclsul/jq3HHbC+Gq4BPPxjRob6EJ4x gJUN7KkPJ+/Lh4Lyjmqxg8JTOIpRSnZ5yt7H70oz87s9C+lyTM2qgROgk8GD2/FNv0g/mK 1tpvTMQsozNcWqce0glxIFW3W4qWpqO3vrFbzPK18ukqf3WQlKarSftqNCc39lqnRCJsFD T72yXlFNubD2cqCgim1MXYG37t/XQ9BtHhAJNw7XPW62xhRgluJu9NDH8DaGQPeJ6fNPUM lAy4yj5F1rEvJ+l0wH9xj8jTaSehKhA2MFUxPpqQp1u3QfjS3zZ3GK0iBJT63A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1706957437; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gyh1JhiZGi5lj23tgwc8yNz5zZZRzxKAF+TVSPG7Ksg=; b=XHTn6rBHgzens9AklLedVsN5X/3sblrfdQFjDscDKNgZNO2rvZaUbWpDG+qUFSW1xC6Sy2 fz+2OwyfDQwfdOBA== From: "tip-bot2 for Borislav Petkov (AMD)" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/sev] x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT Cc: "Borislav Petkov (AMD)" , Ard Biesheuvel , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20240202163510.GDZb0Zvj8qOndvFOiZ@fat_crate.local> References: <20240202163510.GDZb0Zvj8qOndvFOiZ@fat_crate.local> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <170695743640.398.1007788739017786990.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1789806527683897812 X-GMAIL-MSGID: 1789874639160677562 The following commit has been merged into the x86/sev branch of tip: Commit-ID: 29956748339aa8757a7e2f927a8679dd08f24bb6 Gitweb: https://git.kernel.org/tip/29956748339aa8757a7e2f927a8679dd08f24bb6 Author: Borislav Petkov (AMD) AuthorDate: Fri, 02 Feb 2024 17:29:32 +01:00 Committer: Borislav Petkov (AMD) CommitterDate: Sat, 03 Feb 2024 11:38:17 +01:00 x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT It was meant well at the time but nothing's using it so get rid of it. Signed-off-by: Borislav Petkov (AMD) Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20240202163510.GDZb0Zvj8qOndvFOiZ@fat_crate.local --- Documentation/admin-guide/kernel-parameters.txt | 4 +--- Documentation/arch/x86/amd-memory-encryption.rst | 16 +++++++-------- arch/x86/Kconfig | 13 +------------ arch/x86/mm/mem_encrypt_identity.c | 11 +---------- 4 files changed, 10 insertions(+), 34 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 31b3a25..2cb70a3 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3320,9 +3320,7 @@ mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control Valid arguments: on, off - Default (depends on kernel configuration option): - on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) - off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) + Default: off mem_encrypt=on: Activate SME mem_encrypt=off: Do not activate SME diff --git a/Documentation/arch/x86/amd-memory-encryption.rst b/Documentation/arch/x86/amd-memory-encryption.rst index 07caa8f..414bc74 100644 --- a/Documentation/arch/x86/amd-memory-encryption.rst +++ b/Documentation/arch/x86/amd-memory-encryption.rst @@ -87,14 +87,14 @@ The state of SME in the Linux kernel can be documented as follows: kernel is non-zero). SME can also be enabled and activated in the BIOS. If SME is enabled and -activated in the BIOS, then all memory accesses will be encrypted and it will -not be necessary to activate the Linux memory encryption support. If the BIOS -merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), then Linux can activate -memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or -by supplying mem_encrypt=on on the kernel command line. However, if BIOS does -not enable SME, then Linux will not be able to activate memory encryption, even -if configured to do so by default or the mem_encrypt=on command line parameter -is specified. +activated in the BIOS, then all memory accesses will be encrypted and it +will not be necessary to activate the Linux memory encryption support. + +If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), +then memory encryption can be enabled by supplying mem_encrypt=on on the +kernel command line. However, if BIOS does not enable SME, then Linux +will not be able to activate memory encryption, even if configured to do +so by default or the mem_encrypt=on command line parameter is specified. Secure Nested Paging (SNP) ========================== diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 5edec17..58d3593 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1539,19 +1539,6 @@ config AMD_MEM_ENCRYPT This requires an AMD processor that supports Secure Memory Encryption (SME). -config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT - bool "Activate AMD Secure Memory Encryption (SME) by default" - depends on AMD_MEM_ENCRYPT - help - Say yes to have system memory encrypted by default if running on - an AMD processor that supports Secure Memory Encryption (SME). - - If set to Y, then the encryption of system memory can be - deactivated with the mem_encrypt=off command line option. - - If set to N, then the encryption of system memory can be - activated with the mem_encrypt=on command line option. - # Common NUMA Features config NUMA bool "NUMA Memory Allocation and Scheduler Support" diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c index 7f72472..efe9f21 100644 --- a/arch/x86/mm/mem_encrypt_identity.c +++ b/arch/x86/mm/mem_encrypt_identity.c @@ -97,7 +97,6 @@ static char sme_workarea[2 * PMD_SIZE] __section(".init.scratch"); static char sme_cmdline_arg[] __initdata = "mem_encrypt"; static char sme_cmdline_on[] __initdata = "on"; -static char sme_cmdline_off[] __initdata = "off"; static void __init sme_clear_pgd(struct sme_populate_pgd_data *ppd) { @@ -504,7 +503,7 @@ void __init sme_encrypt_kernel(struct boot_params *bp) void __init sme_enable(struct boot_params *bp) { - const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; + const char *cmdline_ptr, *cmdline_arg, *cmdline_on; unsigned int eax, ebx, ecx, edx; unsigned long feature_mask; unsigned long me_mask; @@ -587,12 +586,6 @@ void __init sme_enable(struct boot_params *bp) asm ("lea sme_cmdline_on(%%rip), %0" : "=r" (cmdline_on) : "p" (sme_cmdline_on)); - asm ("lea sme_cmdline_off(%%rip), %0" - : "=r" (cmdline_off) - : "p" (sme_cmdline_off)); - - if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT)) - sme_me_mask = me_mask; cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr | ((u64)bp->ext_cmd_line_ptr << 32)); @@ -602,8 +595,6 @@ void __init sme_enable(struct boot_params *bp) if (!strncmp(buffer, cmdline_on, sizeof(buffer))) sme_me_mask = me_mask; - else if (!strncmp(buffer, cmdline_off, sizeof(buffer))) - sme_me_mask = 0; out: if (sme_me_mask) {