Received: by 2002:a05:7412:bbc7:b0:fc:a2b0:25d7 with SMTP id kh7csp945373rdb; Fri, 2 Feb 2024 08:37:07 -0800 (PST) X-Google-Smtp-Source: AGHT+IEzPNlr5s3KubTjFJKUMsXmIRL/PqAbzV8XVL+P4nkOXVQ3yn4OUgyjrT30hc/s43YQScaB X-Received: by 2002:a05:620a:22f2:b0:783:2a08:8044 with SMTP id p18-20020a05620a22f200b007832a088044mr2819890qki.57.1706891827478; Fri, 02 Feb 2024 08:37:07 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706891827; cv=pass; d=google.com; s=arc-20160816; b=bQypMZxXirTe2GkNBNIi2fZsDCPvt2WNElJe0qzqY/gxuB2y2PB3ud7Z+Lr9Y+wkSD SpAaZhXHb2JsR78prL6eH/DRe2hlDi/EjSxNBUBCP1oxdFr6ILXTnoPz6nf/CsNFzTZg oY1Ec4raL6pyoQNOYwnItRiUqteFTRG6SGEdu3HW3fnOjF17wkDbgKsLbFafSEGkjcs3 jH+VoFwYnM2NLvFJ/y+BjsVQg/1UAbx5+buvZKwXO/Zh4+DkxDGBZKlEOQ7SbRn6etj6 KG1Ows8cgu9Z0y120AgjK7TFUITFJZEChjca8c1GVQFWVYSp2L7N+faHL761nRPbmfZW hBRw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=in-reply-to:content-disposition:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:message-id:subject:cc :to:from:date:dkim-signature; bh=owu4C5rP9Sd62pQo+ZZmYYXOi0xhUhCRq+QLaeQVQpk=; fh=01ebXBW6MkXV8pMizx/aos2u34OVnyWJxN6UBGixKw8=; b=IpeCUU5ydbohe+hEjJ0endOLJsz7wszSRTJvknPqiL2lIO2UBUxaQM3sN1hTckG9Bh brpc/UvHWyOne7xxHbWoEZfclWRcxDi+btqgzysD4BTrST/6nMoz4aWqfi6A8BglhuZJ 1SJZbSnSn33otU+BpYWiFgKb7gyytJ0CJzVSsKu2fQMeii3c2tKMqCR52v+h17rfJXRy M4VL9ck2YbYUdCOpQo2F18GAwuuroFFXizJ6BYST2exWI6/tW0AVV3hJpsjojKOe2WDc NQnpbyQ/HOzKUc0q9fFz3fff71fgr0M4cqdPvv1sB62dSlGBgbupIzEUObTYsXu9WIuv eyJQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@alien8.de header.s=alien8 header.b=DjWjJhKY; arc=pass (i=1 spf=pass spfdomain=alien8.de dkim=pass dkdomain=alien8.de dmarc=pass fromdomain=alien8.de); spf=pass (google.com: domain of linux-kernel+bounces-50151-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-50151-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de X-Forwarded-Encrypted: i=1; AJvYcCWwtJJwuZ8GmjMi5RGVWK2uD149NaScpFn71575YpvPqK+TVxVa9SEDL7bz1erfWHzfVRnqWOHXYoQIIFQ8m8RUOaUcOasQYBh6RvqDIg== Return-Path: Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id a21-20020a05620a125500b00783dae58180si2265701qkl.188.2024.02.02.08.37.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Feb 2024 08:37:07 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-50151-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@alien8.de header.s=alien8 header.b=DjWjJhKY; arc=pass (i=1 spf=pass spfdomain=alien8.de dkim=pass dkdomain=alien8.de dmarc=pass fromdomain=alien8.de); spf=pass (google.com: domain of linux-kernel+bounces-50151-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-50151-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=alien8.de Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 8C7061C2758E for ; Fri, 2 Feb 2024 16:36:43 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 548C61487ED; Fri, 2 Feb 2024 16:35:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b="DjWjJhKY" Received: from mail.alien8.de (mail.alien8.de [65.109.113.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CB991487E7; Fri, 2 Feb 2024 16:35:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=65.109.113.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706891743; cv=none; b=WrxHHd2Ft3Uis8MtCsFVJ9P+4n8WJUyF30eLuY8hqHUFzT9q04OSyywknwKpzOe81Cg07ZNEOOLEVuA8gi6JExSQH//hekb7uywUKenn8bXtZg1R49KZgSPo0q5zGMTnwj/C97P584BVFzP+nxe/xQUz9Pmrptet0F6SvhVb2Y8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706891743; c=relaxed/simple; bh=jfP5FzF2iADTs+nsumSsf+1ytpdI2PwVjp67EKLfiAE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=cXX0uCT+gnqPo6sUSa6aNfgo3Rt3xMniTwN53BaU6TINU366mvT6YJq/PxaFj2zKjigCyemJPC4i6G+E559pfw3eNKtDxtIhWb0r416/mj0qbu2wB3BsqB1pCNIWgdkzJqMdnfkvdY5PxJe8XQ8xmqOG6evuMLpM8xRlPnX7ecA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de; spf=pass smtp.mailfrom=alien8.de; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b=DjWjJhKY; arc=none smtp.client-ip=65.109.113.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=alien8.de Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTP id D347240E01A2; Fri, 2 Feb 2024 16:35:37 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at mail.alien8.de Authentication-Results: mail.alien8.de (amavisd-new); dkim=pass (4096-bit key) header.d=alien8.de Received: from mail.alien8.de ([127.0.0.1]) by localhost (mail.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id BDgLq2vi6VrF; Fri, 2 Feb 2024 16:35:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=alien8; t=1706891735; bh=owu4C5rP9Sd62pQo+ZZmYYXOi0xhUhCRq+QLaeQVQpk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DjWjJhKYuKNK0B335q79y2JbDvwkbghSEGXDReaL7Cg1RJtRKkXofVtq1nTBVZYFi NowRJnt6AZzjVGdQXfyoK3lTxR79KCU89p043iQp2G6OSDb5f1nfaTLW3z2H4RgZq2 y9lrlWDxtzk8HVUP2YJ9wG0mhbKPb+0G0s0Mefn2qTxGLwkmbmyJYZfu0PoqABvXpt /8GfEiQDhzYMT695rw8G95eurTWucDepUJF1M6nIOMR4W4qp9eeZEj7Va1k5/hCl0b 8Aq8IR9bgZjtCvxYrvcNFiUklU/dLr8+1+R48++a/I9ah0Ias/yQ3L5qKvu4CM28jG 182l15VndVVs5pW2EmKozZh9+FWxpmJDtqdlidMwHmvrV+z19zjgp0aVcmqvsLjlQj EO1sEM9Ows2Mhs8BSraRTv6JfSrcqrtdn8mJDXFMY+vGq4ItmzIZhahm4T03KYvvgK tqoXR4Mxzz7of/FQGvXn3zaUDaPYWQQYkOReLU9tzWhw+0mIL1lbncx7JXbH0sXmay xwFfgNHMV0dBmFIWezmZLwFZNyhbY0XfGmjIhvbeyIl0H65UvzF8a+B6ElLl4M74yN Ee25ps5Kn2cvhQB2MRfVMeC9wlh9tvPRDKSGSZtUexgk9Vr8SgQd6whdz5pyTzBBBc jg42PO4t4LFSICDfcWKeKE14= Received: from zn.tnic (pd953021b.dip0.t-ipconnect.de [217.83.2.27]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id D894040E016C; Fri, 2 Feb 2024 16:35:16 +0000 (UTC) Date: Fri, 2 Feb 2024 17:35:10 +0100 From: Borislav Petkov To: Ard Biesheuvel Cc: Tom Lendacky , Ard Biesheuvel , linux-kernel@vger.kernel.org, Kevin Loughlin , Dionna Glaze , Thomas Gleixner , Ingo Molnar , Dave Hansen , Andy Lutomirski , Arnd Bergmann , Nathan Chancellor , Nick Desaulniers , Justin Stitt , Kees Cook , Brian Gerst , linux-arch@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH] x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT Message-ID: <20240202163510.GDZb0Zvj8qOndvFOiZ@fat_crate.local> References: <20240129180502.4069817-21-ardb+git@google.com> <20240129180502.4069817-23-ardb+git@google.com> <20240131083511.GIZboGP8jPIrUZA8DF@fat_crate.local> <20240131092952.GCZboTECip8DbWtYtz@fat_crate.local> <8b38ef82-ec2b-4845-9732-15713a0e2a85@amd.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: On Thu, Feb 01, 2024 at 05:15:51PM +0100, Ard Biesheuvel wrote: > OK, I'll remove it in the next rev. Considering how it simplifies sme_enable() even more, I'd like to expedite this one. Thx. --- From: "Borislav Petkov (AMD)" Date: Fri, 2 Feb 2024 17:29:32 +0100 Subject: [PATCH] x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT It was meant well at the time but nothing's using it so get rid of it. Signed-off-by: Borislav Petkov (AMD) --- Documentation/admin-guide/kernel-parameters.txt | 4 +--- Documentation/arch/x86/amd-memory-encryption.rst | 16 ++++++++-------- arch/x86/Kconfig | 13 ------------- arch/x86/mm/mem_encrypt_identity.c | 11 +---------- 4 files changed, 10 insertions(+), 34 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 31b3a25680d0..2cb70a384af8 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -3320,9 +3320,7 @@ mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control Valid arguments: on, off - Default (depends on kernel configuration option): - on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) - off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) + Default: off mem_encrypt=on: Activate SME mem_encrypt=off: Do not activate SME diff --git a/Documentation/arch/x86/amd-memory-encryption.rst b/Documentation/arch/x86/amd-memory-encryption.rst index 07caa8fff852..414bc7402ae7 100644 --- a/Documentation/arch/x86/amd-memory-encryption.rst +++ b/Documentation/arch/x86/amd-memory-encryption.rst @@ -87,14 +87,14 @@ The state of SME in the Linux kernel can be documented as follows: kernel is non-zero). SME can also be enabled and activated in the BIOS. If SME is enabled and -activated in the BIOS, then all memory accesses will be encrypted and it will -not be necessary to activate the Linux memory encryption support. If the BIOS -merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), then Linux can activate -memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or -by supplying mem_encrypt=on on the kernel command line. However, if BIOS does -not enable SME, then Linux will not be able to activate memory encryption, even -if configured to do so by default or the mem_encrypt=on command line parameter -is specified. +activated in the BIOS, then all memory accesses will be encrypted and it +will not be necessary to activate the Linux memory encryption support. + +If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), +then memory encryption can be enabled by supplying mem_encrypt=on on the +kernel command line. However, if BIOS does not enable SME, then Linux +will not be able to activate memory encryption, even if configured to do +so by default or the mem_encrypt=on command line parameter is specified. Secure Nested Paging (SNP) ========================== diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 5edec175b9bf..58d3593bc4f2 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1539,19 +1539,6 @@ config AMD_MEM_ENCRYPT This requires an AMD processor that supports Secure Memory Encryption (SME). -config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT - bool "Activate AMD Secure Memory Encryption (SME) by default" - depends on AMD_MEM_ENCRYPT - help - Say yes to have system memory encrypted by default if running on - an AMD processor that supports Secure Memory Encryption (SME). - - If set to Y, then the encryption of system memory can be - deactivated with the mem_encrypt=off command line option. - - If set to N, then the encryption of system memory can be - activated with the mem_encrypt=on command line option. - # Common NUMA Features config NUMA bool "NUMA Memory Allocation and Scheduler Support" diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c index 7f72472a34d6..efe9f217fcf9 100644 --- a/arch/x86/mm/mem_encrypt_identity.c +++ b/arch/x86/mm/mem_encrypt_identity.c @@ -97,7 +97,6 @@ static char sme_workarea[2 * PMD_SIZE] __section(".init.scratch"); static char sme_cmdline_arg[] __initdata = "mem_encrypt"; static char sme_cmdline_on[] __initdata = "on"; -static char sme_cmdline_off[] __initdata = "off"; static void __init sme_clear_pgd(struct sme_populate_pgd_data *ppd) { @@ -504,7 +503,7 @@ void __init sme_encrypt_kernel(struct boot_params *bp) void __init sme_enable(struct boot_params *bp) { - const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; + const char *cmdline_ptr, *cmdline_arg, *cmdline_on; unsigned int eax, ebx, ecx, edx; unsigned long feature_mask; unsigned long me_mask; @@ -587,12 +586,6 @@ void __init sme_enable(struct boot_params *bp) asm ("lea sme_cmdline_on(%%rip), %0" : "=r" (cmdline_on) : "p" (sme_cmdline_on)); - asm ("lea sme_cmdline_off(%%rip), %0" - : "=r" (cmdline_off) - : "p" (sme_cmdline_off)); - - if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT)) - sme_me_mask = me_mask; cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr | ((u64)bp->ext_cmd_line_ptr << 32)); @@ -602,8 +595,6 @@ void __init sme_enable(struct boot_params *bp) if (!strncmp(buffer, cmdline_on, sizeof(buffer))) sme_me_mask = me_mask; - else if (!strncmp(buffer, cmdline_off, sizeof(buffer))) - sme_me_mask = 0; out: if (sme_me_mask) { -- 2.43.0 -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette