@@ -2238,8 +2238,9 @@
Default (depends on kernel configuration option):
on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y)
off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n)
- mem_encrypt=on: Activate SME
- mem_encrypt=off: Do not activate SME
+ mem_encrypt=on: Activate SME and SEV
+ mem_encrypt=off: Do not activate SME and SEV
+ mem_encrypt=sme: Activate SME only
Refer to Documentation/x86/amd-memory-encryption.txt
for details on when memory encryption can be activated.
@@ -52,6 +52,7 @@ void swiotlb_set_mem_attributes(void *vaddr, unsigned long size);
bool sme_active(void);
bool sev_active(void);
+unsigned int me_cmdline_state(void);
#else /* !CONFIG_AMD_MEM_ENCRYPT */
@@ -72,6 +73,7 @@ static inline void __init sme_enable(struct boot_params *bp) { }
static inline bool sme_active(void) { return false; }
static inline bool sev_active(void) { return false; }
+static inline unsigned int me_cmdline_state(void) { return ME_CMDLINE_OFF; }
static inline int __init
early_set_memory_decrypted(resource_size_t paddr, unsigned long size) { return 0; }
@@ -592,6 +592,16 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
if (!(msr & MSR_K7_HWCR_SMMLOCK))
goto clear_sev;
+ /* Check for the mem_encrypt cmdline parameter and act accordingly. */
+ switch (me_cmdline_state()) {
+ case ME_CMDLINE_OFF:
+ goto clear_all;
+ case ME_CMDLINE_SME:
+ goto clear_sev;
+ default:
+ break;
+ }
+
return;
clear_all:
@@ -33,6 +33,7 @@
static char sme_cmdline_arg[] __initdata = "mem_encrypt";
static char sme_cmdline_on[] __initdata = "on";
static char sme_cmdline_off[] __initdata = "off";
+static char sme_cmdline_sme[] __initdata = "sme";
/*
* Since SME related variables are set early in the boot process they must
@@ -45,6 +46,7 @@ DEFINE_STATIC_KEY_FALSE(__sev);
EXPORT_SYMBOL_GPL(__sev);
static bool sev_enabled __section(.data) = false;
+static unsigned int cmdline_state __section(.data) = ME_CMDLINE_OFF;
/* Buffer used for early in-place encryption by BSP, no locking needed */
static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE);
@@ -403,6 +405,11 @@ bool sev_active(void)
}
EXPORT_SYMBOL_GPL(sev_active);
+unsigned int me_cmdline_state(void)
+{
+ return cmdline_state;
+}
+
static const struct dma_map_ops sev_dma_ops = {
.alloc = sev_alloc,
.free = sev_free,
@@ -768,7 +775,7 @@ void __init sme_encrypt_kernel(void)
void __init __nostackprotector sme_enable(struct boot_params *bp)
{
- const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
+ const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off, *cmdline_sme;
unsigned int eax, ebx, ecx, edx;
unsigned long feature_mask;
bool active_by_default;
@@ -842,6 +849,9 @@ void __init __nostackprotector sme_enable(struct boot_params *bp)
asm ("lea sme_cmdline_off(%%rip), %0"
: "=r" (cmdline_off)
: "p" (sme_cmdline_off));
+ asm ("lea sme_cmdline_sme(%%rip), %0"
+ : "=r" (cmdline_sme)
+ : "p" (sme_cmdline_sme));
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
active_by_default = true;
@@ -853,10 +863,19 @@ void __init __nostackprotector sme_enable(struct boot_params *bp)
cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer));
- if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
+ if (!strncmp(buffer, cmdline_on, sizeof(buffer))) {
sme_me_mask = me_mask;
- else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
+ cmdline_state = ME_CMDLINE_ON;
+ } else if (!strncmp(buffer, cmdline_off, sizeof(buffer))) {
sme_me_mask = 0;
- else
+ cmdline_state = ME_CMDLINE_OFF;
+ } else if (!strncmp(buffer, cmdline_sme, sizeof(buffer))) {
+ sme_me_mask = me_mask;
+ cmdline_state = ME_CMDLINE_SME;
+ } else {
sme_me_mask = active_by_default ? me_mask : 0;
+ if (active_by_default)
+ cmdline_state = ME_CMDLINE_ON;
+ }
+
}
@@ -15,6 +15,12 @@
#ifndef __ASSEMBLY__
+enum {
+ ME_CMDLINE_OFF,
+ ME_CMDLINE_ON,
+ ME_CMDLINE_SME
+};
+
#ifdef CONFIG_ARCH_HAS_MEM_ENCRYPT
#include <asm/mem_encrypt.h>
@@ -25,6 +31,7 @@
static inline bool sme_active(void) { return false; }
static inline bool sev_active(void) { return false; }
+static unsigned int me_cmdline_state(void) { return ME_CMDLINE_OFF; }
#endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */
The mem_encrypt=on activates both SME and SEV. Add a new argument to disable the SEV and allow SME. The argument can be useful when SEV has issues and we want to disable it. early_detect_mem_encrypt() [cpu/amd.com] will need to know the state of the mem_encrypt= argument. Since early_detect_mem_encrypt() is not defined as __init hence we are not able to use the 'boot_command_line' variable to parse the cmdline argument. We introduce a new function me_cmdline_state() to get the cmdline state from mem_encrypt.c. Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Radim Krčmář" <rkrcmar@redhat.com> Cc: Borislav Petkov <bp@suse.de> Cc: kvm@vger.kernel.org Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- Boris, The patch depends on "x86/CPU/AMD: Add the SEV CPU feature" from Part2 [1]. [1] https://patchwork.kernel.org/patch/9960315/ Documentation/admin-guide/kernel-parameters.txt | 5 +++-- arch/x86/include/asm/mem_encrypt.h | 2 ++ arch/x86/kernel/cpu/amd.c | 10 +++++++++ arch/x86/mm/mem_encrypt.c | 27 +++++++++++++++++++++---- include/linux/mem_encrypt.h | 7 +++++++ 5 files changed, 45 insertions(+), 6 deletions(-)