From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751604AbdI3VRw (ORCPT ); Sat, 30 Sep 2017 17:17:52 -0400 Received: from mail-by2nam01on0083.outbound.protection.outlook.com ([104.47.34.83]:27264 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751141AbdI3VRu (ORCPT ); Sat, 30 Sep 2017 17:17:50 -0400 Cc: brijesh.singh@amd.com, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , kvm@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option To: Borislav Petkov , Tom Lendacky References: <20170928090242.ber7gynwaldinafa@pd.tnic> <20170929230652.37821-1-brijesh.singh@amd.com> <20170930115604.w4g3oplmyo5oyjeq@pd.tnic> From: Brijesh Singh Message-ID: <26bdd83f-f4a0-dbfc-e6f9-fc3780ce0080@amd.com> Date: Sat, 30 Sep 2017 16:17:39 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20170930115604.w4g3oplmyo5oyjeq@pd.tnic> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: BN6PR1001CA0001.namprd10.prod.outlook.com (10.174.84.14) To SN1PR12MB0160.namprd12.prod.outlook.com (10.162.3.147) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 53405c2b-0047-4e4e-20bb-08d50848b198 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:SN1PR12MB0160; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;3:5N+47w2NEm2fr94rhmBAhj23+tcLt2SzIwwaKzPC14PNDlhIgTYKFIhzgUwBCnte7eMqLgej7Ztl0sVh/LfHTY6liiPze+1flzgHnmhbBchRYw+VlBc1hHRLibYDS6o2bgv+FTWqTj/RZdvgcOhto+7Vb1gMY0cxPIfY1FGi9nldffJJjOq7GS3PUamrr10r7h7uhuMKhcKt2SHO0/Q9u7N3kQdA0kgOWhrbuO/RMN1wnqjsOolO7NvoVEI7TOXG;25:c6iqFkv55B21RVg2YmO2Vpht1mn8lIdq/UGULjF1sk6uazPNyPuKlMCUBk+DFXMmUKagm3OisUN4jsUr1XRJkGcOklpEGn1H/V+DPZwi8B2K7Dc3FKYawDgxxTFYSzOzKA2NGmezHrOsyPcSm3l5rbrXAJzMgSlPmO6QOAKO1aiZWgi0ytFIA5HAv8IRtWh1VAdlXjdoyN6H1y8BkKjG6XBYSozpMcdL85KBrOd5vr6G86k+rCIsvvlkcv2ABwZ7zt3ZaN8lPqn3/i+xD735P/e6S+67R4pORtMPOeamCpJiWWcIjj788WXotXrVbRLzFoahL/4RJ/wqZ0cAumf6ww==;31:76z+DdcbKh9QOP9mvpQXSEM6emIO/HlrcVBRIxW25Empcii7moR0/peJhbjP0rXMfCCIrs4jeyzgdABYBBS4uhxm4P7Zv2mmojlx3Kd5FHvgIFSAqewg28UZODAh9kcYl2lSU90VPV1HOiD1P6kMYMXwtAxIZ/5UZ8oe3PnO56ysZKwMnGnq3iNQPKCScyQ/bnL4nvZ8wmMiRFLQ3ouT1hrAEPlvMcXwvqBnJJl95Dw= X-MS-TrafficTypeDiagnostic: SN1PR12MB0160: Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:DE/50AmwI0swnlSIq8Adzc5vayCscZI3tyUFpcYHBsDGP6u1GjI7PVzmy/eihZQkq8YOM16UpNjSGh3C5lg4FywKKsk+0n5gwPJMs1J5rFTvB92Vdu9lhF9RXuTJsgxdQe4z9AJ+8sOcdBOU3zHMkOotAi8k2fNOalHYlU2flm2I7QuV/TBLH7NvYMDshfolziEPoyPmKum4EF59VzjbAkSWvCZpFiwKThrd2O1uPM5f3NT2pvXhEU5tASUpzPmwB5I3FniKWY6wkuhI8S+8rDyEuYxILcGLEk/9+btGrH7tGxURsYa7ftaViP0zTJvqtamXlGr98C03eA99pomEiUphsk0GT5BnauhPj5HD6ulhpWLdg0f5fyGO5OzKO8WgyGKB1Jm1A2nhdQSoQu2yGK48G4cBvPqo0+OKfLeq6hwUuPP8BD4k48anXEQO8Kywl8bjmDFdHMZkXza+vJGA1IYkUB4RMGOD6LrK6wCM4VDdfsncpPnLVStxGvoiCHM+;4:7MB2zEr6Pw02tShOlkww21tjKflXeY3AtQ/33VCWeqVXZ6m2iGgBKmCAxEbfxgRvUz6PJ+dR+Ix+kvB1v63oVOmL+FFdEJqSJ48gOdqoEIzKEr8H/4BsGYEpY99btt8MvG/V5wXlQDdaCXLAohtmUVtkon0RbEr2Cu0IuWiE4f84s8FGaYNIV4/CaIObnCnDDGaDtsxksYObEvLCaNFTclBrG25Egw0PU6E7s0CpZgImo/G5Z33RUReNfSnTcAeTAavkT/dihjAaK9rau5VE/ElpdBvnFOvhE5qLP8ctei/5D2ASu10qKe06NNak4GQvRGQGqOctD2wLWbaoSGNoNLhQJWt0K9ta/BLXFxdbzMQ= X-Exchange-Antispam-Report-Test: UriScan:(166708455590820)(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(6055026)(6041248)(20161123560025)(20161123562025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0160;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0160; X-Forefront-PRVS: 0446F0FCE1 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(376002)(346002)(39860400002)(189002)(199003)(24454002)(377454003)(81156014)(6486002)(23676002)(53416004)(230700001)(36756003)(4326008)(65826007)(6246003)(53936002)(68736007)(305945005)(478600001)(966005)(6116002)(101416001)(8676002)(31686004)(97736004)(33646002)(54356999)(3846002)(5660300001)(53546010)(65956001)(76176999)(54906003)(47776003)(106356001)(110136005)(58126008)(8936002)(189998001)(50986999)(229853002)(50466002)(65806001)(64126003)(66066001)(83506001)(6306002)(81166006)(105586002)(86362001)(2906002)(6666003)(7736002)(31696002)(2950100002)(6636002)(16526017)(25786009)(316002);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0160;H:wsp101544wss.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTYwOzIzOnZNZkxKNGRXUVBpMTlmSFMyOUt5VlVmYmdj?= =?utf-8?B?N1o5TnFiekUwMmc0V0JGeEFzN0VNdEd4bEJyVHptbHFUQTRkcUdvTFBsVlUx?= =?utf-8?B?VkRqanphMTd0c2grL1J4NmMvemVDUy9qaTV5ZXNDYzdTb3FLQ1dScWxkMnMy?= =?utf-8?B?VktTR0srbzlMSzY2OW52NlpSYnBtOFN3MHhpTThaNzdQT0txbXdzaVlUUzJl?= =?utf-8?B?ek9uVGpYY1kwZWhPMWJLalZtTjAxd2VTUjM4L3J3d0lPNWc1b2QzT29PRHVK?= =?utf-8?B?NE0rMXBHaVpnMzJpdFhqenFURGd2czZjQ0FGcnFWN3RNQ3RlM3NEZFNWZ0ZJ?= =?utf-8?B?M3Q0Nm9LZm0wZ296RS9vUFJINzdibG1jV3NOeTkyRnNVMEVHcVJzWDlEWGNn?= =?utf-8?B?Y2V0QlJNc0M2ZnM3aU9uNmJ1RTVna3JVbktOb3RVN3pvWDFKbzNSL1VGeWdp?= =?utf-8?B?SllUaVJ0bnYvVTlpSFhHamJwNkRvY2hOWVFuNyt0UUdyWWdvWjVWdnFLUGY4?= =?utf-8?B?WVdYZlpZd2dubWNoOFlWcEZ4YUNVc3BZSFZoTGx0eTUwaE03RHhkM3ZnWUJF?= =?utf-8?B?b2h2K2hLL2t1U0dPZk9tYm9TeVJPODVreEpWQXh4WEF1QnlzWXhSc21IRUNm?= =?utf-8?B?NFJvQzJEZ3lZS1J3bUM1YURuaXpIWS9nYU43ZlV2cTUvTnFGUkxBemt4QzJr?= =?utf-8?B?R1FaZVZqdFMrOE1iVElLSlpTejZoNUNNZ0RCQVp1UmlGUnh1V2RIWG5rRURz?= =?utf-8?B?ZFBJb1Y2azE5V0hveGI5Um1LOU5JSzJSeDZCdzdJZThJZmRRaG8ySGFmV0RN?= =?utf-8?B?V0EyNkhXaUErcVMyZ1hjcnQxdndCVWNxWEx6RUhLRFRsTE41TnZrbjd1R2V1?= =?utf-8?B?YlMrTE02b3lYdHg1RzlNcDg4Ni9tNG9zTkQzWHpYdEN2VXFpT3VGb3JJbkV5?= =?utf-8?B?UzlSVDlRSmNScEorNFdrNDcvdCtnamtjUGFkZlREeHpleVJ6SFpYeFh3Q2F6?= =?utf-8?B?WDE0OFVWS0IxeWJCRkZxRWxTZy9KMVMxcm9xaHFWdVIvUXdRSStCTE1JS0Vs?= =?utf-8?B?T1l1cU9VaU4wM0lHbzZjNGJrUnd5VmM1R0xmelpJeTlYWVFaRnhnYmY0OGhJ?= =?utf-8?B?bGZqTlR2UWlCOUtuazBMQTA1THlES0djZWUrT0hTMDN3Y2tOSTlHVFJPenZF?= =?utf-8?B?ZUJTd21VZDM5U2F0enV3bEQvTFlFY0VlWXRJY3lKMHB3MDBtL0h1VTVoZFZi?= =?utf-8?B?ZGk4dFVGTDRBWElvcDJGMnhXOWFQcTZUN3JIczhjdkFHYnpMTEdaWWJTdFV2?= =?utf-8?B?QnZ3b0F5MTB5bkNOR2FpeUIrdHN4cXRkN2Rvc2ZweDNmY1p5NXBZRXJrOTcx?= =?utf-8?B?S2QxTncvcExheHFCYnJBbWhmYmF0UjE4QnRLbWxqcXh2eFB5cDdzRXE1Y1d1?= =?utf-8?B?cDNESFhONXNCd2lpMVVXaEVIdmNEdUNWZU5vRlV3ZlpyTFEyemJ1K1paWk4x?= =?utf-8?B?LzFHVWd3YWlBWS9Oc3VHemZIQ25qcnZEUk1iOGkvWkN5L3Uwc1BqNkRVVFFk?= =?utf-8?B?S054Z1lubkdBY1loQ2tGanJTN2xUNUFWdmJ0dDNUOWphVlgxWG51MStXRG5I?= =?utf-8?B?NE1oWlh5dHBDZmsxV2dhZ2xpOHhQOUpuWHVQZDV2TkQzb1BEYlRqR2JzQWhT?= =?utf-8?B?OVVaOEM3WHhYKzhNcisxQ2hTME1TaXhSUDlQM0xTTlBZbVByeTdKK3EraDk5?= =?utf-8?B?eFlITzhWZUpOVWJEWDlTS25oVzR0RTZwUUpoakNzbFFsT1FNMzhkbklBSVJY?= =?utf-8?B?cVpnMjI2U3YvU1FmdTgrTXhndVZCZDd2cVpLYlRiWjljWWxGRkF6UEN6Rkx5?= =?utf-8?Q?Lv/8+SwkAW0urAcUeqciVtgsS/jpfmUR?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;6:65caZcQjWoFL3kmR/WHbhq9mWNpdCHVZX4Wi5fgg3390zQXyYLlCPKi5RyVkwAlXzS+mJQ8Z8wr5uLfLmUDH2gXkblvDsr4AjOylmHU9l/6NtqwQ0kvA6AVZUbst0HPVajo0RUysg4w/Iu2Uwe2UI+qEc6SsGkNSVN6z+4fIX0bU2q9I44hWvyU5McpqSXOEXa9eiT7s8otOuBb5y/uV9SnHiAweHPF2bMK3mliTFi1ovsc1KMGS/HgUlBE0Bb67aLjwoB1BczFEiL7WDqxRoEwoEo4s8J5RrQS9maXD2Mtjl39dqx/g4C2gbAKn08st4ZopnI4eAXCAO26VK1CbDw==;5:ELZcjlzNT5a2u2RaU0MJWKgtMsTo8QQItlupfTBqCwcRXl1rG5BDx5bqDhVg4a7Qtr62/YykXgyyDe0aUpDQ1aAgDCAdspO4LYJr923m9UWewwmd7XRbBrc6H56uLLDVRCyEX3T5psOzlsht7B14vA==;24:NTwRSeKldme98x+rUHVPWzmIcJOeSm5sV1cnEkpbrEyCwk06DRB/dGJlRyL+LtE4p7/GKbn6jjtPrQzWsFS6bkYvOUdFktEirBzp56ix/1k=;7:8HlzElGMLeBJ9Hl90bjYWUwThK+hB0trKnjF9ZaIUsC46XPbr/g1Zldz6bnFPruTNbd4REm+Jz8GRWWPB48OYViE7GV0JHuGZfdJdci8nexbpL5UdLFE5JkhoYubCJ1pwYEHVGwP8uXGnoXLTYOfQujidsD0V//zIrDU6NLC96JVB/8RxPlsThW6oKkCQWTVbY4LvUX6OMrWCQp9RCZVOnGjk5p3cGL5Dpuiq/oim1o= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:V/Xt3M1Bf4oB9qpPc8Ji2MEsmZA5QLEFR+e56MGdtGf+Lyd+I4lojxJs1EBzm0DqE+9v+Ha6bBuA7wBxMlHZXK/RO914EO5+tJ9ozOkJHVAfBWb57aYvjB9s7sHuSzS2J9TjdsrLC0xHRMfzjo8V/rlaJuArMbsjAlItpmRSqWCJdA+N29VhWkADapgr8j10Yu3mWzBHvW/VzzEPsiXiS+MEI3MH++pKvKSYjwfRdPadFEjVS6JtDeXbyt5qtsa6 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2017 21:17:43.5185 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0160 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 9/30/17 6:56 AM, Borislav Petkov wrote: ... > Ok, I went and simplified this whole code path a bit because it was > needlessly a bit too complex. Below is the result, only compile-tested. > > Brijesh, Tom, guys, please check my logic, I might've missed a case. I will take a closure look at this patch on Monday but at a glance I am not sure if patch is addressing our main issue. We were trying to limit the SEV feature exposure from the host OS. The current logic is: 1. Check whether the SME CPUID leaf is present 2. Check if we are running under hypervisor 3. If we are running under hypervisor, check SME_ENABLED bit in MSR_AMD64_SEV 3.1 If bit is cleared, its non SEV guest. Return from the function. 3.2 If bit is set, its SEV guest. We set sev_enabled to 'true' and also set 'sme_me_mask'. Return from the function. The SEV state *cannot* be controlled by a command line option. 4. We are booted on bare-metal. Check if memory encryption is enabled. if enabled, look at any potential command line. Please see the sme_enable() from mem_encrypt.c [1]. https://github.com/codomania/tip/blob/sev-v5-p1/arch/x86/mm/mem_encrypt.c Thanks Brijesh > Thanks. > > --- > From: Borislav Petkov > Date: Sat, 30 Sep 2017 13:33:26 +0200 > Subject: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option > > Extend the mem_encrypt= cmdline option with the "sme" argument so that > one can enable SME only (i.e., this serves as a SEV chicken bit). While > at it, streamline and document the flow logic here: > > 1. Check whether the SME CPUID leaf is present > > 2. Check whether the HW has enabled SME/SEV > > 3. Only *then* look at any potential command line params because doing > so before is pointless. > > 3.1 mem_encrypt=on - enable both SME/SEV > 3.2 mem_encrypt=sme - enable only SME > 3.3 mem_encrypt=off - disable both > > In addition, CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT enables both if > the kernel is built with it enabled. > > While at it, shorten variable names, simplify code flow. > > This is based on a patch by Brijesh Singh . > > Signed-off-by: Borislav Petkov > Cc: Brijesh Singh > Cc: Tom Lendacky > Cc: kvm@vger.kernel.org > Cc: x86@kernel.org > --- > arch/x86/include/asm/mem_encrypt.h | 2 + > arch/x86/kernel/cpu/amd.c | 6 +++ > arch/x86/mm/mem_encrypt.c | 82 +++++++++++++++++++------------------- > 3 files changed, 49 insertions(+), 41 deletions(-) > > diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h > index 3ba68c92be1b..175310f00202 100644 > --- a/arch/x86/include/asm/mem_encrypt.h > +++ b/arch/x86/include/asm/mem_encrypt.h > @@ -19,6 +19,8 @@ > > #include > > +extern bool sev_enabled; > + > #ifdef CONFIG_AMD_MEM_ENCRYPT > > extern u64 sme_me_mask; > diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c > index c1234aa0550c..d0669f3966a6 100644 > --- a/arch/x86/kernel/cpu/amd.c > +++ b/arch/x86/kernel/cpu/amd.c > @@ -13,6 +13,7 @@ > #include > #include > #include > +#include > > #ifdef CONFIG_X86_64 > # include > @@ -32,6 +33,8 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum); > */ > static u32 nodes_per_socket = 1; > > +bool sev_enabled __section(.data) = false; > + > static inline int rdmsrl_amd_safe(unsigned msr, unsigned long long *p) > { > u32 gprs[8] = { 0 }; > @@ -588,6 +591,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c) > if (IS_ENABLED(CONFIG_X86_32)) > goto clear_all; > > + if (!sev_enabled) > + goto clear_sev; > + > rdmsrl(MSR_K7_HWCR, msr); > if (!(msr & MSR_K7_HWCR_SMMLOCK)) > goto clear_sev; > diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c > index 057417a3d9b4..9b83bc1be7c0 100644 > --- a/arch/x86/mm/mem_encrypt.c > +++ b/arch/x86/mm/mem_encrypt.c > @@ -27,12 +27,14 @@ > #include > #include > #include > +#include > > #include "mm_internal.h" > > -static char sme_cmdline_arg[] __initdata = "mem_encrypt"; > -static char sme_cmdline_on[] __initdata = "on"; > -static char sme_cmdline_off[] __initdata = "off"; > +static char sme_cmd[] __initdata = "mem_encrypt"; > +static char sme_cmd_on[] __initdata = "on"; > +static char sme_cmd_off[] __initdata = "off"; > +static char sme_cmd_sme[] __initdata = "sme"; > > /* > * Since SME related variables are set early in the boot process they must > @@ -44,8 +46,6 @@ EXPORT_SYMBOL_GPL(sme_me_mask); > DEFINE_STATIC_KEY_FALSE(__sev); > EXPORT_SYMBOL_GPL(__sev); > > -static bool sev_enabled __section(.data) = false; > - > /* Buffer used for early in-place encryption by BSP, no locking needed */ > static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE); > > @@ -768,13 +768,13 @@ void __init sme_encrypt_kernel(void) > > void __init __nostackprotector sme_enable(struct boot_params *bp) > { > - const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off; > + const char *cmdline_ptr, *cmd, *cmd_on, *cmd_off, *cmd_sme; > unsigned int eax, ebx, ecx, edx; > unsigned long feature_mask; > - bool active_by_default; > - unsigned long me_mask; > + u64 me_mask, msr; > char buffer[16]; > - u64 msr; > + bool sme_only; > + int ret; > > /* Check for the SME/SEV support leaf */ > eax = 0x80000000; > @@ -808,55 +808,55 @@ void __init __nostackprotector sme_enable(struct boot_params *bp) > if (!(eax & feature_mask)) > return; > > - me_mask = 1UL << (ebx & 0x3f); > - > - /* Check if memory encryption is enabled */ > + /* For SME, check the SYSCFG MSR */ > if (feature_mask == AMD_SME_BIT) { > - /* For SME, check the SYSCFG MSR */ > msr = __rdmsr(MSR_K8_SYSCFG); > if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) > return; > - } else { > - /* For SEV, check the SEV MSR */ > + } > + > + /* For SEV, check the SEV MSR */ > + if (feature_mask == AMD_SEV_BIT) { > msr = __rdmsr(MSR_AMD64_SEV); > if (!(msr & MSR_AMD64_SEV_ENABLED)) > return; > - > - /* SEV state cannot be controlled by a command line option */ > - sme_me_mask = me_mask; > - sev_enabled = true; > - return; > } > > + me_mask = BIT_ULL(ebx & 0x3f); > + > /* > * Fixups have not been applied to phys_base yet and we're running > * identity mapped, so we must obtain the address to the SME command > * line argument data using rip-relative addressing. > */ > - asm ("lea sme_cmdline_arg(%%rip), %0" > - : "=r" (cmdline_arg) > - : "p" (sme_cmdline_arg)); > - asm ("lea sme_cmdline_on(%%rip), %0" > - : "=r" (cmdline_on) > - : "p" (sme_cmdline_on)); > - asm ("lea sme_cmdline_off(%%rip), %0" > - : "=r" (cmdline_off) > - : "p" (sme_cmdline_off)); > - > - if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT)) > - active_by_default = true; > - else > - active_by_default = false; > + asm ("lea sme_cmd(%%rip), %0" : "=r" (cmd) : "p" (sme_cmd)); > + asm ("lea sme_cmd_on(%%rip), %0" : "=r" (cmd_on) : "p" (sme_cmd_on)); > + asm ("lea sme_cmd_off(%%rip), %0" : "=r" (cmd_off) : "p" (sme_cmd_off)); > + asm ("lea sme_cmd_sme(%%rip), %0" : "=r" (cmd_sme) : "p" (sme_cmd_sme)); > > cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr | > - ((u64)bp->ext_cmd_line_ptr << 32)); > + ((u64)bp->ext_cmd_line_ptr << 32)); > > - cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer)); > + ret = cmdline_find_option(cmdline_ptr, cmd, buffer, sizeof(buffer)); > + if (ret < 0) > + return; > > - if (!strncmp(buffer, cmdline_on, sizeof(buffer))) > - sme_me_mask = me_mask; > - else if (!strncmp(buffer, cmdline_off, sizeof(buffer))) > + if (!strncmp(buffer, cmd_off, sizeof(buffer))) { > sme_me_mask = 0; > - else > - sme_me_mask = active_by_default ? me_mask : 0; > + return; > + } else if (!strncmp(buffer, cmd_on, sizeof(buffer))) { > + sme_me_mask = me_mask; > + } else if (!strncmp(buffer, cmd_sme, sizeof(buffer))) { > + sme_only = true; > + } > + > + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT)) > + sme_me_mask = me_mask; > + > + if (sme_only) > + return; > + > + /* For SEV, check the SEV MSR */ > + if (feature_mask == AMD_SEV_BIT) > + sev_enabled = true; > }