* [PATCH v4] x86/cpu: clear SME feature flag when not in use
@ 2022-02-16 3:44 Mario Limonciello
2022-02-16 10:33 ` Borislav Petkov
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Mario Limonciello @ 2022-02-16 3:44 UTC (permalink / raw)
To: Borislav Petkov, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)
Cc: Kees Cook, Thomas Lendacky, hughsient, Martin Fernandez,
linux-kernel, Brijesh Singh, Mario Limonciello
Currently the SME CPU feature flag is reflective of whether the CPU
supports the feature but not whether is has been activated by the
kernel.
Change this around to clear the SME feature flag if the kernel is not
using it so userspace can determine if it is available and in use
from `/proc/cpuinfo`.
As the feature flag is cleared on systems where SME isn't active use
CPUID 0x8000001f to confirm SME availability before calling
`native_wbinvd`.
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
Changes from v3->v4:
* Update block comment to explain SME can get turned off
* Reword commit message
arch/x86/kernel/cpu/amd.c | 5 +++++
arch/x86/kernel/process.c | 5 ++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 4edb6f0f628c..dcfbb25b119a 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -585,6 +585,8 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
* the SME physical address space reduction value.
* If BIOS has not enabled SME then don't advertise the
* SME feature (set in scattered.c).
+ * If the kernel has not enabled SME via any means then
+ * don't advertise the SME feature.
* For SEV: If BIOS has not enabled SEV then don't advertise the
* SEV and SEV_ES feature (set in scattered.c).
*
@@ -607,6 +609,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
if (IS_ENABLED(CONFIG_X86_32))
goto clear_all;
+ if (!sme_me_mask)
+ setup_clear_cpu_cap(X86_FEATURE_SME);
+
rdmsrl(MSR_K7_HWCR, msr);
if (!(msr & MSR_K7_HWCR_SMMLOCK))
goto clear_sev;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 81d8ef036637..e131d71b3cae 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -765,8 +765,11 @@ void stop_this_cpu(void *dummy)
* without the encryption bit, they don't race each other when flushed
* and potentially end up with the wrong entry being committed to
* memory.
+ *
+ * Test the CPUID bit directly because the machine might've cleared
+ * X86_FEATURE_SME due to cmdline options.
*/
- if (boot_cpu_has(X86_FEATURE_SME))
+ if (cpuid_eax(0x8000001f) & BIT(0))
native_wbinvd();
for (;;) {
/*
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v4] x86/cpu: clear SME feature flag when not in use
2022-02-16 3:44 [PATCH v4] x86/cpu: clear SME feature flag when not in use Mario Limonciello
@ 2022-02-16 10:33 ` Borislav Petkov
2022-02-16 13:41 ` Limonciello, Mario
2022-02-16 15:05 ` Tom Lendacky
2022-02-16 20:16 ` [tip: x86/cpu] x86/cpu: Clear " tip-bot2 for Mario Limonciello
2 siblings, 1 reply; 5+ messages in thread
From: Borislav Petkov @ 2022-02-16 10:33 UTC (permalink / raw)
To: Mario Limonciello
Cc: maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT),
Kees Cook, Thomas Lendacky, hughsient, Martin Fernandez,
linux-kernel, Brijesh Singh
On Tue, Feb 15, 2022 at 09:44:46PM -0600, Mario Limonciello wrote:
> @@ -607,6 +609,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
> if (IS_ENABLED(CONFIG_X86_32))
> goto clear_all;
>
> + if (!sme_me_mask)
> + setup_clear_cpu_cap(X86_FEATURE_SME);
Why not "goto clear_all;" ?
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v4] x86/cpu: clear SME feature flag when not in use
2022-02-16 10:33 ` Borislav Petkov
@ 2022-02-16 13:41 ` Limonciello, Mario
0 siblings, 0 replies; 5+ messages in thread
From: Limonciello, Mario @ 2022-02-16 13:41 UTC (permalink / raw)
To: Borislav Petkov
Cc: maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT),
Kees Cook, Thomas Lendacky, hughsient, Martin Fernandez,
linux-kernel, Brijesh Singh
On 2/16/2022 04:33, Borislav Petkov wrote:
> On Tue, Feb 15, 2022 at 09:44:46PM -0600, Mario Limonciello wrote:
>> @@ -607,6 +609,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
>> if (IS_ENABLED(CONFIG_X86_32))
>> goto clear_all;
>>
>> + if (!sme_me_mask)
>> + setup_clear_cpu_cap(X86_FEATURE_SME);
>
> Why not "goto clear_all;" ?
>
"clear_all" clears SEV and SEV_ES as well which as pointed out in v2 is
incorrect.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v4] x86/cpu: clear SME feature flag when not in use
2022-02-16 3:44 [PATCH v4] x86/cpu: clear SME feature flag when not in use Mario Limonciello
2022-02-16 10:33 ` Borislav Petkov
@ 2022-02-16 15:05 ` Tom Lendacky
2022-02-16 20:16 ` [tip: x86/cpu] x86/cpu: Clear " tip-bot2 for Mario Limonciello
2 siblings, 0 replies; 5+ messages in thread
From: Tom Lendacky @ 2022-02-16 15:05 UTC (permalink / raw)
To: Mario Limonciello, Borislav Petkov,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)
Cc: Kees Cook, hughsient, Martin Fernandez, linux-kernel, Brijesh Singh
On 2/15/22 21:44, Mario Limonciello wrote:
> Currently the SME CPU feature flag is reflective of whether the CPU
> supports the feature but not whether is has been activated by the
> kernel.
>
> Change this around to clear the SME feature flag if the kernel is not
> using it so userspace can determine if it is available and in use
> from `/proc/cpuinfo`.
>
> As the feature flag is cleared on systems where SME isn't active use
> CPUID 0x8000001f to confirm SME availability before calling
> `native_wbinvd`.
>
> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
> ---
^ permalink raw reply [flat|nested] 5+ messages in thread
* [tip: x86/cpu] x86/cpu: Clear SME feature flag when not in use
2022-02-16 3:44 [PATCH v4] x86/cpu: clear SME feature flag when not in use Mario Limonciello
2022-02-16 10:33 ` Borislav Petkov
2022-02-16 15:05 ` Tom Lendacky
@ 2022-02-16 20:16 ` tip-bot2 for Mario Limonciello
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot2 for Mario Limonciello @ 2022-02-16 20:16 UTC (permalink / raw)
To: linux-tip-commits
Cc: Mario Limonciello, Borislav Petkov, Tom Lendacky, x86, linux-kernel
The following commit has been merged into the x86/cpu branch of tip:
Commit-ID: 08f253ec3767bcfafc5d32617a92cee57c63968e
Gitweb: https://git.kernel.org/tip/08f253ec3767bcfafc5d32617a92cee57c63968e
Author: Mario Limonciello <mario.limonciello@amd.com>
AuthorDate: Tue, 15 Feb 2022 21:44:46 -06:00
Committer: Borislav Petkov <bp@suse.de>
CommitterDate: Wed, 16 Feb 2022 19:45:53 +01:00
x86/cpu: Clear SME feature flag when not in use
Currently, the SME CPU feature flag is reflective of whether the CPU
supports the feature but not whether it has been activated by the
kernel.
Change this around to clear the SME feature flag if the kernel is not
using it so userspace can determine if it is available and in use
from /proc/cpuinfo.
As the feature flag is cleared on systems where SME isn't active, use
CPUID 0x8000001f to confirm SME availability before calling
native_wbinvd().
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20220216034446.2430634-1-mario.limonciello@amd.com
---
arch/x86/kernel/cpu/amd.c | 5 +++++
arch/x86/kernel/process.c | 5 ++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index bad0fa4..0c0b097 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -556,6 +556,8 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
* the SME physical address space reduction value.
* If BIOS has not enabled SME then don't advertise the
* SME feature (set in scattered.c).
+ * If the kernel has not enabled SME via any means then
+ * don't advertise the SME feature.
* For SEV: If BIOS has not enabled SEV then don't advertise the
* SEV and SEV_ES feature (set in scattered.c).
*
@@ -578,6 +580,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
if (IS_ENABLED(CONFIG_X86_32))
goto clear_all;
+ if (!sme_me_mask)
+ setup_clear_cpu_cap(X86_FEATURE_SME);
+
rdmsrl(MSR_K7_HWCR, msr);
if (!(msr & MSR_K7_HWCR_SMMLOCK))
goto clear_sev;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 81d8ef0..e131d71 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -765,8 +765,11 @@ void stop_this_cpu(void *dummy)
* without the encryption bit, they don't race each other when flushed
* and potentially end up with the wrong entry being committed to
* memory.
+ *
+ * Test the CPUID bit directly because the machine might've cleared
+ * X86_FEATURE_SME due to cmdline options.
*/
- if (boot_cpu_has(X86_FEATURE_SME))
+ if (cpuid_eax(0x8000001f) & BIT(0))
native_wbinvd();
for (;;) {
/*
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-02-16 20:17 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-16 3:44 [PATCH v4] x86/cpu: clear SME feature flag when not in use Mario Limonciello
2022-02-16 10:33 ` Borislav Petkov
2022-02-16 13:41 ` Limonciello, Mario
2022-02-16 15:05 ` Tom Lendacky
2022-02-16 20:16 ` [tip: x86/cpu] x86/cpu: Clear " tip-bot2 for Mario Limonciello
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).