RE: [PATCH v8 0/8] x86: Show in sysfs if a memory node is able to do encryption

[Limonciello, Mario]

[Public]



> -----Original Message-----
> From: Borislav Petkov <bp@xxxxxxxxx>
> Sent: Friday, May 6, 2022 07:44
> To: Martin Fernandez <martin.fernandez@xxxxxxxxxxxxx>
> Cc: linux-kernel@xxxxxxxxxxxxxxx; linux-efi@xxxxxxxxxxxxxxx; platform-
> driver-x86@xxxxxxxxxxxxxxx; linux-mm@xxxxxxxxx; tglx@xxxxxxxxxxxxx;
> mingo@xxxxxxxxxx; dave.hansen@xxxxxxxxxxxxxxx; x86@xxxxxxxxxx;
> hpa@xxxxxxxxx; ardb@xxxxxxxxxx; dvhart@xxxxxxxxxxxxx;
> andy@xxxxxxxxxxxxx; gregkh@xxxxxxxxxxxxxxxxxxx; rafael@xxxxxxxxxx;
> rppt@xxxxxxxxxx; akpm@xxxxxxxxxxxxxxxxxxxx;
> daniel.gutson@xxxxxxxxxxxxx; hughsient@xxxxxxxxx;
> alex.bazhaniuk@xxxxxxxxxxxxx; alison.schofield@xxxxxxxxx;
> keescook@xxxxxxxxxxxx
> Subject: Re: [PATCH v8 0/8] x86: Show in sysfs if a memory node is able to do
> encryption
> 
> On Wed, May 04, 2022 at 02:18:30PM -0300, Martin Fernandez wrote:
> > The use case is to know if a user is using hardware encryption or
> > not. This new sysfs file plus knowing if tme/sev is active you can be
> > pretty sure about that.
> 
> Then please explain it in detail and in the text so that it is clear. As
> it is now, the reader is left wondering what that file is supposed to
> state.
> 
> > Dave Hansen pointed those out in a previuos patch serie, here is the
> > quote:
> >
> > > CXL devices will have normal RAM on them, be exposed as "System
> RAM" and
> > > they won't have encryption capabilities.  I think these devices were
> > > probably the main motivation for EFI_MEMORY_CPU_CRYPTO.
> 
> So this would mean that if a system doesn't have CXL devices and has
> TME/SME/SEV-* enabled, then it is running with encrypted memory.
> 
> Which would then also mean, you don't need any of that code - you only
> need to enumerate CXL devices which, it seems, do not support memory
> encryption, and then state that memory encryption is enabled on the
> whole system, except for the memory of those devices.
> 
> I.e.,
> 
> $ dmesg | grep -i SME
> [    1.783650] AMD Memory Encryption Features active: SME
> 
> Done - memory is encrypted on the whole system.
> 
> We could export it into /proc/cpuinfo so that you don't have to grep
> dmesg and problem solved.
> 

Actually we solved that already for SME.  Kernel only exposes the feature
in /proc/cpuinfo if it's active now.
See kernel commit 08f253ec3767bcfafc5d32617a92cee57c63968e.

Fwupd code has been changed to match it too.  It will only trust the presence of
sme flag with kernel 5.18.0 and newer.

https://github.com/fwupd/fwupd/commit/53a49b4ac1815572f242f85a1a1cc52a2d7ed50c