LKML Archive on
help / color / mirror / Atom feed
From: "tip-bot2 for Borislav Petkov" <>
Cc: Paul Menzel <>, Borislav Petkov <>,
	Alex Deucher <>,
	Tom Lendacky <>, <>,,
Subject: [tip: x86/urgent] x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
Date: Mon, 11 Oct 2021 17:18:04 -0000	[thread overview]
Message-ID: <163397268455.25758.9385335529425752157.tip-bot2@tip-bot2> (raw)
In-Reply-To: <>

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     711885906b5c2df90746a51f4cd674f1ab9fbb1d
Author:        Borislav Petkov <>
AuthorDate:    Wed, 06 Oct 2021 19:34:55 +02:00
Committer:     Borislav Petkov <>
CommitterDate: Mon, 11 Oct 2021 19:14:22 +02:00

x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically

This Kconfig option was added initially so that memory encryption is
enabled by default on machines which support it.

However, devices which have DMA masks that are less than the bit
position of the encryption bit, aka C-bit, require the use of an IOMMU
or the use of SWIOTLB.

If the IOMMU is disabled or in passthrough mode, the kernel would switch
to SWIOTLB bounce-buffering for those transfers.

In order to avoid that,

  2cc13bb4f59f ("iommu: Disable passthrough mode when SME is active")

disables the default IOMMU passthrough mode so that devices for which the
default 256K DMA is insufficient, can use the IOMMU instead.

However 2, there are cases where the IOMMU is disabled in the BIOS, etc.
(think the usual hardware folk "oops, I dropped the ball there" cases) or a
driver doesn't properly use the DMA APIs or a device has a firmware or
hardware bug, e.g.:

  ea68573d408f ("drm/amdgpu: Fail to load on RAVEN if SME is active")

However 3, in the above GPU use case, there are APIs like Vulkan and
some OpenGL/OpenCL extensions which are under the assumption that
user-allocated memory can be passed in to the kernel driver and both the
GPU and CPU can do coherent and concurrent access to the same memory.
That cannot work with SWIOTLB bounce buffers, of course.

So, in order for those devices to function, drop the "default y" for the
SME by default active option so that users who want to have SME enabled,
will need to either enable it in their config or use "mem_encrypt=on" on
the kernel command line.

 [ tlendacky: Generalize commit message. ]

Fixes: 7744ccdbc16f ("x86/mm: Add Secure Memory Encryption (SME) support")
Reported-by: Paul Menzel <>
Signed-off-by: Borislav Petkov <>
Acked-by: Alex Deucher <>
Acked-by: Tom Lendacky <>
Cc: <>
 arch/x86/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index bd70e8a..d9830e7 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1525,7 +1525,6 @@ config AMD_MEM_ENCRYPT
 	bool "Activate AMD Secure Memory Encryption (SME) by default"
-	default y
 	depends on AMD_MEM_ENCRYPT
 	  Say yes to have system memory encrypted by default if running on

      parent reply	other threads:[~2021-10-11 17:18 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-05 14:29 `AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y` causes AMDGPU to fail on Ryzen: amdgpu: SME is not compatible with RAVEN Paul Menzel
2021-10-05 14:38 ` Borislav Petkov
2021-10-06  6:27   ` Paul Menzel
2021-10-05 14:48 ` Alex Deucher
2021-10-06  9:42   ` Borislav Petkov
2021-10-06 13:23     ` Alex Deucher
2021-10-06 13:46       ` Borislav Petkov
2021-10-06 14:01       ` Tom Lendacky
2021-10-06 17:48         ` Borislav Petkov
2021-10-06 18:10           ` Alex Deucher
2021-10-06 18:21             ` Alex Deucher
2021-10-06 19:32               ` Borislav Petkov
2021-10-07  6:14                 ` Christian König
2021-10-06 18:21             ` Borislav Petkov
2021-10-06 18:36               ` Alex Deucher
2021-10-06 19:34                 ` Borislav Petkov
2021-10-06 21:39                 ` Tom Lendacky
2021-10-11 13:05           ` Paul Menzel
2021-10-11 13:11             ` Borislav Petkov
2021-10-11 13:27               ` Tom Lendacky
2021-10-11 13:52                 ` Paul Menzel
2021-10-11 13:58                   ` Tom Lendacky
2021-10-11 14:21                     ` Paul Menzel
2021-10-11 14:28                       ` Tom Lendacky
2021-10-11 14:32                       ` Alex Deucher
2021-10-11 16:03                         ` [PATCH -v2] x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically Borislav Petkov
2021-10-11 16:05                           ` Alex Deucher
2021-10-11 16:29                           ` Tom Lendacky
2021-10-11 17:18 ` tip-bot2 for Borislav Petkov [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=163397268455.25758.9385335529425752157.tip-bot2@tip-bot2 \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).