x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT

commit 29956748339aa8757a7e2f927a8679dd08f24bb6 upstream.

It was meant well at the time but nothing's using it so get rid of it.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20240202163510.GDZb0Zvj8qOndvFOiZ@fat_crate.local
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index f7dfdd3d021ea3eac00bd17413f40af101c15c1b..88dffaf8f0a9935e0b2f2232199c290188c47a54 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3206,9 +3206,7 @@
 
        mem_encrypt=    [X86-64] AMD Secure Memory Encryption (SME) control
                        Valid arguments: on, off
-                       Default (depends on kernel configuration option):
-                         on  (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y)
-                         off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n)
+                       Default: off
                        mem_encrypt=on:         Activate SME
                        mem_encrypt=off:        Do not activate SME
 

diff --git a/Documentation/x86/amd-memory-encryption.rst b/Documentation/x86/amd-memory-encryption.rst
index 934310ce7258298008e4c6ba5be611105993e1c1..bace87cc9ca2ce74b0db8d3ac705dcf6d69cd999 100644 (file)
--- a/Documentation/x86/amd-memory-encryption.rst
+++ b/Documentation/x86/amd-memory-encryption.rst
@@ -87,14 +87,14 @@ The state of SME in the Linux kernel can be documented as follows:
          kernel is non-zero).
 
 SME can also be enabled and activated in the BIOS. If SME is enabled and
-activated in the BIOS, then all memory accesses will be encrypted and it will
-not be necessary to activate the Linux memory encryption support.  If the BIOS
-merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), then Linux can activate
-memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or
-by supplying mem_encrypt=on on the kernel command line.  However, if BIOS does
-not enable SME, then Linux will not be able to activate memory encryption, even
-if configured to do so by default or the mem_encrypt=on command line parameter
-is specified.
+activated in the BIOS, then all memory accesses will be encrypted and it
+will not be necessary to activate the Linux memory encryption support.
+
+If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG),
+then memory encryption can be enabled by supplying mem_encrypt=on on the
+kernel command line.  However, if BIOS does not enable SME, then Linux
+will not be able to activate memory encryption, even if configured to do
+so by default or the mem_encrypt=on command line parameter is specified.
 
 Secure Nested Paging (SNP)
 ==========================

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 5caa023e98397ad686e3e796e5e192ca532e70e4..bea53385d31e32d3ed19c4c0cdf5250f6a8adf1f 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1553,19 +1553,6 @@ config AMD_MEM_ENCRYPT
          This requires an AMD processor that supports Secure Memory
          Encryption (SME).
 
-config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
-       bool "Activate AMD Secure Memory Encryption (SME) by default"
-       depends on AMD_MEM_ENCRYPT
-       help
-         Say yes to have system memory encrypted by default if running on
-         an AMD processor that supports Secure Memory Encryption (SME).
-
-         If set to Y, then the encryption of system memory can be
-         deactivated with the mem_encrypt=off command line option.
-
-         If set to N, then the encryption of system memory can be
-         activated with the mem_encrypt=on command line option.
-
 # Common NUMA Features
 config NUMA
        bool "NUMA Memory Allocation and Scheduler Support"

diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 4daeefa011ed3d692308c3c010426d75d1bca040..7d96904230af0c9a78072586962712f028061f1a 100644 (file)
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -97,7 +97,6 @@ static char sme_workarea[2 * PMD_PAGE_SIZE] __section(".init.scratch");
 
 static char sme_cmdline_arg[] __initdata = "mem_encrypt";
 static char sme_cmdline_on[]  __initdata = "on";
-static char sme_cmdline_off[] __initdata = "off";
 
 static void __init sme_clear_pgd(struct sme_populate_pgd_data *ppd)
 {
@@ -504,7 +503,7 @@ void __init sme_encrypt_kernel(struct boot_params *bp)
 
 void __init sme_enable(struct boot_params *bp)
 {
-       const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
+       const char *cmdline_ptr, *cmdline_arg, *cmdline_on;
        unsigned int eax, ebx, ecx, edx;
        unsigned long feature_mask;
        unsigned long me_mask;
@@ -587,12 +586,6 @@ void __init sme_enable(struct boot_params *bp)
        asm ("lea sme_cmdline_on(%%rip), %0"
             : "=r" (cmdline_on)
             : "p" (sme_cmdline_on));
-       asm ("lea sme_cmdline_off(%%rip), %0"
-            : "=r" (cmdline_off)
-            : "p" (sme_cmdline_off));
-
-       if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
-               sme_me_mask = me_mask;
 
        cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
                                     ((u64)bp->ext_cmd_line_ptr << 32));
@@ -602,8 +595,6 @@ void __init sme_enable(struct boot_params *bp)
 
        if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
                sme_me_mask = me_mask;
-       else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
-               sme_me_mask = 0;
 
 out:
        if (sme_me_mask) {