linux-kernel - Re: [PATCH v4] x86/boot: Don't return encryption mask from __startup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f81447e67af13eb211ddb97511657931cd95f2f4.camel@intel.com>
Date: Mon, 23 Jun 2025 11:26:14 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "tglx@...utronix.de" <tglx@...utronix.de>, "x86@...nel.org"
	<x86@...nel.org>, "khaliidcaliy@...il.com" <khaliidcaliy@...il.com>,
	"mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>
CC: "hpa@...or.com" <hpa@...or.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] x86/boot: Don't return encryption mask from
 __startup_64()

On Thu, 2025-06-19 at 07:36 +0000, Khalid Ali wrote:
> Avoid returning the SME encryption mask from __startup_64(), and instead
> let the function handle encryption directly as needed. 
> 

Some nits below:

"the function" here is confusing, since it sounds like you are referring to
__startup_64(), but I think you actually meant its caller.

So, "the function" -> "the caller".


> The encryption
> mask is already available to callers and can be accessed via 

"callers" -> "users", since only functions can have callers?

Or just:

  The encryption mask is already available after sme_enable() and ...

? 

> sme_get_me_mask() in C code, or directly through the sme_me_mask symbol
> in assembly, if CONFIG_AMD_MEM_ENCRYPT is enabled.
> 
> This change aligns with how secondary_startup_64_no_verify handles SME
> and keeps the behavior consistent. For Intel CPUs, SME is not relevant,
> so there is no need to retrieve the mask unless CONFIG_AMD_MEM_ENCRYPT
> is enabled.
> 
> Signed-off-by: Khalid Ali <khaliidcaliy@...il.com>

Overall I think this patch makes code logic clearer, so:

Acked-by: Kai Huang <kai.huang@...el.com>