From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option
Date: Tue, 3 Oct 2017 12:50:15 +0200
Message-ID: <a01ee720-e9cf-2ecb-8288-7d86c5a46d86@redhat.com>
References: <20171001171617.uzwfzps7sxowfram@pd.tnic>
 <20171001194509.4187-1-brijesh.singh@amd.com>
 <20171001220216.nhwc5momrn7wq3kj@pd.tnic>
 <6de5cc08-0a0d-cb45-9518-e5b30fd7e276@amd.com>
 <20171002124107.rwn5ww3wkynxwmsa@pd.tnic>
 <715846be-0f2e-07ee-63a0-ba1794d1bcbd@amd.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>,
        =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>,
        kvm@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org
To: Brijesh Singh <brijesh.singh@amd.com>, Borislav Petkov <bp@suse.de>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <715846be-0f2e-07ee-63a0-ba1794d1bcbd@amd.com>
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org

On 02/10/2017 17:07, Brijesh Singh wrote:
> 
> 
> Yep, that will work just fine. There are couple of ways we can limit
> hypervisor from creating the SEV guest 1) clear the X86_FEATURE_SEV bit
> when mem_encrypt=sme is passed or 2) parse the mem_encrypt=xxx in
> kvm-amd.ko
> and fail the KVM_SEV_INIT when mem_encrpt=sme or mem_encrypt=off.

Stupid question ahead: if it's just about guests, why bother with
mem_encrypt=xxx at all?  kvm_amd should have a sev parameter anyway, you
can just do kvm_amd.sev=0 to disable it.

Paolo