From mboxrd@z Thu Jan  1 00:00:00 1970
From: Brijesh Singh <brijesh.singh@amd.com>
Subject: Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted
 Virtualization (SEV) support
Date: Thu, 28 Sep 2017 13:48:48 -0500
Message-ID: <abed199b-217e-65ba-8dfc-f2e7b71eeef5@amd.com>
References: <20170927151329.70011-1-brijesh.singh@amd.com>
 <20170927151329.70011-3-brijesh.singh@amd.com>
 <20170928090242.ber7gynwaldinafa@pd.tnic>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: brijesh.singh@amd.com, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, x86@kernel.org,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Andy Lutomirski <luto@kernel.org>
To: Borislav Petkov <bp@suse.de>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20170928090242.ber7gynwaldinafa@pd.tnic>
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org

Hi Boris,

On 09/28/2017 04:02 AM, Borislav Petkov wrote:
...

>> +bool sev_active(void)
>> +{
>> +	return sme_me_mask && sev_enabled;
> 
> What I'm still missing is the chicken bit. I.e., to be able to boot with
> "mem_encrypt=smeonly" or so, which disables the SEV side but can still
> allow SME. For when SEV has issues and people want to disable it.
> 


Let me understand the ask, are you saying that we need a method to disable the SEV
feature from the host OS so that Hypervisor will not be able to create a SEV guest?
Because once a guest is booted with SEV feature, there is no way to disable the SEV
feature from the guest.

i.e if "mem_encrypt=smeonly" is set then we clear X86_FEATURE_SEV capability flag
defined in [1].

[1] https://marc.info/?l=linux-kernel&m=150585470323923&w=2


> You can do the patch ontop of those and send it as a reply to this
> thread - no need to wait to resend the whole thing again.
>