From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brijesh Singh Subject: Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Date: Fri, 29 Sep 2017 10:54:39 -0500 Message-ID: References: <20170927151329.70011-1-brijesh.singh@amd.com> <20170927151329.70011-3-brijesh.singh@amd.com> <20170928090242.ber7gynwaldinafa@pd.tnic> <20170928192347.gkpmpetmmp7523wu@pd.tnic> <0ed8db87-3f18-fd69-19e3-7f23a43bb8d2@amd.com> <20170929144146.ctidwarilxntpu3i@pd.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Cc: brijesh.singh@amd.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, Tom Lendacky , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Andy Lutomirski To: Borislav Petkov Return-path: In-Reply-To: <20170929144146.ctidwarilxntpu3i@pd.tnic> Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On 09/29/2017 09:41 AM, Borislav Petkov wrote: > On Fri, Sep 29, 2017 at 07:28:47AM -0500, Brijesh Singh wrote: >> if we are adding a chicken bits then I think we should do it for both >> "smeonly" and "sevonly". We can boot host OS with SME disabled and SEV >> enabled, and still be able to create the SEV guest from the hypervisor. > > Sure, but is that a real use case? I mean, who would want to run > encrypted guests on an unencrypted hypervisor? > In production, you do not want to run encrypted guest on an unencrypted hypervisor -- I was thinking about the debug environment. We can start with mem_encrypt=sme and if we see the need for 'sev' arg then we can extend it later. I am working on the patch and will send for the review. thanks -Brijesh