From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751910AbdJCKuV (ORCPT ); Tue, 3 Oct 2017 06:50:21 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35648 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751156AbdJCKuU (ORCPT ); Tue, 3 Oct 2017 06:50:20 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 2F3B3883C7 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option To: Brijesh Singh , Borislav Petkov Cc: Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , kvm@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org References: <20171001171617.uzwfzps7sxowfram@pd.tnic> <20171001194509.4187-1-brijesh.singh@amd.com> <20171001220216.nhwc5momrn7wq3kj@pd.tnic> <6de5cc08-0a0d-cb45-9518-e5b30fd7e276@amd.com> <20171002124107.rwn5ww3wkynxwmsa@pd.tnic> <715846be-0f2e-07ee-63a0-ba1794d1bcbd@amd.com> From: Paolo Bonzini Message-ID: Date: Tue, 3 Oct 2017 12:50:15 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <715846be-0f2e-07ee-63a0-ba1794d1bcbd@amd.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Tue, 03 Oct 2017 10:50:20 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/10/2017 17:07, Brijesh Singh wrote: > > > Yep, that will work just fine. There are couple of ways we can limit > hypervisor from creating the SEV guest 1) clear the X86_FEATURE_SEV bit > when mem_encrypt=sme is passed or 2) parse the mem_encrypt=xxx in > kvm-amd.ko > and fail the KVM_SEV_INIT when mem_encrpt=sme or mem_encrypt=off. Stupid question ahead: if it's just about guests, why bother with mem_encrypt=xxx at all? kvm_amd should have a sev parameter anyway, you can just do kvm_amd.sev=0 to disable it. Paolo