From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35774) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bkCvY-00060Q-Td for qemu-devel@nongnu.org; Wed, 14 Sep 2016 12:20:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bkCvU-0008C5-LM for qemu-devel@nongnu.org; Wed, 14 Sep 2016 12:20:47 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44726) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bkCvU-0008Bz-FC for qemu-devel@nongnu.org; Wed, 14 Sep 2016 12:20:44 -0400 Date: Wed, 14 Sep 2016 19:20:42 +0300 From: "Michael S. Tsirkin" Message-ID: <20160914191431-mutt-send-email-mst@kernel.org> References: <147377800565.11859.4411044563640180545.stgit@brijesh-build-machine> <147377806784.11859.11149856529336910514.stgit@brijesh-build-machine> <20160913155807.GA2850@thinpad.lan.raisama.net> <6411b07f-4edd-390c-acca-5342ab1187ba@amd.com> <20160913220044.GY24695@thinpad.lan.raisama.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Brijesh Singh Cc: Eduardo Habkost , crosthwaite.peter@gmail.com, armbru@redhat.com, p.fedin@samsung.com, qemu-devel@nongnu.org, lcapitulino@redhat.com, pbonzini@redhat.com, rth@twiddle.net, "Daniel P. Berrange" On Wed, Sep 14, 2016 at 11:10:54AM -0500, Brijesh Singh wrote: > > > > Various commands and parameters are documented [1] > > > > > > [1] http://support.amd.com/TechDocs/55766_SEV-KM%20API_Spec.pdf > > > > If I understand correctly, the docs describe the firmware > > interface. The interface provided by QEMU is not the same thing, > > and needs to be documented as well (even if it contains pointers > > to sections or tables in the firmware interface docs). > > > > Some of the questions I have about the fields are: > > * Do we really need the user to provide all the options below? > > * Can't QEMU or KVM calculate vcpu_count/vcpu_length/vcpu_mask, > > for example? > > Good question, I don't think we need to get this information from guest > owner and it can be calculated from KVM. I will check with security folks on > how this information is used in measurement generation and make the changes > accordingly. > > > * Is bit 0 (KS) the only bit that can be set on flags? If so, why > > not a boolean "ks" option? > Agreed. I will fix in v2. > > > * Is "policy" the guest policy structure described at page 23? If > > so, why exposing the raw value instead of separate fields for > > each bit/field in the structure? (and only for the ones that > > are supposed to be set by the user) > > Yes policy is described in chapter 3, page 23. I am open to separate the > fields. > Let me know if something like this works > > sev-launch-rule,flags.ks=0,policy.dbg=0,policy.ks=0,policy.nosend=0,... My question is, does all of it have to be sev specific? For example, add a generic flag to block debug commands from monitor. When blocked, and if sev happens to be enabled, you can run guest with debug disabled. -- MST