From: Brijesh Singh <brijesh.singh@amd.com>
To: Borislav Petkov <bp@suse.de>
Cc: brijesh.singh@amd.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, x86@kernel.org,
Tom Lendacky <thomas.lendacky@amd.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
Andy Lutomirski <luto@kernel.org>
Subject: Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support
Date: Fri, 29 Sep 2017 07:28:47 -0500 [thread overview]
Message-ID: <0ed8db87-3f18-fd69-19e3-7f23a43bb8d2@amd.com> (raw)
In-Reply-To: <20170928192347.gkpmpetmmp7523wu@pd.tnic>
On 9/28/17 2:23 PM, Borislav Petkov wrote:
...
> So actually we need chicken bits to be able to *enable* both when
> CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT is not set.
>
> I.e.,
>
> * mem_encrypt=on - both SME and SEV enabled
>
> * mem_encrypt=smeonly - only SME, no SEV on the host. This option will
> basically prevent from using any SEV guests and make the SEV part of the
> code inactive. I.e., sev_active() and sev_enabled should be false. As
> you say above, we should clear X86_FEATURE_SEV, yes.
>
> * mem_encrypt=off - neither SME/SEV are enabled.
>
> And =on and =off we already have.
>
> How does that sound?
if we are adding a chicken bits then I think we should do it for both
"smeonly" and "sevonly". We can boot host OS with SME disabled and SEV
enabled, and still be able to create the SEV guest from the hypervisor.
How about this ?
mem_encrypt=on both SME and SEV enabled
mem_encrypt=sev only SEV enabled
mem_encrypt=sme only SME enabled
mem_encrypt=off neither SME/SEV are enabled
-Brijesh
next prev parent reply other threads:[~2017-09-29 12:28 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-27 15:13 [Part1 PATCH v5 00/17] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 01/17] Documentation/x86: Add AMD Secure Encrypted Virtualization (SEV) description Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Brijesh Singh
2017-09-28 9:02 ` Borislav Petkov
2017-09-28 18:48 ` Brijesh Singh
2017-09-28 19:23 ` Borislav Petkov
2017-09-29 12:28 ` Brijesh Singh [this message]
2017-09-29 14:41 ` Borislav Petkov
2017-09-29 15:54 ` Brijesh Singh
2017-09-29 15:56 ` Borislav Petkov
2017-09-29 21:27 ` [Part1 PATCH v5.1 " Brijesh Singh
2017-09-30 8:49 ` Borislav Petkov
2017-09-29 23:06 ` [Part1 PATCH v5 18/18] x86/mm: add 'sme' argument in mem_encrypt= Brijesh Singh
2017-09-30 11:56 ` [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov
2017-09-30 21:17 ` Brijesh Singh
2017-09-30 21:41 ` Borislav Petkov
2017-10-01 17:00 ` Brijesh Singh
2017-10-01 17:16 ` Borislav Petkov
2017-10-01 19:45 ` Brijesh Singh
2017-10-01 22:02 ` Borislav Petkov
2017-10-02 11:32 ` Brijesh Singh
2017-10-02 12:41 ` Borislav Petkov
2017-10-02 15:07 ` Brijesh Singh
2017-10-03 10:50 ` Paolo Bonzini
2017-10-03 11:20 ` Borislav Petkov
2017-10-02 13:44 ` Tom Lendacky
2017-10-02 13:51 ` Borislav Petkov
2017-10-02 16:35 ` Tom Lendacky
2017-10-03 11:29 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 03/17] x86/mm: Don't attempt to encrypt initrd under SEV Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 04/17] x86/realmode: Don't decrypt trampoline area " Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 05/17] x86/mm: Use encrypted access of boot related data with SEV Brijesh Singh
2017-09-28 11:13 ` Borislav Petkov
2017-09-28 16:20 ` [Part1 PATCH v5.1 " Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 06/17] x86/mm: Include SEV for encryption memory attribute changes Brijesh Singh
2017-09-27 15:53 ` Brijesh Singh
2017-09-27 17:26 ` Borislav Petkov
2017-09-27 19:17 ` [Part1 PATCH v5.1 " Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 07/17] x86/efi: Access EFI data as encrypted when SEV is active Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 08/17] resource: Consolidate resource walking code Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 09/17] resource: Provide resource struct in resource walk callback Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 10/17] x86/mm, resource: Use PAGE_KERNEL protection for ioremap of memory pages Brijesh Singh
2017-09-28 16:23 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 11/17] x86/mm: Add DMA support for SEV memory encryption Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 12/17] x86/boot: Add early boot support when running with SEV active Brijesh Singh
2017-09-28 17:02 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 13/17] x86/io: Unroll string I/O when SEV is active Brijesh Singh
2017-09-28 17:51 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 14/17] x86: Add support for changing memory encryption attribute in early boot Brijesh Singh
2017-09-27 15:13 ` [Part1 PATCH v5 15/17] percpu: Introduce DEFINE_PER_CPU_DECRYPTED Brijesh Singh
2017-09-28 20:32 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 16/17] X86/KVM: Decrypt shared per-cpu variables when SEV is active Brijesh Singh
2017-09-29 5:51 ` Borislav Petkov
2017-09-27 15:13 ` [Part1 PATCH v5 17/17] X86/KVM: Clear encryption attribute " Brijesh Singh
2017-09-29 6:26 ` [Part1 PATCH v5 00/17] x86: Secure Encrypted Virtualization (AMD) Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0ed8db87-3f18-fd69-19e3-7f23a43bb8d2@amd.com \
--to=brijesh.singh@amd.com \
--cc=bp@suse.de \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome