From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752120AbdI2OmC (ORCPT <rfc822;w@1wt.eu>);
        Fri, 29 Sep 2017 10:42:02 -0400
Received: from mx2.suse.de ([195.135.220.15]:51710 "EHLO mx1.suse.de"
        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
        id S1751346AbdI2OmB (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 29 Sep 2017 10:42:01 -0400
Date: Fri, 29 Sep 2017 16:41:46 +0200
From: Borislav Petkov <bp@suse.de>
To: Brijesh Singh <brijesh.singh@amd.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Andy Lutomirski <luto@kernel.org>
Subject: Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted
 Virtualization (SEV) support
Message-ID: <20170929144146.ctidwarilxntpu3i@pd.tnic>
References: <20170927151329.70011-1-brijesh.singh@amd.com>
 <20170927151329.70011-3-brijesh.singh@amd.com>
 <20170928090242.ber7gynwaldinafa@pd.tnic>
 <abed199b-217e-65ba-8dfc-f2e7b71eeef5@amd.com>
 <20170928192347.gkpmpetmmp7523wu@pd.tnic>
 <0ed8db87-3f18-fd69-19e3-7f23a43bb8d2@amd.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <0ed8db87-3f18-fd69-19e3-7f23a43bb8d2@amd.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Sep 29, 2017 at 07:28:47AM -0500, Brijesh Singh wrote:
> if we are adding a chicken bits then I think we should do it for both
> "smeonly" and "sevonly". We can boot host OS with SME disabled and SEV
> enabled, and still be able to create the SEV guest from the hypervisor.

Sure, but is that a real use case? I mean, who would want to run
encrypted guests on an unencrypted hypervisor?

> How about this ?
> 
> mem_encrypt=on     both SME and SEV enabled
> mem_encrypt=sev    only SEV enabled
> mem_encrypt=sme   only SME enabled
> mem_encrypt=off     neither SME/SEV are enabled

I like those short mnemonics, ACK. Less typing is always good.

Thx.

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--