Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option

From	Borislav Petkov <bp@suse.de>
Newsgroups	linux.kernel
Subject	Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option
Date	2017-10-01 19:20 +0200
Message-ID	<uvQ4h-4Te-1@gated-at.bofh.it> (permalink)
References	(1 earlier) <uvoB4-3DX-3@gated-at.bofh.it> <uvoB4-3DX-1@gated-at.bofh.it> <uvxO1-1iy-5@gated-at.bofh.it> <uvxO1-1iy-3@gated-at.bofh.it> <uvQ4h-4Te-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sun, Oct 01, 2017 at 12:00:31PM -0500, Brijesh Singh wrote:
> When SEV feature is disabled, KVM will not be able to launch any SEV
> guests.  When SEV support is available, KVM can enable it in a specific
> VM by setting SEV bit before executing the VMRUN instruction.

So I want to be able to disable SEV and the whole code that comes with
it in the *host*.

> Guest OS:
> --------
> Checks the MSR_AMD64_SEV to determine if SEV feature is enabled. Please
> note that the MSR is a read-only. IOW, MSR is not intercepted by the
> hypervisor.
> 
> Currently, mem_encrypt=xxx and CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
> is don't care. We can not depend on the command line because when SEV is
> enabled in a VM then instruction fetch will be decrypted by the
> hardware. If we want then we can perform the comparison between the SEV
> state obtained through MSR with user supplied command line and trigger
> BUG() if they don't match.

And when we have supplied mem_encrypt=sme to the *host* cmdline, it
should be impossible to start SEV guests. IOW, that feature mask test
should not happen and I should do instead:

        } else if (!strncmp(buffer, cmd_sme, sizeof(buffer))) {
                sme_only = true;
		sev_enabled = false;
        }

Or, respectively, not set it here as it is false already but set it at
the end of the function like this:

        if (sme_only)
                return;

	sev_enabled = true;
}

Hmmm?

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

Thread

Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted  Virtualization (SEV) support Borislav Petkov <bp@suse.de> - 2017-09-28 11:10 +0200
  Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted  Virtualization (SEV) support Borislav Petkov <bp@suse.de> - 2017-09-28 21:30 +0200
    Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted  Virtualization (SEV) support Borislav Petkov <bp@suse.de> - 2017-09-29 16:50 +0200
      Re: [Part1 PATCH v5 02/17] x86/mm: Add Secure Encrypted  Virtualization (SEV) support Borislav Petkov <bp@suse.de> - 2017-09-29 18:00 +0200
  Re: [Part1 PATCH v5.1 02/17] x86/mm: Add Secure Encrypted  Virtualization (SEV) support Borislav Petkov <bp@suse.de> - 2017-09-30 11:00 +0200
  [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov <bp@suse.de> - 2017-09-30 14:00 +0200
    Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov <bp@suse.de> - 2017-09-30 23:50 +0200
      Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov <bp@suse.de> - 2017-10-01 19:20 +0200
        Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov <bp@suse.de> - 2017-10-02 00:10 +0200
          Re: [PATCH] x86/CPU/AMD, mm: Extend with mem_encrypt=sme option Borislav Petkov <bp@suse.de> - 2017-10-02 14:50 +0200

csiph-web