Messages in this thread | | | Subject | Re: [PATCH] x86/sev: Add AMD_SEV_ES_GUEST Kconfig for including SEV-ES support | From | Paolo Bonzini <> | Date | Mon, 18 Jan 2021 19:03:17 +0100 |
| |
On 16/01/21 06:40, Tom Lendacky wrote: > >> Introduce a new Kconfig, AMD_SEV_ES_GUEST, to control the inclusion of >> support for running as an SEV-ES guest. Pivoting on AMD_MEM_ENCRYPT for >> guest SEV-ES support is undesirable for host-only kernel builds as >> AMD_MEM_ENCRYPT is also required to enable KVM/host support for SEV and >> SEV-ES. > > I believe only KVM_AMD_SEV is required to enable the KVM support to run > SEV and SEV-ES guests. The AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT setting is > only used to determine whether to enable the KVM SEV/SEV-ES support by > default on module load.
Right:
if (IS_ENABLED(CONFIG_KVM_AMD_SEV) && sev) { sev_hardware_setup(); } else { sev = false; sev_es = false; }
I removed the addition to "config AMD_MEM_ENCRYPT_ from Sean's patch, but (despite merging it not once but twice) I don't really like the hidden dependency on AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT and thus AMD_MEM_ENCRYPT. Is there any reason to not always enable sev/sev_es by default?
Paolo
| |