On 22/09/2016 16:59, Borislav Petkov wrote:

On Thu, Sep 22, 2016 at 04:45:51PM +0200, Paolo Bonzini wrote:

quoted

The main difference between the SME and SEV encryption, from the point
of view of the kernel, is that real-mode always writes unencrypted in
SME and always writes encrypted in SEV.  But UEFI can run in 64-bit mode
and learn about the C bit, so EFI boot data should be unprotected in SEV
guests.

Actually, it is different: you can start fully encrypted in SME, see:

https://lkml.kernel.org/r/20160822223539.29880.96739.stgit@tlendack-t1.amdoffice.net

The last paragraph alludes to a certain transparent mode where you're
already encrypted and only certain pieces like EFI is not encrypted.

Which paragraph?

quoted

Because the firmware volume is written to high memory in encrypted
form, and because the PEI phase runs in 32-bit mode, the firmware
code will be encrypted; on the other hand, data that is placed in low
memory for the kernel can be unencrypted, thus limiting differences
between SME and SEV.

When you run fully encrypted, you still need to access EFI tables in the
clear. That's why I'm confused about this patch here.

I might be wrong, but I don't think this patch was tested with OVMF or Duet.

Paolo