[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v1 15/40] i386/tdx: Add property sept-ve-disable for tdx-gues
|
From: |
Gerd Hoffmann |
|
Subject: |
Re: [PATCH v1 15/40] i386/tdx: Add property sept-ve-disable for tdx-guest object |
|
Date: |
Fri, 2 Sep 2022 18:52:51 +0200 |
On Fri, Sep 02, 2022 at 03:26:35PM +0000, Sean Christopherson wrote:
> On Fri, Sep 02, 2022, Gerd Hoffmann wrote:
> >
> > Hmm, ok, but shouldn't the SEPT_VE bit *really* controlled by the guest
> > then?
> >
> > Having a hypervisor-controlled config bit to protect against a malicious
> > hypervisor looks pointless to me ...
>
> IIRC, all (most?) of the attributes are included in the attestation report,
> so a
> guest/customer can refuse to provision secrets to the guest if the hypervisor
> is
> misbehaving.
Good. I think we sorted all issues then.
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
take care,
Gerd