From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Tobin Feldman-Fitzthum <tobin@linux.ibm.com> Cc: Steve Rutherford <srutherford@google.com>, Paolo Bonzini <pbonzini@redhat.com>, Ashish Kalra <Ashish.Kalra@amd.com>, thomas.lendacky@amd.com, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, tobin@ibm.com, jejb@linux.ibm.com, richard.henderson@linaro.org, qemu-devel@nongnu.org, frankeh@us.ibm.com, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Wed, 18 Aug 2021 20:04:28 +0100 [thread overview] Message-ID: <YR1ZvArdq4sKVyTJ@work-vm> (raw) In-Reply-To: <458ba932-5150-8706-3958-caa4cc67c8e3@linux.ibm.com> * Tobin Feldman-Fitzthum (tobin@linux.ibm.com) wrote: > On 8/17/21 6:04 PM, Steve Rutherford wrote: > > On Tue, Aug 17, 2021 at 1:50 PM Tobin Feldman-Fitzthum > > <tobin@linux.ibm.com> wrote: > > > This is essentially what we do in our prototype, although we have an > > > even simpler approach. We have a 1:1 mapping that maps an address to > > > itself with the cbit set. During Migration QEMU asks the migration > > > handler to import/export encrypted pages and provides the GPA for said > > > page. Since the migration handler only exports/imports encrypted pages, > > > we can have the cbit set for every page in our mapping. We can still use > > > OVMF functions with these mappings because they are on encrypted pages. > > > The MH does need to use a few shared pages (to communicate with QEMU, > > > for instance), so we have another mapping without the cbit that is at a > > > large offset. > > > > > > I think this is basically equivalent to what you suggest. As you point > > > out above, this approach does require that any page that will be > > > exported/imported by the MH is mapped in the guest. Is this a bad > > > assumption? The VMSA for SEV-ES is one example of a region that is > > > encrypted but not mapped in the guest (the PSP handles it directly). We > > > have been planning to map the VMSA into the guest to support migration > > > with SEV-ES (along with other changes). > > Ahh, It sounds like you are looking into sidestepping the existing > > AMD-SP flows for migration. I assume the idea is to spin up a VM on > > the target side, and have the two VMs attest to each other. How do the > > two sides know if the other is legitimate? I take it that the source > > is directing the LAUNCH flows? > > Yeah we don't use PSP migration flows at all. We don't need to send the MH > code from the source to the target because the MH lives in firmware, which > is common between the two. Are you relying on the target firmware to be *identical* or purely for it to be *compatible* ? It's normal for a migration to be the result of wanting to do an upgrade; and that means the destination build of OVMF might be newer (or older, or ...). Dave > We start the target like a normal VM rather than > waiting for an incoming migration. The plan is to treat the target like a > normal VM for attestation as well. The guest owner will attest the target VM > just like they would any other VM that is started on their behalf. Secret > injection can be used to establish a shared key for the source and target. > > -Tobin > > > > > --Steve > > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
WARNING: multiple messages have this Message-ID (diff)
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Tobin Feldman-Fitzthum <tobin@linux.ibm.com> Cc: thomas.lendacky@amd.com, Ashish Kalra <Ashish.Kalra@amd.com>, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, Steve Rutherford <srutherford@google.com>, richard.henderson@linaro.org, jejb@linux.ibm.com, tobin@ibm.com, qemu-devel@nongnu.org, frankeh@us.ibm.com, Paolo Bonzini <pbonzini@redhat.com>, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Wed, 18 Aug 2021 20:04:28 +0100 [thread overview] Message-ID: <YR1ZvArdq4sKVyTJ@work-vm> (raw) In-Reply-To: <458ba932-5150-8706-3958-caa4cc67c8e3@linux.ibm.com> * Tobin Feldman-Fitzthum (tobin@linux.ibm.com) wrote: > On 8/17/21 6:04 PM, Steve Rutherford wrote: > > On Tue, Aug 17, 2021 at 1:50 PM Tobin Feldman-Fitzthum > > <tobin@linux.ibm.com> wrote: > > > This is essentially what we do in our prototype, although we have an > > > even simpler approach. We have a 1:1 mapping that maps an address to > > > itself with the cbit set. During Migration QEMU asks the migration > > > handler to import/export encrypted pages and provides the GPA for said > > > page. Since the migration handler only exports/imports encrypted pages, > > > we can have the cbit set for every page in our mapping. We can still use > > > OVMF functions with these mappings because they are on encrypted pages. > > > The MH does need to use a few shared pages (to communicate with QEMU, > > > for instance), so we have another mapping without the cbit that is at a > > > large offset. > > > > > > I think this is basically equivalent to what you suggest. As you point > > > out above, this approach does require that any page that will be > > > exported/imported by the MH is mapped in the guest. Is this a bad > > > assumption? The VMSA for SEV-ES is one example of a region that is > > > encrypted but not mapped in the guest (the PSP handles it directly). We > > > have been planning to map the VMSA into the guest to support migration > > > with SEV-ES (along with other changes). > > Ahh, It sounds like you are looking into sidestepping the existing > > AMD-SP flows for migration. I assume the idea is to spin up a VM on > > the target side, and have the two VMs attest to each other. How do the > > two sides know if the other is legitimate? I take it that the source > > is directing the LAUNCH flows? > > Yeah we don't use PSP migration flows at all. We don't need to send the MH > code from the source to the target because the MH lives in firmware, which > is common between the two. Are you relying on the target firmware to be *identical* or purely for it to be *compatible* ? It's normal for a migration to be the result of wanting to do an upgrade; and that means the destination build of OVMF might be newer (or older, or ...). Dave > We start the target like a normal VM rather than > waiting for an incoming migration. The plan is to treat the target like a > normal VM for attestation as well. The guest owner will attest the target VM > just like they would any other VM that is started on their behalf. Secret > injection can be used to establish a shared key for the source and target. > > -Tobin > > > > > --Steve > > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2021-08-18 19:04 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-08-16 13:25 [RFC PATCH 00/13] Add support for Mirror VM Ashish Kalra 2021-08-16 13:26 ` [RFC PATCH 01/13] machine: Add mirrorvcpus=N suboption to -smp Ashish Kalra 2021-08-16 21:23 ` Eric Blake 2021-08-16 21:23 ` Eric Blake 2021-08-16 13:27 ` [RFC PATCH 02/13] hw/boards: Add mirror_vcpu flag to CPUArchId Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 03/13] hw/i386: Mark mirror vcpus in possible_cpus Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 04/13] hw/acpi: Don't include mirror vcpus in ACPI tables Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 05/13] cpu: Add boolean mirror_vcpu field to CPUState Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 06/13] hw/i386: Set CPUState.mirror_vcpu=true for mirror vcpus Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 07/13] kvm: Add Mirror VM ioctl and enable cap interfaces Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 08/13] kvm: Add Mirror VM support Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 09/13] kvm: create Mirror VM and share primary VM's encryption context Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 10/13] softmmu/cpu: Skip mirror vcpu's for pause, resume and synchronization Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 11/13] kvm/apic: Disable in-kernel APIC support for mirror vcpu's Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 12/13] hw/acpi: disable modern CPU hotplug interface " Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 13/13] hw/i386/pc: reduce fw_cfg boot cpu count taking into account " Ashish Kalra 2021-08-16 14:01 ` [RFC PATCH 00/13] Add support for Mirror VM Claudio Fontana 2021-08-16 14:01 ` Claudio Fontana 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 14:44 ` Ashish Kalra 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 15:13 ` Ashish Kalra 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-18 10:31 ` Ashish Kalra 2021-08-18 11:25 ` James Bottomley 2021-08-18 11:25 ` James Bottomley 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 16:28 ` James Bottomley 2021-08-18 16:28 ` James Bottomley 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 18:51 ` James Bottomley 2021-08-18 18:51 ` James Bottomley 2021-08-18 19:47 ` Paolo Bonzini 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 20:53 ` Paolo Bonzini 2021-08-16 23:53 ` Steve Rutherford 2021-08-16 23:53 ` Steve Rutherford 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 14:08 ` Ashish Kalra 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 22:04 ` Steve Rutherford 2021-08-17 22:04 ` Steve Rutherford 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 19:04 ` Dr. David Alan Gilbert [this message] 2021-08-18 19:04 ` Dr. David Alan Gilbert 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 22:10 ` James Bottomley 2021-08-19 22:10 ` James Bottomley 2021-08-23 12:26 ` Dr. David Alan Gilbert 2021-08-23 12:26 ` Dr. David Alan Gilbert 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-19 14:07 ` Tobin Feldman-Fitzthum 2021-08-19 14:07 ` Tobin Feldman-Fitzthum 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:57 ` James Bottomley 2021-08-17 22:57 ` James Bottomley 2021-08-17 23:10 ` Steve Rutherford 2021-08-17 23:10 ` Steve Rutherford 2021-08-18 2:49 ` James Bottomley 2021-08-18 2:49 ` James Bottomley 2021-08-18 14:06 ` Ashish Kalra 2021-08-18 17:07 ` Ashish Kalra 2021-08-16 15:07 Tobin Feldman-Fitzthum 2021-08-16 15:07 ` Tobin Feldman-Fitzthum
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YR1ZvArdq4sKVyTJ@work-vm \ --to=dgilbert@redhat.com \ --cc=Ashish.Kalra@amd.com \ --cc=brijesh.singh@amd.com \ --cc=dovmurik@linux.vnet.ibm.com \ --cc=ehabkost@redhat.com \ --cc=frankeh@us.ibm.com \ --cc=jejb@linux.ibm.com \ --cc=kvm@vger.kernel.org \ --cc=mst@redhat.com \ --cc=pbonzini@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=richard.henderson@linaro.org \ --cc=srutherford@google.com \ --cc=thomas.lendacky@amd.com \ --cc=tobin@ibm.com \ --cc=tobin@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.