From: Tobin Feldman-Fitzthum <tobin@linux.ibm.com> To: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: thomas.lendacky@amd.com, Ashish Kalra <Ashish.Kalra@amd.com>, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, Steve Rutherford <srutherford@google.com>, richard.henderson@linaro.org, jejb@linux.ibm.com, tobin@ibm.com, qemu-devel@nongnu.org, frankeh@us.ibm.com, Paolo Bonzini <pbonzini@redhat.com>, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Thu, 19 Aug 2021 10:07:33 -0400 [thread overview] Message-ID: <5d63f919-354e-5afa-fae4-0f520f5af215@linux.ibm.com> (raw) In-Reply-To: <YR4U11ssVUztsPyx@work-vm> On 8/19/21 4:22 AM, Dr. David Alan Gilbert wrote: > * Tobin Feldman-Fitzthum (tobin@linux.ibm.com) wrote: >> On 8/18/21 3:04 PM, Dr. David Alan Gilbert wrote: >> >>> Are you relying on the target firmware to be *identical* or purely for >>> it to be *compatible* ? It's normal for a migration to be the result of >>> wanting to do an upgrade; and that means the destination build of OVMF >>> might be newer (or older, or ...). >>> >>> Dave >> This is a good point. The migration handler on the source and target must >> have the same memory footprint or bad things will happen. Using the same >> firmware on the source and target is an easy way to guarantee this. Since >> the MH in OVMF is not a contiguous region of memory, but a group of >> functions scattered around OVMF, it is a bit difficult to guarantee that the >> memory footprint is the same if the build is different. > Can you explain what the 'memory footprint' consists of? Can't it just > be the whole of the OVMF rom space if you have no way of nudging the MH > into it's own chunk? The footprint is not massive. It is mainly ConfidentialMigrationDxe and the OVMF crypto support. It might be feasible to copy these components to a fixed location that would be the same across fw builds. It might also be feasible to pin these components to certain addresses. OVMF sort of supports doing this. We can raise the question in that community. It also might work to protect the entirety of OVMF as you suggest. Currently we don't copy any of the OVMF ROM (as in flash0) over. That said, the MH doesn't run from the ROM so we would need to protect the memory used by OVMF as well. In some ways it might seem easier to protect all of the OVMF memory rather than just a couple of packages, but there are some complexities. For one thing, we would only want to protect efi runtime memory, as boot memory may be in use by the OS and would need to be migrated. The MH could check whether each page is efi runtime memory and skip any pages that are. Runtime memory won't be a contiguous blob, however, so for this approach the layout of the runtime memory would need to be the same on the source and target. We can sidestep these issues entirely by using identical firmware images. That said, there are a number of strategies for developing compatible OVMF images and I definitely see the value of doing so. -Tobin > > I think it really does have to cope with migration to a new version of > host. > > Dave > >> -Tobin >> >>> >>>> We start the target like a normal VM rather than >>>> waiting for an incoming migration. The plan is to treat the target like a >>>> normal VM for attestation as well. The guest owner will attest the target VM >>>> just like they would any other VM that is started on their behalf. Secret >>>> injection can be used to establish a shared key for the source and target. >>>> >>>> -Tobin >>>> >>>>> --Steve >>>>>
WARNING: multiple messages have this Message-ID (diff)
From: Tobin Feldman-Fitzthum <tobin@linux.ibm.com> To: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: thomas.lendacky@amd.com, Ashish Kalra <Ashish.Kalra@amd.com>, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, Steve Rutherford <srutherford@google.com>, tobin@ibm.com, jejb@linux.ibm.com, richard.henderson@linaro.org, qemu-devel@nongnu.org, frankeh@us.ibm.com, Paolo Bonzini <pbonzini@redhat.com>, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Thu, 19 Aug 2021 10:07:33 -0400 [thread overview] Message-ID: <5d63f919-354e-5afa-fae4-0f520f5af215@linux.ibm.com> (raw) In-Reply-To: <YR4U11ssVUztsPyx@work-vm> On 8/19/21 4:22 AM, Dr. David Alan Gilbert wrote: > * Tobin Feldman-Fitzthum (tobin@linux.ibm.com) wrote: >> On 8/18/21 3:04 PM, Dr. David Alan Gilbert wrote: >> >>> Are you relying on the target firmware to be *identical* or purely for >>> it to be *compatible* ? It's normal for a migration to be the result of >>> wanting to do an upgrade; and that means the destination build of OVMF >>> might be newer (or older, or ...). >>> >>> Dave >> This is a good point. The migration handler on the source and target must >> have the same memory footprint or bad things will happen. Using the same >> firmware on the source and target is an easy way to guarantee this. Since >> the MH in OVMF is not a contiguous region of memory, but a group of >> functions scattered around OVMF, it is a bit difficult to guarantee that the >> memory footprint is the same if the build is different. > Can you explain what the 'memory footprint' consists of? Can't it just > be the whole of the OVMF rom space if you have no way of nudging the MH > into it's own chunk? The footprint is not massive. It is mainly ConfidentialMigrationDxe and the OVMF crypto support. It might be feasible to copy these components to a fixed location that would be the same across fw builds. It might also be feasible to pin these components to certain addresses. OVMF sort of supports doing this. We can raise the question in that community. It also might work to protect the entirety of OVMF as you suggest. Currently we don't copy any of the OVMF ROM (as in flash0) over. That said, the MH doesn't run from the ROM so we would need to protect the memory used by OVMF as well. In some ways it might seem easier to protect all of the OVMF memory rather than just a couple of packages, but there are some complexities. For one thing, we would only want to protect efi runtime memory, as boot memory may be in use by the OS and would need to be migrated. The MH could check whether each page is efi runtime memory and skip any pages that are. Runtime memory won't be a contiguous blob, however, so for this approach the layout of the runtime memory would need to be the same on the source and target. We can sidestep these issues entirely by using identical firmware images. That said, there are a number of strategies for developing compatible OVMF images and I definitely see the value of doing so. -Tobin > > I think it really does have to cope with migration to a new version of > host. > > Dave > >> -Tobin >> >>> >>>> We start the target like a normal VM rather than >>>> waiting for an incoming migration. The plan is to treat the target like a >>>> normal VM for attestation as well. The guest owner will attest the target VM >>>> just like they would any other VM that is started on their behalf. Secret >>>> injection can be used to establish a shared key for the source and target. >>>> >>>> -Tobin >>>> >>>>> --Steve >>>>>
next prev parent reply other threads:[~2021-08-19 14:09 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-08-16 13:25 [RFC PATCH 00/13] Add support for Mirror VM Ashish Kalra 2021-08-16 13:26 ` [RFC PATCH 01/13] machine: Add mirrorvcpus=N suboption to -smp Ashish Kalra 2021-08-16 21:23 ` Eric Blake 2021-08-16 21:23 ` Eric Blake 2021-08-16 13:27 ` [RFC PATCH 02/13] hw/boards: Add mirror_vcpu flag to CPUArchId Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 03/13] hw/i386: Mark mirror vcpus in possible_cpus Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 04/13] hw/acpi: Don't include mirror vcpus in ACPI tables Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 05/13] cpu: Add boolean mirror_vcpu field to CPUState Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 06/13] hw/i386: Set CPUState.mirror_vcpu=true for mirror vcpus Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 07/13] kvm: Add Mirror VM ioctl and enable cap interfaces Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 08/13] kvm: Add Mirror VM support Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 09/13] kvm: create Mirror VM and share primary VM's encryption context Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 10/13] softmmu/cpu: Skip mirror vcpu's for pause, resume and synchronization Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 11/13] kvm/apic: Disable in-kernel APIC support for mirror vcpu's Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 12/13] hw/acpi: disable modern CPU hotplug interface " Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 13/13] hw/i386/pc: reduce fw_cfg boot cpu count taking into account " Ashish Kalra 2021-08-16 14:01 ` [RFC PATCH 00/13] Add support for Mirror VM Claudio Fontana 2021-08-16 14:01 ` Claudio Fontana 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 14:44 ` Ashish Kalra 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 15:13 ` Ashish Kalra 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-18 10:31 ` Ashish Kalra 2021-08-18 11:25 ` James Bottomley 2021-08-18 11:25 ` James Bottomley 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 16:28 ` James Bottomley 2021-08-18 16:28 ` James Bottomley 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 18:51 ` James Bottomley 2021-08-18 18:51 ` James Bottomley 2021-08-18 19:47 ` Paolo Bonzini 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 20:53 ` Paolo Bonzini 2021-08-16 23:53 ` Steve Rutherford 2021-08-16 23:53 ` Steve Rutherford 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 14:08 ` Ashish Kalra 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 22:04 ` Steve Rutherford 2021-08-17 22:04 ` Steve Rutherford 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 19:04 ` Dr. David Alan Gilbert 2021-08-18 19:04 ` Dr. David Alan Gilbert 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 22:10 ` James Bottomley 2021-08-19 22:10 ` James Bottomley 2021-08-23 12:26 ` Dr. David Alan Gilbert 2021-08-23 12:26 ` Dr. David Alan Gilbert 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-19 14:07 ` Tobin Feldman-Fitzthum [this message] 2021-08-19 14:07 ` Tobin Feldman-Fitzthum 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:57 ` James Bottomley 2021-08-17 22:57 ` James Bottomley 2021-08-17 23:10 ` Steve Rutherford 2021-08-17 23:10 ` Steve Rutherford 2021-08-18 2:49 ` James Bottomley 2021-08-18 2:49 ` James Bottomley 2021-08-18 14:06 ` Ashish Kalra 2021-08-18 17:07 ` Ashish Kalra 2021-08-16 15:07 Tobin Feldman-Fitzthum 2021-08-16 15:07 ` Tobin Feldman-Fitzthum
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=5d63f919-354e-5afa-fae4-0f520f5af215@linux.ibm.com \ --to=tobin@linux.ibm.com \ --cc=Ashish.Kalra@amd.com \ --cc=brijesh.singh@amd.com \ --cc=dgilbert@redhat.com \ --cc=dovmurik@linux.vnet.ibm.com \ --cc=ehabkost@redhat.com \ --cc=frankeh@us.ibm.com \ --cc=jejb@linux.ibm.com \ --cc=kvm@vger.kernel.org \ --cc=mst@redhat.com \ --cc=pbonzini@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=richard.henderson@linaro.org \ --cc=srutherford@google.com \ --cc=thomas.lendacky@amd.com \ --cc=tobin@ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.