From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: James Bottomley <jejb@linux.ibm.com> Cc: Tobin Feldman-Fitzthum <tobin@linux.ibm.com>, Steve Rutherford <srutherford@google.com>, Paolo Bonzini <pbonzini@redhat.com>, Ashish Kalra <Ashish.Kalra@amd.com>, thomas.lendacky@amd.com, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, tobin@ibm.com, richard.henderson@linaro.org, qemu-devel@nongnu.org, frankeh@us.ibm.com, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Mon, 23 Aug 2021 13:26:27 +0100 [thread overview] Message-ID: <YSOT87eg4UjCG+jG@work-vm> (raw) In-Reply-To: <d6eb8f7ff2d78296b5ba3a20d1dc9640f4bb8fa5.camel@linux.ibm.com> * James Bottomley (jejb@linux.ibm.com) wrote: > On Thu, 2021-08-19 at 15:28 +0100, Dr. David Alan Gilbert wrote: > > * James Bottomley (jejb@linux.ibm.com) wrote: > > > On Thu, 2021-08-19 at 09:22 +0100, Dr. David Alan Gilbert wrote: > [...] > > > > I think it really does have to cope with migration to a new > > > > version of host. > > > > > > Well, you're thinking of OVMF as belonging to the host because of > > > the way it is supplied, but think about the way it works in > > > practice now, forgetting about confidential computing: OVMF is RAM > > > resident in ordinary guests, so when you migrate them, the whole of > > > OVMF (or at least what's left at runtime) goes with the migration, > > > thus it's not possible to change the guest OVMF by migration. The > > > above is really just an extension of that principle, the only > > > difference for confidential computing being you have to have an > > > image of the current OVMF ROM in the target to seed migration. > > > > > > Technically, the problem is we can't overwrite running code and > > > once the guest is re-sited to the target, the OVMF there has to > > > match exactly what was on the source for the RT to still > > > function. Once the migration has run, the OVMF on the target must > > > be identical to what was on the source (including internally > > > allocated OVMF memory), and if we can't copy the MH code, we have > > > to rely on the target image providing this identical code and we > > > copy the rest. > > > > I'm OK with the OVMF now being part of the guest image, and having to > > exist on both; it's a bit delicate though unless we have a way to > > check it (is there an attest of the destination happening here?) > > There will be in the final version. The attestations of the source and > target, being the hash of the OVMF (with the registers in the -ES > case), should be the same (modulo any firmware updates to the PSP, > whose firmware version is also hashed) to guarantee the OVMF is the > same on both sides. We'll definitely take an action to get QEMU to > verify this ... made a lot easier now we have signed attestations ... Hmm; I'm not sure you're allowed to have QEMU verify that - we don't trust it; you need to have either the firmware say it's OK to migrate to the destination (using the existing PSP mechanism) or get the source MH to verify a quote from the destination. [Somewhere along the line, if you're not using the PSP, I think you also need to check the guest policy to check it is allowed to migrate]. Dave > James > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
WARNING: multiple messages have this Message-ID (diff)
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: James Bottomley <jejb@linux.ibm.com> Cc: thomas.lendacky@amd.com, Ashish Kalra <Ashish.Kalra@amd.com>, brijesh.singh@amd.com, ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, Steve Rutherford <srutherford@google.com>, richard.henderson@linaro.org, tobin@ibm.com, qemu-devel@nongnu.org, frankeh@us.ibm.com, Tobin Feldman-Fitzthum <tobin@linux.ibm.com>, Paolo Bonzini <pbonzini@redhat.com>, dovmurik@linux.vnet.ibm.com Subject: Re: [RFC PATCH 00/13] Add support for Mirror VM. Date: Mon, 23 Aug 2021 13:26:27 +0100 [thread overview] Message-ID: <YSOT87eg4UjCG+jG@work-vm> (raw) In-Reply-To: <d6eb8f7ff2d78296b5ba3a20d1dc9640f4bb8fa5.camel@linux.ibm.com> * James Bottomley (jejb@linux.ibm.com) wrote: > On Thu, 2021-08-19 at 15:28 +0100, Dr. David Alan Gilbert wrote: > > * James Bottomley (jejb@linux.ibm.com) wrote: > > > On Thu, 2021-08-19 at 09:22 +0100, Dr. David Alan Gilbert wrote: > [...] > > > > I think it really does have to cope with migration to a new > > > > version of host. > > > > > > Well, you're thinking of OVMF as belonging to the host because of > > > the way it is supplied, but think about the way it works in > > > practice now, forgetting about confidential computing: OVMF is RAM > > > resident in ordinary guests, so when you migrate them, the whole of > > > OVMF (or at least what's left at runtime) goes with the migration, > > > thus it's not possible to change the guest OVMF by migration. The > > > above is really just an extension of that principle, the only > > > difference for confidential computing being you have to have an > > > image of the current OVMF ROM in the target to seed migration. > > > > > > Technically, the problem is we can't overwrite running code and > > > once the guest is re-sited to the target, the OVMF there has to > > > match exactly what was on the source for the RT to still > > > function. Once the migration has run, the OVMF on the target must > > > be identical to what was on the source (including internally > > > allocated OVMF memory), and if we can't copy the MH code, we have > > > to rely on the target image providing this identical code and we > > > copy the rest. > > > > I'm OK with the OVMF now being part of the guest image, and having to > > exist on both; it's a bit delicate though unless we have a way to > > check it (is there an attest of the destination happening here?) > > There will be in the final version. The attestations of the source and > target, being the hash of the OVMF (with the registers in the -ES > case), should be the same (modulo any firmware updates to the PSP, > whose firmware version is also hashed) to guarantee the OVMF is the > same on both sides. We'll definitely take an action to get QEMU to > verify this ... made a lot easier now we have signed attestations ... Hmm; I'm not sure you're allowed to have QEMU verify that - we don't trust it; you need to have either the firmware say it's OK to migrate to the destination (using the existing PSP mechanism) or get the source MH to verify a quote from the destination. [Somewhere along the line, if you're not using the PSP, I think you also need to check the guest policy to check it is allowed to migrate]. Dave > James > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2021-08-23 12:26 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-08-16 13:25 [RFC PATCH 00/13] Add support for Mirror VM Ashish Kalra 2021-08-16 13:26 ` [RFC PATCH 01/13] machine: Add mirrorvcpus=N suboption to -smp Ashish Kalra 2021-08-16 21:23 ` Eric Blake 2021-08-16 21:23 ` Eric Blake 2021-08-16 13:27 ` [RFC PATCH 02/13] hw/boards: Add mirror_vcpu flag to CPUArchId Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 03/13] hw/i386: Mark mirror vcpus in possible_cpus Ashish Kalra 2021-08-16 13:27 ` [RFC PATCH 04/13] hw/acpi: Don't include mirror vcpus in ACPI tables Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 05/13] cpu: Add boolean mirror_vcpu field to CPUState Ashish Kalra 2021-08-16 13:28 ` [RFC PATCH 06/13] hw/i386: Set CPUState.mirror_vcpu=true for mirror vcpus Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 07/13] kvm: Add Mirror VM ioctl and enable cap interfaces Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 08/13] kvm: Add Mirror VM support Ashish Kalra 2021-08-16 13:29 ` [RFC PATCH 09/13] kvm: create Mirror VM and share primary VM's encryption context Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 10/13] softmmu/cpu: Skip mirror vcpu's for pause, resume and synchronization Ashish Kalra 2021-08-16 13:30 ` [RFC PATCH 11/13] kvm/apic: Disable in-kernel APIC support for mirror vcpu's Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 12/13] hw/acpi: disable modern CPU hotplug interface " Ashish Kalra 2021-08-16 13:31 ` [RFC PATCH 13/13] hw/i386/pc: reduce fw_cfg boot cpu count taking into account " Ashish Kalra 2021-08-16 14:01 ` [RFC PATCH 00/13] Add support for Mirror VM Claudio Fontana 2021-08-16 14:01 ` Claudio Fontana 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:15 ` Paolo Bonzini 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 14:23 ` Daniel P. Berrangé 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:00 ` Paolo Bonzini 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:16 ` Daniel P. Berrangé 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 15:35 ` Paolo Bonzini 2021-08-16 14:44 ` Ashish Kalra 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 14:58 ` Paolo Bonzini 2021-08-16 15:13 ` Ashish Kalra 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:38 ` Paolo Bonzini 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-16 15:48 ` Dr. David Alan Gilbert 2021-08-18 10:31 ` Ashish Kalra 2021-08-18 11:25 ` James Bottomley 2021-08-18 11:25 ` James Bottomley 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:31 ` Dr. David Alan Gilbert 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:35 ` James Bottomley 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 15:43 ` Dr. David Alan Gilbert 2021-08-18 16:28 ` James Bottomley 2021-08-18 16:28 ` James Bottomley 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 17:30 ` Dr. David Alan Gilbert 2021-08-18 18:51 ` James Bottomley 2021-08-18 18:51 ` James Bottomley 2021-08-18 19:47 ` Paolo Bonzini 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 17:23 ` Dr. David Alan Gilbert 2021-08-16 20:53 ` Paolo Bonzini 2021-08-16 23:53 ` Steve Rutherford 2021-08-16 23:53 ` Steve Rutherford 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 7:05 ` Michael S. Tsirkin 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 8:38 ` Dr. David Alan Gilbert 2021-08-17 14:08 ` Ashish Kalra 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 16:32 ` Paolo Bonzini 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 20:50 ` Tobin Feldman-Fitzthum 2021-08-17 22:04 ` Steve Rutherford 2021-08-17 22:04 ` Steve Rutherford 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 15:32 ` Tobin Feldman-Fitzthum 2021-08-18 19:04 ` Dr. David Alan Gilbert 2021-08-18 19:04 ` Dr. David Alan Gilbert 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-18 21:42 ` Tobin Feldman-Fitzthum 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 8:22 ` Dr. David Alan Gilbert 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:06 ` James Bottomley 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 14:28 ` Dr. David Alan Gilbert 2021-08-19 22:10 ` James Bottomley 2021-08-19 22:10 ` James Bottomley 2021-08-23 12:26 ` Dr. David Alan Gilbert [this message] 2021-08-23 12:26 ` Dr. David Alan Gilbert 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-23 16:28 ` Tobin Feldman-Fitzthum 2021-08-19 14:07 ` Tobin Feldman-Fitzthum 2021-08-19 14:07 ` Tobin Feldman-Fitzthum 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 23:20 ` Paolo Bonzini 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 21:54 ` Steve Rutherford 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:37 ` Paolo Bonzini 2021-08-17 22:57 ` James Bottomley 2021-08-17 22:57 ` James Bottomley 2021-08-17 23:10 ` Steve Rutherford 2021-08-17 23:10 ` Steve Rutherford 2021-08-18 2:49 ` James Bottomley 2021-08-18 2:49 ` James Bottomley 2021-08-18 14:06 ` Ashish Kalra 2021-08-18 17:07 ` Ashish Kalra 2021-08-16 15:07 Tobin Feldman-Fitzthum 2021-08-16 15:07 ` Tobin Feldman-Fitzthum
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YSOT87eg4UjCG+jG@work-vm \ --to=dgilbert@redhat.com \ --cc=Ashish.Kalra@amd.com \ --cc=brijesh.singh@amd.com \ --cc=dovmurik@linux.vnet.ibm.com \ --cc=ehabkost@redhat.com \ --cc=frankeh@us.ibm.com \ --cc=jejb@linux.ibm.com \ --cc=kvm@vger.kernel.org \ --cc=mst@redhat.com \ --cc=pbonzini@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=richard.henderson@linaro.org \ --cc=srutherford@google.com \ --cc=thomas.lendacky@amd.com \ --cc=tobin@ibm.com \ --cc=tobin@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.