lkml.org 
[lkml]   [2024]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH v4 0/4] x86/snp: Add kexec support
    From
    Hey Ashish,

    On 09.04.24 22:42, Ashish Kalra wrote:
    > From: Ashish Kalra <ashish.kalra@amd.com>
    >
    > The patchset adds bits and pieces to get kexec (and crashkernel) work on
    > SNP guest.


    With this patch set (and similar for the TDX one), you enable the
    typical kdump case, which is great!

    However, if a user is running with direct kernel boot - which is very
    typical in SEV-SNP setup, especially for Kata Containers and similar -
    the initial launch measurement is a natural indicator of the target
    environment. Kexec basically allows them to completely bypass that: You
    would be able to run a completely different environment than the one you
    measure through the launch digest. I'm not sure it's a good idea to even
    allow that by default in CoCo environments - at least not if the kernel
    is locked down.

    Do you have any plans to build a CoCo native kexec where you allow a VM
    to create a new VM context with a guest provided seed? The new context
    could rerun all of the attestation and so enable users to generate a new
    launch digest. If you then atomically swap into the new context, it
    would in turn enable them to natively "kexec" into a completely new VM
    context including measurements.

    I understand that an SVSM + TPM implementation may help to some extent
    here by integrating with IMA and adding the new kernel into the IMA log.
    But that quickly becomes very convoluted (hence difficult to assess
    correctness for) and the same measurement question arises just one level
    up then: How do you update your SVSM while maintaining a full
    measurement and trust chain?


    Thanks,

    Alex


    \
     
     \ /
      Last update: 2024-05-27 18:12    [W:4.077 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site