lkml.org 
[lkml]   [2021]   [Apr]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [RFC v2] KVM: x86: Support KVM VMs sharing SEV context
Date
On 09/04/21 03:18, James Bottomley wrote:
> If you want to share ASIDs you have to share the firmware that the
> running VM has been attested to. Once the VM moves from LAUNCH to
> RUNNING, the PSP won't allow the VMM to inject any more firmware or do
> any more attestations.

I think Steve is suggesting to just change the RIP of the mirror VM,
which would work for SEV but not SEV-ES (the RAM migration helper won't
*suffice* for SEV-ES, but perhaps you could use the PSP to migrate the
VMSA and the migration helper for the rest?).

If you want to use a single firmware binary, SEC does almost no I/O
accesses (the exception being the library constructor from
SourceLevelDebugPkg's SecPeiDebugAgentLib), so you probably can:

- detect the migration helper hardware in PlatformPei, either from
fw_cfg or based on the lack of it

- either divert execution to the migration helper through
gEfiEndOfPeiSignalPpiGuid, or if it's too late add a new boot mode and
PPI to DxeLoadCore.

Paolo

> What you mirror after this point can thus only
> contain what has already been measured or what the guest added. This
> is why we think there has to be a new entry path into the VM for the
> mirror vCPU.

\
 
 \ /
  Last update: 2021-04-09 10:14    [W:0.040 / U:1.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site