| Date | Wed, 8 Nov 2023 12:40:02 +0100 | Subject | Re: [RFC 0/33] KVM: x86: hyperv: Introduce VSM support | From | Alexander Graf <> |
| |
Hey Nicolas,
On 08.11.23 12:17, Nicolas Saenz Julienne wrote: > Hyper-V's Virtual Secure Mode (VSM) is a virtualisation security feature > that leverages the hypervisor to create secure execution environments > within a guest. VSM is documented as part of Microsoft's Hypervisor Top > Level Functional Specification [1]. Security features that build upon > VSM, like Windows Credential Guard, are enabled by default on Windows 11, > and are becoming a prerequisite in some industries. > > This RFC series introduces the necessary infrastructure to emulate VSM > enabled guests. It is a snapshot of the progress we made so far, and its > main goal is to gather design feedback. Specifically on the KVM APIs we > introduce. For a high level design overview, see the documentation in > patch 33. > > Additionally, this topic will be discussed as part of the KVM > Micro-conference, in this year's Linux Plumbers Conference [2].
Awesome, looking forward to the session! :)
> The series is accompanied by two repositories: > - A PoC QEMU implementation of VSM [3]. > - VSM kvm-unit-tests [4]. > > Note that this isn't a full VSM implementation. For now it only supports > 2 VTLs, and only runs on uniprocessor guests. It is capable of booting > Windows Sever 2016/2019, but is unstable during runtime.
How much of these limitations are inherent in the current set of patches? What is missing to go beyond 2 VTLs and into SMP land? Anything that will require API changes?
Alex
Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879
|