[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support
From: |
Michael S. Tsirkin |
Subject: |
Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support |
Date: |
Wed, 14 Sep 2016 19:20:42 +0300 |
On Wed, Sep 14, 2016 at 11:10:54AM -0500, Brijesh Singh wrote:
>
> > > Various commands and parameters are documented [1]
> > >
> > > [1] http://support.amd.com/TechDocs/55766_SEV-KM%20API_Spec.pdf
> >
> > If I understand correctly, the docs describe the firmware
> > interface. The interface provided by QEMU is not the same thing,
> > and needs to be documented as well (even if it contains pointers
> > to sections or tables in the firmware interface docs).
> >
> > Some of the questions I have about the fields are:
> > * Do we really need the user to provide all the options below?
> > * Can't QEMU or KVM calculate vcpu_count/vcpu_length/vcpu_mask,
> > for example?
>
> Good question, I don't think we need to get this information from guest
> owner and it can be calculated from KVM. I will check with security folks on
> how this information is used in measurement generation and make the changes
> accordingly.
>
> > * Is bit 0 (KS) the only bit that can be set on flags? If so, why
> > not a boolean "ks" option?
> Agreed. I will fix in v2.
>
> > * Is "policy" the guest policy structure described at page 23? If
> > so, why exposing the raw value instead of separate fields for
> > each bit/field in the structure? (and only for the ones that
> > are supposed to be set by the user)
>
> Yes policy is described in chapter 3, page 23. I am open to separate the
> fields.
> Let me know if something like this works
>
> sev-launch-rule,flags.ks=0,policy.dbg=0,policy.ks=0,policy.nosend=0,...
My question is, does all of it have to be sev specific?
For example, add a generic flag to block debug commands from monitor.
When blocked, and if sev happens to be enabled, you can run guest with
debug disabled.
--
MST
- [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, (continued)
- [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Brijesh Singh, 2016/09/13
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Eduardo Habkost, 2016/09/13
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Brijesh Singh, 2016/09/13
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Michael S. Tsirkin, 2016/09/13
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Eduardo Habkost, 2016/09/13
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Daniel P. Berrange, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Eduardo Habkost, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Daniel P. Berrange, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Brijesh Singh, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Daniel P. Berrange, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support,
Michael S. Tsirkin <=
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Brijesh Singh, 2016/09/14
- Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Michael S. Tsirkin, 2016/09/14
Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support, Daniel P. Berrange, 2016/09/14
[Qemu-devel] [RFC PATCH v1 18/22] i386: clear C-bit in SEV guest page table walk, Brijesh Singh, 2016/09/13
[Qemu-devel] [RFC PATCH v1 15/22] i386: sev: register RAM read/write ops for BIOS and PC.RAM region, Brijesh Singh, 2016/09/13