On Tue, Mar 05, 2019 at 05:23:04PM +0000, Mohammed, Karimullah wrote: > Hi Daniel, > MKTME supports encryption of memory(NVRAM) for Virtual Machines(hardware > based encryption). This features uses Linux kernel key ring services, i.e. > Operations like, allocation and clearing of secret/keys. These keys are > used in encryption of memory in Virtual machines. So MKTME provided > encryption of entire RAM of a VM, allocated to it, thereby supporting VM > isolation feature. > > So to implement this functionality in openstack > > 1. Nova executes host capability command, to identify if the hardware > support for MKTME (openstack xml host_capabilities command request > -->> libvirt ->> QEMU)-- qemu monitoring commands > 2. Once the hardware is identified and if user configures mktme policy > to launch a VM in openstack, Nova > a. Sends a new xml command request to libvirt, then libvirt makes > a syscall to Linux kernel key ring services to get/retrieve a > key/key-handle for this VM ( we are not sure at this point > whether to make this syscall directly in libvirt or through QEMU) What will openstack do with the key / key-handle it gets back from libvirt ? Why does it need to allocate one before starting the VMs, as opposed to letting QEMU or libvirt allocate it during startup ? By allocating it separately from the VM start request it opens the possibility for leaking keys, if VM startup fails and the mgmt app doesn't release the now unused key. > b. Once the key is retrieved , Nova compute executes a VM launch > xml command request to libvirt with a new argument called > mktme- keyhandle , which will send a command request to QEMU > to launch the VM( We are in process of supporting this > functionality in QEMU for VM launch operation, with new > mktme-key argument) > > We are not sure , where to make this(2a) kernel system calls at present > and looking for suggestions. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
