On Fri, Mar 17, 2017 at 03:45:26PM +0100, Paolo Bonzini wrote:
> Yes, and I'd like that to be done with a new data section rather than a
> special KVM hook.
Can you give more details about how pls? Or is there already an example for that
somewhere in the kvm code?
> I have no idea. SEV-ES seems to be very hard to set up at the beginning
> of the kernel bootstrap. There's all sorts of chicken and egg problems,
> as well as complicated handshakes between the firmware and the guest,
> and the way to do it also depends on the trust and threat models.
>
> A much simpler way is to just boot under a trusted hypervisor, do
> "modprobe sev-es" and save a snapshot of the guest. Then you sign the
> snapshot and pass it to your cloud provider.
Right, especially the early trapping could be a pain. I don't think this
is cast in stone yet, though...
We'll see.
Thanks.
--
Regards/Gruss,
Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--
