On Fri, Apr 26, 2024, Michael Roth wrote: > On Fri, Apr 26, 2024 at 12:57:08PM -0700, Sean Christopherson wrote: > > On Fri, Apr 26, 2024, Michael Roth wrote: > > What is "management"? I assume its some userspace daemon? > > It could be a daemon depending on cloud provider, but the main example > we have in mind is something more basic like virtee[1] being used to > interactively perform an update at the command-line. E.g. you point it > at the new VLEK, the new cert, and it will handle updating the certs at > some known location and issuing the SNP_LOAD_VLEK command. With this ^^^^^^^^^^^^^^^^^^^ > interface, it can take the additional step of PAUSE'ing attestations > before performing either update to keep the 2 actions in sync with the > guest view. ... > > without having to bounce through the kernel. It doesn't even require a push > > model, e.g. wrap/redirect the certs with a file that has a "pause" flag and a > > sequence counter. > > We could do something like flag the certificate file itself, it does > sounds less painful than the above. But what defines that spec? Whoever defines "some known location". And it doesn't need to be a file wrapper, e.g. put the cert in a directory along with a lock. Actually, IIUC, there doesn't even need to be a separate lock file. I know very little about userspace programming, but common sense and a quick search tells me that file locks are a solved problem. E.g. it took me ~5 minutes of Googling to come up with this, which AFAICT does exactly what you want. touch ~/vlek.cert ( flock -e 200 echo "Locked the cert, sleeping for 10 seconds" sleep 10 echo "Igor, it's alive!!!!!!" ) 200< vlek.cert touch ~/vlek.cert ( flock -s 201 echo "Got me a shared lock, no updates for you!" ) 201< vlek.cert
