From: "Michael S. Tsirkin" <mst@redhat.com>
To: Brijesh Singh <brijesh.singh@amd.com>
Cc: Eduardo Habkost <ehabkost@redhat.com>,
crosthwaite.peter@gmail.com, armbru@redhat.com,
p.fedin@samsung.com, qemu-devel@nongnu.org,
lcapitulino@redhat.com, pbonzini@redhat.com, rth@twiddle.net,
"Daniel P. Berrange" <berrange@redhat.com>
Subject: Re: [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support
Date: Wed, 14 Sep 2016 23:23:38 +0300 [thread overview]
Message-ID: <20160914222536-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <6e6c9859-cd54-193a-47b5-efbb43d84ec6@amd.com>
On Wed, Sep 14, 2016 at 01:46:09PM -0500, Brijesh Singh wrote:
> 7) Guest owner validates the measurement. If measurement matches then we are
> good to launch the guest. This should ensure that bootcode was not
> compromised by hypervisor.
As hypervisor can e.g. execute said code in any order (without touching
protected memory) this seems rather like adding asserts in code at
random points. Frankly if one is so worried about the boot sequence,
just send an already booted guest to the cloud provider.
But anyway, that's beside the point. My point is that all this
measurement dance is orthogonal to memory encryption.
It happens to be part of the same AMD CPU, but it
might not be on other CPUs, and I don't see why
should command line/QOM APIs tie us to what AMD did.
--
MST
next prev parent reply other threads:[~2016-09-14 20:23 UTC|newest]
Thread overview: 125+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-13 14:46 [Qemu-devel] [RFC PATCH v1 00/22] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2016-09-13 14:46 ` [Qemu-devel] [RFC PATCH v1 01/22] exec: add guest RAM read/write ops Brijesh Singh
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 02/22] cpu-common: add debug version of physical memory read/write Brijesh Singh
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 03/22] monitor: use debug version of physical memory read api Brijesh Singh
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 04/22] memattrs: add SEV debug attrs Brijesh Singh
2016-09-13 23:00 ` Paolo Bonzini
2016-09-14 20:30 ` Brijesh Singh
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 05/22] i386: add new option to enable SEV guest Brijesh Singh
2016-09-13 22:41 ` Paolo Bonzini
2016-09-14 8:41 ` Daniel P. Berrange
2016-09-14 9:11 ` Paolo Bonzini
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 06/22] sev: add initial SEV support Brijesh Singh
2016-09-13 15:58 ` Eduardo Habkost
2016-09-13 19:54 ` Brijesh Singh
2016-09-13 20:10 ` Michael S. Tsirkin
2016-09-13 22:00 ` Eduardo Habkost
2016-09-14 8:30 ` Daniel P. Berrange
2016-09-14 11:54 ` Eduardo Habkost
2016-09-14 11:58 ` Daniel P. Berrange
2016-09-14 16:10 ` Brijesh Singh
2016-09-14 16:13 ` Daniel P. Berrange
2016-09-14 16:20 ` Michael S. Tsirkin
2016-09-14 18:46 ` Brijesh Singh
2016-09-14 20:23 ` Michael S. Tsirkin [this message]
2016-09-14 8:37 ` Daniel P. Berrange
2016-09-13 14:47 ` [Qemu-devel] [RFC PATCH v1 07/22] sev: add SEV launch start command Brijesh Singh
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 08/22] sev: add SEV launch update command Brijesh Singh
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 09/22] sev: add SEV launch finish command Brijesh Singh
2016-09-13 22:15 ` Eduardo Habkost
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command Brijesh Singh
2016-09-14 2:28 ` Michael S. Tsirkin
2016-09-14 8:57 ` Paolo Bonzini
2016-09-14 13:05 ` Michael S. Tsirkin
2016-09-14 13:07 ` Paolo Bonzini
2016-09-14 13:23 ` Daniel P. Berrange
2016-09-14 13:32 ` Michael S. Tsirkin
2016-09-14 13:37 ` Daniel P. Berrange
2016-09-14 13:50 ` Michael S. Tsirkin
2016-09-14 14:08 ` Eduardo Habkost
2016-09-14 14:14 ` Paolo Bonzini
2016-09-14 14:38 ` Michael S. Tsirkin
2016-09-14 15:17 ` Michael S. Tsirkin
2016-09-14 14:15 ` Daniel P. Berrange
2016-09-14 14:48 ` Michael S. Tsirkin
2016-09-14 15:06 ` Daniel P. Berrange
2016-09-14 15:46 ` Michael S. Tsirkin
2016-09-14 17:35 ` Eduardo Habkost
2016-09-14 22:05 ` Michael S. Tsirkin
2016-09-15 14:58 ` Eduardo Habkost
2016-09-14 13:27 ` [Qemu-devel] [PATCH v2] virtio_pci: Limit DMA mask to 44 bits for legacy virtio devices Michael S. Tsirkin
2016-09-14 13:36 ` [Qemu-devel] [RFC PATCH v1 10/22] sev: add SEV debug decrypt command Brijesh Singh
2016-09-14 13:48 ` Michael S. Tsirkin
2016-09-14 14:19 ` Paolo Bonzini
2016-09-14 15:02 ` Michael S. Tsirkin
2016-09-14 16:53 ` Paolo Bonzini
2016-09-14 18:15 ` Michael S. Tsirkin
2016-09-14 18:45 ` Paolo Bonzini
2016-09-14 19:24 ` Michael S. Tsirkin
2016-09-14 19:58 ` Paolo Bonzini
2016-09-14 20:36 ` Michael S. Tsirkin
2016-09-14 20:44 ` Paolo Bonzini
2016-09-14 21:25 ` Brijesh Singh
2016-09-14 21:38 ` Michael S. Tsirkin
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 11/22] sev: add SEV debug encrypt command Brijesh Singh
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 12/22] sev: add SEV guest status command Brijesh Singh
2016-09-13 14:48 ` [Qemu-devel] [RFC PATCH v1 13/22] hmp: update 'info kvm' to display SEV status Brijesh Singh
2016-09-13 16:09 ` Eric Blake
2016-09-14 16:16 ` Brijesh Singh
2016-09-15 4:13 ` Michael S. Tsirkin
2016-09-13 23:01 ` Paolo Bonzini
2016-09-13 14:49 ` [Qemu-devel] [RFC PATCH v1 14/22] sev: provide SEV-enabled guest RAM read/write ops Brijesh Singh
2016-09-13 14:49 ` [Qemu-devel] [RFC PATCH v1 15/22] i386: sev: register RAM read/write ops for BIOS and PC.RAM region Brijesh Singh
2016-09-13 23:05 ` Paolo Bonzini
2016-09-14 20:59 ` Brijesh Singh
2016-09-14 21:00 ` Paolo Bonzini
2016-09-14 21:47 ` Brijesh Singh
2016-09-14 21:52 ` Paolo Bonzini
2016-09-14 22:06 ` Brijesh Singh
2016-09-14 22:17 ` Paolo Bonzini
2016-09-14 22:26 ` Brijesh Singh
2016-09-15 14:13 ` Brijesh Singh
2016-09-15 15:19 ` Paolo Bonzini
2016-09-13 14:49 ` [Qemu-devel] [RFC PATCH v1 17/22] target-i386: add cpuid Fn8000_001f Brijesh Singh
2016-09-13 23:07 ` Paolo Bonzini
2016-09-21 16:20 ` Brijesh Singh
2016-09-21 16:24 ` Paolo Bonzini
2016-09-21 18:21 ` Eduardo Habkost
2016-09-13 14:49 ` [Qemu-devel] [RFC PATCH v1 18/22] i386: clear C-bit in SEV guest page table walk Brijesh Singh
2016-09-13 14:49 ` [Qemu-devel] [RFC PATCH v1 19/22] exec: set debug attribute in SEV-enabled guest Brijesh Singh
2016-09-13 23:06 ` Paolo Bonzini
2016-09-13 14:50 ` [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode Brijesh Singh
2016-09-13 18:39 ` Michael S. Tsirkin
2016-09-13 20:46 ` Brijesh Singh
2016-09-13 20:55 ` Michael S. Tsirkin
2016-09-13 22:53 ` Paolo Bonzini
2016-09-14 2:33 ` Michael S. Tsirkin
2016-09-14 8:58 ` Paolo Bonzini
2016-09-21 18:00 ` [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode Message-ID: <20160921205731-mutt-send-email-mst@kernel.org> Michael S. Tsirkin
2016-09-14 12:09 ` [Qemu-devel] [RFC PATCH v1 20/22] fw_cfg: sev: disable dma in real mode Eduardo Habkost
2016-09-14 13:01 ` Paolo Bonzini
2016-09-14 13:14 ` Michael S. Tsirkin
2016-09-14 13:51 ` Eduardo Habkost
2016-09-14 16:10 ` Michael S. Tsirkin
2016-09-14 17:25 ` Eduardo Habkost
2016-09-21 18:03 ` Michael S. Tsirkin
2016-09-21 18:19 ` Brijesh Singh
2016-09-13 14:50 ` [Qemu-devel] [RFC PATCH v1 21/22] hw: add pre and post system reset callback Brijesh Singh
2016-09-13 22:47 ` Paolo Bonzini
2016-09-14 16:19 ` Brijesh Singh
2016-09-13 14:50 ` [Qemu-devel] [RFC PATCH v1 22/22] loader: reload bios image on ROM reset in SEV-enabled guest Brijesh Singh
2016-09-13 18:47 ` Michael S. Tsirkin
2016-09-13 22:59 ` Paolo Bonzini
2016-09-14 2:38 ` Michael S. Tsirkin
2016-09-14 20:29 ` Brijesh Singh
2016-09-14 20:38 ` Paolo Bonzini
2016-09-14 21:09 ` Michael S. Tsirkin
2016-09-14 21:11 ` Paolo Bonzini
2016-09-14 21:24 ` Brijesh Singh
2016-09-13 15:20 ` [Qemu-devel] [RFC PATCH v1 00/22] x86: Secure Encrypted Virtualization (AMD) Eduardo Habkost
[not found] ` <147377816978.11859.942423377333907417.stgit@brijesh-build-machine>
2016-09-13 18:37 ` [Qemu-devel] [RFC PATCH v1 16/22] i386: pc: load OS images at fixed location in SEV-enabled guest Michael S. Tsirkin
2016-09-21 15:55 ` Brijesh Singh
2016-09-21 15:58 ` Paolo Bonzini
2016-09-21 16:08 ` Brijesh Singh
2016-09-21 16:17 ` Paolo Bonzini
2016-09-14 2:55 ` [Qemu-devel] [RFC PATCH v1 00/22] x86: Secure Encrypted Virtualization (AMD) Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160914222536-mutt-send-email-mst@kernel.org \
--to=mst@redhat.com \
--cc=armbru@redhat.com \
--cc=berrange@redhat.com \
--cc=brijesh.singh@amd.com \
--cc=crosthwaite.peter@gmail.com \
--cc=ehabkost@redhat.com \
--cc=lcapitulino@redhat.com \
--cc=p.fedin@samsung.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).