On Fri, Mar 17, 2017 at 03:45:26PM +0100, Paolo Bonzini wrote: > Yes, and I'd like that to be done with a new data section rather than a > special KVM hook.
Can you give more details about how pls? Or is there already an example for that somewhere in the kvm code? > I have no idea. SEV-ES seems to be very hard to set up at the beginning > of the kernel bootstrap. There's all sorts of chicken and egg problems, > as well as complicated handshakes between the firmware and the guest, > and the way to do it also depends on the trust and threat models. > > A much simpler way is to just boot under a trusted hypervisor, do > "modprobe sev-es" and save a snapshot of the guest. Then you sign the > snapshot and pass it to your cloud provider. Right, especially the early trapping could be a pain. I don't think this is cast in stone yet, though... We'll see. Thanks. -- Regards/Gruss, Boris. SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel