Re: [libvirt] New Feature: Intel MKTME Support
Hi Daniel,
MKTME supports encryption of memory(NVRAM) for Virtual Machines(hardware based
encryption). This features uses Linux kernel key ring services, i.e. Operations like,
allocation and clearing of secret/keys. These keys are used in encryption of memory in
Virtual machines. So MKTME provided encryption of entire RAM of a VM, allocated to it,
thereby supporting VM isolation feature.
So to implement this functionality in openstack
1. Nova executes host capability command, to identify if the hardware support for MKTME
(openstack xml host_capabilities command request -->> libvirt ->> QEMU)-- qemu
monitoring commands
2. Once the hardware is identified and if user configures mktme policy to launch a VM in
openstack, Nova
a. Sends a new xml command request to libvirt, then libvirt makes a syscall to Linux
kernel key ring services to get/retrieve a key/key-handle for this VM ( we are not sure at
this point whether to make this syscall directly in libvirt or through QEMU)
b. Once the key is retrieved , Nova compute executes a VM launch xml command request to
libvirt with a new argument called mktme- keyhandle , which will send a command request to
QEMU to launch the VM( We are in process of supporting this functionality in QEMU for
VM launch operation, with new mktme-key argument)
We are not sure , where to make this(2a) kernel system calls at present and looking for
suggestions.
Thanks
karim
-----Original Message-----
From: Daniel P. Berrangé [mailto:berrange@redhat.com]
Sent: Tuesday, March 5, 2019 2:15 AM
To: Mohammed, Karimullah <karimullah.mohammed(a)intel.com>
Cc: Carvalho, Larkins L <larkins.l.carvalho(a)intel.com>; libvir-list(a)redhat.com
Subject: Re: [libvirt] New Feature: Intel MKTME Support
On Mon, Mar 04, 2019 at 10:44:12PM +0000, Mohammed, Karimullah wrote:
Hi Daniel,
Thank you for answering our questions. We will soon send our design
documentation for a review/discussion for MKTME enablement. This is
not a complex feature , but in any case we wanted to start off with a
design review , so that we get approved forehand for what we will be
implementing.
I would like to take liberty in asking you question related to
Libvirt, I did ask this question in IRC channel did not get any responses.
Can Libvirt directly make an kernel system call? i.e for a XML request
if we have to make a kernel syscall, can we directly make kernel
syscall in Libvirt or do we have to go through QEMU to process the
request. We would like to know the norm of calling kernel system calls in Libvirt.
It is hard to give a general answer to that without understanding the context of the
system call in question.
Libvirt can certainly make arbitrary system calls as it needs. If the system call is
discovering information that has an impact on QEMU functionality though, it may be better
to query it via QEMU.
If you can provide more detail & usage context we can give a more useful answer.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|