mirror of
https://github.com/libvirt/libvirt.git
synced 2025-02-25 18:55:26 -06:00
conf: Introduce launch-security element in domain
The launch-security element can be used to define the security model to use when launching a domain. Currently we support 'sev'. When 'sev' is used, the VM will be launched with AMD SEV feature enabled. SEV feature supports running encrypted VM under the control of KVM. Encrypted VMs have their pages (code and data) secured such that only the guest itself has access to the unencrypted version. Each encrypted VM is associated with a unique encryption key; if its data is accessed to a different entity using a different key the encrypted guests data will be incorrectly decrypted, leading to unintelligible data. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Erik Skultety <eskultet@redhat.com>
This commit is contained in:
committed by
Erik Skultety
parent
6596ac4235
commit
e5791a0306
24
tests/genericxml2xmlindata/launch-security-sev.xml
Normal file
24
tests/genericxml2xmlindata/launch-security-sev.xml
Normal file
@@ -0,0 +1,24 @@
|
||||
<domain type='kvm'>
|
||||
<name>QEMUGuest1</name>
|
||||
<uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
|
||||
<memory unit='KiB'>219100</memory>
|
||||
<currentMemory unit='KiB'>219100</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-1.0'>hvm</type>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
</devices>
|
||||
<launch-security type='sev'>
|
||||
<cbitpos>47</cbitpos>
|
||||
<reduced-phys-bits>1</reduced-phys-bits>
|
||||
<policy>0x0001</policy>
|
||||
<dh-cert>AQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAAAQAAAAAOAAA</dh-cert>
|
||||
<session>IHAVENOIDEABUTJUSTPROVIDINGASTRING</session>
|
||||
</launch-security>
|
||||
</domain>
|
||||
Reference in New Issue
Block a user