From: Andrei Semenov <andrei.semenov@vates.fr>
To: xen-devel@lists.xenproject.org
Cc: "Andrei Semenov" <andrei.semenov@vates.fr>,
"Jan Beulich" <jbeulich@suse.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Roger Pau Monné" <roger.pau@citrix.com>,
"George Dunlap" <george.dunlap@citrix.com>,
"Julien Grall" <julien@xen.org>,
"Stefano Stabellini" <sstabellini@kernel.org>
Subject: [PATCH v1 0/2] AMD SEV initial work
Date: Wed, 10 Apr 2024 17:36:35 +0200 [thread overview]
Message-ID: <cover.1712759753.git.andrei.semenov@vates.fr> (raw)
In-Reply-To: <cover.1712759753.git.andrei.semenov@vates.fr>
///HERE YOU GO
Andrei Semenov (2):
Implemented AMD SEV discovery and enabling.
Implemented Amd Secure Processor device driver
xen/arch/x86/cpu/amd.c | 53 ++
xen/arch/x86/hvm/svm/Makefile | 1 +
xen/arch/x86/hvm/svm/sev.c | 4 +
xen/arch/x86/include/asm/cpufeature.h | 3 +
xen/arch/x86/include/asm/cpufeatures.h | 2 +
xen/arch/x86/include/asm/msr-index.h | 1 +
xen/arch/x86/include/asm/psp-sev.h | 655 ++++++++++++++++++++
xen/arch/x86/include/asm/sev.h | 11 +
xen/drivers/Kconfig | 2 +
xen/drivers/Makefile | 1 +
xen/drivers/crypto/Kconfig | 10 +
xen/drivers/crypto/Makefile | 1 +
xen/drivers/crypto/asp.c | 808 +++++++++++++++++++++++++
xen/include/xen/types.h | 2 +-
14 files changed, 1553 insertions(+), 1 deletion(-)
create mode 100644 xen/arch/x86/hvm/svm/sev.c
create mode 100644 xen/arch/x86/include/asm/psp-sev.h
create mode 100644 xen/arch/x86/include/asm/sev.h
create mode 100644 xen/drivers/crypto/Kconfig
create mode 100644 xen/drivers/crypto/Makefile
create mode 100644 xen/drivers/crypto/asp.c
--
2.35.3
WARNING: multiple messages have this Message-ID (diff)
From: Andrei Semenov <andrei.semenov@vates.fr>
To: xen-devel@lists.xenproject.org
Cc: "Andrei Semenov" <andrei.semenov@vates.fr>,
"Jan Beulich" <jbeulich@suse.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Roger Pau Monné" <roger.pau@citrix.com>,
"George Dunlap" <george.dunlap@citrix.com>,
"Julien Grall" <julien@xen.org>,
"Stefano Stabellini" <sstabellini@kernel.org>
Subject: [PATCH v1 0/2] Starting AMD SEV work
Date: Wed, 10 Apr 2024 17:36:34 +0200 [thread overview]
Message-ID: <cover.1712759753.git.andrei.semenov@vates.fr> (raw)
Message-ID: <20240410153634.eSS2rDX1-jwpEsKifmvtr86Frpg687lJ6TlODTsGxuc@z> (raw)
This patch series initiate work on AMD SEV technology implementation in Xen.
SEV stands for "Secure Encrypted Virtualization" and allows the memory contents
of a VM to be encrypted with a key unique to this VM. In this way the neither
other VMs nor hypervisor can't read the memory content of this "encrypted"
VM.
In order to create and to run such a VM different layers of software must
interact (bascally Xen hypevisor, Xen toolstack in dom0 and the encrypted VM
itself).
In this work we start with discovering and enabling SEV feature on the platform.
The second patch ports AMD Secure Processor driver on Xen. This AMD Secure
Processor device (a.k.a PSP) is the way the different software layers interact
with AMD firmware/hardware to manage and run the encrypted VM.
Actually there's two modes of functionning of the ASP driver. The "polling" mode
and the "interrupt" mode. The interrupt mode raises some questions about how we
put the client thread to sleep (wait for interrupt). The actual way, based on
waitqueue, have two major inconvinients.
- compatibility with Intel Control-flow Enfocement (shadow stack)
- requests serialization (locking)
So, actually if CET is enabled on the platform all requests will be done by the
driver in "polling" mode. As with requests serialization, the "interrupt" mode
actually assumes the serialization is done by the driver client.
Obviously, I hope there wll be discussions with the community on these 2
inconvienients to find out more efficient solutions.
Andrei Semenov (2):
Implemented AMD SEV discovery and enabling.
Implemented Amd Secure Processor device driver
xen/arch/x86/cpu/amd.c | 53 ++
xen/arch/x86/hvm/svm/Makefile | 1 +
xen/arch/x86/hvm/svm/sev.c | 4 +
xen/arch/x86/include/asm/cpufeature.h | 3 +
xen/arch/x86/include/asm/cpufeatures.h | 2 +
xen/arch/x86/include/asm/msr-index.h | 1 +
xen/arch/x86/include/asm/psp-sev.h | 655 ++++++++++++++++++++
xen/arch/x86/include/asm/sev.h | 11 +
xen/drivers/Kconfig | 2 +
xen/drivers/Makefile | 1 +
xen/drivers/crypto/Kconfig | 10 +
xen/drivers/crypto/Makefile | 1 +
xen/drivers/crypto/asp.c | 808 +++++++++++++++++++++++++
xen/include/xen/types.h | 2 +-
14 files changed, 1553 insertions(+), 1 deletion(-)
create mode 100644 xen/arch/x86/hvm/svm/sev.c
create mode 100644 xen/arch/x86/include/asm/psp-sev.h
create mode 100644 xen/arch/x86/include/asm/sev.h
create mode 100644 xen/drivers/crypto/Kconfig
create mode 100644 xen/drivers/crypto/Makefile
create mode 100644 xen/drivers/crypto/asp.c
--
2.35.3
next parent reply other threads:[~2024-04-10 15:37 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-10 15:36 Andrei Semenov [this message]
2024-04-10 15:36 ` [PATCH v1 0/2] Starting AMD SEV work Andrei Semenov
2024-04-10 15:36 ` [PATCH v1 0/2] AMD SEV initial work Andrei Semenov
2024-04-10 15:36 ` [PATCH v1 1/2] Implemented AMD SEV discovery and enabling Andrei Semenov
2024-04-11 18:32 ` Andrew Cooper
2024-04-12 14:06 ` Andrei Semenov
2024-04-12 14:38 ` Vaishali Thakkar
2024-04-12 15:07 ` Andrew Cooper
2024-04-12 15:18 ` Vaishali Thakkar
2024-04-18 8:13 ` Jan Beulich
2024-04-18 13:29 ` Andrei Semenov
2024-04-10 15:36 ` [PATCH v1 2/2] Implemented Amd Secure Processor device driver Andrei Semenov
2024-04-11 18:42 ` Andrew Cooper
2024-04-12 14:49 ` Andrei Semenov
2024-04-12 14:56 ` Andrew Cooper
2024-04-18 8:31 ` Jan Beulich
2024-04-10 16:31 ` [PATCH v1 0/2] AMD SEV initial work Andrei Semenov
2024-04-11 0:50 ` [PATCH v1 0/2] Starting AMD SEV work Marek Marczykowski-Górecki
2024-04-11 7:48 ` Andrei Semenov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1712759753.git.andrei.semenov@vates.fr \
--to=andrei.semenov@vates.fr \
--cc=andrew.cooper3@citrix.com \
--cc=george.dunlap@citrix.com \
--cc=jbeulich@suse.com \
--cc=julien@xen.org \
--cc=roger.pau@citrix.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.