Enabling AMD SEV in Xen

on YouTube ↗30m

" summary

Work adds concrete SEV support to Xen: an ASP driver talks to the AMD secure processor for key management and guest lifecycle (launch, snapshot, migrate, shutdown), libxl/xl gains new secure-guest APIs, and Xen’s ASID allocator moves to fixed ASID per VM with separate ASID blocks for SEV, SEV-ES and SEV-SNP guests. Changes include TLB/flush and SVM op updates, RMP/SNP handling, and upstream patches for an AMD PSP driver and libxl integration; AMD’s PSP firmware is available as open source for testing.

AI-written summary · about

" chapters (5)

1. 0:00Introduction and context
2. 2:22AMD memory encryption overview
3. 3:23Confidential computing features
4. 18:13Implementation in Xen
5. 29:42Q&A and concluding remarks

" related talks

• 33mAMD Encrypted Virtualization UpdateDavid Kaplan · Linux Security Summit Europe 2018
• 11mSecure TSC for AMD SEVSNP guestsNikunj Dadhani · Linux Plumbers Conference 2023
• 25mProtecting from MaliciousHypervisor Using AMD SEV-SNPBrijesh Singh · KVM Forum 2021
• 44mAMD x86 Memory Encryption TechnologiesDavid Kaplan · Linux Security Summit 2016
• 40mUpcoming x86 Technologies for Malicious Hypervisor ProtectionDavid Kaplan · Linux Security Summit Europe 2019
• 34mSEV-SNP Development Status UpdateMichael Roth, Ashish Kalra · KVM Forum 2022
• 28mProviding Confidential Guest Services with a Secure VM Service Module on AMDThomas Lendacky · KVM Forum 2022
• 15mRemote Attestation in AMD SEV-SNP Confidential VMsClaudio Carvalho · Linux Plumbers Conference 2023