Re: [RFC 0/4] Adding Virtual Memory Fuses to Xen

[Julien Grall <julien@xxxxxxx>]

Hi Demi,

On 13/12/2022 22:22, Demi Marie Obenour wrote:
> On Tue, Dec 13, 2022 at 08:55:28PM +0000, Julien Grall wrote:
> > On 13/12/2022 19:48, Smith, Jackson wrote:
> > > Hi Xen Developers,
> > Hi Jackson,
> >
> > Thanks for sharing the prototype with the community. Some questions/remarks
> > below.
> [snip]
>
> > > With this technique, we protect the integrity and confidentiality of
> > > guest memory. However, a compromised hypervisor can still read/write
> > > register state during traps, or refuse to schedule a guest, denying
> > > service. We also recognize that because this technique precludes
> > > modifying Xen's page tables after startup, it may not be compatible
> > > with all of Xen's potential use cases. On the other hand, there are
> > > some uses cases (in particular statically defined embedded systems)
> > > where our technique could be adopted with minimal friction.
> >  From what you wrote, this sounds very much like the project Citrix and
> > Amazon worked on called "Secret-free hypervisor" with a twist. In your case,
> > you want to prevent the hypervisor to map/unmap the guest memory.
> >
> > You can find some details in [1]. The code is x86 only, but I don't see any
> > major blocker to port it on arm64.
> Is there any way the secret-free hypervisor code could be upstreamed?
I have posted a new version with also a PoC for arm64:

https://lore.kernel.org/xen-devel/20221216114853.8227-1-julien@xxxxxxx/T/#t

For convenience, I have also pushed a branch to my personal git:

https://xenbits.xen.org/gitweb/?p=people/julieng/xen-unstable.git;a=summary

branch no-directmap-v1

Cheers,

--
Julien Grall