Xen Project Developer & Design Summit

This session has two parts: if we need more time, the session will continue in Intel Features 3 on the following day

Part 1: Design Discussion: SGX virtualization - Kai Huang
Intel Software Guard Extensions (SGX) is a set of new instructions and memory access mechanism targeting to protect user-level software from being attacked. It achieves this by using particular address range of 'enclave' in user-level application, and content of enclave cannot be accessed directly by any software from outside, including privileged software. Enclave Page Cache (EPC) is the hardware resource used to commit to enclave. EPC is limited resource typically reserved by BIOS. SGX also supports Launch Control which allows 3rd party to run their own Launch Enclave, which governs other enclaves to run. SGX virtualization on Xen including exposing SGX to guest, EPC management, Launch Control virtualization, SGX interaction with VMX handling, etc. This design discussion is about to go through the SGX virtualization design with maintainers & other developers, including problems, design options, detailed technical discussion, etc, to make further Xen SGX integration go more smoothly.

Part2: Design Discussion: Shared Virtual Memory Virtualization Implementation on Xen - Yi Liu
Shared Virtual Memory (SVM) is a VT-d feature that allows sharing application address space with the I/O device. The feature works with the PCI sig Process Address Space ID (PASID). With SVM, programmer gets a consistent view of memory across host application and device, avoids pining or copying overheads. We have been working on supporting SVM in Xen to enable SVM usage in guest if a SVM capable device is assigned. e.g. assign IGD to a guest, applications like OpenCL would benefit if SVM is supported in guest. SVM virtualization requires exposing a virtual VT-d to guest. In this discussion, Yi would update the latest SVM virtualization implementation and foresee the future work about supporting SVM and IOVA a single virtual VT-d on Xen.