Isolating PCI/CXL Devices: It All Starts with System Launch
summary
Covers Hyperlaunch, a new capability for starting hypervisors (with a brief look at Xen), and how it connects to TrenchBoot (Linux Secure Launch) and MAC communication fabrics to establish secure, trustworthy isolation and dedicated management of PCI devices — with applicability to CXL — by leveraging IOMMU behavior. Explains using a lightweight restricted bootstrap to enable PCI/IOMMU-based isolation and discusses potential for hypervisors to adopt a common IOMMU management approach.
AI-written summary · about
related talks
41mSecuring Your Xen-Based Cloud
28mCXL and confidential computing
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
37mTrenchBoot - How to Nicely Boot System with Intel TXT and AMD SVM
22mLXDs: Towards Isolation of Kernel Subsystems
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment
28mConfidential Devices (TEE I/O): A series of modest proposals
48mBooting a Linux Kernel in a Higher Privilege Level