{"id":250,"date":"2024-12-30T12:28:30","date_gmt":"2024-12-30T04:28:30","guid":{"rendered":"https:\/\/www.yewpo.top\/?p=250"},"modified":"2024-12-30T12:28:30","modified_gmt":"2024-12-30T04:28:30","slug":"svsm-%e4%bb%a3%e7%a0%81%e5%88%9d%e6%ac%a1%e9%98%85%e8%af%bb","status":"publish","type":"post","link":"https:\/\/www.yewpo.top\/index.php\/250\/","title":{"rendered":"COCONUT-SVSM \u4ee3\u7801\u521d\u6b21\u9605\u8bfb"},"content":{"rendered":"
\n

SVSM: Secure VM Service Module\uff0c\u5373\u5b89\u5168\u865a\u62df\u673a\u670d\u52a1\u6a21\u5757\u3002<\/p>\n

SVSM \u7684\u767d\u76ae\u4e66\uff1ahttps:\/\/www.amd.com\/content\/dam\/amd\/en\/documents\/epyc-technical-docs\/specifications\/58019.pdf<\/a><\/p>\n<\/blockquote>\n

\n

COCONUT-SVSM \u9879\u76ee\u5730\u5740\uff1aGitHub – coconut-svsm\/svsm: COCONUT-SVSM<\/a><\/p>\n

git<\/span> clone https:\/\/github.com\/coconut-svsm\/svsm\ncd<\/span> svsm\ngit<\/span> submodule update --init\ncargo install<\/span> bindgen-cli<\/code><\/pre>\n
\u8fd9\u4e2a\u9879\u76ee\u662f\u4f7f\u7528 Rust \u8bed\u8a00\u7f16\u5199\u7684\uff0c\u524d\u671f\u9700\u8981\u5b89\u88c5 Rust \u76f8\u5173\u5de5\u5177\u3002<\/p>\n<\/blockquote>\n
\n
\u9605\u8bfb\u5927\u578b\u9879\u76ee\u8fd8\u662f\u975e\u5e38\u63a8\u8350\u5b89\u88c5\u8bed\u8a00\u670d\u52a1\u5668\u7684\uff0c\u8fd9\u6837\u53ef\u4ee5\u6982\u89c8\u4e00\u4e2a\u4ee3\u7801\u6587\u4ef6\u5b9e\u73b0\u7684\u51fd\u6570\u60c5\u51b5\uff0c\u4ece\u800c\u6709\u9488\u5bf9\u6027\u7684\u9605\u8bfb\u3002<\/p>\n<\/blockquote>\n
\u9879\u76ee\u6982\u89c8<\/h2>\n
\u9879\u76ee\u6839\u76ee\u5f55\u4e0b\u5c31\u653e\u4e86\u5f88\u591a\u76ee\u5f55\uff0c\u5927\u90e8\u5206\u662f\u9879\u76ee\u6240\u9700\u7684\u5e93\u548c\u5de5\u5177\u3002\u9700\u8981\u5173\u6ce8\u7684\u51e0\u4e2a\u4ee3\u7801\u6587\u4ef6\u5939\u662f\uff1a<\/p>\n
    \n
  • \n
    cpuarch\uff1a\u6709 ARM \u67b6\u6784\u76f8\u5173\u7684\u5185\u5bb9\uff0c\u5176\u4e2d\u5305\u542b VMSA (VM Shared Area)\u3002<\/p>\n<\/li>\n
  • \n
    kernel\uff1a\u9879\u76ee\u6838\u5fc3\u4ee3\u7801\u6587\u4ef6\u5939\u4e86\u3002<\/p>\n<\/li>\n
  • \n
    stage1\uff1a\u7b2c\u4e00\u542f\u52a8\u9636\u6bb5\u3002<\/p>\n<\/li>\n
  • \n
    syscall\uff1a\u7cfb\u7edf\u8c03\u7528\u76f8\u5173\u7684\u4ee3\u7801\u3002<\/p>\n<\/li>\n<\/ul>\n
    \u5176\u4ed6\u6587\u4ef6\u5939\u5c31\u6309\u9700\u9605\u8bfb\u3002<\/p>\n
    \u9879\u76ee\u4e3b\u4f53<\/h2>\n
    \u9879\u76ee\u7684\u4e3b\u9898\u4ee3\u7801\u90fd\u5728 kernel \u76ee\u5f55\u4e0b\u3002\u6253\u5f00\u6587\u4ef6\u5939\u540e\uff0c\u53ef\u4ee5\u770b\u770b kernel \u7684\u76ee\u5f55\u7ed3\u6784\uff1a<\/p>\n
      \n
    • \n
      \u5404\u4e2a\u529f\u80fd\u6a21\u5757\uff0c\u5305\u62ec\uff1a<\/p>\n
        \n
      • \n
        acpi\uff1a\u4e2d\u65ad\u63a7\u5236\u76f8\u5173\u3002<\/p>\n<\/li>\n
      • \n
        cpu\uff1a\u62bd\u8c61\u865a\u62df cpu \u6a21\u5757\u3002<\/p>\n<\/li>\n
      • \n
        fs\uff1aram_fs \u6587\u4ef6\u7cfb\u7edf\u3002<\/p>\n<\/li>\n
      • \n
        locking\uff1a\u9501\u529f\u80fd\u6a21\u5757\u3002<\/p>\n<\/li>\n
      • \n
        mm\uff1a\u5185\u5b58\u7ba1\u7406\u6a21\u5757\u3002<\/p>\n<\/li>\n
      • \n
        platform\uff1a\u5177\u4f53\u7684 Guest CPU \u7684\u5b9e\u73b0\u3002<\/p>\n<\/li>\n
      • \n
        protocols\uff1a\u6309\u7167 SVSM \u767d\u76ae\u4e66\u5b9e\u73b0\u7684\u76f8\u5173\u63a5\u53e3\u529f\u80fd\u3002<\/p>\n<\/li>\n
      • \n
        sev\uff1a\u5373 SEV \u7684\u76f8\u5173\u529f\u80fd\u3002<\/p>\n<\/li>\n
      • \n
        syscall\uff1a\u7cfb\u7edf\u8c03\u7528\u3002<\/p>\n<\/li>\n
      • \n
        task\uff1a\u4efb\u52a1\u7ba1\u7406\u6a21\u5757\u3002<\/p>\n<\/li>\n
      • \n
        vtpm\uff1aTPM \u7684\u76f8\u5173\u5b9e\u73b0\u3002<\/p>\n<\/li>\n
      • \n
        \u4e00\u4e9b\u5176\u4ed6\u529f\u80fd\u6a21\u5757\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n
      • \n
        \u5355\u72ec\u7684\u4ee3\u7801\u6587\u4ef6\u3002<\/p>\n<\/li>\n<\/ul>\n
        \u8fd9\u4e48\u4e00\u770b\uff0cSVSM \u582a\u79f0\u4e00\u4e2a\u5b8c\u6210\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\u5728\u5355\u72ec\u7684\u4ee3\u7801\u6587\u4ef6\u4e2d\uff0c\u53ef\u4ee5\u770b\u5230 svsm.rs<\/code> \u4ee3\u7801\u6587\u4ef6\u3002\u4e0d\u59a8\u5148\u4ece\u8fd9\u4e2a\u4ee3\u7801\u6587\u4ef6\u5165\u624b\u3002<\/p>\n
        \u901a\u8fc7\u6d4f\u89c8\u8fd9\u4e2a\u4ee3\u7801\u5b9e\u73b0\u7684\u51fd\u6570\uff0c\u5c31\u53d1\u73b0\u4e24\u4e2a\u53ef\u80fd\u6bd4\u8f83\u91cd\u8981\u7684\u51fd\u6570\u3002\u4e00\u4e2a svsm_start<\/code>\uff0c\u4e00\u4e2a svsm_main<\/code>\u3002\u5148\u6765\u770b\u770b\u540e\u8005\u3002<\/p>\n
        svsm_main<\/code> \u5b8c\u6210\u4e86 SVSM \u5ba2\u6237\u673a\u7684\u521d\u6b65\u914d\u7f6e\u3002\u5305\u62ec SVSM \u5e73\u53f0\u7684\u73af\u5883\u521d\u59cb\u5316\uff0cSVSM \u53c2\u6570\u914d\u7f6e\uff0c\u76f8\u5173\u5185\u5b58\u7a7a\u95f4\u7684\u521d\u59cb\u5316\u548c\u62f7\u8d1d\u3002\u901a\u8fc7 config.load_cpu_info<\/code> \u51fd\u6570\u83b7\u53d6 CPU \u76f8\u5173\u4fe1\u606f\u548c\u4e2d\u65ad\u76f8\u5173\u4fe1\u606f\u3002\u7136\u540e\uff0c\u8c03\u7528 start_kernel_task<\/code> \u6765\u542f\u52a8\u4e00\u4e2a kernel \u4efb\u52a1\u3002<\/p>\n
        \u518d\u770b\u770b svsm_start<\/code>\uff0c\u4f3c\u4e4e\u611f\u89c9\u8fd9\u4e2a\u4ee3\u7801\u624d\u662f SVSM \u7684\u4e3b\u51fd\u6570\u3002\u4e0d\u4ec5\u5b8c\u6210\u4e86\u6574\u4e2a SVSM \u7684GDT \u548c IDT \u7684\u521d\u59cb\u5316\uff0c\u8fd8\u5b8c\u6210\u6bcf\u4e2a BSP_CPU \u7684\u521d\u59cb\u5316\uff08\u6b64\u5904\u7684 BSP \u6307\u7684\u662f Bootstrap Processor\uff09\uff0c\u5305\u62ec\u9875\u8868\uff0c\u67b6\u6784\uff0c\u4ee5\u53ca\u521d\u59cb\u4efb\u52a1\u3002\u8fd9\u4e2a\u521d\u59cb\u4efb\u52a1\uff0c\u5c31\u662f svsm_main<\/code>\u3002\u6700\u540e\uff0c\u901a\u8fc7\u8c03\u5ea6\u7684\u65b9\u5f0f\uff0c\u8fdb\u5165\u5230 svsm_main<\/code> \u4e2d\u6267\u884c\u3002<\/p>\n
        svsm_start<\/code> \u6709\u4e24\u4e2a\u51fd\u6570\u53c2\u6570\uff0c\u5e94\u8be5\u8fd8\u6709\u5176\u4ed6\u51fd\u6570\u6765\u8c03\u7528\u8be5\u51fd\u6570\u3002\u76f4\u63a5\u770b\u4ee3\u7801\uff0c\u4e0d\u592a\u80fd\u76f4\u63a5\u627e\u5230\u8fd9\u4e2a\u51fd\u6570\u3002\u4f46\u662f\u518d\u770b\u770b\u6587\u4ef6\u76ee\u5f55\uff0c\u627e\u5230\u4e86 svsm.lds<\/code> \u94fe\u63a5\u6587\u4ef6\u3002\u94fe\u63a5\u6587\u4ef6\u7684\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
        OUTPUT_ARCH(i386:x86-64)\n\nSECTIONS\n{\n    . = 0xffffff8000000000;\n    .text : {\n        *(.startup.*)\n        *(.text)\n        *(.text.*)\n        . = ALIGN(16);\n        entry_code_start = .;\n        *(.entry.text)\n        entry_code_end = .;\n        . = ALIGN(16);\n        exception_table_start = .;\n        KEEP(*(__exception_table))\n        exception_table_end = .;\n    }\n    . = ALIGN(4096);\n    .rodata : { *(.rodata) *(.rodata.*) }\n    . = ALIGN(4096);\n    .data : { *(.data) *(.data.*) }\n    . = ALIGN(4096);\n    .bss : {\n        *(.bss) *(.bss.*)\n        . = ALIGN(4096);\n    }\n    . = ALIGN(4096);\n}\n\nENTRY(startup_64)<\/code><\/pre>\n
        \u5927\u6982\u7387\uff0c\u6574\u4e2a SVSM \u7684\u542f\u52a8\u4ee3\u7801\u662f\u7528\u6c47\u7f16\u5199\u7684\u3002\u7528 grep<\/code> \u547d\u4ee4\u641c\u7d22\u4e00\u4e0b startup<\/code>\uff0c\u7ed3\u679c\u53d1\u73b0\uff0cstartup<\/code> \u7684\u6c47\u7f16\u4ee3\u7801\u662f\u9576\u5d4c\u5728 Rust \u4ee3\u7801\u4e2d\u7684\uff0c\u4e5f\u5c31\u5728svsm.rs<\/code> \u6587\u4ef6\u4e2d\u3002startup<\/code> \u7684\u6c47\u7f16\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
            .text\n    .section \".startup.text\"<\/span>,\"ax\"<\/span>\n    .code64\n\n    .globl  startup_64\nstartup_64:<\/span>\n    \/<\/span>*<\/span> Setup stack *<\/span>\/<\/span>\n    leaq bsp_stack_end(%<\/span>rip), %<\/span>rsp<\/span>\n\n    \/<\/span>*<\/span> Jump to rust code *<\/span>\/<\/span>\n    movq    %<\/span>r8<\/span>, %<\/span>rdi<\/span>\n    movq    %<\/span>r9<\/span>, %<\/span>rsi<\/span>\n    jmp svsm_start\n\n    .bss\n\n    .align {PAGE_SIZE}\nbsp_stack:<\/span>\n    .fill 8<\/span>*<\/span>{PAGE_SIZE}, 1<\/span>, 0<\/span>\nbsp_stack_end:<\/span><\/code><\/pre>\n
        \u554astartup_64<\/code> \u4e5f\u4ec5\u4ec5\u521d\u59cb\u5316\u4e86\u6808\u7684\u5927\u5c0f\u4ee5\u53ca\u5c06 r8<\/code> \u548c r9<\/code> \u503c\u62f7\u8d1d\u5230\u4f20\u9012\u53c2\u6570\u7684\u4e24\u4e2a\u5bc4\u5b58\u5668\u4e2d\uff0c\u5e76\u8c03\u7528 svsm_start<\/code>\u3002\u8fd9\u6837\u770b\u6765\uff0c\u7cfb\u7edf\u7684\u6839\u4e5f\u4e0d\u5728\u8fd9\u91cc\u3002\u518d\u8bfb\u8bfb startup_64<\/code> \u7684\u6ce8\u91ca\uff0c\u5f97\u5230\u4e86\u662f stage2 \u52a0\u8f7d\u5668\u8bbe\u7f6e\u7684\u8be5\u5165\u53e3\u3002<\/p>\n
        \u7b2c\u4e00\u9636\u6bb5\u542f\u52a8\u8fc7\u7a0b<\/h2>\n
        \u7b2c\u4e00\u9636\u6bb5\u542f\u52a8\u8fc7\u7a0b (stage1) \u7684\u4ee3\u7801\u5728 SVSM \u9879\u76ee\u6839\u76ee\u5f55\u4e0b  stage1<\/code> \u6587\u4ef6\u5939\u4e2d\u3002\u4e3b\u8981\u662f reset<\/code> \u548c stage1<\/code> \u4e24\u4e2a\u6c47\u7f16\u4ee3\u7801\u3002\u540e\u8005\u5b8c\u6210\u4e86\u6fc0\u6d3b\u7f13\u5b58\u548c\u51c6\u5907 stage2 \u542f\u52a8\u7684\u5de5\u4f5c\u3002<\/p>\n
        stage2 \u7684\u51c6\u5907\u5de5\u4f5c<\/h3>\n
        \u7b2c\u4e8c\u9636\u6bb5\u7684\u542f\u52a8\u51c6\u5907\u5de5\u4f5c\u5305\u62ec\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n
          \n
        • \n
          \u521d\u59cb\u5316\u6808\u6307\u9488<\/strong>\u3001\u7b2c\u4e8c\u9636\u6bb5\u542f\u52a8\u4e8c\u8fdb\u5236\u6587\u4ef6\u76f8\u5173\u4fe1\u606f\uff0c\u8d77\u59cb\u548c\u7ec8\u6b62\u5730\u5740<\/strong>\u3001\u5185\u6838\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684\u76f8\u5173\u4fe1\u606f\uff0c\u8d77\u59cb\u548c\u7ec8\u6b62\u5730\u5740<\/strong>\u3002<\/p>\n<\/li>\n
        • \n
          \u5c06 BSP \u4e00\u4e9b\u5143\u6570\u636e\u538b\u5165\u6808\u3002<\/p>\n<\/li>\n
        • \n
          \u8df3\u8f6c\u7b2c\u4e8c\u9636\u6bb5\u542f\u52a8\u5730\u5740\uff0c\u8fdb\u5165\u4e8c\u9636\u6bb5\u542f\u52a8\u3002<\/p>\n<\/li>\n<\/ul>\n
          \u7b2c\u4e8c\u9636\u6bb5\u542f\u52a8\u8fc7\u7a0b<\/h2>\n
          \u7b2c\u4e8c\u9636\u6bb5\u542f\u52a8\u8fc7\u7a0b\u7684\u4ee3\u7801\u5728 kernel\/stage2.rs<\/code> \u6587\u4ef6\u4e2d\u3002\u4ece stage2.lds<\/code> \u94fe\u63a5\u6587\u4ef6\u4e2d\u53ef\u4ee5\u770b\u51fa\uff0c\u5176\u5165\u53e3\u51fd\u6570\u4ecd\u7136\u4e3a startup<\/code> \u51fd\u6570\u3002startup<\/code> \u51fd\u6570\u5728 boot_stage2.rs<\/code> \u6587\u4ef6\u4e2d\u5b9e\u73b0\u3002\u8be5\u51fd\u6570\u5b8c\u6210\u4e00\u4e9b\u9875\u9762\u521d\u59cb\u5316\u540e\uff0c\u8c03\u7528\u4e86 stage2_main<\/code> \u51fd\u6570\u3002stage2_main<\/code> \u51fd\u6570\u5728 kernel\/stage2.rs<\/code> \u4e2d\u5b9e\u73b0\u3002<\/p>\n
          stage2_main<\/code> \u51fd\u6570\u5b8c\u6210\u4e86\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n
            \n
          • \n
            \u521d\u59cb\u5316\u5e73\u53f0\u7684\u7c7b\u578b\u3002<\/p>\n<\/li>\n
          • \n
            \u83b7\u53d6 SVSM \u7684\u914d\u7f6e\u4fe1\u606f\u3002<\/p>\n<\/li>\n
          • \n
            \u5206\u914d\u5185\u6838\u7684\u5185\u5b58\u7a7a\u95f4\u3002<\/p>\n<\/li>\n
          • \n
            \u52a0\u8f7d\u7b2c\u4e00\u5757\u5185\u6838\u7684ELF\u548cIGVM\uff0c\u5f97\u5230 kernel_entry \u7684\u5730\u5740\u3002<\/p>\n<\/li>\n
          • \n
            \u8bbe\u7f6e\u5185\u6838\u7684\u542f\u52a8\u9009\u9879\u3002<\/p>\n<\/li>\n
          • \n
            \u8bbe\u7f6e\u5185\u6838\u542f\u52a8\u9009\u9879\u53c2\u6570\uff0c\u8df3\u8f6c\u5230 kernel_entry\uff0c\u5b9e\u9645\u4e0a\u5c31\u662f startup_64<\/code>\u3002<\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
            COCONUT-SVSM \u4ee3\u7801\u521d\u6b21\u9605\u8bfb\u548c\u7406\u89e3\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[12],"class_list":["post-250","post","type-post","status-publish","format-standard","hentry","category-os","tag-svsm"],"_links":{"self":[{"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/posts\/250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/comments?post=250"}],"version-history":[{"count":0,"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/posts\/250\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/media?parent=250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/categories?post=250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yewpo.top\/index.php\/wp-json\/wp\/v2\/tags?post=250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}