Boosting the Network Performance of Confidential VM Using Userspace Stack
summary
Confidential VM overheads are dominated by a longer VM‑exit path and extra memory copies between encrypted guest pages and shared bounce buffers. The team runs DPDK on Intel TDX and AMD SEV‑SNP (Xeon SPR), patches the CVM kernel to allow DMA into unencrypted zones, extends DPDK to manage encrypted/unencrypted pages, and runs a userspace stack (VPP via LD_PRELOAD) to use DPDK polling mode and integrated TLS processing so packets decrypt/encrypt directly into guest pages, giving about 2× throughput improvement over the kernel stack.
AI-written summary · about
chapters (6)
- 0:00Introduction to CVM and challenges
- 3:13Performance impact of CVM
- 7:51DPDK adaptation in CVM
- 10:03Optimized data flow with VPP
- 13:01Performance evaluation results
- 14:28Future work and Q&A
related talks
41mConfidential Computing, from host to workload
36mEverybody is talking about Confidential Computing - the minimum Devs should know
13mVM Security with Confidential Computing
44mAdvancements in Confidential Computing
23mDemystifying Confidential Computing: An update for enthusiasts & professionals
12mSecurity and Performance in the Delegated User-level Virtualization
24mThe Common Challenges of Secure VMs
18mSecurely booting confidential VMs with encrypting disk