Protected Execution Facility
summary
An architecture modification to Power called Protected Execution Facility creates a new firmware layer Protected Execution Ultravisor and a secure memory region so a regular VM can be converted into a secure virtual machine (SVM) whose memory is copied into hardware-protected RAM and decrypted only by the ultravisor using keys held in TPM 2.0. Boot uses a new ESM instruction, runtime overhead is single‑digit percent, and first release forbids suspend/resume, migration, overcommit and dedicated devices. Tooling embeds encrypted blobs containing passphrases and integrity metadata.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:16Acknowledgements
- 1:18Team
- 2:40Objectives for Protected Execution Facility
- 4:59Creating and Running SVM
- 9:27Base Principles
- 11:15Overview of architecture
- 14:07Architecture implication for the hypervisor
- 15:44Architecture at the VM level
- 18:08Revocation
- 21:34Limitations
- 22:59Contents of ESM blob
- 24:32SVM format and Booting
- 26:09Steps to start Secure VM
- 27:16Boot Changes
- 28:22Interfaces to the Ultravior ultra calls
- 30:34KVM Changes
- 31:30Kernel Changes
- 32:09Brief Introduction to some of the hardware changes
- 33:57Summary of Protected Execution Facility
- 34:26Relevant IBM secure processor products and Research
related talks
42mProtected Execution Facility
55mProtected Execution Facility On Power
49mBreaking Hardware-Enforced Security With Hypervisors
18mSecurely booting confidential VMs with encrypting disk
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
36mConfidential VMs in the cloud
21mSecure Live Migration of Encrypted VMs
41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER Systems