Protected Execution Facility
summary
Describes a hardware extension to Power that creates Protected Execution Facility memory regions plus an accompanying firmware called the Protected Execution Ultravisor that enforces confidentiality and integrity for Secure Virtual Machines (SVMs). Shows tooling that converts a normal KVM VM into an encrypted, integrity-protected SVM using TPM‑sealed keys and an ESN blob; SVMs run in secure memory, interrupts and hypercalls route through the ultravisor, and live migration and PCI device passthrough are intentionally disabled initially.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 5:57Outline
- 6:11Open Source
- 6:24New Stuff
- 6:49Protected Execution Facility
- 7:55In transit
- 8:58SVM
- 11:32Base Principles
- 12:42Overview
- 15:50Linux KVM
- 16:28Normal and Secure VM
- 17:20Limitations
- 18:36Layout
- 19:19CSM blob
- 22:30Boot changes
- 23:27Ultravisor
- 25:46Kernel Changes
- 26:57Hardware Changes
- 29:45Summary
- 31:01IBM Secure Hardware
- 32:10Questions
related talks
41mProtected Execution Facility
55mProtected Execution Facility On Power
21mSecure Live Migration of Encrypted VMs
36mConfidential VMs in the cloud
49mBreaking Hardware-Enforced Security With Hypervisors
18mSecurely booting confidential VMs with encrypting disk
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
25mProtecting from MaliciousHypervisor Using AMD SEV-SNP