Making PCI devices ready for confidential computing
summary
Clear checklist of what device firmware must implement to attach devices to TEEs: hardware IDE link encryption via PCIe DOE, attestation and certificate delivery using SPDM, IDE key negotiation and boot/firmware measurement reporting, and the TDI/TDR state machine from TDS with locked/run/error states. Explains RIM endorsement-based appraisal, how keys are injected and used for DMA/link encryption, and shows the protocol flow tying SPDM, CMA/IDE and TDS together so device firmware can be TEE-IO-ready.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:47New Platform Architecture
- 1:05Device Support in TVM
- 2:04TEE-IO device secure communication
- 3:43TEE-IO device attestation
- 5:58TEE-IO device management
- 7:35TEE-IO device security requirement
- 9:02TEE-IO Device Software Stack
- 10:16TDI state machine
- 11:18TEE-IO Device Setup
- 12:30Summary
related talks
30mDevice Attestation in Hardware TEE based Confidential Computing
41mIntroducing IO Devices into Trusted Execution Environments
01h 00mPCI device authentication encryption
28mSecure bootloader for Confidential Computing
27mPCI device authentication & encryption
36mEverybody is talking about Confidential Computing - the minimum Devs should know
31mSecure IO
47mThe Rise of Confidential Computing, What It Is and What it Means to You