CPC: Flexible, Secure, and Efficient CVM Maintenance with Confidential Procedure...
summary
CPC (Confidential Procedure Calls) runs vetted maintenance code inside CVMs using extra host‑wakeup vCPU threads (hvvCPUs) and a state‑machine API, avoiding firmware bloat and host intrusion. Prototypes on AMD SEV and ARM CCA use VMPL or a confidential page table isolation trick to protect CPC code and memory. Measured results show 3× faster resource reclamation and up to 138× (authors also report 340× with AES acceleration) faster live migration versus firmware‑based approaches. Cross‑platform compatibility and reduced firmware TCB are claimed.
AI-written summary · about
chapters (10)
- 0:00CPC and CVM challenges
- 2:49Current CVM maintenance limits
- 6:03CPC design goals and concept
- 8:51CPC extends vCPU scheduling
- 10:17CPC snapshot performance
- 12:03Security beyond CVM threats
- 13:30CPC on non-AMD CVMs
- 15:43CPC security boundaries and TCB
- 16:51CPC memory reclamation results
- 18:39CPC summary and future
related talks
13mVM Security with Confidential Computing
41mConfidential Computing, from host to workload
29mCustomer managed TCB with CVMs on Azure
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
28mCXL and confidential computing
23mIntegrating Confidential Computing Into Cloud Infrastructure: Challenges and Opportunities
19mA Verification Methodology for the Arm® Confidential Computing Architecture: Fr...
13mCOCONUT Secure VM Service Module Discussion