Supporting TEE on x86 Client Platforms with pKVM
summary
Implements pKVM on x86 to run isolated TEE VMs (TVMs) alongside a passthrough primary VM with only minor host-kernel changes, using EPT shadowing for memory ownership, PKM-owned IOMMU for DMA protection, and virtual interrupt chaining. Claims TVM memory and state are protected, normal VM and primary VM performance are near-native, and total PKM code stays small at <25k LOC. Prototype supports partial IO and VM exits routing; code publishing to GitHub and community alignment are planned.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:16Use Scenario of TEE on Client Platform
- 2:18Protected KVM (pKVM)
- 3:24PKVM Flow Overview
- 5:28De-privilege Kernel (ARM vs. X86) VS
- 6:52Transparent Platform Resource
- 8:10Memory Protection
- 10:06Interrupt Handling
- 10:47MMIO Handling
- 12:25DMA Protection
- 15:29Key Arch Comparation
- 16:22PKVM-X86 Arch Overview
- 18:03Performance Evaluation - Primary VM
- 19:13Status Update & Next Step
related talks
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
48mKernel TEE Subsystem Evolution
17mStatus Update on TDX Support
28mConfidential Devices (TEE I/O): A series of modest proposals
39mKernel TEE subsystem evolution
44mKernel TEE subsystem BoF
46mTPM in TEE
18mGuest Memory Protection -- Current Status and Future