Upstream & Guest Distro support for Confidential Compute
summary
Confidential VM features arrive incrementally and many guest images lack the matching firmware/kernel support, which causes silent failures later; propose a concrete feature-negotiation: firmware advertises a bitmap of reserved feature bits (e.g. lazy accept reserved bit, example minimal accept size 4 GB), guest queries host via GHCB/GCI extension, and the guest self-terminates quickly on mismatch (fail fast). Also propose image metadata/annotations, test mainline distro images before enabling features, and treat live migration as a capability gated by both guest and host versions.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:21Baseline confidential compute
- 3:34Incremental feature challenges
- 6:43Guest feature verification
- 10:39Future compatibility concerns
- 13:52Control plane limitations
- 17:35Testing and distro support
related talks
31mSecure IO
13mTowards unified confidential computing ABIs
23mDemystifying Confidential Computing: An update for enthusiasts & professionals
28mConfidential Devices (TEE I/O): A series of modest proposals
20mExtending OpenPOWER Boot Security to Guests
50mHardening the Linux Guest for the Confidential Cloud Computing: Deep Dive and Results
55mSecure IO BoF
41mConfidential Computing, from host to workload