I guess that's okay for the microphone. Great. So, hello everybody. My name is Andrey Seminoff
and I work at the company and the XPNG team. So, this talk is about implementing AMD
ACV-7 technology, exemptive provider, well, exempt project community with all behind the
schedule comparing to other heavy providers on that technology. So, I'll work just trying to
fill the gap on that. So, what's in the agenda, I will talk first briefly on AMD
CV technology and presented basically to, so it will be more likely for later. After that,
we will go through this in more deeper, on more deeper level. I will talk about AMD
ACV-7 processor as well as some work to need to be done to be compliant with CV technology.
So, we'll talk about platform, finite state, automata, guest, finite state automata, about
exempt specials, way to address exempts and hypercalls. And some challenges we need to implement
and to deal with to emulator, emulation, emulator and some instructions. After that, I will
talk a little bit about what's going on for now work. It's not finished yet, but we advanced
well, active led once and then that's all. Let's go ahead. So, what's AMD ACV technology?
ACV is a secure, secure, uncrupet virtualization. Basically, it's a computer, computer technology
from AMD and which targets specifically women, environments. Well, you know, couple of words,
it's about it's to have for EM and encrypt it environment where it's up to them to decide whether
it wants or not to share its data with other software running on the platform as other
VMs and even the hypervisor. So, only DVM, only 7 leveled VM can access the decrypt this data
and that's about it. So, it's an extension to AMD, V technology, it's an AMD virtualization
technology. And it comes in building blocks. First of all, it's a semi-secure memory encryption,
which is the basis for this technology. It's not particularly, it's not in the ACV specification,
but it's a certain technology is based on it. After that, you have ACV playing ACV, ACV,
encrypted state, ACV and TIO. You will just present it briefly in the next slide. So, ACV,
what's this about? They introduced an AMD on memory controller, an encryption, an encryption
unity. So, the memory can be encrypted. There's one IS and encryption key generated at
the boot. It's not persistent key. And whether or not the memory is encrypted or not, it's up
to the systems software to decide. The decision is made with the page tables and the special
flag is so called CBIT, which you can position in the PTE. And the memory writes to this page
will be encrypted by this encryption unity. What's the mention, maybe, that position in this CBIT
will not encrypt the memory by some magic. You try to that. So, if you want to encrypt some
memory, which already, some data, which already in memory, you probably need to use some
special procedures as an encrypt in place. So, we established two mapping, watch with the one
you will read the data and through the next one you will write it. So, the memory will be encrypted.
So, next, you have a CB, play a CB. So, it will produce AMD secure processor. So, it
is a piece of hardware, which is in the heart of this technology and the one which enforce
the whole technology. In fact, it's allowed to generate VM encryption key, which is bound to
ICWDVM. If, for VM, which we try to print in 32 bit mode, basically all the memory is encrypted.
In memory, which is in the 4VDM, which runs in the 40, for 64 bit mode, you can, the VM can choose
which the memory is encrypted. All instruction fetch done by the processor and hardware,
patch double walls are also encrypted, regardless of the state of the CBT. So, it's obviously
a good thing to have to avoid some code injection, but you will we will see that basically
we have to deal with some with this in some special way, because it needs to be a special address
in the hypervisor, this thing. So, encryption is bound to the physical address, so you can just
copy the page from one place to another, because it does not work. You don't can have DMA to this
DMA to this encrypted pages. Well, in a couple of words, what's next on this CB, play a CB,
yes. So, all CPU and FPU context is encrypted, they have some, they enlarged, these are
instructions said to introduce some special instructions to handle with this,
some new exception handler, which is the VM utilization communication exception, and they introduced
GHDB protocol, so even the VM is totally encrypted, the registers in the memory,
the VM can communicate with the hypervisor. After that come a CB is NP, and so secure nested pages,
that feature assume integral decontrol on the memory, so each if hypervisor was software
tried to temper with memory, the VM will detect it, it's based on reverse map, table, stuff like that,
so it's, we target this work later, it's not still done, and more recently, you have CIO,
CIO, CIO, so it allows to establish a trusted channel to the device and to have
communicate with the device with the encrypted memory. Okay, so the first one, what we had to do in
the exam, it's implement, I am this CPU processor. Also known as, we call it SP, also known as SP,
probably the most people who know a little bit about this technology, you know, the SP, because for
historical reasons, so basically the PCI device, the most unknown thing we had to address on that,
it was, it's that this device have multiple interfaces, it's the only one PCI BDF,
all these interfaces covered by one PCI BDF, so you have also, you have also
cryptocoprocessor, which behind this BDF, and also some trusted execution environments,
and in KVM, they have all this stuff running in the host kernel,
obviously we can run it, we can run it in the host kernel, because the VM
managed on the exam, they provide a level, so we need to create some parallel to a
light interfaces for the other functions, if if some other piece of the software want to
use this other interface, other interfaces, other than the SP, so SP presents some mailbox protocol,
which is bi-zixing about three-christic play, and that for some API, we can be grouped in
following area, platform management, guest management, remote attestation supports,
guest migration, some other stuff is copy-swapping, so one, so let's take a look, it'll be
about platforms finance state, automata, nothing that dig about that, the ASP handle the platform
context and manage it, so basically what you need to do certainly it's to need the platform,
which is not some particularly complicated thing to do, you have all bunch of functions,
which allows you to create the platform and development key, defy element key, and so for us,
so one, so we didn't have any trouble to go through that, it's kind of three-state automata,
nothing special on that, so for the guest, the guest life cycle is managed in Zen,
so we need to do some bunch of functions, which allows to launch the guest, we have the
launch start, which creates the guest context, activate, which generate the VM encryption key,
and bounce it to the guest ACID, launch method, take the measure of the guest in some
TPM, like manner, so we, it's not the whole picture of the guest state automata,
but because there also states related to migrating the VM from one host to another, we don't
talk about that, maybe the most important in most, almost, how could I say, not difficult,
but need to pay attention to that, it's launch of data, as I said, the guest will run in
the guest instruction fetches, we'll be, we'll consider that the guest is encrypted,
so you need to encrypt the initial image of the guest, or the firmware you're willing to run before
the guest starts as grab, or we, or we map stuff like that, so we need to encrypt first the whole
guest memory, because the hardware will consider it's encrypted, so it needs to be encrypted,
well, not mixing to say otherwise on that, it's pretty straightforward, things to do,
we introduced all this, all this hook to the exam, to the server, to the SP processor,
in all this SVM operations, which already are exams, so we can hide the most of it from the
toolstack and stuff, so pretty straightforward, okay, so it starts to be a little bit trickier,
for example, because then have a way to provide services to the VM through the hypercalls,
unfortunately for us, this hypercalls use virtual memory,
ABI, so the guest who will unlock this hypercall through the VM call, the same call on the
instruction will provide some virtual addresses, as I said, unfortunately and happily,
because it needs to be done like this, with linear address in the guest,
have no meaning for the hypervisor anymore, because all the page tables are encrypted,
so basically, before that the software page wall, through the page tables of the guest,
we are possible with a CV technology, you just can't guess what's about linear address,
so you can't use this ABI, which is in the end, and basically we need to change it,
there's also, in the end community, upstream, and the project, there's many talks to change it,
because it's all the subject to address in the end, so we changed it on our level to, by modifying
a couple of macros and stuff like that, so it's not very hard to do,
also, some challenges on the hypercall pages, which was dynamically constructed,
you can do this anymore, and then, while some tricks and stuff to be,
to be compliant with the way the guest invokes the guest services.
Well, where did it become a little bit more trickier, it's about how you emulate the devices
and how you, how you emulate some instructions, so to IO space, there's just two way to use the device
in X86 architecture, so the IO space, so in out instructions, and memory access is for more
complicated devices, so basically it's memory, okay, so in the IO space, you have in out instructions
stuff like that, as I said, your instruction pointer pointer is just in others, so you can
access to the real instruction, which is in it, so basically, happily for us, you have a feature
called decodacist in the RAM architecture, which provide you some information as per the IO port,
direction, size, and easy, it's a string operation, and we can guess, we can guess what,
when guests exit it on IO, where it makes it, we can guess what's happening, so we can do stuff
in the melee stuff for this. Obviously, if there's a string operation, we can do anything,
so probably need to, in Linux drivers, we need to touch this, and there's no way to guess what's
happening if string IO operation are used. Almost the same thing for memory mapped IO,
you have, when you exit on nested page fault, it's how the memory mapped IO I'm related,
only what you have, it's only a narrow code, and the fault in guests, physical others,
so happily for us, there's decodacist, which provides instruction lengths and instruction bytes in the
VMCB, but it's in theory, and fortunately, there's some corner cases, which are hard to handle,
related to, there's a processor, the rat has related to map map technologies,
as some other cases, which we can handle, so it's not very, very stable,
maybe need to avoid this memory IO access in your guest, if you want to use
a 7 technology, well, you can't do this to memory reference, if you use some, if you're
driver or use some instructions, you can't guess what's happened in guests, so basically,
as far as I know, in linings, you have some feature called the unroll,
unroll IO strings, so this instruction will not be used, but still,
some stuff can be evaluated, okay, well, some other, what's about exceptions,
basically, the instruction emulates, by exam, all can be evaluated, most of them,
obviously, undefined instructions you can, nothing to do with that,
so you can have must be disabled for guests, move to the control registers,
basically, decodacist will help, you provide the direction of the operation,
and also general purpose, but registers invoked in that, and so one is so forth,
basically, all the instructions fit well in that, some things you can, the task switch on
80, x86 feature, on x86 architecture, you can handle, it's okay for everything injection too,
yes, so I have not that much time, what's the next to be done, so to run one x and
a cv uncritly state environment, so we need to add up, then depend on parts in linings kernel,
also add up to speed rivals, in example, special guest management on that, implement
GHCB guest host common block protocol exam, add up to different exam parts for emulation,
hv and function table stuff like that, and that's basically what we did and what we're doing,
so thank you, everybody, if you have questions.
How do you do migration? For now, we didn't address that, but yeah, there's a whole bunch of
ASP interface, which allow to migrate one guest, from one host to another host, what's going on
two hostes before he established trusted channel in a testing with AMD processor, he's talking
with AMD processor, they all the all the processors are seven-level processors, there was seven-level
platforms, and they established trusted channel, after that, he realized I can just
encrypt memory in some common key to the both platforms, put it through the channel to the other
host and decreed it and uncrited with a new VM encryption key, so it runs on, so it's basically
the operation, actually we didn't did that yet, so yeah, sorry, can you repeat the question sorry,
can you repeat the question? Who wouldn't, can you repeat his question?
Ah, okay, okay, because those are the audience, yeah, so okay, sorry, so is there any work around
for memory or your emulation? No, you okay, so AMD position from what I understand is that
you don't have to do this because the next step is the CVES encrypted state, so basically what's
happening? You're going out with the guest on the AMX, it's stuff like that, and you can't
not sing guests because the whole registers are encrypted, the whole memory is encrypted potentially
so it's a introduced some as I told the guest host communication block, so some chunk of
memory which is decreed it, so well I will not go deep in the technology, but basically you
the guests need to provide special information to the supervisor that I want this, I want to
access this memory, I'll address you, so there's a way to do this with a new next step of the
with the next step of the CV technology, so basically in fact a CV playing a CV has not that much
meaning because first obviously run guest pretend it's secure and have all the register accessible
by the supervisor, it's kind of joke because at some point it will be leaking to the registers,
some data potentially you want to protect, so it's just a step that you can
a CV playing a CV is just a step to the next level, to the CVES, to be to run fully
encrypted VM which is really a short to have security properties, confidentiality and SNP provide
also integrity control on that memory, you mentioned that GMA is not available, so will this impact
performance? So the question is, is GMA is not available for 7, in fact it's not exactly
it, you can't communicate in playing the CV, up to a CV, you can't communicate with the device
through the encrypted memory because device will not understand it, so probably you can, but
it's wrong, not be that mean, so you have to declare this memory through the CV as a shared
memory, so all these DMA accesses need to be done through shared memory and the old communication
with the other parts of the VMs because you have some priority allies, drivers, stuff like
that or the supervisor because you all this memory need to be especially addressed to not be
private, they called it private memory, so it could not be shared memory, sorry guys, time is up, so
if you want, you can chat later or send me an email