Okay, first of all, thank you very much for coming to my talk.
I'm very glad that so many of you are interested in open source
sphere, metaphor, confination of building.
Second, thanks to DevRome managers for accepting my talk.
Yeah, luckily this year we don't have open source
pyramid DevRome, but anyway, I got there quite a lot of feedback from
many people, so I would like to thank all the reviewers of this presentation.
Thremed up, me how was the brain technical coding developers brain behind this?
I'm a coordinator and kind of high level vision for that.
So modern high, modern high assurance requires
confidential computing.
We have 10 years of confidential computing.
Definity, this is like a state-of-the-art part of the security ecosystem.
And I don't think we can build high assurance infrastructure
without confidential computing.
And of course, we need high assurance to build some sovereignty.
So how we will do this, if we don't have enough experts,
and of course we have to grow more experts, we need more seniors.
So how we grow those seniors need some hardware,
some transparent ecosystem, which they can inspect,
research, analyze, reason about.
And this is what this talk is about.
So first of all, I would like to give a
to confidential computing ecosystem some research platform for
the educational purposes for security research purposes,
which they can easily inspect.
And then hopefully that will increase transparency
in the ecosystem, increase openness of the ecosystem.
And then hopefully we can get the underlying key components
of the firmware, which are right now,
close swords, binary robes, going into standardization,
and openness.
And what I will show in this presentation,
the firmware trust problem, and who, all these who,
and where, like, who we rely on,
then I will tell you about open seal and core boot,
and what we did to open the ecosystem.
And then I will show you the demo of the stock,
showing the SCV, S&P,
attestation on the open seal plus core boot on the retail server,
which you can buy, which you can provision,
which you can flash, and play with, of course,
if you can afford the memory design.
Okay, so this, I don't expect you to read this,
go back to the presentation, read the details,
I know the letters are small.
This slide is just to tell you what's my thinking about high assurance,
and this is definitely extremely simplified view,
because it's not enough here.
It, this picture should be much bigger.
But let's start from the right side.
First of all, I'm thinking about the bootstrapable tool chains.
This is inspired by stage X, this trust company, this stage X,
which is very similar to GUIX, to next thinking,
but also a little bit different in some places.
But it doesn't matter the point is to bootstrap from some,
from some seed, from some known,
all the table piece of bytes, in assembly, whole tool chain.
So we can do this in a reproducible way,
and we can make sure that it's really what we,
that what we building is really from the code that we get,
things we have some transparency.
When we have the tool chain, we can start building.
How we building, we have to build on multiple targets,
to have distributed reproducibility code on,
because if we will build on multiple targets,
they will agree on the harshest.
That means the software supply chain is not compromised,
and it's very likely we can build some trust
worthiness based on that evidence.
If we do a very metal on different architectures,
for cross compiling, this is even better.
Then if we have some builds, and we have some trust worthiness
in those build, and some assurance of those builds,
we can go into owner controller through the status
and chain of trust, that's kind of future,
3M depth contributing a lot to that future,
to make the ability of buying the hardware,
and you essentially can't provision all your own keys
into a good guard, or whatever AMD platform,
secure boot, or whatever ARM platform,
so you can really own the platform,
that the keys, your keys are fused in OTP,
or ifuses, and from the beginning of the word,
from the power on everything whole whole software is yours.
After that, after that, I hope this can contribute
to the confidential computing ecosystem,
and hopefully at some point we will have some open source
firmware here, and open source firmware here.
This is trusted execution environment security monitor.
I have a lot of slides, so I have to speed up
because I don't have time to talk about all those details.
I want to build some parallel, because some of you
maybe don't know, okay, what is this open source
firmware ecosystem?
I just want to tell you, like, you know,
cardboard, who knows, cardboard?
Good, but very good.
Tyano core is an IDK, IDK2,
IDK2, IDK2, IDK2, IDK2,
UFI, reference implementation ecosystem,
Linux boot, Snim boot loader,
AMD open seal is kind of new thing.
I will talk a little bit about OpenSFI,
which is OCP activity.
It's even newer thing, it's right now in drafting.
Caliptera, very good root of trust,
despite coming from Microsoft,
but Microsoft AMD and Google,
but it's very good, really.
Read the specification, it's very good.
Open Titan, trusted firmware,
and Linux is because of the presence in OpenBMC.
I want to build some parallel with the BIOS evolution.
So, I divided the evolution of Confederation computing
into IRAS, like the BIOS evolution.
So, in the beginning, we have this proprietary error.
Then we have some tribes of openness and standardization,
like we see here.
And then hopefully we go more into standardization
when we have standards, we can build the open implementations
and try to improve our ecosystem to make it more trustworthy.
And build this architecture that we talk about.
I'm not sure if I should go very deep into that one.
You probably all know this evolution.
So, it depends how we count.
2017, some say 2016,
because the white paper was from 2016,
but the processors were cheaper to lighter.
But we essentially have these generations of AMD processor,
Naples, Rome, Milan, Genoa, Turing,
which every includes more and more security features.
Turing includes SVT, trusted IO,
which is very interesting.
We plan to do some stuff with that.
But point of the slide is showing.
First of all, by the way, security promise was not publicly communicated from AMD.
There was no CVs.
There were internal tracking of the firmware security issues.
About they were not as a CVs.
If you look into release notes of the AMD SCV firmware,
you will find there were problems there.
Then they communicated at the Milan state.
They communicated this security.
And then suddenly CVs were issues.
We see just in the AMD SCV firmware,
we got 22 here, 28 here and so far, 15 for Turing.
Some of those are cross-cross micro-architectures.
So that's the point of the slide to show that this closed source piece is quite vulnerable.
And there are a lot of evidence for problems there.
Okay?
Okay.
And this trust problem.
We got 20 years of trusted computing.
I know you don't like trusted computing because you like confidential computing.
And this is kind of in that being cooperation.
It is like kind of some small war.
But the point is trusted computing working for 20 years,
on improving the ecosystem.
As bombs, you know, TPM, standardization of the protocol dies,
then openness of the BIOS.
All this work made around core boot and so on and so on.
Harder true of the root of trust, also provisioning code.
Harder true of trust we working hard on opening that.
BMC also is we're opening that.
We're going into some standardization versus PDM.
Also dies in BMC appearing.
Then we're saying, okay, let's don't trust this one.
We will trust this one, which is like binary block.
And it's closed source.
We don't really know what is going there.
So we essentially took all this work and transferred that to some closer to the ecosystem.
Okay, that's fine.
That's why, but let's now work on improving this ecosystem.
So why this is wrong?
Intel management engine story showing so many vulnerabilities.
Single co processor is essentially a risk.
And especially cross it source one.
Then BIOS Richard openness with the core boot, then open seal from AMD.
Essentially opens the silicon initialization part.
So part of the initialization of the AMD processor was moved to ASP.
The most secret part, memory initialization.
But rest was left in the open.
And now we can have totally fully BIOS for AMD.
And this is what I will tell you about on later slides.
Because that's essentially a huge achievement.
And thanks to thanks to the AMD.
Yeah, this is what I said.
Yeah, this is like skis of RAM, yeah.
Okay, AMD co founded the Kaliptera.
There's really great spec.
It's the everything is well thought.
Really really respect.
I just hope that at some point we will have this chip in regular devices.
And really the promise of the spec will deliver.
But on the one side we have Kaliptera.
And on the other side they deliver this.
So I'm not sure I don't understand this.
Unless at some point Kaliptera will replace AMD security processor.
And this is quote from Brian Kelly from Microsoft who's Kaliptera architect.
Great security compromised by other great ideas.
Start to weaken its security posture.
So the point is that if security project is successful.
Then there's money in that project.
And there are managers who wants to create new features for the project.
More features, more features, bigger PCB, more vulnerabilities.
And essentially good project is no longer good project.
Yeah.
So we have to be conscious about that part.
So let's start what we build.
So this is state from last year.
This has state of high assurance.
Confidential infrastructure from last year.
So you see that we already got operating system open.
Yeah, we we even have firmware in this VMs open.
We got open hypervisors.
Firmare not really bios.
No no.
Sometimes BMC for some platforms.
But then we didn't know like what kind of proprietary pieces are there.
Sometimes BMC could be OTP fuse it to boot just the open.
Excuse me.
Just operating system vendor wants GPU definitely not.
The that the test execution environment security manager definitely definitely.
So ASP or whatever Intel has like management engine.
Definitely not.
Of course we have IBM and and arm, which is like a little bit more open.
But that difference that's different story.
And it's in CPU also.
Some platforms got.
Intel boot got provision at some note.
So it depends.
So this was of course a level.
We just were thinking.
Okay, what's going on here?
Where is the platform?
Which platform we should choose?
Which will give us ability to implement that.
And then this we know already.
Thanks to open seal and core boot dot.
Yeah, we can do this.
That's why it was already planted.
And.
Okay, little bit about the open open seal.
I already told you about little bit about it.
So who knows Agissa and the Agissa.
Okay, some.
So I'm the Agissa is a is a silicon initialization component that is added to BIOS by AMD.
So yeah, this is secret source for for an initialization of the silicon.
Yeah, it's like Intel FSP also.
The the point here is that Intel FSP took into consideration integration with the core boot.
So they have special mode of Intel FSP to integrate with open source BIOS.
And AMD did not of course there were really days of of AMD where they completely open source Agissa.
And it was included in the core boot.
But that's not what I'm talking.
I'm talking about the modern platform.
It's not the very legacy one.
So this was not all the table.
This was not all the table because this has been iron broke.
And then we have open seal, which is fully open source is on.
I guess MIT license on GitHub.
Everyone can contribute to it.
And we already did quite a lot of that.
It consists of three libraries.
Silicon initialization for memory and CPU part of the initialization platform reference
Firmare for platform right at configuration.
And utilities is at service if someone wants to add something more to this to this part.
But you know typically we want to leave it as small as possible.
And this was contributed to OCP as a standard in September 2025, which is very, very good.
And of course what we still have this one, I will not torture AMD more.
Okay.
So let's look at the boot chain.
How it looks like?
This is how it looks like before.
So we got some root of trust in our AMD security processor.
Then we have independent bios vendor framework, which we have no idea what's going on inside.
Something, something binary blocks and essentially closed source.
We knew that they integrated Agesar because that they needed for initialization of the AMD silicon.
And maybe they added some other features.
And then at some point we started hypervisor and from that combination VMs.
So we moved.
This is what 3M depth contributes with our code to cardboard.
So this one is just the standard boot process of cardboard.
And you can see that open seal is kind of blue at the RAM state level.
So this is one of the stages of booting of cardboard.
We cannot, we couldn't do this with Agesar because it's UFI only.
And RAM state cardboard does not implement this interface.
So this was not an option.
But this was possible to implement everything.
Every each step is is open.
It's contributed upstream mostly merged.
Okay.
This is the hardware.
This is Gigabyte MZ33-IR1.
Turing by Splatform.
We know that it's not provisioned with PSB unless they will change something in shipping.
But right now it is not.
We already confirmed there is no security in VMC.
So VMC is also possible.
So this is first retail server hardware, which will be shipped with open source firmware.
For the introspection in the confidential computing environment.
This is story on our blog post.
So this was the size of the contribution without SVSNP.
It was 13, 30,000 lights of code 80 for patches to cardboard.
7 to open seal around, you know, 3.7 of open seal code base was delivered with that work.
You can read about that using those links, rights are on the website.
Okay.
A little bit about the SVSNP implementation around 900 lines of code in cardboard and open seal.
This is what was delivered.
So yeah, I guess I will not dive into this.
It's like some PSP initialization, some memory integrity protection initialization mailbox for PSP.
So like some basic stuff to establish relation with with a SP with PSP to be able to run this feature on the open source feed my files.
Okay.
This is attestation.
I also think most of you know what's going on here.
So we have our confidential VM.
We have this project SNP guest.
We just creating a report which talks with AMD secure processor.
It using this vendor chip and those met key to sign it returns reports.
Then we fetch from the AMD server certificates.
We check that everything is okay.
Yeah, which checking that this sign is okay.
And then we can attest that whatever we get here from AMD SP is correct.
And then we will go to the yeah.
Attestation is completed.
Okay, demo time.
Let me go here.
Yeah, so first of all, we showing this is really core boot.
And that this is this gigabyte platform.
Then we showing that the kernel.
This is Ubuntu that the kernel really detected the features.
And what kind of features are enabled.
Then we start in QAMO with AMD SCV BIOS and all the required parameters.
And inside, we will essentially run this SNP guest report and confirm that the auto stations exceed.
Maybe I can make it a little bit faster.
The SNP guest.
We use root.
We're checking the features that the features are really recognized by the.
That we are in VMPL zero that the features are really recognized by the QAMO KVM.
Yeah, we have to load the module.
And then we're going to generate report.
Yeah, the report is generated.
Then we have to fetch all the keys from the server.
Yeah, which vendor, we fetch vendor chip and also in key,
with which that the keys are correctly signed.
And then we do the auto station and confirm that everything.
There's certainly a much is the attestation report and so on.
So that's what was delivered.
And let me get back to slides.
And this is the state after.
So the next slide is maybe better.
This is better.
So this is what changed.
So we have no keys here.
We have no keys here.
We deliver this part.
Of course, this part and this part stay close.
We provide that there is no key here.
And then because of that, we planning this one.
We planning OpenBNC with fusing.
Also fusing for the CPU.
And we already delivered this part.
So we have BIOS, which is open for your in-spoke
Interspection of the.
Yeah, I have to finish.
So I will just tell you.
There are kind of some backup slide.
But I will just tell you what's the future of that.
The future is that we have to complete the upstreaming.
We would like to offer.
The shot already.
So the shot is like a downstream distribution of the core boot,
which trimmed up many things.
So we will sell the gigabyte hardware with this.
But you don't have to buy from us.
You can buy the hardware yourself and flash yourself.
Compile and flash yourself.
And it would be great if you could deliver some feedback.
And some essentially testing because, you know,
there are memory testing.
Perifer testing is very important.
The next thing is SCV trusted IO for GPU accelerators.
I hope my being next year I can show that.
And participation in OpenSFI.
And in future, I hope we can contribute the same stuff for the other
confidential computing pieces.
And that's it from my side.
And we can, I don't know if we have any time for question.
Thank you very much.
Yes.
So when it's like something you were talking about.
But you were talking so.
Which one is it?
Is it green and draw a post?
What kind of protocol is it using?
You're just going like.
So let's be honest.
I'm not expert with attestation.
We're using an SNP guest.
You can, that's open source project from AMD.
You can check the source code and see how they doing it.
I don't know because I didn't expect that source.
That's not my point of this presentation.
The point of presentation is showing that I'm giving open source
Firmary-based platform for researchers' introspection.
That might go.
And attestation ecosystem and binaries for
Acestation is your topic.
It's confidential computing developers.
Researchers architect topic.
That's not my topic.
Yes?
Good question.
The memory that I've insinitation.
Is there any purpose in this?
Is it new to scope open?
Yes.
Is it a memory-genization scope of the open-seal?
No.
The most secret code was moved into PSP into PSP.
And that's why they can reveal all the other stuff.
That's why they give open-seal to the public.
That's, I think that's good choice.
Now we have to fight the next stage.
Yeah.
For your conduct, so you have only your roadmap into TDS.
I'm sent a lot of what you did for your personal platform.
By the way, is it possible to go to open-seal?
Is there something similar for Intel?
Yes.
It's Intel at the SP, it's closed source.
Is it possible open source firmware for Intel and Intel TDX?
To some extent, Intel keeps more proprietary closed source
groups.
So, AMD got open-seal, Intel got Intel FSP.
Intel FSP is closed so far and I don't think they will open it.
So, that's the limitation.
We have other platform, ASROR, CRAC, which you can find on our website.
Suffer app is, I guess, supports TDX.
A lot of question.
I'd know, like, what kind of level of TDX features its supports.
We already have DashROR for it.
So, there is open source for it.
Yeah.
So, there is possibility for researcher to enter something and check how much open it is.
So, what's the roadmap to what's having the system before it?
We are going to do things like the GPU, the network.
We have to keep our control up.
I mean, we have that business power in the home, because it's power to go out.
But that's been a while ago.
And I haven't seen anything similar to that's called on our AMD 64.
Yes.
So, the question is, what about other components like GPU firmware?
And, and the second was, this is a component.
We have to keep our control.
We have all these other things.
Network, keyboard control.
So, and essentially periphery controls.
Yes.
Platforms are full of firmware, full of proprietary firmware.
I'm not sure we can do everything.
We are just small company.
Like, help us.
Like, let's do it together.
Yes, there is work in almost every piece of ecosystem.
And we just have to push forward to propose something,
to show that the closer it's site, that a lot of CVs, that's our work.
Regarding the power, we did the power.
We did the transition of the C++ 800,000 lines of code of C++ to see the gore boot.
There is some small false promise there, which I can talk about you after,
because that's, with thinking that everything is completely open source on power,
but there are some missing specs.
Yeah?
You know, the thing that you can actually reverse the layer search,
and well-impeared, we see the chasing that vendors will be producing,
as a specular specification.
We are pulling them to three years.
We see them to create this location based on the observations from the open source projects.
One example is the feedbacks.
There's a new version.
Valet IO, which is on PCI.
There is no hardware on that.
And that's where you can get it's 336.
So at least 1, 2, 3 years after we're going to get something on the PX 2.0.
Yeah, so emulation is one thing we should push.
So the question is, if we can somehow reverse with the proprietary vendors to have something
earlier, or we'll cooperate with open ecosystem to have the features earlier,
then they release hardware.
And yes, I think they, so Intel do in Cmix, I think they should release more in Cmix,
and essentially provide working models for those advanced features.
QM could also get the contribution.
What would be the rough cost for a lunch system based on this?
That's a very good question.
It really, yeah, what would be the rough cost for this system?
What we did here was very expensive.
I will tell you.
It's not easy project.
It's not sponsored by NLNet, but NLNet also kind of finishing sponsoring,
and also we have to leave somehow.
Yeah, so it would definitely be margin on top of the, on top of the regulars.
It would be very hefty margin.
But on the other side, I don't expect you to pay that margin, because you are the hackers.
I don't want to earn money on hackers.
I don't care.
I care about those who want to benefit from open ecosystem,
without contributing to this ecosystem.
They will pay.
You can take the platform, get the code, compile yourself, and necessarily flash.
And that's for free.
The board cost, like, you know, the board cost is nothing comparison to memory cost.
So for, so it really depends which CPU you will use.
Yeah, it really depends on that.
I don't know what's the right now, how much 600 euro or something for this motherboard or something.
You can, isn't it?
Check, NZ33, A01, eBay, and check what's the price.
Hi, I'm wondering if you looked into it, like, the code driver,
or the NLNet, which driver?
Which driver?
The code driver of the CPU.
Cove driver?
Go.
Ah, go.
Graphical driver.
No, no, no, no, no, no, no, no.
This is not yet, maybe when we will get into a CV trusted IOR,
this would be something which will be more interesting,
because we will have some security story there.
Yeah, because that's, you know, I'm working on the thing report.
So I'm trying, but you need that information.
Cool, cool.
So we can, like, we definitely, if you will publish it,
we definitely can pick up and, and think.
All right.
Thank you again.
Thank you very much.
Thank you.