Exploring I/O Support for Virtualization-Based Trusted Execution Environment - Hao Wu, Intel

Exploring I/O Support for Virtualization-Based Trusted Execution Environment - Hao Wu, Intel

Confidential computing protects data in use by performing computation in a hardware-based Trusted Execution Environment (TEE). One use case is running confidential computing inside TEE VMs, which are protected against VMM/Host Software. As more and more computing workloads require assistances or accelerations from external devices, IO becomes necessary to run those workloads inside TEE VMs. This presentation will focus on discussion for IO support options in TEE VMs, and what are required for software, Linux/KVM, host hardware, and devices to support these options. For example, one of the options is using direct IO + bounce buffer in shared memory, in case the device has no access to TEE VM private memory but only shared memory, data through the shared bounce buffer needs additional protection and encryption for security.