요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
.. SPDX-License-Identifier: GPL-2.0
=====================
AMD Memory Encryption
=====================
Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV) are
features found on AMD processors.
SME provides the ability to mark individual pages of memory as encrypted using
the standard x86 page tables. A page that is marked encrypted will be
automatically decrypted when read from DRAM and encrypted when written to
DRAM. SME can therefore be used to protect the contents of DRAM from physical
attacks on the system.
SEV enables running encrypted virtual machines (VMs) in which the code and data
of the guest VM are secured so that a decrypted version is available only
within the VM itself. SEV guest VMs have the concept of private and shared
memory. Private memory is encrypted with the guest-specific key, while shared
memory may be encrypted with hypervisor key. When SME is enabled, the hypervisor
key is the same key which is used in SME.
A page is encrypted when a page table entry has the encryption bit set (see
below on how to determine its position). The encryption bit can also be
specified in the cr3 register, allowing the PGD table to be encrypted. Each
successive level of page tables can also be encrypted by setting the encryption
bit in the page table entry that points to the next table. This allows the full
page table hierarchy to be encrypted. Note, this means that just because the
encryption bit is set in cr3, doesn't imply the full hierarchy is encrypted.
Each page table entry in the hierarchy needs to have the encryption bit set to
achieve that. So, theoretically, you could have the encryption bit set in cr3
so that the PGD is encrypted, but not set the encryption bit in the PGD entry
for a PUD which results in the PUD pointed to by that entry to not be
encrypted.
When SEV is enabled, instruction pages and guest page tables are always treated
as private. All the DMA operations inside the guest must be performed on shared
memory. Since the memory encryption bit is controlled by the guest OS when it
is operating in 64-bit or 32-bit PAE mode, in all other modes the SEV hardware
forces the memory encryption bit to 1.
Support for SME and SEV can be determined through the CPUID instruction. The
CPUID function 0x8000001f reports information related to SME::
0x8000001f[eax]:
Bit[0] indicates support for SME
Bit[1] indicates support for SEV
0x8000001f[ebx]:
Bits[5:0] pagetable bit number used to activate memory
encryption
Bits[11:6] reduction in physical address space, in bits, when
memory encryption is enabled (this only affects
system physical addresses, not guest physical
addresses)
If support for SME is present, MSR 0xc00100010 (MSR_AMD64_SYSCFG) can be used to
determine if SME is enabled and/or to enable memory encryption::
0xc0010010:
Bit[23] 0 = memory encryption features are disabled
1 = memory encryption features are enabled
If SEV is supported, MSR 0xc0010131 (MSR_AMD64_SEV) can be used to determine if
SEV is active::
0xc0010131:
Bit[0] 0 = memory encryption is not active
1 = memory encryption is active
Linux relies on BIOS to set this bit if BIOS has determined that the reduction
in the physical address space as a result of enabling memory encryption (see
CPUID information above) will not conflict with the address space resource
requirements for the system. If this bit is not set upon Linux startup then
Linux itself will not set it and memory encryption will not be possible.
The state of SME in the Linux kernel can be documented as follows:
- Supported:
The CPU supports SME (determined through CPUID instruction).
- Enabled:
Supported and bit 23 of MSR_AMD64_SYSCFG is set.
- Active:
Supported, Enabled and the Linux kernel is actively applying
the encryption bit to page table entries (the SME mask in the
kernel is non-zero).
SME can also be enabled and activated in the BIOS. If SME is enabled and
activated in the BIOS, then all memory accesses will be encrypted and it
will not be necessary to activate the Linux memory encryption support.
If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG),
then memory encryption can be enabled by supplying mem_encrypt=on on the
kernel command line. However, if BIOS does not enable SME, then Linux
will not be able to activate memory encryption, even if configured to do
so by default or the mem_encrypt=on command line parameter is specified.
Secure Nested Paging (SNP)
==========================
SEV-SNP introduces new features (SEV_FEATURES[1:63]) which can be enabled
by the hypervisor for security enhancements. Some of these features need
guest side implementation to function correctly. The below table lists the
expected guest behavior with various possible scenarios of guest/hypervisor
SNP feature support.
+-----------------+---------------+---------------+------------------+
| Feature Enabled | Guest needs | Guest has | Guest boot |
| by the HV | implementation| implementation| behaviour |
+=================+===============+===============+==================+
| No | No | No | Boot |
| | | | |
+-----------------+---------------+---------------+------------------+
| No | Yes | No | Boot |
| | | | |
+-----------------+---------------+---------------+------------------+
| No | Yes | Yes | Boot |
| | | | |
+-----------------+---------------+---------------+------------------+
| Yes | No | No | Boot with |
| | | | feature enabled |
+-----------------+---------------+---------------+------------------+
| Yes | Yes | No | Graceful boot |
| | | | failure |
+-----------------+---------------+---------------+------------------+
| Yes | Yes | Yes | Boot with |
| | | | feature enabled |
+-----------------+---------------+---------------+------------------+
More details in AMD64 APM[1] Vol 2: 15.34.10 SEV_STATUS MSR
Reverse Map Table (RMP)
=======================
The RMP is a structure in system memory that is used to ensure a one-to-one
mapping between system physical addresses and guest physical addresses. Each
page of memory that is potentially assignable to guests has one entry within
the RMP.
The RMP table can be either contiguous in memory or a collection of segments
in memory.
Contiguous RMP
--------------
Support for this form of the RMP is present when support for SEV-SNP is
present, which can be determined using the CPUID instruction::
0x8000001f[eax]:
Bit[4] indicates support for SEV-SNP
The location of the RMP is identified to the hardware through two MSRs::
0xc0010132 (RMP_BASE):
System physical address of the first byte of the RMP
0xc0010133 (RMP_END):
System physical address of the last byte of the RMP
Hardware requires that RMP_BASE and (RPM_END + 1) be 8KB aligned, but SEV
firmware increases the alignment requirement to require a 1MB alignment.
The RMP consists of a 16KB region used for processor bookkeeping followed
by the RMP entries, which are 16 bytes in size. The size of the RMP
determines the range of physical memory that the hypervisor can assign to
SEV-SNP guests. The RMP covers the system physical address from::
0 to ((RMP_END + 1 - RMP_BASE - 16KB) / 16B) x 4KB.
The current Linux support relies on BIOS to allocate/reserve the memory for
the RMP and to set RMP_BASE and RMP_END appropriately. Linux uses the MSR
values to locate the RMP and determine the size of the RMP. The RMP must
cover all of system memory in order for Linux to enable SEV-SNP.
Segmented RMP
-------------
Segmented RMP support is a new way of representing the layout of an RMP.
Initial RMP support required the RMP table to be contiguous in memory.
RMP accesses from a NUMA node on which the RMP doesn't reside
can take longer than accesses from a NUMA node on which the RMP resides.
Segmented RMP support allows the RMP entries to be located on the same
node as the memory the RMP is covering, potentially reducing latency
associated with accessing an RMP entry associated with the memory. Each
RMP segment covers a specific range of system physical addresses.
Support for this form of the RMP can be determined using the CPUID
instruction::
0x8000001f[eax]:
Bit[23] indicates support for segmented RMP
If supported, segmented RMP attributes can be found using the CPUID
instruction::
0x80000025[eax]:
Bits[5:0] minimum supported RMP segment size
Bits[11:6] maximum supported RMP segment size
0x80000025[ebx]:
Bits[9:0] number of cacheable RMP segment definitions
Bit[10] indicates if the number of cacheable RMP segments
is a hard limit
To enable a segmented RMP, a new MSR is available::
0xc0010136 (RMP_CFG):
Bit[0] indicates if segmented RMP is enabled
Bits[13:8] contains the size of memory covered by an RMP
segment (expressed as a power of 2)
The RMP segment size defined in the RMP_CFG MSR applies to all segments
of the RMP. Therefore each RMP segment covers a specific range of system
physical addresses. For example, if the RMP_CFG MSR value is 0x2401, then
the RMP segment coverage value is 0x24 => 36, meaning the size of memory
covered by an RMP segment is 64GB (1 << 36). So the first RMP segment
covers physical addresses from 0 to 0xF_FFFF_FFFF, the second RMP segment
covers physical addresses from 0x10_0000_0000 to 0x1F_FFFF_FFFF, etc.
When a segmented RMP is enabled, RMP_BASE points to the RMP bookkeeping
area as it does today (16K in size). However, instead of RMP entries
beginning immediately after the bookkeeping area, there is a 4K RMP
segment table (RST). Each entry in the RST is 8-bytes in size and represents
an RMP segment::
Bits[19:0] mapped size (in GB)
The mapped size can be less than the defined segment size.
A value of zero, indicates that no RMP exists for the range
of system physical addresses associated with this segment.
Bits[51:20] segment physical address
This address is left shift 20-bits (or just masked when
read) to form the physical address of the segment (1MB
alignment).
The RST can hold 512 segment entries but can be limited in size to the number
of cacheable RMP segments (CPUID 0x80000025_EBX[9:0]) if the number of cacheable
RMP segments is a hard limit (CPUID 0x80000025_EBX[10]).
The current Linux support relies on BIOS to allocate/reserve the memory for
the segmented RMP (the bookkeeping area, RST, and all segments), build the RST
and to set RMP_BASE, RMP_END, and RMP_CFG appropriately. Linux uses the MSR
values to locate the RMP and determine the size and location of the RMP
segments. The RMP must cover all of system memory in order for Linux to enable
SEV-SNP.
More details in the AMD64 APM Vol 2, section "15.36.3 Reverse Map Table",
docID: 24593.
Secure VM Service Module (SVSM)
===============================
SNP provides a feature called Virtual Machine Privilege Levels (VMPL) which
defines four privilege levels at which guest software can run. The most
privileged level is 0 and numerically higher numbers have lesser privileges.
More details in the AMD64 APM Vol 2, section "15.35.7 Virtual Machine
Privilege Levels", docID: 24593.
When using that feature, different services can run at different protection
levels, apart from the guest OS but still within the secure SNP environment.
They can provide services to the guest, like a vTPM, for example.
When a guest is not running at VMPL0, it needs to communicate with the software
running at VMPL0 to perform privileged operations or to interact with secure
services. An example fur such a privileged operation is PVALIDATE which is
*required* to be executed at VMPL0.
In this scenario, the software running at VMPL0 is usually called a Secure VM
Service Module (SVSM). Discovery of an SVSM and the API used to communicate
with it is documented in "Secure VM Service Module for SEV-SNP Guests", docID:
58019.
(Latest versions of the above-mentioned documents can be found by using
a search engine like duckduckgo.com and typing in:
site:amd.com "Secure VM Service Module for SEV-SNP Guests", docID: 58019
for example.)
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
SME와 SEV
1-21이 `GPL-2.0` 문서는 AMD processor의 Secure Memory Encryption(SME)과 Secure Encrypted Virtualization(SEV)을 설명합니다.
SME는 표준 x86 page table을 사용해 memory page 각각을 encrypted로 표시합니다. encrypted page는 DRAM에서 읽을 때 자동으로 decrypt되고 DRAM에 쓸 때 encrypt되므로 physical attack으로부터 DRAM content를 보호할 수 있습니다.
SEV는 guest VM의 code와 data를 보호해 decrypted version을 VM 내부에서만 사용할 수 있는 encrypted virtual machine을 실행하게 합니다. SEV guest VM에는 private memory와 shared memory가 있습니다.
private memory는 guest-specific key로 encrypt하고 shared memory는 hypervisor key로 encrypt할 수 있습니다. SME가 enabled이면 hypervisor key는 SME에서 쓰는 key와 같습니다.
page-table encryption hierarchy와 DMA
22-40page-table entry에 encryption bit를 설정하면 page가 encrypted됩니다. bit 위치를 찾는 방법은 뒤에서 설명합니다. `cr3` register에도 encryption bit를 지정해 PGD table을 encrypt할 수 있습니다.
다음 page-table level을 가리키는 entry마다 encryption bit를 설정하면 successive level도 encrypt되어 전체 page-table hierarchy를 보호할 수 있습니다.
`cr3`에 encryption bit가 설정됐다고 전체 hierarchy가 자동으로 encrypted되는 것은 아닙니다. 각 hierarchy entry에도 bit가 필요합니다. 예를 들어 `cr3`로 PGD를 encrypt해도 PUD를 가리키는 PGD entry에 bit가 없으면 그 PUD는 encrypted되지 않습니다.
SEV가 enabled이면 instruction page와 guest page table은 항상 private으로 취급됩니다. guest 내부의 모든 DMA operation은 shared memory에서 수행해야 합니다.
64-bit 또는 32-bit PAE mode에서는 guest OS가 memory encryption bit를 제어합니다. 그 밖의 mode에서는 SEV hardware가 memory encryption bit를 1로 강제합니다.
CPUID와 MSR로 지원·활성 상태 확인
41-69SME와 SEV 지원 여부는 CPUID instruction으로 확인합니다. CPUID function `0x8000001f`는 SME 관련 capability와 page-table encryption bit 위치, physical-address-space reduction을 보고합니다.
0x8000001f[eax]:
Bit[0] indicates support for SME
Bit[1] indicates support for SEV
0x8000001f[ebx]:
Bits[5:0] pagetable bit number used to activate memory
encryption
Bits[11:6] reduction in physical address space, in bits, when
memory encryption is enabled (this only affects
system physical addresses, not guest physical
addresses)SME를 지원하면 `MSR_AMD64_SYSCFG`를 사용해 SME enabled 상태를 확인하거나 memory encryption을 enable할 수 있습니다.
원문 prose에는 MSR을 `0xc00100010`으로 표기하지만 이어지는 register block과 symbol `MSR_AMD64_SYSCFG`의 값은 `0xc0010010`입니다.
0xc0010010:
Bit[23] 0 = memory encryption features are disabled
1 = memory encryption features are enabledSEV를 지원하면 `MSR_AMD64_SEV`(`0xc0010131`)의 bit 0으로 memory encryption active 상태를 확인합니다.
0xc0010131:
Bit[0] 0 = memory encryption is not active
1 = memory encryption is activeBIOS 조건과 Linux SME 상태
70-98Linux는 memory encryption을 enable할 때 줄어드는 physical address space가 system address-space resource requirement와 충돌하지 않는다고 BIOS가 판단한 경우 BIOS가 `MSR_AMD64_SYSCFG` bit 23을 설정한다고 전제합니다.
Linux startup 때 bit가 설정되지 않았으면 Linux가 직접 설정하지 않으므로 memory encryption을 사용할 수 없습니다.
Linux kernel의 SME state는 다음 세 단계입니다.
- Supported: CPU가 SME를 지원합니다. CPUID instruction으로 판별합니다.
- Enabled: Supported 상태이며 `MSR_AMD64_SYSCFG` bit 23이 설정돼 있습니다.
- Active: Supported와 Enabled 상태이고 Linux kernel이 page-table entry에 encryption bit를 실제로 적용합니다. kernel의 SME mask가 non-zero입니다.
BIOS가 SME를 enable하고 activate할 수도 있습니다. 이 경우 모든 memory access가 encrypted되므로 Linux memory-encryption support를 별도로 activate할 필요가 없습니다.
BIOS가 SME를 enable하기만 했다면, 즉 `MSR_AMD64_SYSCFG` bit 23만 설정했다면 kernel command line의 `mem_encrypt=on`으로 memory encryption을 활성화할 수 있습니다. BIOS가 SME를 enable하지 않았다면 default configuration이나 `mem_encrypt=on`을 사용해도 Linux가 activate할 수 없습니다.
Secure Nested Paging feature negotiation
99-132SEV-SNP는 security enhancement를 위해 hypervisor가 enable할 수 있는 새 feature `SEV_FEATURES[1:63]`을 도입합니다. 일부 feature는 올바르게 동작하려면 guest-side implementation이 필요합니다.
guest와 hypervisor의 SNP feature 지원 조합에 따른 예상 guest behavior는 다음과 같습니다.
원문의 ASCII 표를 동일한 네 열과 여섯 scenario로 구조화했습니다.
자세한 내용은 AMD64 APM[1] Volume 2 section `15.34.10 SEV_STATUS MSR`을 참조합니다.
Reverse Map Table 개요
133-143Reverse Map Table(RMP)은 system physical address와 guest physical address 사이의 one-to-one mapping을 보장하기 위해 system memory에 두는 구조입니다. guest에 할당될 가능성이 있는 memory page마다 RMP entry 하나가 있습니다.
RMP table은 memory에서 contiguous할 수도 있고 여러 memory segment의 collection일 수도 있습니다.
contiguous RMP
144-175SEV-SNP를 지원하면 contiguous RMP도 지원하며 CPUID `0x8000001f[eax]` bit 4로 확인합니다.
0x8000001f[eax]:
Bit[4] indicates support for SEV-SNPhardware에는 `RMP_BASE`와 `RMP_END` 두 MSR로 RMP 위치를 알립니다.
0xc0010132 (RMP_BASE):
System physical address of the first byte of the RMP
0xc0010133 (RMP_END):
System physical address of the last byte of the RMPhardware는 `RMP_BASE`와 `(RMP_END + 1)`에 8 KiB alignment를 요구하지만 SEV firmware는 더 엄격한 1 MiB alignment를 요구합니다.
RMP는 processor bookkeeping용 16 KiB region 뒤에 16-byte RMP entry들이 이어지는 구조입니다. RMP size는 hypervisor가 SEV-SNP guest에 할당할 수 있는 physical-memory range를 결정합니다.
0 to ((RMP_END + 1 - RMP_BASE - 16KB) / 16B) x 4KB.현재 Linux support는 BIOS가 RMP memory를 allocate/reserve하고 `RMP_BASE`, `RMP_END`를 올바르게 설정한다고 전제합니다. Linux는 MSR 값으로 RMP 위치와 size를 구합니다. Linux가 SEV-SNP를 enable하려면 RMP가 system memory 전체를 cover해야 합니다.
segmented RMP와 capability
176-205segmented RMP는 RMP layout을 표현하는 새 방식입니다. 초기 RMP는 table 전체가 contiguous memory에 있어야 했습니다. RMP가 없는 NUMA node에서 RMP에 접근하면 RMP가 있는 node보다 오래 걸릴 수 있습니다.
segmented RMP는 RMP가 cover하는 memory와 같은 node에 entry를 둘 수 있어 entry-access latency를 줄일 수 있습니다. 각 RMP segment는 특정 system-physical-address range를 cover합니다.
segmented RMP 지원 여부는 CPUID `0x8000001f[eax]` bit 23으로 확인합니다.
0x8000001f[eax]:
Bit[23] indicates support for segmented RMP지원되는 경우 CPUID `0x80000025`에서 최소·최대 segment size, cacheable segment definition 수, 그 수가 hard limit인지 확인합니다.
0x80000025[eax]:
Bits[5:0] minimum supported RMP segment size
Bits[11:6] maximum supported RMP segment size
0x80000025[ebx]:
Bits[9:0] number of cacheable RMP segment definitions
Bit[10] indicates if the number of cacheable RMP segments
is a hard limitRMP_CFG와 segment coverage
206-220segmented RMP를 enable하기 위해 `RMP_CFG` MSR `0xc0010136`을 사용합니다. bit 0은 enable 상태이고 bits 13:8은 한 RMP segment가 cover하는 memory size를 power-of-two exponent로 나타냅니다.
0xc0010136 (RMP_CFG):
Bit[0] indicates if segmented RMP is enabled
Bits[13:8] contains the size of memory covered by an RMP
segment (expressed as a power of 2)`RMP_CFG`에 정의한 segment size는 모든 RMP segment에 적용됩니다. 예를 들어 값이 `0x2401`이면 coverage exponent는 `0x24`, 즉 36이고 segment 하나가 64 GiB(원문 표기 `64GB`, `1 << 36`)를 cover합니다.
따라서 첫 segment는 physical address `0`부터 `0xF_FFFF_FFFF`, 둘째 segment는 `0x10_0000_0000`부터 `0x1F_FFFF_FFFF`를 cover하며 이후에도 같은 방식으로 이어집니다.
RMP Segment Table과 Linux 요구 사항
221-245segmented RMP를 enable하면 `RMP_BASE`는 기존처럼 16 KiB bookkeeping area를 가리킵니다. 다만 바로 뒤에 RMP entry가 시작되는 대신 4 KiB RMP Segment Table(RST)이 놓입니다. RST entry는 8 byte이며 RMP segment 하나를 나타냅니다.
Bits[19:0] mapped size (in GB)
The mapped size can be less than the defined segment size.
A value of zero, indicates that no RMP exists for the range
of system physical addresses associated with this segment.
Bits[51:20] segment physical address
This address is left shift 20-bits (or just masked when
read) to form the physical address of the segment (1MB
alignment).bits 19:0은 mapped size를 GiB 단위로 나타내며 defined segment size보다 작을 수 있습니다. 0이면 해당 system-physical-address range에 RMP가 없습니다. bits 51:20은 segment physical address이며 20 bit left shift해 1 MiB aligned physical address를 만듭니다.
RST는 segment entry 512개를 담을 수 있습니다. cacheable RMP segment 수가 hard limit이면 CPUID `0x80000025_EBX[9:0]`이 나타내는 수로 table size를 제한할 수 있고, hard-limit 여부는 `0x80000025_EBX[10]`에 있습니다.
현재 Linux support는 BIOS가 bookkeeping area, RST, 모든 segment memory를 allocate/reserve하고 RST를 만든 뒤 `RMP_BASE`, `RMP_END`, `RMP_CFG`를 설정한다고 전제합니다. Linux는 MSR로 segment 위치와 size를 찾으며 SEV-SNP를 enable하려면 RMP가 system memory 전체를 cover해야 합니다.
RMP 사양 참조
246-249자세한 내용은 AMD64 APM Volume 2 section `15.36.3 Reverse Map Table`, document ID `24593`을 참조합니다.
Secure VM Service Module
250-271SNP의 Virtual Machine Privilege Levels(VMPL)는 guest software가 실행될 수 있는 privilege level 네 개를 정의합니다. 가장 privileged한 level은 0이며 숫자가 커질수록 privilege가 낮습니다. 자세한 내용은 AMD64 APM Volume 2 section `15.35.7 Virtual Machine Privilege Levels`, document ID `24593`에 있습니다.
이 feature를 사용하면 guest OS와 분리되어 있으면서도 secure SNP environment 안에 있는 서로 다른 protection level에서 service를 실행할 수 있습니다. 예를 들어 guest에 vTPM service를 제공할 수 있습니다.
guest가 VMPL0에서 실행되지 않으면 privileged operation 수행이나 secure service 이용을 위해 VMPL0 software와 통신해야 합니다. 예를 들어 `PVALIDATE`는 반드시 VMPL0에서 실행해야 합니다.
이 scenario에서 VMPL0 software를 일반적으로 Secure VM Service Module(SVSM)이라 부릅니다. SVSM discovery와 communication API는 `Secure VM Service Module for SEV-SNP Guests`, document ID `58019`에 정의되어 있습니다.
최신 SVSM 문서 찾기
272-278위 문서의 최신 version은 DuckDuckGo 같은 search engine에서 다음 query를 입력해 찾을 수 있습니다.
site:amd.com "Secure VM Service Module for SEV-SNP Guests", docID: 58019
요약과 해설
amd-memory-encryption.rst:1-278SME는 x86 page-table C-bit로 DRAM page를 자동 encrypt/decrypt하고, SEV는 guest-specific key의 private memory와 hypervisor가 접근하는 shared memory를 구분합니다. page-table hierarchy는 각 level entry에 C-bit를 설정해야 완전히 encrypted되며 guest DMA는 shared memory를 사용해야 합니다.
CPUID `0x8000001f`와 `MSR_AMD64_SYSCFG`·`MSR_AMD64_SEV`로 capability와 활성 상태를 확인합니다. Linux는 BIOS가 physical-address-space reduction을 검증해 SME를 enable하고 RMP memory를 reserve했다고 전제합니다.
SEV-SNP의 RMP는 system physical address와 guest physical address의 one-to-one mapping을 보장합니다. segmented RMP는 NUMA-local entry로 latency를 줄이며 `RMP_CFG`와 RST로 segment를 기술합니다. VMPL0의 SVSM은 낮은 VMPL guest에 `PVALIDATE`, vTPM 같은 privileged·secure service를 제공합니다.