system/i386/amd-memory-encryption.rst

1 .. _amd-sev:
8 SEV is an extension to the AMD-V architecture which supports running encrypted
17 AMD secure processor (AMD-SP), which is present in AMD SOCs. Firmware running
18 inside the AMD-SP provides commands to support a common VM lifecycle. This
23 Secure Encrypted Virtualization - Encrypted State (SEV-ES) builds on the SEV
30 Launching (SEV and SEV-ES)
31 --------------------------
40 For a SEV-ES guest, the ``LAUNCH_UPDATE_VMSA`` command is also used to encrypt the
45 its public Diffie-Hellman key (PDH) and session parameters. These inputs
46 should be treated as a binary blob and must be passed as-is to the SEV firmware.
50 in bad measurement). The guest policy is a 4-byte data structure containing
57      sev-guest,id=sev0,policy=0x1...\
59 Setting the "SEV-ES required" policy bit (bit 2) will launch the guest as a
60 SEV-ES guest::
63      sev-guest,id=sev0,policy=0x5...\
69 The DH certificate and session blob can be provided via the ``dh-cert-file`` and
70 ``session-file`` properties::
73        sev-guest,id=sev0,dh-cert-file=<file1>,session-file=<file2>
80 ``LAUNCH_UPDATE_VMSA`` encrypts all the vCPU VMSAs for a SEV-ES guest using the
85 for a SEV-ES guest, encrypted VMSAs. This measurement is a signature of the
86 memory contents and, for a SEV-ES guest, the VMSA contents, that can be sent
103       -machine ...,confidential-guest-support=sev0 \
104       -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1
106 To launch a SEV-ES guest::
109       -machine ...,confidential-guest-support=sev0 \
110       -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x5
112 An SEV-ES guest has some restrictions as compared to a SEV guest. Because the
114 a SEV-ES guest:
116  - Does not support SMM - SMM support requires updating the guest register
118  - Does not support reboot - a system reset requires updating the guest register
120  - Requires in-kernel irqchip - the burden is placed on the hypervisor to
124 ---------------------------------------------
127 it in the exact same way as it is calculated by the AMD-SP.  SEV API Spec
128 ([SEVAPI]_) section 6.5.1 describes the AMD-SP operations:
140 from the ``query-sev`` qmp command.
142 The value of MNONCE is part of the response of ``query-sev-launch-measure``: it
143 is the last 16 bytes of the base64-decoded data field (see SEV API Spec
154 * if kernel is used, and ``kernel-hashes=on``, then ``kernel_hashes_blob`` is
158 * if SEV-ES is enabled (``policy & 0x4 != 0``), ``vmsas_blob`` is the
161   or in AMD APM Volume 2 ([APMVOL2]_) Table B-2: VMCB Layout, State Save Area.
163 If kernel hashes are not used, or SEV-ES is disabled, use empty blobs for
166 Launching (SEV-SNP)
167 -------------------
171 three commands communicate with SEV-SNP firmware to generate a fresh memory
173 more details on the SEV-SNP firmware interfaces used by these commands please
174 see the SEV-SNP Firmware ABI.
178 guest policy and other parameters as described in the SEV-SNP firmware
180 QAPI schema for the sev-snp-guest object.
184 'sev-snp-guest' object.
186 +--------+-------+----------+-------------------------------------------------+
188 +---------------------------+-------------------------------------------------+
189 | policy                    | hex   | 0x30000  | a 64-bit guest policy        |
190 +---------------------------+-------------------------------------------------+
191 | guest-visible-workarounds | string| 0        | 16-byte base64 encoded string|
194 +---------------------------+-------------------------------------------------+
205 in the attestation report. See the SEV-SNP spec for further details.
209 'sev-snp-guest' object.
211 +--------------------+-------+----------+-------------------------------------+
213 +--------------------+-------+----------+-------------------------------------+
214 | id-block           | string| none     | base64 encoded ID block             |
215 +--------------------+-------+----------+-------------------------------------+
216 | id-auth            | string| none     | base64 encoded authentication       |
218 +--------------------+-------+----------+-------------------------------------+
219 | author-key-enabled | bool  | 0        | auth block contains author key      |
220 +--------------------+-------+----------+-------------------------------------+
222 +--------------------+-------+----------+-------------------------------------+
224 To launch a SEV-SNP guest (additional parameters are documented in the QAPI
225 schema for the 'sev-snp-guest' object)::
228     -machine ...,confidential-guest-support=sev0 \
229     -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1
233 ---------
241 ----------------
246 ---------------
251 ----------
254 …ps://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/memory-encryption-wh…
257    <https://www.amd.com/system/files/TechDocs/55766_SEV-KM_API_Specification.pdf>`_
260 …<https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.…
265 …<http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption…
266 * `Extending Secure Encrypted Virtualization With SEV-ES (2018)
267 …<https://www.linux-kvm.org/images/9/94/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thoma…
270 <https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.p…
274 * SEV-ES is section 15.35