1.. SPDX-License-Identifier: GPL-2.0 2 3===================== 4AMD Memory Encryption 5===================== 6 7Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV) are 8features found on AMD processors. 9 10SME provides the ability to mark individual pages of memory as encrypted using 11the standard x86 page tables. A page that is marked encrypted will be 12automatically decrypted when read from DRAM and encrypted when written to 13DRAM. SME can therefore be used to protect the contents of DRAM from physical 14attacks on the system. 15 16SEV enables running encrypted virtual machines (VMs) in which the code and data 17of the guest VM are secured so that a decrypted version is available only 18within the VM itself. SEV guest VMs have the concept of private and shared 19memory. Private memory is encrypted with the guest-specific key, while shared 20memory may be encrypted with hypervisor key. When SME is enabled, the hypervisor 21key is the same key which is used in SME. 22 23A page is encrypted when a page table entry has the encryption bit set (see 24below on how to determine its position). The encryption bit can also be 25specified in the cr3 register, allowing the PGD table to be encrypted. Each 26successive level of page tables can also be encrypted by setting the encryption 27bit in the page table entry that points to the next table. This allows the full 28page table hierarchy to be encrypted. Note, this means that just because the 29encryption bit is set in cr3, doesn't imply the full hierarchy is encrypted. 30Each page table entry in the hierarchy needs to have the encryption bit set to 31achieve that. So, theoretically, you could have the encryption bit set in cr3 32so that the PGD is encrypted, but not set the encryption bit in the PGD entry 33for a PUD which results in the PUD pointed to by that entry to not be 34encrypted. 35 36When SEV is enabled, instruction pages and guest page tables are always treated 37as private. All the DMA operations inside the guest must be performed on shared 38memory. Since the memory encryption bit is controlled by the guest OS when it 39is operating in 64-bit or 32-bit PAE mode, in all other modes the SEV hardware 40forces the memory encryption bit to 1. 41 42Support for SME and SEV can be determined through the CPUID instruction. The 43CPUID function 0x8000001f reports information related to SME:: 44 45 0x8000001f[eax]: 46 Bit[0] indicates support for SME 47 Bit[1] indicates support for SEV 48 0x8000001f[ebx]: 49 Bits[5:0] pagetable bit number used to activate memory 50 encryption 51 Bits[11:6] reduction in physical address space, in bits, when 52 memory encryption is enabled (this only affects 53 system physical addresses, not guest physical 54 addresses) 55 56If support for SME is present, MSR 0xc00100010 (MSR_AMD64_SYSCFG) can be used to 57determine if SME is enabled and/or to enable memory encryption:: 58 59 0xc0010010: 60 Bit[23] 0 = memory encryption features are disabled 61 1 = memory encryption features are enabled 62 63If SEV is supported, MSR 0xc0010131 (MSR_AMD64_SEV) can be used to determine if 64SEV is active:: 65 66 0xc0010131: 67 Bit[0] 0 = memory encryption is not active 68 1 = memory encryption is active 69 70Linux relies on BIOS to set this bit if BIOS has determined that the reduction 71in the physical address space as a result of enabling memory encryption (see 72CPUID information above) will not conflict with the address space resource 73requirements for the system. If this bit is not set upon Linux startup then 74Linux itself will not set it and memory encryption will not be possible. 75 76The state of SME in the Linux kernel can be documented as follows: 77 78 - Supported: 79 The CPU supports SME (determined through CPUID instruction). 80 81 - Enabled: 82 Supported and bit 23 of MSR_AMD64_SYSCFG is set. 83 84 - Active: 85 Supported, Enabled and the Linux kernel is actively applying 86 the encryption bit to page table entries (the SME mask in the 87 kernel is non-zero). 88 89SME can also be enabled and activated in the BIOS. If SME is enabled and 90activated in the BIOS, then all memory accesses will be encrypted and it 91will not be necessary to activate the Linux memory encryption support. 92 93If the BIOS merely enables SME (sets bit 23 of the MSR_AMD64_SYSCFG), 94then memory encryption can be enabled by supplying mem_encrypt=on on the 95kernel command line. However, if BIOS does not enable SME, then Linux 96will not be able to activate memory encryption, even if configured to do 97so by default or the mem_encrypt=on command line parameter is specified. 98 99Secure Nested Paging (SNP) 100========================== 101 102SEV-SNP introduces new features (SEV_FEATURES[1:63]) which can be enabled 103by the hypervisor for security enhancements. Some of these features need 104guest side implementation to function correctly. The below table lists the 105expected guest behavior with various possible scenarios of guest/hypervisor 106SNP feature support. 107 108+-----------------+---------------+---------------+------------------+ 109| Feature Enabled | Guest needs | Guest has | Guest boot | 110| by the HV | implementation| implementation| behaviour | 111+=================+===============+===============+==================+ 112| No | No | No | Boot | 113| | | | | 114+-----------------+---------------+---------------+------------------+ 115| No | Yes | No | Boot | 116| | | | | 117+-----------------+---------------+---------------+------------------+ 118| No | Yes | Yes | Boot | 119| | | | | 120+-----------------+---------------+---------------+------------------+ 121| Yes | No | No | Boot with | 122| | | | feature enabled | 123+-----------------+---------------+---------------+------------------+ 124| Yes | Yes | No | Graceful boot | 125| | | | failure | 126+-----------------+---------------+---------------+------------------+ 127| Yes | Yes | Yes | Boot with | 128| | | | feature enabled | 129+-----------------+---------------+---------------+------------------+ 130 131More details in AMD64 APM[1] Vol 2: 15.34.10 SEV_STATUS MSR 132 133Reverse Map Table (RMP) 134======================= 135 136The RMP is a structure in system memory that is used to ensure a one-to-one 137mapping between system physical addresses and guest physical addresses. Each 138page of memory that is potentially assignable to guests has one entry within 139the RMP. 140 141The RMP table can be either contiguous in memory or a collection of segments 142in memory. 143 144Contiguous RMP 145-------------- 146 147Support for this form of the RMP is present when support for SEV-SNP is 148present, which can be determined using the CPUID instruction:: 149 150 0x8000001f[eax]: 151 Bit[4] indicates support for SEV-SNP 152 153The location of the RMP is identified to the hardware through two MSRs:: 154 155 0xc0010132 (RMP_BASE): 156 System physical address of the first byte of the RMP 157 158 0xc0010133 (RMP_END): 159 System physical address of the last byte of the RMP 160 161Hardware requires that RMP_BASE and (RPM_END + 1) be 8KB aligned, but SEV 162firmware increases the alignment requirement to require a 1MB alignment. 163 164The RMP consists of a 16KB region used for processor bookkeeping followed 165by the RMP entries, which are 16 bytes in size. The size of the RMP 166determines the range of physical memory that the hypervisor can assign to 167SEV-SNP guests. The RMP covers the system physical address from:: 168 169 0 to ((RMP_END + 1 - RMP_BASE - 16KB) / 16B) x 4KB. 170 171The current Linux support relies on BIOS to allocate/reserve the memory for 172the RMP and to set RMP_BASE and RMP_END appropriately. Linux uses the MSR 173values to locate the RMP and determine the size of the RMP. The RMP must 174cover all of system memory in order for Linux to enable SEV-SNP. 175 176Segmented RMP 177------------- 178 179Segmented RMP support is a new way of representing the layout of an RMP. 180Initial RMP support required the RMP table to be contiguous in memory. 181RMP accesses from a NUMA node on which the RMP doesn't reside 182can take longer than accesses from a NUMA node on which the RMP resides. 183Segmented RMP support allows the RMP entries to be located on the same 184node as the memory the RMP is covering, potentially reducing latency 185associated with accessing an RMP entry associated with the memory. Each 186RMP segment covers a specific range of system physical addresses. 187 188Support for this form of the RMP can be determined using the CPUID 189instruction:: 190 191 0x8000001f[eax]: 192 Bit[23] indicates support for segmented RMP 193 194If supported, segmented RMP attributes can be found using the CPUID 195instruction:: 196 197 0x80000025[eax]: 198 Bits[5:0] minimum supported RMP segment size 199 Bits[11:6] maximum supported RMP segment size 200 201 0x80000025[ebx]: 202 Bits[9:0] number of cacheable RMP segment definitions 203 Bit[10] indicates if the number of cacheable RMP segments 204 is a hard limit 205 206To enable a segmented RMP, a new MSR is available:: 207 208 0xc0010136 (RMP_CFG): 209 Bit[0] indicates if segmented RMP is enabled 210 Bits[13:8] contains the size of memory covered by an RMP 211 segment (expressed as a power of 2) 212 213The RMP segment size defined in the RMP_CFG MSR applies to all segments 214of the RMP. Therefore each RMP segment covers a specific range of system 215physical addresses. For example, if the RMP_CFG MSR value is 0x2401, then 216the RMP segment coverage value is 0x24 => 36, meaning the size of memory 217covered by an RMP segment is 64GB (1 << 36). So the first RMP segment 218covers physical addresses from 0 to 0xF_FFFF_FFFF, the second RMP segment 219covers physical addresses from 0x10_0000_0000 to 0x1F_FFFF_FFFF, etc. 220 221When a segmented RMP is enabled, RMP_BASE points to the RMP bookkeeping 222area as it does today (16K in size). However, instead of RMP entries 223beginning immediately after the bookkeeping area, there is a 4K RMP 224segment table (RST). Each entry in the RST is 8-bytes in size and represents 225an RMP segment:: 226 227 Bits[19:0] mapped size (in GB) 228 The mapped size can be less than the defined segment size. 229 A value of zero, indicates that no RMP exists for the range 230 of system physical addresses associated with this segment. 231 Bits[51:20] segment physical address 232 This address is left shift 20-bits (or just masked when 233 read) to form the physical address of the segment (1MB 234 alignment). 235 236The RST can hold 512 segment entries but can be limited in size to the number 237of cacheable RMP segments (CPUID 0x80000025_EBX[9:0]) if the number of cacheable 238RMP segments is a hard limit (CPUID 0x80000025_EBX[10]). 239 240The current Linux support relies on BIOS to allocate/reserve the memory for 241the segmented RMP (the bookkeeping area, RST, and all segments), build the RST 242and to set RMP_BASE, RMP_END, and RMP_CFG appropriately. Linux uses the MSR 243values to locate the RMP and determine the size and location of the RMP 244segments. The RMP must cover all of system memory in order for Linux to enable 245SEV-SNP. 246 247More details in the AMD64 APM Vol 2, section "15.36.3 Reverse Map Table", 248docID: 24593. 249 250Secure VM Service Module (SVSM) 251=============================== 252 253SNP provides a feature called Virtual Machine Privilege Levels (VMPL) which 254defines four privilege levels at which guest software can run. The most 255privileged level is 0 and numerically higher numbers have lesser privileges. 256More details in the AMD64 APM Vol 2, section "15.35.7 Virtual Machine 257Privilege Levels", docID: 24593. 258 259When using that feature, different services can run at different protection 260levels, apart from the guest OS but still within the secure SNP environment. 261They can provide services to the guest, like a vTPM, for example. 262 263When a guest is not running at VMPL0, it needs to communicate with the software 264running at VMPL0 to perform privileged operations or to interact with secure 265services. An example fur such a privileged operation is PVALIDATE which is 266*required* to be executed at VMPL0. 267 268In this scenario, the software running at VMPL0 is usually called a Secure VM 269Service Module (SVSM). Discovery of an SVSM and the API used to communicate 270with it is documented in "Secure VM Service Module for SEV-SNP Guests", docID: 27158019. 272 273(Latest versions of the above-mentioned documents can be found by using 274a search engine like duckduckgo.com and typing in: 275 276 site:amd.com "Secure VM Service Module for SEV-SNP Guests", docID: 58019 277 278for example.) 279