Skip to content

feat(sev): add AMD SEV support #542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

zyuiop
Copy link

@zyuiop zyuiop commented Apr 24, 2025

Currently, this library's page table features does not work on an AMD encrypted memory system.

This is because AMD-SME and AMD-SEV use one physical address bit to map the encryption status in the page table entry.
The position of this bit is not known at compile time and must be determined at runtime.
We therefore need to know before using any page table feature where this bit is so that we can remove it from physical addresses when using page table entries.

My approach is as follows:

  • Modify the PageTableFlags structure to allow any unknown bits ;
  • Define a static mask for the physical address bits, that can be (unsafely) modified, and use that to determine the physical address in a page table entry ;
  • Add a amd_sev module with an init function that detects the presence of an memory encryption features, and if so, (unsafely) modifies the physical address mask.

Someone implementing an operating system designed to work under AMD memory encryption features would need to call amd_sev::init before doing any page table operations.

I am not 100% confident my approach, in particular unsafely modifying static variables, so I gladly take feedback on this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant