kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: update SEV-SNP backend support

Browse Source 
Remove the stale MSHV-only wording now that the docs and CVM test path
cover KVM SEV-SNP with IGVM stage0 and fw_cfg [0, 1].

[0]: https://github.com/cloud-hypervisor/cloud-hypervisor/pull/7942
[1]: https://github.com/cloud-hypervisor/cloud-hypervisor/pull/8347

On-behalf-of: SAP philipp.schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
This commit is contained in:
Philipp Schuster
2026-06-30 13:35:02 +02:00
committed by Bo Chen
parent 013981b649
commit 2e62081bec
2 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/amd_sev_snp.md
View File

@@ -1,9 +1,5 @@
# AMD SEV-SNP
### WARNING
This feature is currently only supported on MSHV.
AMD Secure Encrypted Virtualization & Secure Nested Paging (SEV-SNP) is an AMD
technology designed to add strong memory integrity protection to help prevent
malicious hypervisor-based attacks like data replay, memory-remapping and more
@@ -18,7 +14,8 @@ links:
A machine with AMD SEV-SNP support which is enabled in the BIOS is required.
On the Cloud Hypervisor side, all you need is to build the project with the
`sev_snp` feature enabled:
`sev_snp` feature enabled. This enables the MSHV and IGVM support that is
needed by the default SEV-SNP build:
```bash
cargo build --no-default-features --features "sev_snp"
@@ -27,6 +24,13 @@ cargo build --no-default-features --features "sev_snp"
**Note**
Please note that `sev_snp` cannot be enabled in conjunction with the `tdx` feature flag.
SEV-SNP is also supported on KVM with an IGVM stage0 image and a guest kernel
provided through `fw_cfg`. Build that configuration with:
```bash
cargo build --no-default-features --features "kvm,igvm,sev_snp,fw_cfg"
```
You can run a SEV-SNP VM using the following command:
```bash
@@ -37,4 +41,4 @@ You can run a SEV-SNP VM using the following command:
--disk path=ubuntu.img
```
For more information related to Microsoft Hypervisor, please see [mshv.md](mshv.md)
For more information related to Microsoft Hypervisor, please see [mshv.md](mshv.md).

9
docs/mshv.md
View File

@@ -27,11 +27,16 @@ The IGVM file format is designed to encapsulate all information required to laun
At a conceptual level, this file format is a set of commands created by the tool that generated the file, used by the loader to construct the initial guest state. The file format also contains measurement information that the underlying platform will use to confirm that the file was loaded correctly and signed by the appropriate authorities.
Cloud Hypervisor can be built using igvm feature flag along with mshv and/or sev-snp. IGVM only works with MSHV.
Cloud Hypervisor can be built using the `igvm` feature flag along with `mshv`
and/or `sev_snp`. IGVM is used for MSHV guests and for KVM SEV-SNP guests that
boot through an IGVM stage0 image.
## SEV-SNP
AMD's [Secure Encrypted Virtualization (SEV)](https://www.amd.com/en/developer/sev.html) and extensions such as Secure Nested Paging (SEV-SNP) encrypt memory and restrict access to a guest VM's memory and registers, securing it against a compromised hypervisor or VMM. They utilize the Platform Security Processor (PSP) to store keys and encrypt/decrypt the data. Microsoft has been continuously adding/improving support for SEV-SNP on Microsoft Hyper-V. Cloud-Hypervisor can be built with the sev_snp feature including mshv and igvm feature.
AMD's [Secure Encrypted Virtualization (SEV)](https://www.amd.com/en/developer/sev.html) and extensions such as Secure Nested Paging (SEV-SNP) encrypt memory and restrict access to a guest VM's memory and registers, securing it against a compromised hypervisor or VMM. They utilize the Platform Security Processor (PSP) to store keys and encrypt/decrypt the data. Microsoft has been continuously adding/improving support for SEV-SNP on Microsoft Hyper-V.
Cloud Hypervisor's default `sev_snp` feature enables the `mshv` and `igvm`
features needed for the MSHV SEV-SNP path.
## Use Cases