Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV)

Web:        https://git.kernel.org/torvalds/c/b38defdb44fb0377b38896e38ac1fc8482e68f76
Commit:     b38defdb44fb0377b38896e38ac1fc8482e68f76
Parent:     4fbd8d194f06c8a3fd2af1ce560ddb31f7ec8323
Refname:    refs/heads/master
Author:     Brijesh Singh <[email protected]>
AuthorDate: Mon Dec 4 10:57:23 2017 -0600
Committer:  Brijesh Singh <[email protected]>
CommitDate: Mon Dec 4 10:57:23 2017 -0600

    Documentation/virtual/kvm: Add AMD Secure Encrypted Virtualization (SEV)
    
    Create a Documentation entry to describe the AMD Secure Encrypted
    Virtualization (SEV) feature.
    
    Cc: Thomas Gleixner <[email protected]>
    Cc: Ingo Molnar <[email protected]>
    Cc: "H. Peter Anvin" <[email protected]>
    Cc: Paolo Bonzini <[email protected]>
    Cc: "Radim Krčmář" <[email protected]>
    Cc: Jonathan Corbet <[email protected]>
    Cc: Borislav Petkov <[email protected]>
    Cc: Tom Lendacky <[email protected]>
    Cc: [email protected]
    Cc: [email protected]
    Cc: [email protected]
    Signed-off-by: Brijesh Singh <[email protected]>
    Reviewed-by: Borislav Petkov <[email protected]>
---
 Documentation/virtual/kvm/00-INDEX                 |  3 ++
 .../virtual/kvm/amd-memory-encryption.rst          | 45 ++++++++++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/Documentation/virtual/kvm/00-INDEX b/Documentation/virtual/kvm/00-INDEX
index 69fe1a8b7ad1..3da73aabff5a 100644
--- a/Documentation/virtual/kvm/00-INDEX
+++ b/Documentation/virtual/kvm/00-INDEX
@@ -26,3 +26,6 @@ s390-diag.txt
 	- Diagnose hypercall description (for IBM S/390)
 timekeeping.txt
 	- timekeeping virtualization for x86-based architectures.
+amd-memory-encryption.txt
+	- notes on AMD Secure Encrypted Virtualization feature and SEV firmware
+	  command description
diff --git a/Documentation/virtual/kvm/amd-memory-encryption.rst b/Documentation/virtual/kvm/amd-memory-encryption.rst
new file mode 100644
index 000000000000..a8ef21e737db
--- /dev/null
+++ b/Documentation/virtual/kvm/amd-memory-encryption.rst
@@ -0,0 +1,45 @@
+======================================
+Secure Encrypted Virtualization (SEV)
+======================================
+
+Overview
+========
+
+Secure Encrypted Virtualization (SEV) is a feature found on AMD processors.
+
+SEV is an extension to the AMD-V architecture which supports running
+virtual machines (VMs) under the control of a hypervisor. When enabled,
+the memory contents of a VM will be transparently encrypted with a key
+unique to that VM.
+
+The hypervisor can determine the SEV support through the CPUID
+instruction. The CPUID function 0x8000001f reports information related
+to SEV::
+
+	0x8000001f[eax]:
+			Bit[1] 	indicates support for SEV
+	    ...
+		  [ecx]:
+			Bits[31:0]  Number of encrypted guests supported simultaneously
+
+If support for SEV is present, MSR 0xc001_0010 (MSR_K8_SYSCFG) and MSR 0xc001_0015
+(MSR_K7_HWCR) can be used to determine if it can be enabled::
+
+	0xc001_0010:
+		Bit[23]	   1 = memory encryption can be enabled
+			   0 = memory encryption can not be enabled
+
+	0xc001_0015:
+		Bit[0]	   1 = memory encryption can be enabled
+			   0 = memory encryption can not be enabled
+
+When SEV support is available, it can be enabled in a specific VM by
+setting the SEV bit before executing VMRUN.::
+
+	VMCB[0x90]:
+		Bit[1]	    1 = SEV is enabled
+			    0 = SEV is disabled
+
+SEV hardware uses ASIDs to associate a memory encryption key with a VM.
+Hence, the ASID for the SEV-enabled guests must be from 1 to a maximum value
+defined in the CPUID 0x8000001f[ecx] field.
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html