{"id":13642089,"url":"https://github.com/AMDESE/linux-svsm","last_synced_at":"2025-04-20T15:34:45.529Z","repository":{"id":58611594,"uuid":"515643561","full_name":"AMDESE/linux-svsm","owner":"AMDESE","description":"Linux SVSM (Secure VM Service Module) for secure x86 virtualization in Rust","archived":false,"fork":false,"pushed_at":"2024-02-01T22:38:58.000Z","size":248,"stargazers_count":125,"open_issues_count":8,"forks_count":32,"subscribers_count":24,"default_branch":"main","last_synced_at":"2024-11-09T13:36:57.231Z","etag":null,"topics":["amd","operating-systems","virtualization"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AMDESE.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-19T15:34:24.000Z","updated_at":"2024-10-29T04:16:32.000Z","dependencies_parsed_at":"2024-11-09T13:42:28.535Z","dependency_job_id":null,"html_url":"https://github.com/AMDESE/linux-svsm","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AMDESE%2Flinux-svsm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AMDESE%2Flinux-svsm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AMDESE%2Flinux-svsm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AMDESE%2Flinux-svsm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AMDESE","download_url":"https://codeload.github.com/AMDESE/linux-svsm/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249918712,"owners_count":21345406,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amd","operating-systems","virtualization"],"created_at":"2024-08-02T01:01:27.325Z","updated_at":"2025-04-20T15:34:45.142Z","avatar_url":"https://github.com/AMDESE.png","language":"Rust","funding_links":[],"categories":["Beyond SGX Enclave Projects"],"sub_categories":["Memory Protection"],"readme":"# Linux SVSM (Secure VM Service Module)\n\n\\*\\* The Linux SVSM project is no longer being actively developed.\nUsers of Linux SVSM should switch over to the\n[COCONUT SVSM project](https://github.com/coconut-svsm/svsm). \\*\\*\n\n## Table of contents\n\n1. [What is this magic?](#introduction)\n2. [Preparing the host](#host)\n3. [Installation](#install)\n4. [Running Linux SVSM](#run)\n5. [Contribution](#contribute)\n6. [Linux SVSM userspace](#cpl3)\n7. [Authors and License](#authors)\n\n## What is this magic? \u003ca name=\"introduction\"\u003e\u003c/a\u003e\n\nLinux SVSM (Secure VM Service Module) implements a guest communication\ninterface so that VM guests can offload sensitive operations (for example,\nupdating access permissions on protected pages) onto a privileged\\* guest\nacting as service module. Linux SVSM relies on AMD's Secure Nested Paging\n(SNP) and prior Secure Encrypted Virtualization technologies (See\n[SEV documentation](https://developer.amd.com/sev/)).\n\nThe idea is that Linux SVSM will not only offload security operations,\nbut will also be able to provide other services such as live VM migration;\nthe privilege separation model of SVSM permits the existence of a virtual\nTrusted Platform Module (virtual TPM).\n\n\\* AMD SNP introduces the Virtual Machine Privilege Level (VMPLs) for\nenhanced security control. VMPL0 is the highest level of privilege.\nLinux SVSM runs at VMPL 0, as opposed to other guests running under\nVMPL \u003e=1. Certain operations become architecturally impossible to guests\nrunning at lower privilege levels (e.g. use of the PVALIDATE instruction\nand certain forms of RMPADJUST).\n\nGenerate and read source code documentation with:\n\n```\n# make doc\n```\n\nwhich will also install necessary prerequisites.\n\n## Preparing the host \u003ca name=\"host\"\u003e\u003c/a\u003e\n\nLinux SVSM assumes a host with support for AMD's SEV-SNP, as well as\ncompatible guest, Qemu and OVMF BIOS. We provide bash scripts to automate\nthe installation process of these prerequisites. The remainder of these\ninstructions were tested on Ubuntu 22.04 server, installed with kernel\n5.15.0-46-generic.\n\nStart by verifying that the following BIOS settings are enabled. The\nsettings may vary depending on the vendor BIOS. The menu options below are\nfrom AMD's BIOS.\n\n```\n  CBS -\u003e CPU Common -\u003e\n                SEV-ES ASID space Limit Control -\u003e Manual\n                SEV-ES ASID space limit -\u003e 100\n                SNP Memory Coverage -\u003e Enabled\n                SMEE -\u003e Enabled\n      -\u003e NBIO common -\u003e\n                SEV-SNP -\u003e Enabled\n```\n\nWe now need to build the host and guest kernels, Qemu and OVMF BIOS used for\nlaunching the SEV-SNP guest.\n\n```\n$ cd scripts/\n$ ./build.sh --package\n```\n\nIf build fails, read subsection [Build troubleshooting](#trouble-build). On\nsuccessful build, the binaries will be available in `snp-release-\u003cDATE\u003e`.\n\nNow we need to install the Linux kernel on the host machine:\n\n```\n$ cd snp-release-\u003cdate\u003e\n$ sudo ./install.sh\n```\n\nReboot the machine and choose SNP Host kernel from the grub menu. You can\ncheck you have a kernel with the proper SNP support with:\n\n```\n$ sudo dmesg | grep SEV\n[    7.393321] SEV-SNP: RMP table physical address 0x0000000088a00000 - 0x00000000a8ffffff\n[   18.958687] ccp 0000:22:00.1: SEV firmware update successful\n[   21.081484] ccp 0000:22:00.1: SEV-SNP API:1.51 build:3\n[   21.286378] SEV supported: 255 ASIDs\n[   21.290367] SEV-ES and SEV-SNP supported: 254 ASIDs\n```\n\n### Build troubleshooting \u003ca name=\"trouble-build\"\u003e\u003c/a\u003e\n\nThe most likely source of build errors is missing a tool. Try installing\nthe following:\n\n```\n$ sudo apt install make ninja-build libglib2.0-dev libpixman-1-dev python3\n$ sudo apt install nasm iasl flex bison libelf-dev libssl-dev\n```\n\nIf your error is during OVMF's compilation, you can try getting a verbose\nform of the error, running manually with -v. In our case:\n\n```\n$ cd ovmf\n$ source edksetup.sh\n$ nice build -v -q --cmd-len=64436 -DDEBUG_ON_SERIAL_PORT -n 32 -t GCC5 -a X64 -p OvmfPkg/OvmfPkgX64.dsc\n```\n\nIf your error involves still not finding Python, you may try to replace `python`\nwith `python3` in the file `BaseTools/Tests/GNUmakefile` of the `ovmf` folder\nthat you have just cloned.\n\n## Installation \u003ca name=\"install\"\u003e\u003c/a\u003e\n\nLinux SVSM requires the Rust nightly tool-chain, as well as components that\ncan be downloaded from rustup. The process can be automated with:\n\n```\n# make prereq\n```\n\nYou can select default installation for rustup. After that, make sure rust-lld\ncan be found in your PATH. You can edit your ~/.bashrc with:\n\n```\nexport PATH=\"/(YOUR PATH)/rustlib/x86_64-unknown-linux-gnu/bin/:$PATH\"\n```\n\nTo build:\n\n```\n# make\n```\n\nTo build with serial output progress information, for debugging:\n\n```\n# make FEATURES=verbose\n```\n\nYou should NEVER have to specify the cargo target, as we have\n.cargo/config.toml. The Makefile includes a basic clean target. To\nforce prerequisites re-installation on the next execution of make do:\n\n```\n# make superclean\n```\n\nTo run the unit tests:\n\n```\n# make test\n```\n\n## Running Linux SVSM \u003ca name=\"run\"\u003e\u003c/a\u003e\n\nThe building process will generate svsm.bin that can be passed to Qemu (svsm\nparameter). Inside directory scripts/ we provide launch-qemu.sh to ease the\nexecution of the Qemu virtual machine. First, we need an empty virtual disk\nimage and distribution (in our example, Ubuntu):\n\n```\n# qemu-img create -f qcow2 guest.qcow2 30G\n# wget \u003clink-to-iso\u003e ubuntu.iso\n```\n\nOnce we have an image prepared, we can boot with the command below. In the\nGrub option of installation, you can edit the linux kernel command adding\n'console=tty0 console=ttyS0,115200n8' and then Ctr+X.\n\n```\n# ./launch-qemu.sh -hda guest.qcow2 -cdrom ubuntu.iso\n```\n\nafter that, we can simply boot and install the kernel \\*.debs/\\*.rpms from\nwithin the guest VM.\n\n```\n[host@snp-host ~]#  ./launch-qemu.sh -hda guest.qcow2\n[guest@snp-guest ~]# scp host@ip:/\u003cdir\u003e/scripts/linux/\u003cversion\u003e*guest*.deb .\n[guest@snp-guest ~]# chmod +x *.deb \u0026\u0026 dpkg -i *.deb\n[guest@snp-guest ~]# reboot\n```\n\nFinally, we will have to execute the script again, this time providing the\nSVSM binary. Once the SVSM guest is up, you can check it is running on\nVMPL1 (lower privilege level) with:\n\n```\n[host@snp-host ~]#  ./launch-qemu.sh -hda guest.qcow2 -sev-snp -svsm svsm.bin\n[guest@snp-guest ~]# dmesg | grep VMPL\n[    1.264552] SEV: SNP running at VMPL1.\n```\n\nNote: The launch-qemu.sh script was updated to support the newer UPM-based\nSEV-SNP support. If you are running on an older SEV-SNP host kernel that\ndoesn't support UPM, please add the -noupm parameter to the launch command:\n\n```\n[host@snp-host ~]#  ./launch-qemu.sh -hda guest.qcow2 -sev-snp -svsm svsm.bin -noupm\n```\n\nBy default, SVSM lives at 512 GB (SVSM\\_GPA), and has 256 MB of memory\n(SVSM\\_MEM). This can be changed at compilation. For example:\n\n```\n# make SVSM_GPA=0x90000000 SVSM_MEM=0x20000000\n```\n\nThe SVSM page table applies an offset to its virtual addresses.\n\n## Linux SVSM userspace \u003ca name=\"cpl3\"\u003e\u003c/a\u003e\n\nLinux SVSM's main branch does not contain support for userspace (CPL3).\nIf interested, checkout branch cpl-support.\n\n## Contribution \u003ca name=\"contribute\"\u003e\u003c/a\u003e\n\nPlease read CONTRIBUTING.md for instructions on contribution and style.\n\n## Authors and License \u003ca name=\"authors\"\u003e\u003c/a\u003e\n\nThe original authors and maintainers of this software are:\n\n- [Thomas Lendacky](https://github.com/tlendacky)\n- [Carlos Bilbao](https://github.com/Zildj1an)\n\nand they will act as reviewers for future contributions.\n\nOther developers have made substantial contributions to this project, to\nobtain the full list, please refer to the [Contributors](https://github.com/AMDESE/linux-svsm/graphs/contributors)\npage or review the authorship information in the project's source code\nheaders.\n\nLinux SVSM is distributed under the MIT license. For more information, read\nfile LICENSE. To obtain information about the crates that Linux SVSM\ndepends on, you can run:\n\n```\n$./scripts/crates.sh\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAMDESE%2Flinux-svsm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAMDESE%2Flinux-svsm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAMDESE%2Flinux-svsm/lists"}