Linux "sev_secret" Patches For Tapping Confidential Computing Secret Areas In AMD SEV
Written by Michael Larabel in AMD on 9 August 2021 at 04:00 PM EDT. 1 Comment
AMD --
The latest AMD SEV work happening to the Linux kernel for benefiting EPYC servers with virtualization is the new "sev_secret" module for allowing guests to access confidential computing secret areas.

AMD Secure Encrypted Virtualization does allow guest VM owners to inject "secrets" into the virtual machines without the host or hypervisor being able to read those secrets. At present though the Linux kernel doesn't allow accessing of these secrets from within guest virtual machines.

Thanks to IBM engineers, support for accessing the confidential computing secret areas within AMD SEV guests is coming in the form of the new "sev_secret" kernel module. The sev_secret module handles copying of the secrets fron the EFI memory to kernel-reserved memory and then allows exposing those secrets within the VM via SecurityFS.

One of the example use-cases for this secret injection usage to VMs is for having guest VMs perform operations on encrypted files and the decryption key being passed to the VM using this mechanism. In doing so, the host/hypervisor doesn't have access to said key and with SEV the guest's memory is also encrypted.


This patch series sent out today by IBM engineer Dov Murik succeeds a former "request for comments" on the matter.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week