AMD x86 Memory Encryption Technologies
summary
AMD adds on-chip AES to encrypt DRAM and manages keys in the isolated AMD Secure Processor so memory encryption happens transparently with low runtime impact. It provides SME single-key C-bit page encryption to foil physical DRAM scraping (no integrity or replay protection), and SEV per-VM keys with cache tagging so hypervisors cannot directly read guest memory. Launch and migration use a Diffie‑Hellman provisioning flow and key slots; Linux patches and hypervisor APIs exist now. DMA must use shared pages; side‑channels remain out of scope.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:28Agenda
- 1:04Motivation
- 2:58Attacks
- 4:24Hardware Engine
- 6:51AMD Secure Processor
- 8:17Secure Memory Encryption
- 13:38Secure Encrypted Virtualization
- 15:39Architecture
- 17:36Example
- 18:15Secure Communication
- 18:52Encryption
- 19:19VMCB
- 19:39Launch Receipt
- 20:38Hardware Architecture
- 25:57Comparison
- 27:51Linux enablement
- 29:11Linux SME
- 32:09hypervisor modifications
- 37:53public documentation
related talks
01h 11mAMD x86 Memory Encryption Technologies
30mEncrypting Memory at Scale
33mAMD Encrypted Virtualization Update
30mEnabling AMD SEV in Xen
44mAdvancements in Confidential Computing
24mThe Common Challenges of Secure VMs
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
36mEverybody is talking about Confidential Computing - the minimum Devs should know