sev - GitLite

KO | EN

gitlite — search

#javascript #react #ai #llm #golang #android #machine-learning #docker #nodejs #macos #awesome #kubernetes #ios #mcp

sev

(★ 151)

Rust library for AMD SEV and SEV-SNP

파일 탐색기

최종 버전 다운로드 (.zip)

- - dco.yml
  - lint.yml
  - test.yml
- auto_assign-issues.yml
- auto_assign.yml
- dependabot.yml
- - certchain.dot
  - certchain.dot.png
  - prerequisites.md
  - process.msc
  - process.msc.png
  - protections.md
  - README.md
- - mod.rs
- - mod.rs
- - mod.rs
  - sev.rs
  - snp.rs
- - gctx.rs
  - idblock.rs
  - idblock_types.rs
  - mod.rs
  - ovmf.rs
  - sev.rs
  - sev_hashes.rs
  - snp.rs
  - vcpu_types.rs
  - vmsa.rs
- - byte_parser.rs
  - decoder.rs
  - encoder.rs
  - mod.rs
- - key.rs
  - mod.rs
- - cached_chain.rs
  - hexline.rs
  - impl_const_id.rs
  - mod.rs
- - mod.rs
- error.rs
- lib.rs
- - cert_chain_milan
  - cert_chain_turin
  - report_milan.hex
  - vcek_milan.der
  - vcek_turin.der
- - ovmf_AmdSev_suffix.bin
  - ovmf_OvmfX64_suffix.bin
  - test_auth_block.bin
  - test_auth_key.pem
  - test_auth_sig.bin
  - test_id_key.pem
  - test_id_sig.bin
- - ark.cert.bad
  - ark.cert.sig
  - ark.rs
  - ask.rs
  - cek.cert
  - cek.rs
  - mod.rs
  - oca.cert
  - oca.rs
  - pdh.cert
  - pdh.rs
  - pek.cert
  - pek.rs
- - ark.rs
  - ask.rs
  - cek.cert
  - cek.rs
  - mod.rs
  - oca.cert
  - oca.rs
  - pdh.cert
  - pdh.rs
  - pek.cert
  - pek.rs
- api.rs
- certs.rs
- guest.rs
- id-block.rs
- measurement.rs
- session.rs
- sev_launch.rs
- snp_launch.rs
.gitignore
.rustfmt.toml
build.rs
Cargo.lock
Cargo.toml
CODEOWNERS
LICENSE
package-version.py
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/virtee/sev

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd sev

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Rust

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Rust (rustup) rustup으로 설치하면 cargo도 함께 설치됩니다.

cargo build --release

Rust 프로젝트를 컴파일합니다.

cargo run

빌드 후 바로 실행까지 진행합니다.

✅ cargo build가 에러 없이 끝나면 성공입니다. target/ 폴더에 실행 파일이 생성됩니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

The `sev` crate provides an implementation of the [AMD Secure Encrypted
Virtualization (SEV)][SEV] APIs and the [SEV Secure Nested Paging
Firmware (SNP)][SNP] ABIs.

[SEV]: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/55766_SEV-KM_API_Specification.pdf
[SNP]: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf

## SEV APIs

The linux kernel exposes two technically distinct AMD SEV APIs:

1. An API for managing the SEV platform itself
2. An API for managing SEV-enabled KVM virtual machines

This crate implements both of those APIs and offers them to client.
code through a flexible and type-safe high-level interface.

## SNP ABIs

Like SEV, the linux kernel exposes another two different AMD SEV-SNP ABIs:

1. An ABI for managing the SEV-SNP platform itself
2. An ABI for managing SEV-SNP enabled KVM virtual machines

These new ABIs work only for **SEV-SNP** enabled hosts and guests.

This crate implements APIs for both SEV and SEV-SNP management.

## SEV and SEV-SNP enablement

By default, both the SEV and SEV-SNP libraries are compiled.
Because many modules provide support to both legacy SEV and SEV-SNP, they have been split into individual sub-modules `sev.rs` and `snp.rs`, isolating generation specific behavior.
If desired, you may opt to exclude either of the sub-modules by disabling its feature in your project's `Cargo.toml`

For example, to include the SEV APIs only:  
`sev = { version = "1.2.1", default-features = false, features = ["sev"] }`  
 
To include the SEV-SNP APIs only:  
`sev = { version = "1.2.1", default-features = false, features = ["snp"] }`

## Platform Management

Refer to the [firmware](https://docs.rs/sev/latest/sev/firmware/) module for more information.

## Guest Management

Refer to the [launch](https://docs.rs/sev/latest/sev/launch/) module for more information.

## Cryptographic Verification

To enable the cryptographic verification of certificate chains and
attestation reports, either the `openssl` or `crypto_nossl` feature
has to be enabled manually. With `openssl`, OpenSSL is used for the
verification. With `crypto_nossl`, OpenSSL is _not_ used for the
verification and instead pure-Rust libraries (e.g., `p384`, `rsa`,
etc.) are used. `openssl` and `crypto_nossl` are mutually exclusive,
and enabling both at the same time leads to a compiler error.

## Remarks

Note that the linux kernel provides access to these APIs through a set
of `ioctl`s that are meant to be called on device nodes (`/dev/kvm` and
`/dev/sev`, to be specific). As a result, these `ioctl`s form the substrate
of the `sev` crate. Binaries that result from consumers of this crate are
expected to run as a process with the necessary privileges to interact
with the device nodes.

## Using the C API

Projects in C can take advantage of the C API for the SEV [launch] ioctls.
To install the C API, users can use `cargo-c` with the features they would
like to produce and install a `pkg-config` file, a static library, a dynamic
library, and a C header:

`cargo cinstall --prefix=/usr --libdir=/usr/lib64`

[firmware]: ./src/firmware/
[launch]: ./src/launch/