System
SEV-SNP instructions (AMD)
SEV-SNP, Secure Nested Paging, keeps a reverse map (RMP) of which guest owns each page, so that the hypervisor cannot remap or read the memory of an encrypted guest.
An AMD extension: Intel processors do not have this instruction.
- CPUID
- SNP
CPUID.8000001FH:EAX[4] - Instructions
- 4 mnemonics
- Processors
- Zen 3, Zen 4, Zen 5, Zen 6
Note: Only the EPYC server processors have SEV-SNP: AMD's references for the Ryzen processors of Zen 3, Zen 4 and Zen 5 leave CPUID_Fn8000001F_EAX[SNP] (bit 4) clear.
- Linux flag
sev_snp
SEV-SNP (Secure Encrypted Virtualization with Secure Nested Paging) protects the memory of a guest from the hypervisor. The processor keeps a reverse map (RMP) with an entry for each page of memory, saying which guest owns it. The hypervisor assigns pages with RMPUPDATE and splits large ones with PSMASH; the guest accepts each page with PVALIDATE before it uses it, and can give lower-privileged parts of itself (VMPLs) access with RMPADJUST. XED’s chip model, which ends with Zen 2, gives these instructions to no processor but its placeholder for future AMD processors, so the processors above come from the CPU data of this site: the EPYC server processors from Zen 3 on. AMD’s manual gives the CPUID bit.
Instructions
| Mnemonic | Summary | Forms |
|---|---|---|
| PSMASH | Splits the reverse map (RMP) entry of a 2-MByte page into the entries of its 512 4-KByte pages; SEV-SNP. | 1 |
| PVALIDATE | Lets an SEV-SNP guest validate a page of its memory, or take the validation back, in the reverse map (RMP). | 1 |
| RMPADJUST | Changes the permissions of a guest page for a less privileged VMPL in the reverse map (RMP); SEV-SNP. | 1 |
| RMPUPDATE | Writes a new reverse map (RMP) entry for a page, which the hypervisor uses to assign it to a guest; SEV-SNP. | 1 |
CPUID and processors
XED splits SEV-SNP into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model. - The CPU data of x86-64.net: Zen 3 to Zen 6, from GCC’s
-marchfeature sets and AMD’s Processor Programming References, which the page of each processor cites. - AMD64 Architecture Programmer's Manual, Volume 3: General-Purpose and System Instructions (24594, rev. 3.36, March 2024), Wayback Machine copy of AMD's PDF
- AMD64 Architecture Programmer's Manual, Volume 2: System Programming (24593, rev. 3.42, March 2024), Wayback Machine copy of AMD's PDF
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.