Provide the option to enable AMD SEV-ES and SEV-SNP

[raja-grewal]

This pull request provides the options to enable two extensions of AMD Secure Encrypted Virtualization (SEV):

• SEV-ES (Encrypted State) extends SEV by encrypting each guests virtual CPU register state during VM exits, and
• SEV-SNP (Secure Nested Paging) extends SEV by activating hardware-level memory integrity.

As per suggested in #338 (comment) by @ArrayBolt3.

Changes

There are no changes to the functionality of the codebase.

Provide the disabled by default options:

kvm_amd.sev_es=1
kvm_amd.sev_snp=1

Mandatory Checklist

• Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements:

Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

Optional Checklist

The following items are optional but might be requested in certain cases.

• I have tested it locally
• I have reviewed and updated any documentation if relevant
• I am providing new code and test(s) for it

[ArrayBolt3]

Looks good, merged into my arraybolt3/trixie branch. Thank you!

[raja-grewal]

Note I have added an importance reference regarding the scenarios in which AMD SME can causes breakages from my similar contributions to secureblue/secureblue#1631 (comment). In summary, these niche problematic cases should also not be looked at as much of concern by us either as we also force enable IOMMU.

This should pave the way for us in the future to also enable AMD SME and SEV by default. However, that should be done in a separate issue/PR.

[ArrayBolt3]

Thanks, merged that into my branch also.