Virtual Machine Privilege Levels (VMPL's)

AMD SEV-SNP introduces Virtual Machine Privilege Levels, which are additional privilege levels that further isolate page table access for running software within a cVM. Each page table entry in the RMP also contains an associated VMPL. Like ring privilege levels, VMPLs are hierarchical, starting with 0 as the highest privilege level and ending with 3. Each vCPU assigned to a cVM runs in its own VMPL and can only grant page table access permissions according to its own VMPL. VMPLs with higher privileges can access the page tables of VMPLs with lower privileges, but not vice versa.