EC2 AMD CPU 的 SEV-SNP 指令集的开启方法与性能测试

aws ec2 describe-instance-types --region us-east-2 \
  --filters Name=processor-info.supported-features,Values=amd-sev-snp \
  --query 'InstanceTypes[].InstanceType' --output text

c6a.8xlarge	c6a.large	c6a.xlarge	c6a.2xlarge	c6a.4xlarge	c6a.12xlarge	c6a.16xlarge
m6a.xlarge	m6a.4xlarge	m6a.2xlarge	m6a.8xlarge	m6a.large
r6a.large	r6a.2xlarge	r6a.4xlarge	r6a.xlarge

aws ec2 run-instances --region ap-northeast-1 --dry-run \
  --image-id ami-0c051224e18c11f2e \
  --instance-type c6a.xlarge \
  --cpu-options AmdSevSnp=enabled

aws: [ERROR]: An error occurred (UnsupportedOperation) when calling the RunInstances operation: AMD SEV-SNP is not supported in this Region. Either launch the instance in a supported Region or do not specify a value for AmdSevSnp in CpuOptions.

AMI=$(aws ssm get-parameter --region us-east-2 \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query Parameter.Value --output text)
aws ec2 describe-images --region us-east-2 --image-ids $AMI \
  --query 'Images[0].[ImageId,Name,BootMode]' --output text

ami-02dae70ab25064279	al2023-ami-2023.12.20261102.0-kernel-6.18-x86_64	uefi-preferred

aws ec2 create-security-group --region us-east-2 \
  --vpc-id <your-vpc-id> \
  --group-name sev-snp-test-sg \
  --description "SEV-SNP benchmark, egress only" \
  --tag-specifications 'ResourceType=security-group,Tags=[{Key=Project,Value=AMD-SEV-SNP}]' \
  --query GroupId --output text

sg-06e01c759161da241

aws ec2 run-instances --region us-east-2 \
  --image-id ami-02dae70ab25064279 \
  --instance-type c6a.2xlarge \
  --cpu-options AmdSevSnp=enabled \
  --subnet-id <subnet-id-of-us-east-2a> \
  --security-group-ids sg-06e01c759161da241 \
  --iam-instance-profile Name=AmazonSSMRoleForInstancesQuickSetup \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=sev-snp-on},{Key=Project,Value=AMD-SEV-SNP}]' \
  --query 'Instances[0].[InstanceId,Placement.AvailabilityZone,CpuOptions]' --output json

[
    "i-0c43016da15a0c159",
    "us-east-2a",
    {
        "CoreCount": 4,
        "ThreadsPerCore": 2,
        "AmdSevSnp": "enabled"
    }
]

aws ec2 describe-instances --region us-east-2 \
  --instance-ids i-0c43016da15a0c159 \
  --query 'Reservations[].Instances[].CpuOptions'

[
    {
        "CoreCount": 4,
        "ThreadsPerCore": 2,
        "AmdSevSnp": "enabled"
    }
]

uname -r
lscpu | grep -E 'Model name|^CPU\(s\)|Thread|Core\(s\)|L3'
free -h | head -2
dmesg | grep -i -E 'sev|memory encryption'
ls -l /dev/sev-guest

cd performace-test-script
python3 ssm_send.py us-east-2 sysinfo.sh i-0c43016da15a0c159

zsh ssm_get.sh us-east-2 <command-id> i-0c43016da15a0c159

Status: Success
ResponseCode: 0
--- stdout
--- kernel
6.18.56-125.164.amzn2023.x86_64
--- cpu
CPU(s):                                  8
Model name:                              AMD EPYC 7R13 Processor
BIOS Model name:                         AMD EPYC 7R13 Processor
Thread(s) per core:                      2
Core(s) per socket:                      4
L3 cache:                                16 MiB (1 instance)
--- memory
               total        used        free      shared  buff/cache   available
Mem:            14Gi       226Mi        13Gi       0.0Ki       281Mi        13Gi
--- dmesg sev
[    1.128073] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
[    1.128085] SEV: Status: SEV SEV-ES SEV-SNP 
[    1.257181] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit()
[    1.472607] SEV: Using SNP CPUID table, 38 entries present.
[    1.472607] SEV: SNP running at VMPL0.
[    1.785651] SEV: SNP guest platform devices initialized.
[    1.867660] software IO TLB: Memory encryption is active and system is using DMA bounce buffers
[    5.365673] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key)
--- sev-guest device
crw-------. 1 root root 10, 259 Nov  2 09:47 /dev/sev-guest

--- meminfo
MemTotal:       14773208 kB
--- swiotlb
[    0.000124] software IO TLB: SWIOTLB bounce buffer size adjusted to 946MB
[    0.074372] software IO TLB: area num 8.
[    0.074374] software IO TLB: SWIOTLB bounce buffer size roundup to 1024MB

--- meminfo
MemTotal:       15993208 kB
--- swiotlb
[    0.016086] software IO TLB: area num 8.
[    0.316707] software IO TLB: mapped [mem 0x00000000b4482000-0x00000000b8482000] (64MB)

#!/bin/bash
# 准备 ffmpeg 静态构建与 Big Buck Bunny 1080p 测试片源
export HOME=/root
set -euo pipefail

mkdir -p /opt/bench && cd /opt/bench
dnf install -y -q xz tar unzip

# 1. 下载 ffmpeg 静态构建（两台实例使用同一份二进制，避免编译差异）
curl -sSfLO https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz
tar xf ffmpeg-release-amd64-static.tar.xz
cp ffmpeg-*-amd64-static/ffmpeg ffmpeg-*-amd64-static/ffprobe /usr/local/bin/

# 2. 下载 Big Buck Bunny 1080p 30fps 片源，截取第 60 秒起 30 秒，去掉音轨
curl -sSfLO https://download.blender.org/demo/movies/BBB/bbb_sunflower_1080p_30fps_normal.mp4.zip
unzip -o -q bbb_sunflower_1080p_30fps_normal.mp4.zip
/usr/local/bin/ffmpeg -hide_banner -nostdin -loglevel error -y \
  -ss 60 -i bbb_sunflower_1080p_30fps_normal.mp4 -t 30 -c copy -an bbb_1080p_30s.mp4

# 3. 输出版本与校验值，确认两台实例的测试条件一致
/usr/local/bin/ffmpeg -hide_banner -version | head -1
md5sum /usr/local/bin/ffmpeg bbb_1080p_30s.mp4
/usr/local/bin/ffprobe -v error -select_streams v:0 -count_packets \
  -show_entries stream=codec_name,width,height,r_frame_rate,nb_read_packets \
  -of default=noprint_wrappers=1 bbb_1080p_30s.mp4

python3 ssm_send.py us-east-2 prepare.sh i-0c43016da15a0c159

Status: Success
ResponseCode: 0
--- stdout
ffmpeg version 7.0.2-static https://johnvansickle.com/ffmpeg/  Copyright (c) 2000-2024 the FFmpeg developers
d5c698e0e98e5cf7de03fe14bd1cda6a  /usr/local/bin/ffmpeg
88779f8ac07afa321e53313b34f1ddee  bbb_1080p_30s.mp4
codec_name=h264
width=1920
height=1080
r_frame_rate=30/1
nb_read_packets=1138

#!/bin/bash
# ffmpeg 转码性能测试：每个场景运行 3 次，记录 -benchmark 输出的 rtime（墙钟时间）
export HOME=/root
set -uo pipefail
cd /opt/bench
FF=/usr/local/bin/ffmpeg
IN=bbb_1080p_30s.mp4
RUNS=3
mkdir -p out

run() {
  local name=$1; shift
  local list=() log t frames
  for i in $(seq 1 $RUNS); do
    log=$($FF -hide_banner -nostdin -y -benchmark "$@" 2>&1 | tr '\r' '\n')
    t=$(echo "$log" | grep -o 'rtime=[0-9.]*s' | tr -dc '0-9.')
    # 取 ffmpeg 最后一行进度中的实际输出帧数
    frames=$(echo "$log" | grep -o 'frame= *[0-9]*' | tail -1 | tr -dc '0-9')
    list+=("$t")
  done
  local med fps
  med=$(printf '%s\n' "${list[@]}" | sort -n | sed -n '2p')
  fps=$(awk -v f="$frames" -v t="$med" 'BEGIN{printf "%.2f", f/t}')
  printf '%-18s frames=%s runs=%s median=%ss fps=%s\n' "$name" "$frames" "$(IFS=,; echo "${list[*]}")" "$med" "$fps"
}

echo "host=$(hostname) nproc=$(nproc) start=$(date -u +%FT%TZ)"
# T1 解码：H.264 1080p 解码到空输出
run T1_decode_h264   -i "$IN" -f null -
# T2 点播转码：libx264 preset medium CRF 23
run T2_x264_medium   -i "$IN" -c:v libx264 -preset medium -crf 23 out/t2.mp4
# T3 点播转码：libx265 preset medium CRF 28
run T3_x265_medium   -i "$IN" -c:v libx265 -preset medium -crf 28 -x265-params log-level=error out/t3.mp4
# T4 直播转码：缩放到 720p，libx264 preset veryfast，固定码率 3 Mbps
run T4_x264_720p_live -i "$IN" -vf scale=1280:720 -c:v libx264 -preset veryfast -b:v 3M -maxrate 3M -bufsize 6M out/t4.mp4
# T5 单线程：libx264 preset medium，限制 1 个线程，观察单核性能
run T5_x264_1thread  -i "$IN" -c:v libx264 -preset medium -crf 23 -threads 1 out/t5.mp4

python3 ssm_send.py us-east-2 bench.sh i-0c43016da15a0c159
aws ssm get-command-invocation --region us-east-2 \
  --command-id <command-id> --instance-id i-0c43016da15a0c159 \
  --query Status --output text

host=ip-172-31-8-159.us-east-2.compute.internal nproc=8 start=2026-11-02T09:51:43Z
T1_decode_h264     frames=902 runs=1.624,1.620,1.672 median=1.624s fps=555.42
T2_x264_medium     frames=902 runs=13.531,13.269,13.306 median=13.306s fps=67.79
T3_x265_medium     frames=902 runs=26.207,26.020,26.250 median=26.207s fps=34.42
T4_x264_720p_live  frames=902 runs=7.151,7.023,6.937 median=7.023s fps=128.44
T5_x264_1thread    frames=902 runs=51.619,52.632,52.068 median=52.068s fps=17.32

host=ip-172-31-8-159.us-east-2.compute.internal nproc=8 start=2026-11-02T10:00:02Z
T1_decode_h264     frames=902 runs=1.641,1.636,1.616 median=1.636s fps=551.34
T2_x264_medium     frames=902 runs=13.167,13.274,13.315 median=13.274s fps=67.95
T3_x265_medium     frames=902 runs=25.920,25.821,26.072 median=25.920s fps=34.80
T4_x264_720p_live  frames=902 runs=7.108,6.866,6.784 median=6.866s fps=131.37
T5_x264_1thread    frames=902 runs=53.087,51.968,52.028 median=52.028s fps=17.34

aws ec2 run-instances --region us-east-2 \
  --image-id ami-02dae70ab25064279 \
  --instance-type c6a.2xlarge \
  --subnet-id <subnet-id-of-us-east-2b> \
  --security-group-ids sg-06e01c759161da241 \
  --iam-instance-profile Name=AmazonSSMRoleForInstancesQuickSetup \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=sev-snp-off},{Key=Project,Value=AMD-SEV-SNP}]' \
  --query 'Instances[0].[InstanceId,Placement.AvailabilityZone,CpuOptions]' --output json

[
    "i-0a0445cf92ef9017d",
    "us-east-2b",
    {
        "CoreCount": 4,
        "ThreadsPerCore": 2
    }
]

--- kernel
6.18.56-125.164.amzn2023.x86_64
--- cpu
CPU(s):                                  8
Model name:                              AMD EPYC 7R13 Processor
BIOS Model name:                         AMD EPYC 7R13 Processor
Thread(s) per core:                      2
Core(s) per socket:                      4
L3 cache:                                16 MiB (1 instance)
--- memory
               total        used        free      shared  buff/cache   available
Mem:            15Gi       236Mi        14Gi       0.0Ki       281Mi        14Gi
--- dmesg sev
--- sev-guest device
ls: cannot access '/dev/sev-guest': No such file or directory

host=ip-172-31-19-32.us-east-2.compute.internal nproc=8 start=2026-11-02T09:51:43Z
T1_decode_h264     frames=902 runs=1.176,1.162,1.170 median=1.170s fps=770.94
T2_x264_medium     frames=902 runs=11.737,11.753,11.748 median=11.748s fps=76.78
T3_x265_medium     frames=902 runs=22.234,22.294,22.223 median=22.234s fps=40.57
T4_x264_720p_live  frames=902 runs=3.889,3.906,3.908 median=3.906s fps=230.93
T5_x264_1thread    frames=902 runs=48.705,48.229,49.049 median=48.705s fps=18.52

host=ip-172-31-19-32.us-east-2.compute.internal nproc=8 start=2026-11-02T10:00:01Z
T1_decode_h264     frames=902 runs=1.169,1.160,1.163 median=1.163s fps=775.58
T2_x264_medium     frames=902 runs=11.787,11.737,11.805 median=11.787s fps=76.52
T3_x265_medium     frames=902 runs=22.066,22.284,22.228 median=22.228s fps=40.58
T4_x264_720p_live  frames=902 runs=3.913,3.943,3.899 median=3.913s fps=230.51
T5_x264_1thread    frames=902 runs=48.423,49.252,48.340 median=48.423s fps=18.63

python3 ssm_send.py us-east-2 profile.sh i-0c43016da15a0c159 i-0a0445cf92ef9017d

T1_decode_h264     bench: utime=7.260s stime=1.805s rtime=1.620s ctxt=36958 RES=1266 CAL=13469
T2_x264_medium     bench: utime=87.739s stime=4.458s rtime=13.232s ctxt=94757 RES=9109 CAL=20704
T4_x264_720p_live  bench: utime=26.436s stime=7.225s rtime=6.773s ctxt=147645 RES=5629 CAL=53022
T5_x264_1thread    bench: utime=58.007s stime=1.274s rtime=52.335s ctxt=22333 RES=271 CAL=11266

T1_decode_h264     bench: utime=6.945s stime=0.261s rtime=1.155s ctxt=40423 RES=1560 CAL=13960
T2_x264_medium     bench: utime=82.645s stime=0.668s rtime=11.795s ctxt=95535 RES=9145 CAL=19796
T4_x264_720p_live  bench: utime=26.222s stime=0.722s rtime=3.927s ctxt=105837 RES=10207 CAL=19002
T5_x264_1thread    bench: utime=54.007s stime=0.260s rtime=48.647s ctxt=25775 RES=340 CAL=11980

aws ec2 terminate-instances --region us-east-2 \
  --instance-ids i-0c43016da15a0c159 i-0a0445cf92ef9017d
aws ec2 wait instance-terminated --region us-east-2 \
  --instance-ids i-0c43016da15a0c159 i-0a0445cf92ef9017d
aws ec2 delete-security-group --region us-east-2 --group-id sg-06e01c759161da241