16 Enhancing virtual machine security with AMD SEV-SNP #

A system with an AMD EPYC (3rd Gen or newer) is required to run AMD SEV-SNP virtual machines. The BIOS of the AMD machine must provide the necessary options to enable support for confidential computing on the platform.

The VM Host Server requires minor configuration changes prior to running AMD SEV-SNP enabled VM Guests. The default IOMMU configuration in SUSE Linux Enterprise Server 15 SP7 is passthrough mode. To use the AMD SEV-SNP feature, the IOMMU must be configured in non-passthrough mode. This is required to prevent peripheral devices from accessing memory that belongs to an encrypted VM Guest, compromising its data integrity. The MSR kernel module is required to use the optional snphost tool.

You can verify the installation and configuration of the VM Host Server using dmesg or the optional snphost tool.

You can create and install AMD SEV-SNP protected virtual machines using the libvirt framework once the VM Host Server is properly configured and the AMD Secure Processor is initialized. The installation methods described in Chapter 10, Guest installation can be used with SEV-SNP protected virtual machines. The only exception is ISO installation using a virtual CD-ROM. See the limitations section for more details.

In addition to virtual CD-ROMs, VM Host Server-provided TPM devices are not compatible with AMD SEV-SNP-protected virtual machines and should be removed from the installation configuration. Rebooting SEV-SNP virtual machines is also not supported. The installation should ensure SEV-SNP virtual machines are configured to shut down on reboot. See the limitations section for more details.

Section 10.1, “GUI-based guest installation” describes GUI-based virtual machine installation using virt-manager. To enable AMD SEV-SNP, activate Customize configuration before install before selecting Finish in the New VM wizard. When the VM Guest configuration dialog opens, select Memory, then activate the Enable launch security checkbox and select Apply. Finally, select Begin Installation to proceed with the installation as described in Section 10.1, “GUI-based guest installation”.

Section 10.2, “Installing from the command line with virt-install” describes virtual machine installation using virt-install. AMD SEV-SNP can be enabled with the --launchSecurity option. Below is a modification of Example 10.2, “Example of a virt-install command line” that enables AMD SEV-SNP protection:

> virt-install --connect qemu:///system --virt-type kvm \
--name sle15sp7 --memory 4096 --disk size=60 --location /path/to/iso --graphics vnc \
--os-variant sle15sp7 --boot uefi --events on_reboot=destroy --launchSecurity type=sev-snp

See the Launch Security section of the libvirt Domain XML format manual at https://libvirt.org/formatdomain.html#launch-security for more information on the settings supported by --launchSecurity.

From the appearance of the virtual machine, one cannot tell whether it runs in a confidential computing environment. But there are several ways to verify that from within the virtual machine.

The kernel log will contain messages describing the state of AMD memory encryption features within the virtual machine. To check the kernel log, run the following command:

> sudo  dmesg | grep -i sev-snp
[ 1.986186] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP

The presence of the SEV-SNP feature in the kernel log, among other active memory encryption features, shows that it is active for the virtual machine.

You can use the optional snpguest tool to verify if the SEV-SNP feature is active in the virtual machine. Similar to snphost, the snpguest tool requires the MSR kernel module. The following example demonstrates using snpguest to check the status of memory encryption features within the virtual machine:

> sudo  modprobe msr && snpguest ok
[ PASS ] - SEV: ENABLED
[ PASS ] - SEV-ES: ENABLED
[ PASS ] - SNP: ENABLED

There are also cryptographically secure ways to prove the security of the AMD SEV-SNP environment.

Once SEV-SNP activation has been verified, the integrity of the confidential VM can be established through attestation, which provides cryptographic proof that it runs on genuine AMD hardware under a verified firmware and TCB level, backed by a trusted certificate hierarchy.

Note that the steps here perform local attestation verification only. It verifies the report signature and certificate chain from inside the guest and ensures that the attestation data matches the platform state. This workflow does not include remote attestation, where the attestation report is sent to an external verifier or service that independently validates the platform trust and enforces access to secrets or workload authorization.

The attestation process involves two tools: snpguest and snphost.

16.6.1 Generating and verifying the attestation report #

  

Inside the guest, the snpguest tool can be used to perform the attestation workflow. This process generates an attestation report, fetches the corresponding AMD certificate chain, and verifies that the report is cryptographically signed by a valid platform key.

1. Generate an attestation report and a corresponding request file. The --random flag includes random data for uniqueness:

   > sudo snpguest report attestation-report.bin request-file.bin --random

2. Fetch the AMD CA and ASK certificates from the Key Distribution Service (KDS) in DER format. Replace genoa with your processor model if different:

   > sudo snpguest fetch ca der genoa ./certs-kds

3. Fetch the Versioned Chip Endorsement Key (VCEK) using the generated attestation report:

   > sudo snpguest fetch vcek der genoa ./certs-kds attestation-report.bin

4. Verify the attestation report against the fetched certificates:

   > sudo snpguest verify attestation ./certs-kds attestation-report.bin
   
   Reported TCB Boot Loader from certificate matches the attestation report.
   Reported TCB TEE from certificate matches the attestation report.
   Reported TCB SNP from certificate matches the attestation report.
   Reported TCB Microcode from certificate matches the attestation report.
   Chip ID from certificate matches the attestation report.
   VEK signed the Attestation Report!

Note

The extended attestation workflow using the snpguest certificates command relies on QEMU functionality that is not currently available.

The following limitations are placed on SEV-SNP VM Guests.

These limitations may be removed in the future as the hardware, firmware and specific layers of software receive new features.