{"id":13640661,"url":"https://github.com/virtee/sev-snp-measure","last_synced_at":"2025-09-07T23:31:01.441Z","repository":{"id":38833279,"uuid":"467712475","full_name":"virtee/sev-snp-measure","owner":"virtee","description":"Calculate AMD SEV/SEV-ES/SEV-SNP measurement for confidential computing","archived":false,"fork":false,"pushed_at":"2024-06-18T15:41:44.000Z","size":1790,"stargazers_count":55,"open_issues_count":5,"forks_count":15,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-11-09T10:39:21.652Z","etag":null,"topics":["attestation","confidential-computing","security"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/virtee.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-08T23:46:16.000Z","updated_at":"2024-09-18T18:34:09.000Z","dependencies_parsed_at":"2024-03-21T18:43:15.852Z","dependency_job_id":"8646eb01-14b2-4e17-ad97-42e2255fae0a","html_url":"https://github.com/virtee/sev-snp-measure","commit_stats":null,"previous_names":["virtee/sev-snp-measure","ibm/sev-snp-measure"],"tags_count":10,"template":false,"template_full_name":"IBM/repo-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/virtee%2Fsev-snp-measure","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/virtee%2Fsev-snp-measure/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/virtee%2Fsev-snp-measure/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/virtee%2Fsev-snp-measure/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/virtee","download_url":"https://codeload.github.com/virtee/sev-snp-measure/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":232262320,"owners_count":18496432,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attestation","confidential-computing","security"],"created_at":"2024-08-02T01:01:13.209Z","updated_at":"2025-09-07T23:31:01.428Z","avatar_url":"https://github.com/virtee.png","language":"Python","funding_links":[],"categories":["Remote Attestation (RA) and Secure Channels"],"sub_categories":["Library OSes and SDKs"],"readme":"# sev-snp-measure\n\n## Scope\n\nCommand-line tool and Python library to calculate expected measurement of an\nAMD SEV/SEV-ES/SEV-SNP guest VM for confidential computing.\n\n## Installation\n\n### From pip\n\nInstall from pip:\n\n    pip install sev-snp-measure\n\nThis installs the `sevsnpmeasure` package and the `sev-snp-measure`\ncommand-line script.\n\n### From Github\n\nClone the Github repo and run the script directly from the local directory:\n\n    git clone https://github.com/virtee/sev-snp-measure.git\n    cd sev-snp-measure\n    ./sev-snp-measure.py --help\n\n## Command-line usage\n\n### sev-snp-measure\n```\n$ sev-snp-measure --help\nusage: sev-snp-measure [-h] [--version] [-v] --mode {sev,seves,snp,snp:ovmf-hash,snp:svsm}\n                       [--vcpus N] [--vcpu-type CPUTYPE] [--vcpu-sig VALUE] [--vcpu-family FAMILY]\n                       [--vcpu-model MODEL] [--vcpu-stepping STEPPING] [--vmm-type VMMTYPE] --ovmf\n                       PATH [--kernel PATH] [--initrd PATH] [--append CMDLINE]\n                       [--guest-features VALUE] [--output-format {hex,base64}]\n                       [--snp-ovmf-hash HASH] [--dump-vmsa] [--svsm PATH]\n                       [--vars-size SIZE | --vars-file PATH]\n\nCalculate AMD SEV/SEV-ES/SEV-SNP guest launch measurement\n\noptions:\n  -h, --help            show this help message and exit\n  --version             show program's version number and exit\n  -v, --verbose\n  --mode {sev,seves,snp,snp:ovmf-hash,snp:svsm}\n                        Guest mode\n  --vcpus N             Number of guest vcpus\n  --vcpu-type CPUTYPE   Type of guest vcpu (EPYC, EPYC-v1, EPYC-v2, EPYC-IBPB, EPYC-v3, EPYC-v4,\n                        EPYC-Rome, EPYC-Rome-v1, EPYC-Rome-v2, EPYC-Rome-v3, EPYC-Milan, EPYC-\n                        Milan-v1, EPYC-Milan-v2, EPYC-Genoa, EPYC-Genoa-v1)\n  --vcpu-sig VALUE      Guest vcpu signature value\n  --vcpu-family FAMILY  Guest vcpu family\n  --vcpu-model MODEL    Guest vcpu model\n  --vcpu-stepping STEPPING\n                        Guest vcpu stepping\n  --vmm-type VMMTYPE    Type of guest vmm (QEMU, ec2, gce)\n  --ovmf PATH           OVMF file to calculate hash from\n  --kernel PATH         Kernel file to calculate hash from\n  --initrd PATH         Initrd file to calculate hash from (use with --kernel)\n  --append CMDLINE      Kernel command line to calculate hash from (use with --kernel)\n  --guest-features VALUE\n                        Hex representation of the guest kernel features expected to be included\n                        (defaults to 0x1); see README.md for possible values\n  --output-format {hex,base64}\n                        Measurement output format\n  --snp-ovmf-hash HASH  Precalculated hash of the OVMF binary (hex string)\n  --dump-vmsa           Write measured VMSAs to vmsa\u003cN\u003e.bin (seves, snp, and snp:svsm modes only)\n\nsnp:svsm Mode:\n  AMD SEV-SNP with Coconut-SVSM. This mode additionally requires --svsm and either --vars-file\n  or --vars-size to be set.\n\n  --svsm PATH           SVSM binary\n  --vars-size SIZE      Size of the OVMF_VARS file in bytes (conflicts with --vars-file)\n  --vars-file PATH      OVMF_VARS file (conflicts with --vars-size)\n```\n\n### Example: SNP mode\n\n```\n$ sev-snp-measure --mode snp --vcpus=1 --vcpu-type=EPYC-v4 --ovmf=OVMF.fd --kernel=vmlinuz --initrd=initrd.img --append=\"console=ttyS0 loglevel=7\"\n1c8bf2f320add50cb22ca824c17f3fa51a7a4296a4a3113698c2e31b50c2dcfa7e36dea3ebc3a9411061c30acffc6d5a\n```\n\n### Example: SNP:SVSM mode\n\n```\n$ sev-snp-measure \\\n    --mode snp:svsm \\\n    --vmm-type=QEMU \\\n    --vcpus=4 \\\n    --vcpu-type=EPYC-v4 \\\n    --ovmf=OVMF_CODE.fd \\\n    --svsm=svsm.bin --vars-file=OVMF_VARS.fd\n3447e476b226e317890a350003b56ee17becb48d1dc25dd6b5819a1192df3238f50cda0f0216bd5ae2a992ad7ab961c4\n```\n\n### snp-create-id-block\n```\n$ snp-create-id-block --help\nusage: snp-create-id-block [-h] [--measurement VALUE] [--idkey PATH] [--authorkey PATH]\n\nCalculate AMD SEV-SNP guest id block\n\noptional arguments:\n  -h, --help           show this help message and exit\n  --measurement VALUE  Guest launch measurement in Base64 encoding\n  --idkey PATH         id private key file\n  --authorkey PATH     author private key file\n```\n\n## Programmatic usage\n\nAfter installing the `sev-snp-measure` package with pip, you can call it from\nanother Python application:\n\n```python3\nfrom sevsnpmeasure import guest,id_block\nfrom sevsnpmeasure import vcpu_types\nfrom sevsnpmeasure.sev_mode import SevMode\n\nld = guest.calc_launch_digest(SevMode.SEV_SNP, vcpus_num, vcpu_types.CPU_SIGS[\"EPYC-v4\"],\n                              ovmf_path, kernel_path, initrd_path, cmdline_str, guest_features)\nprint(\"Calculated measurement:\", ld.hex())\n\nblock = id_block.snp_calc_id_block(ld,\"id_key_file\",\"author_key_file\")\nprint(\"Calculated id block in base64\", block)\n```\n\n## Choosing guest CPU type\n\nFor SEV-ES and SEV-SNP, the initial CPU state (VMSA) includes the guest CPU\nsignature in the edx register when you use the QEMU vmm.  Therefore, starting\nthe VM with a different type of guest CPU will modify the content of the VMSA,\nand therefore modify the calculated measurement.\n\nYou can choose the guest CPU type using `--vcpu-type`, or `--vcpu-sig`, or a\ncombination of `--vcpu-family`, `--vcpu-model`, and `--vcpu-stepping`. For\nexample, the following 3 invocations are identical:\n\n1. `sev-snp-measure --vcpu-type=EPYC-v4 ...`\n2. `sev-snp-measure --vcpu-sig=0x800f12 ...`\n3. `sev-snp-measure --vcpu-family=23 --vcpu-model=1 --vcpu-stepping=2 ...`\n\n## SEV-SNP Guest Feature Field Values\nPrior to Linux Kernel version 6.6, the default value was always calculated to `0x1`, as the kernel only supported `SNPActive`. After the release of Linux Kernel 6.6, additional features were made available some of them enabled by default. Because of this, the new default value is `0x21` which is `SNPActive + DebugSwap`. Other possible combinations my be derived by generating a 64-bit hex value from the following chart:\n\n| BIT FIELD | Description |\n|:---------:|:------------:|\n| 0 | SNPActive |\n| 1 | vTOM |\n| 2 | ReflectVC |\n| 3 | RestrictedInjection |\n| 4 | AlternateInjection |\n| 5 | DebugSwap |\n| 6 | PreventHostIBS |\n| 7 | BTBIsolation |\n| 8 | VmplSSS |\n| 9 | SecureTSC |\n| 10 | VmgexitParameter |\n| 11 | Reserved, SBZ |\n| 12 | IbsVirtualization |\n| 13 | Reserved, SBZ |\n| 14 | VmsaRegProt |\n| 15 | SmtProtection |\n| 63:16 | Reserved, SBZ |\n\n\n## Precalculated OVMF hashes\n\nThe SEV-SNP digest gets generated in multiple steps that each have a digest as output. With that digest output, you can stop at any of these steps and continue generation of the full digest later. These are the steps:\n\n1. OVMF\n2. (optional) -kernel, -initrd, -append arguments\n3. Initial state of all vCPUs\n\nIn situations where only minor OVMF changes happen, you may not want to copy the full OVMF binary to the validation system. In these situations, you can cut digest calculation after the `OVMF` step and use its hash instead of the full binary.\n\nTo generate a hash, use the `--mode snp:ovmf-hash` parameter:\n\n    $ sev-snp-measure --mode snp:ovmf-hash --ovmf OVMF.fd\n    cab7e085874b3acfdbe2d96dcaa3125111f00c35c6fc9708464c2ae74bfdb048a198cb9a9ccae0b3e5e1a33f5f249819\n\nOn a different machine that only has access to an older but compatible OVMF binary, you can then ingest the hash again to generate a full measurement:\n\n    $ sev-snp-measure --mode snp --vcpus=1 --vcpu-type=EPYC-v4 --ovmf=OVMF.fd.old --ovmf-hash cab7e[...]\n    d52697c3e056fb8d698d19cc29adfbed5a8ec9170cb9eb63c2ac957d22b4eb647e25780162036d063a0cf418b8830acc\n\n## Related projects\n\n* [sev-snp-measure-go](https://github.com/virtee/sev-snp-measure-go): port of sev-snp-measure to Go\n* libvirt tools: [virt-dom-sev-validate](https://gitlab.com/berrange/libvirt/-/blob/lgtm/tools/virt-dom-sev-validate.py),\n  [virt-dom-sev-vmsa-tool](https://gitlab.com/berrange/libvirt/-/blob/lgtm/tools/virt-dom-sev-vmsa-tool.py)\n* [sev Rust crate](https://github.com/virtee/sev) and [snpguest CLI tool](https://github.com/virtee/snpguest)\n* [snp-digest-rs](https://github.com/slp/snp-digest-rs)\n* AMD [sev-tool](https://github.com/AMDESE/sev-tool), [sev-guest](https://github.com/AMDESE/sev-guest),\n  and [sev-utils](https://github.com/amd/sev-utils)\n* [go-sev-guest](https://github.com/google/go-sev-guest)\n\n## Development\n\nRun all unit tests:\n\n    pip install -r requirements.txt\n    make test\n\nCheck unit tests coverage:\n\n    pip install coverage\n    make coverage\n    # See HTML coverage report in htmlcov/\n\nCheck Python type hints:\n\n    pip install mypy\n    make typecheck\n\nCheck Python coding style:\n\n    pip install flake8\n    make lint\n\n## Notes\n\nIf you have any questions or issues you can create a new [issue\nhere](https://github.com/virtee/sev-snp-measure/issues/new)\n\nPull requests are welcome!\n\n## License\n\nApache 2.0 license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvirtee%2Fsev-snp-measure","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvirtee%2Fsev-snp-measure","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvirtee%2Fsev-snp-measure/lists"}