SNPHOST(1)

📦
version 0.9.0 · 2 versions
, in nixpkgs unstable

🎀 SNPHOST(1) 🎀 — snphost, aka ur fave AMD SEV-SNP bestie ✨

okay so real talk, this page is SNPHOST(1) from the manual, and it's literally all about snphost — the command line tool that manages the AMD SEV-SNP environment. grab a boba, we're getting into it 💅

🌸 NAME 🌸

snphost — command line tool for managing the AMD SEV-SNP environment. that's it, that's the whole vibe 🫶

✨ SYNOPSIS ✨

snphost [GLOBAL_OPTIONS] [COMMAND] [COMMAND_ARGS]
snphost [-h, --help]
snphost command --help

🦋 DESCRIPTION 🦋

snphost is a CLI utility for managing and interacting with the AMD SEV-SNP firmware device of a host system. lowkey iconic of it ngl 💖

🌈 GLOBAL OPTIONS 🌈

  • -q, --quiet — don't print any output to the console. silence is golden, main character energy 🙈

👑 COMMANDS 👑

💜 snphost export

usage: snphost export [der, pem] CERT-FILE DIR-PATH

this command exports the SEV-SNP certificate chain to the directory provided by DIR-PATH. you have to provide the CERT-FILE where the certs are currently stored in (in GHCB format) — like, that's not optional bestie. you also gotta specify if you want the certs exported in PEM or DER certificate format. these are the only two encoding formats supported in this tool, periodt. currently only AMD chain certificates (ARK, ASK, VCEK and VLEK) are supported for export.

options:

  • -h, --help — show a help message.

💜 snphost import

usage: snphost import DIR-PATH CERT-FILE

this command imports serialized SEV-SNP certificates to the specified CERT-FILE. this CERT-FILE can then be provided to QEMU to perform extended attestation on guest — slay. currently, only the ASK, ARK, VCEK and VLEK are supported to serialize in the tool. note that there are a few user requirements for this command to work as intended 👀

all certificates must be located in the same directory with specific names:

  • ARK certificate => ark.{pem, der}
  • ASK certificate => ask.{pem, der}
  • VCEK certificate => vcek.{pem, der}
  • VLEK certificate => vlek.{pem, der}

not all certificates are needed in the directory, only the ones that a user is looking to import to the CERT-FILE. so don't stress about collecting them all like they're pokémon 🧚

options:

  • -h, --help — show a help message

💜 snphost ok

usage: snphost ok

this command probes the processor, sysfs, and KVM for AMD SEV-SNP related capabilities on the host and emits the results. it's giving health check, it's giving vibe check 🌸

options:

  • -s, --short — show only failures with summary counts
  • -v, --verbose — show detailed test descriptions grouped by category with detected issues summary
  • -f, --features — include optional feature tests (skipped by default)
  • -o, --output <OUTPUT> — controls how test results are rendered. supported formats:
    • default — human-readable output (default)
    • json — machine-readable JSON output
  • -h, --help — show a help message

💜 snphost commit

usage: snphost commit

this command commits the current firmware and SNP platform config versions to the PSP.

😭 no cap, read this twice: this can't be undone and will not allow rollbacks to older versions. once it's done it's done, no take-backs, no ctrl+z.

options:

  • -h, --help — show a help message.

💜 snphost config set

usage: snphost config set BOOTLOADER TEE SNP-FW MICROCODE MASK-CHIP

this command allows the user to change the config of the SNP platform. the user can provide the desired versions of the different TCB parameters they would like to modify. the command will change the reported values by the PSP. in order to have these changes committed, the user would have to use snphost commit. the user can also provide a new mask-chip value that will change the mask chip bit field values in the config.

explanation of the different parameters:

  • BOOTLOADER — desired reported bootloader version
  • TEE — desired reported PSP OS version
  • SNP-FW — desired reported SNP Firmware level
  • MICROCODE — desired reported patch level of all the cores
  • MASK-CHIP — change the CHIP ID and CHIP KEY settings by changing the MASK-CHIP bits. valid values range from 0-3 depending on what bits the user wants enabled.
    • Bit[0] -> CHIP ID: indicates that the CHIP_ID field in the attestation report will always be 0.
    • Bit[1] -> MASK KEY: indicates that the VCEK is not used in attestation and guest key derivation.
  • FMC — current FMC firmware version

for example, if the user would like MASK KEY to be enabled and CHIP ID disabled, then they would pass in a 2. math is mathing, iykyk 💅

options:

  • -h, --help — show a help message.

💜 snphost config reset

usage: snphost config reset

this command resets the SEV-NP platform — wait, SEV-SNP platform 💀. anyway: this will clear all persistent data managed by the platform and reset the platform configuration to its last committed version. it's giving factory reset but make it firmware 🌀

options:

  • -h, --help — show a help message.

💜 snphost show

usage: snphost show [guests, identifier, tcb, vcek-url, version ]

this command describes the state of the SEV-SNP platform. there are several platform details to describe:

  • Guest count: snphost show guests
  • Platform identifier: snphost show identifier
  • TCB version: snphost show tcb
  • VCEK URL: snphost show vcek-url
  • Firmware version: snphost show version

options:

  • -h, --help — show a help message

💜 snphost verify certs

usage: snphost verify certs DIR-PATH

this command verifies the full SEV-SNP certificate authority (CA) chain using the certificates stored in the specified directory. there are two possible CA chains that can be verified:

  • the VCEK chain: ark, ask, vcek.
  • or the VLEK chain: ark, asvk, vlek.

if both chains are present, the tool will default to verifying the VLEK chain. the certificates must be named as one of the following: ark, ask, asvk, vlek, vcek, followed by the format in which they're stored (cert.pem or cert.der). only PEM and DER formats are supported.

options:

  • -h, --help — show a help message

💜 snphost verify vlek-hashstick

usage: snphost verify vlek-hashstick HASHSTICK-PATH

this command verifies the provided VLEK hashstick against the current system configuration. there are 2 verifications the hashstick needs to pass before being loaded.

one relates to the authentication of the actual wrapped vlek content, but this authentication can only be done at fw level.H15 — yeah, that trailing bit is literally what the page says, don't come for me 🙈

the other is matching the reported TCB version in the VLEK vs the one in the system. this command compares the TCB version in the hashstick against the TCB version in the system, making sure these fields match. once the TCB is verified the user can load the vlek hashstick using the vlek-load command. chef's kiss 🎀

options:

  • -h, --help — show a help message

💜 snphost fetch vcek

usage: snphost fetch vcek [ der, pem ] DIR-PATH [url]

this command fetches the host system's versioned chip endorsement key (VCEK) and writes the encoded certificate to the directory at path DIR-PATH. users must specify which format they would like the certificate to be encoded in (DER or PEM). the URL of the VCEK can be explicitly set. if not explicitly set, the URL will be generated based on firmware data — it just knows ✨

options:

  • -h, --help — show a help message

💜 snphost fetch crl

usage: snphost fetch crl DIR-PATH

this command fetches the host system's certificate revocation list (CRL) and writes the encoded list to the directory at path DIR-PATH.

options:

  • -h, --help — show a help message

💜 snphost vlek-load

usage: snphost vlek-load $HASHSTICK-FILE

this command attempts to load the provided VLEK-HASHSTICK into the system. when requesting a VLEK from the KDS, the user should receive both a VLEK certificate and a Wrapped Hashtick. this command uses the hashstick file to initiate the load process. if the hashstick fails verification, the command will return an error 😭 users are encouraged to pre-verify the hashstick using the verify vlek-hashstick command — like, do urself a favor bestie 🫶

options:

  • -h, --help — show a help message

🍓 REPORTING BUGS 🍓

please report all bugs to https://github.com/virtee/snphost/issues — they wanna hear from u, fr fr 💌

and that's the whole page!! xoxo, this was 1980-01-01-vintage content filed under SNPHOST(1), stay hydrated and don't run snphost commit unless u mean it 💖✨

📦 where this page comes from