在不可信的 EPYC 9654 上使用 AMD SEV-SNP 技术运行机密虚拟机

git clone https://github.com/AMDESE/AMDSEV.git
git checkout snp-latest
# 构建 QEMU
./build.sh qemu
# 构建 QEMU 使用的 OVMF (UEFI 固件)
./build.sh ovmf
# 构建支持 SEV-SNP 的 kernel
./build.sh kernel
sudo cp kvm.conf /etc/modprobe.d/

cd linux
apt install ./linux-headers-6.11.0-rc3-snp-host-85ef1ac03941_6.11.0-rc3-g85ef1ac03941-2_amd64.deb ./linux-libc-dev_6.11.0-rc3-g85ef1ac03941-2_amd64.deb ./linux-image-6.11.0-rc3-snp-host-85ef1ac03941_6.11.0-rc3-g85ef1ac03941-2_amd64.deb
reboot

test@epyc:~$ uname -a
Linux epyc 6.11.0-rc3-snp-host-85ef1ac03941 #2 SMP Sun Aug 24 02:32:26 CST 2025 x86_64 x86_64 x86_64 GNU/Linux
test@epyc:~$ sudo dmesg | grep SEV
[    0.000000] SEV-SNP: RMP table physical range [0x0000000015500000 - 0x0000000075afffff]
[    0.003519] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x0000000015400000]
[    0.003526] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x0000000075a00000]
[   13.101084] ccp 0000:03:00.5: SEV API:1.55 build:36
[   13.101094] ccp 0000:03:00.5: SEV-SNP API:1.55 build:36
[   13.127843] kvm_amd: SEV enabled (ASIDs 128 - 1006)
[   13.127844] kvm_amd: SEV-ES enabled (ASIDs 1 - 127)
[   13.127845] kvm_amd: SEV-SNP enabled (ASIDs 1 - 127)
test@epyc:~$ cat /sys/module/kvm_amd/parameters/sev_snp 
Y

# 启动虚拟机
# P.S. 我编辑了下脚本, 加入 -netdev user,id=vmnic,hostfwd=tcp::8000-:22 -device e1000,netdev=vmnic,romfile= -vnc :1 -device virtio-vga 参数, 开启端口转发和 VNC 便于观察虚拟机状态
sudo ./launch-qemu.sh -hda ../debian13-secure.qcow2 -sev-snp -mem 16384 -smp 16

# 安装生成度量值需要的工具
pip install sev-snp-measure

# 重新在可信环境下构建需要的 OVMF
git clone https://github.com/AMDESE/AMDSEV.git
cd AMDSEV
git checkout snp-latest
# 这里构建前要做个小修改, 把 common.sh 中的 OvmfPkg/OvmfPkgX64.dsc 替换为 OvmfPkg/AmdSev/AmdSevX64.dsc
# 见 https://github.com/virtee/sev-snp-measure/issues/26#issuecomment-1636995518
touch ovmf/OvmfPkg/AmdSev/Grub/grub.efi  # 这条 touch 来自 https://github.com/AMDESE/AMDSEV/issues/124#issuecomment-1336387966
./build.sh ovmf
cd ..
cp AMDSEV/ovmf/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd .

# 图方便, 直接从当前系统 (同样是 Ubuntu 22.04) 偷一个 kernel 和 initramfs 出来, Ubuntu 22.04 已经有作为 guest 时现成的 SNP 支持了
sudo cp /boot/vmlinuz .
# 得先把 sev-guest 这个需要的驱动打包进 initramfs 里
echo -e '\nsev-guest' > /etc/initramfs-tools/modules
sudo update-initramfs -u
sudo cp /boot/initrd.img .

# 再额外打包一个需要的 snpguest 工具进去
sudo unmkinitramfs -v initrd.img .
wget https://github.com/virtee/snpguest/releases/download/v0.9.1/snpguest
sudo chown root:root snpguest
sudo chmod 755 snpguest
sudo cp snpguest main/usr/bin
sudo cp /usr/bin/base64 main/usr/bin
cd main
find . | sudo cpio -o -H newc | gzip > ../myinitrd.cpio.gz
cd ..

# 生成需要的 measurement, 这是我们等下要验证的值
sev-snp-measure --mode snp --vcpus 16 --vcpu-type EPYC-v4 --ovmf OVMF.fd --kernel vmlinuz --initrd myinitrd.cpio.gz --append "console=ttyS0"
# Output: 4936d42a8e2c2e91f1f1160063097b43b5c0c3339f5f85586128356e16d4cf36ebe5657fbbf9c3163dcf606bdf7e542c

# 需要先编辑 launch-qemu.sh
# 在 -object sev-snp-guest,...,reduced-phys-bits=1 这行结尾追加 ,kernel-hashes=on
sudo ./launch-qemu.sh -sev-snp -bios .. -cpu EPYC-v4 -smp 16 -mem 16384 -kernel ../vmlinuz -initrd ../myinitrd.cpio.gz -append "console=ttyS0" -hda ""

/mnt/ssd/qemu/AMDSEV/usr/local/bin/qemu-system-x86_64 -enable-kvm -cpu EPYC-v4 -machine q35 -netdev user,id=vmnic,hostfwd=tcp::8000-:22 -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= -vnc :1 -device virtio-vga -smp 16,maxcpus=255 -m 16384M,slots=5,maxmem=24576M -no-reboot -bios /mnt/ssd/qemu/OVMF.fd -machine confidential-guest-support=sev0,vmport=off -object memory-backend-memfd,id=ram1,size=16384M,share=true,prealloc=false -machine memory-backend=ram1 -object sev-snp-guest,id=sev0,policy=0x30000,cbitpos=51,reduced-phys-bits=1,kernel-hashes=on -kernel ../vmlinuz -append "console=ttyS0" -initrd ../myinitrd.cpio.gz -nographic -monitor pty -monitor unix:monitor,server,nowait

openssl rand -hex 64 > nonce.hex
# 此处为 3502ae46269024fda5eea969d942f15b9cf9708602709d97b0de1ceaa0b712c7a6ea5170310fd6f10e9f1ad223cb4ffbc8fd036a70846cb7d50f3086c64c2da0

echo '3502ae46269024fda5eea969d942f15b9cf9708602709d97b0de1ceaa0b712c7a6ea5170310fd6f10e9f1ad223cb4ffbc8fd036a70846cb7d50f3086c64c2da0' > nonce.hex
# 调用我们之前准备的 snpguest 工具生成 report.bin
snpguest report report.bin nonce.hex
# 把这个文件读取回来
cat report.bin | base64
# 输出为 AgAAAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAEAAAAJ...<后略>

# 下载 AMD 提供的 genoa (EPYC 9004) 的 CA 证书 (ark.pem + ask.pem)
snpguest fetch ca pem . genoa

# 根据 Attestation report 从 AMD KDS 服务下载 vcek.pem
# VCEK (Versioned Chip Endorsement Key) 对于每个 CPU 是不同的
snpguest fetch vcek -p genoa pem . report.bin

# 我们得到了 ARK (AMD Root Key) -> ASK (AMD SEK Key) -> VCEK 的信任链
snpguest verify certs .
# 输出:
# The AMD ARK was self-signed!
# The AMD ASK was signed by the AMD ARK!
# The VCEK was signed by the AMD ASK!

# 验证得到的 Attestation Report
snpguest verify attestation -p genoa . report.bin
# 输出:
# Reported TCB Boot Loader from certificate matches the attestation report.
# Reported TCB TEE from certificate matches the attestation report.
# Reported TCB SNP from certificate matches the attestation report.
# Reported TCB Microcode from certificate matches the attestation report.
# VEK signed the Attestation Report!

truncate -s 5G rootfs_enc.raw

sudo losetup -f rootfs_enc.raw
losetup -a   # 沟槽的 snap 给我干到了 /dev/loop28, 以下就以这个为例

# 直接将整个虚拟磁盘用 LUKS 加密, 在此处设置密码, 以 "AMD,YES!" 为例
# 默认的 LUKS 没有数据完整性保证: https://security.stackexchange.com/questions/87367/does-luks-protect-the-filesystem-integrity
# 所以我们这里使用 LUKS2 并手动开启 integrity, 这目前还是个实验性选项
sudo cryptsetup luksFormat --type luks2 /dev/loop28 --integrity hmac-sha256
sudo cryptsetup luksOpen /dev/loop28 guest_rootfs
sudo mkfs.ext4 /dev/mapper/guest_rootfs

mkdir rootfs
sudo mount /dev/mapper/guest_rootfs rootfs

sudo debootstrap --arch=amd64 jammy rootfs http://mirror.nju.edu.cn/ubuntu/

sudo chroot rootfs  # chroot 到 rootfs 进行设置
passwd root  # 设置登录需要的密码, 你也可以创建新用户
# 配置下网络, 等下直接 SSH (终端密码登录是不安全的)
cat << EOF > /etc/netplan/01-config.yaml
network:
  version: 2
  ethernets:
    enp0s1:
      dhcp4: true
EOF

apt update && apt install ssh  # 这里顺便记录下 SSH key, 如果只有 root 记得加公钥或者允许密码登录
exit  # 退出 chroot

sudo umount rootfs
sudo cryptsetup luksClose guest_rootfs
sudo losetup -d /dev/loop28

#!/bin/sh
# 此脚本整个替换掉原来的 initramfs 中的 init
# 我这里用了 age 这个工具来进行加密解密, 自己使用 CGO_ENABLED=0 编译之后就完全没有动态链接库了, 你可以打包自己熟悉的工具
# 目前实现的是手动交互版本, 如果你愿意配置网络的话, 可以做成无人值守的安全启动

LUKS_DEVICE="/dev/sda"
MAPPER_NAME="encroot"
FS_TYPE="ext4"
NEW_ROOT_MP="/new_root"

echo "==> [INITRAMFS] Starting LUKS init script..."
echo "==> [INITRAMFS] Mounting essential filesystems..."
mkdir /proc /sys
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs devtmpfs /dev

echo "==> [INITRAMFS] Loading crypto modules..."
modprobe sev-guest
modprobe dm_crypt
modprobe dm_integrity

echo "==> [INITRAMFS] Starting remote attestation process..."

read -r -p "Enter nonce:" NONCE

echo "    -> Generating attestation report with nonce..."
echo -n $NONCE > /nonce.txt
snpguest report /report1.bin /nonce.txt

if [ $? -ne 0 ]; then
    echo "!!! [INITRAMFS] FAILED to get attestation report."
    exit 1
fi

echo "    -> Generating ephemeral key pair..."
age-keygen -o /vm_key.txt
EPHEMERAL_PUBLIC_KEY=$(grep "public key: " /vm_key.txt | cut -d ' ' -f 4)
echo "    -> Public key generated."

echo "    -> Generating attestation report with public key..."
echo -n "$EPHEMERAL_PUBLIC_KEY  " > /pub.txt  # age pub key 长 62 bytes, 这里凑一个 64 bytes, 能直接传 key 原文就不用 hash 了
snpguest report /report2.bin /pub.txt

if [ $? -ne 0 ]; then
    echo "!!! [INITRAMFS] FAILED to get attestation report."
    exit 1
fi

echo "    -> Attestation report generated."

echo "----- REPORT 1 -----"
cat /report1.bin | base64
echo "----- REPORT 2 -----"
cat /report2.bin | base64

read -r -p "Enter encrypted LUKS key (age format, one-line base64):" ENCRYPTED_LUKS_KEY_B64
echo $ENCRYPTED_LUKS_KEY_B64 | base64 -d > /luks.age

echo "==> [INITRAMFS] Decrypting LUKS key..."
DECRYPTED_LUKS_KEY=$(age --decrypt -i /vm_key.txt /luks.age)
if [ $? -ne 0 ] || [ -z "${DECRYPTED_LUKS_KEY}" ]; then
    echo "!!! [INITRAMFS] FAILED to decrypt LUKS key."
    exit 1
fi

rm /vm_key.txt /luks.age /pub.txt /report1.bin /report2.bin

echo "==> [INITRAMFS] Attempting to unlock LUKS device: ${LUKS_DEVICE}"
echo -n "${DECRYPTED_LUKS_KEY}" | cryptsetup luksOpen ${LUKS_DEVICE} ${MAPPER_NAME} --key-file -

if [ $? -ne 0 ]; then
    echo "!!! [INITRAMFS] FAILED to unlock LUKS device with provided key."
    exit 1
fi

echo "==> [INITRAMFS] LUKS device unlocked successfully as /dev/mapper/${MAPPER_NAME}"

echo "==> [INITRAMFS] Creating mount point for the real root..."
mkdir ${NEW_ROOT_MP}

echo "==> [INITRAMFS] Mounting decrypted root filesystem..."
mount -t ${FS_TYPE} /dev/mapper/${MAPPER_NAME} ${NEW_ROOT_MP}

if [ $? -ne 0 ]; then
    echo "!!! [INITRAMFS] FAILED to mount decrypted root filesystem."
    # exec /bin/sh  # 仅供调试时使用
    exit 1
fi

echo "==> [INITRAMFS] Real root filesystem mounted successfully."

echo "==> [INITRAMFS] Unmounting temp filesystems..."
umount /proc
umount /sys
umount /dev

echo "==> [INITRAMFS] Switching to real root and executing init..."
exec switch_root ${NEW_ROOT_MP} /sbin/init

echo "!!! [INITRAMFS] FAILED to switch_root."
exit 1

snpguest verify attestation -p genoa . report1.bin
# VEK signed the Attestation Report!
snpguest verify attestation -p genoa . report2.bin
# VEK signed the Attestation Report!

snpguest display report report1.bin  # 验证 Measurement 和 Nonce
snpguest display report report2.bin  # 验证 Measurement, 获得 age 公钥

echo -n "AMD,YES\!" | age -r age15lz45488nzmk3q4kmfdg9489s7652h0h04vdekjhnptwa5wnff3snv45ly | base64 -w 0