Enable SEV-SNP

Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) is a hardware-based security feature available with AMD CPUs, which provides memory encryption and integrity protection for virtual machines (VMs). SEV-SNP isolates VMs from the hypervisor and other host system software.

Important

Enabling SEV-SNP on a RHEL host is a Technology Preview only. However, enabling SEV-SNP on a RHEL guest is fully supported.

Enable SEV-SNP on a RHEL host
Copy link

To enable Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) on a RHEL host, you must ensure that your system meets the prerequisites and then install the snphost and libvirt-daemon-kvm packages.

Before you begin
Copy link

  • Your host uses the following hardware and software:
    • An AMD CPU that supports SEV-SNP, such as a supported model from the AMD EPYC series
    • RHEL 10.0 or later
    • SEV firmware version 1.55 or later
    • Sufficient system memory for SNP Memory Coverage configuration
  • The following settings are enabled in UEFI CPU menu:
    • SVM Mode (Secure Virtual Machine Mode)
    • SEV-SNP Support or Secure Nested Paging
    • SMEE (Secure Memory Encryption)

About this task
Copy link

SEV-SNP is a hardware-based security feature that provides strong memory encryption and integrity protection for virtual machines (VMs). This isolates VMs from the hypervisor and other host system software. SEV-SNP is available only with AMD CPUs.

Important

Using SEV-SNP on a RHEL host is a Technology Preview only. Technology Preview features are not supported with Red Hat production service levels agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Procedure
Copy link

Install the necessary packages on the RHEL host. 
# dnf install snphost libvirt-daemon-kvm

Results
Copy link

  • Verify that SEV-SNP is enabled on the host. 
    # virt-host-validate qemu
     
      QEMU: Checking for hardware virtualization:   PASS
  QEMU: Checking if device '/dev/kvm' exists:   PASS
  QEMU: Checking if device '/dev/kvm' is accessible:   PASS
  QEMU: Checking if device '/dev/vhost-net' exists:   PASS
  QEMU: Checking if device '/dev/net/tun' exists:   PASS
  QEMU: Checking for cgroup 'cpu' controller support:   PASS
  QEMU: Checking for cgroup 'cpuacct' controller support:   PASS
  QEMU: Checking for cgroup 'cpuset' controller support:   PASS
  QEMU: Checking for cgroup 'memory' controller support:   PASS
  QEMU: Checking for cgroup 'devices' controller support:   PASS
  QEMU: Checking for cgroup 'blkio' controller support:   PASS
  QEMU: Checking for device assignment IOMMU support:   PASS
  QEMU: Checking if IOMMU is enabled by kernel:   PASS
  QEMU: Checking for secure guest support:   PASS

    If SEV-SNP is enabled on the host, the Checking for secure guest support line reports PASS.

What to do next
Copy link

Enable SEV-SNP on a RHEL guest
Copy link

To enable Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) in a RHEL virtual machine (VM), you can apply SEV-SNP configuration when creating the VM. Alternatively, you can enable SEV-SNP in an existing RHEL VM by editing the VM configuration.

Before you begin
Copy link

  • SEV-SNP is enabled on your RHEL host. For instructions, see Enabling SEV-SNP on a RHEL host
  • The host has libvirt, virt-install, and virt-xml installed
  • The VM uses a supported RHEL version as the guest operating system:
    • RHEL 9.2 or later
    • RHEL 10.0 or later

About this task
Copy link

SEV-SNP is a hardware-based security feature that provides strong memory encryption and integrity protection for VMs. This isolates VMs from the hypervisor and other host system software. SEV-SNP is available only with AMD CPUs.

Procedure
Copy link

  • To create a new RHEL VM with SEV-SNP enabled:
    • Use the virt-install utility with the --launchSecurity sev-snp,policy=0x30000 option. For example: 
      # virt-install \
    --name <vm_name> --os-info rhel9.6 --memory 2048 --vcpus 2 \
    --boot uefi --import --disk /var/lib/libvirt/images/disk.qcow2 \
    --graphics none --console pty,target_type=serial \
    --launchSecurity sev-snp,policy=0x30000
  • To enable SEV-SNP functionality in an existing RHEL VM:
    1. Shut down the existing virtual machine if it is running. 
      # virsh shutdown <vm_name>
    2. Export and back up the current VM configuration. 
      # virsh dumpxml <vm_name> > /tmp/<vm_name>-backup.xml
    3. Add SEV-SNP launch security configuration to the VM domain. 
      # virt-xml <vm_name> --edit --launchSecurity type=sev-snp,policy=0x30000

      This command adds the SEV-SNP configuration to the VM’s domain XML. Alternatively, you can manually edit the configuration by using virsh edit vm-name and add the <launchSecurity type='sev-snp'> element.

    4. Ensure the VM is configured with a compatible CPU model. 
      # virsh dumpxml <vm_name> --xpath //cpu
       
      <cpu mode="host-passthrough" check="none" migratable="on"/>

      The CPU must be set to host-passthrough or use an AMD EPYC model. If it is not, update it:

      # virt-xml <vm_name> --edit --cpu mode=host-passthrough
    5. Start the VM. 
      # virsh start <vm_name>

Results
Copy link

  1. On the host, verify that the VM is running with SEV-SNP enabled. 
    # virsh dumpxml --xpath //launchSecurity <vm_name>
     
    <launchSecurity type="sev-snp">
  <policy>0x00030000</policy>
</launchSecurity>
  2. Log in to the guest VM.
  3. Verify that the SEV-SNP guest device exists. 
    # ls -l /dev/sev_guest

    If SEV-SNP is properly enabled in the guest, this command lists the /dev/sev_guest character device.

    Important

    Checking the existence of /dev/sev_guest proves only that the VM is configured and operating correctly. To prove that the VM is using SEV-SNP to secure it against a hostile host, you must perform a cryptographic attestation of the guest.

    For more information about attestation, see Learn about Confidential Computing Attestation (Red Hat Blog).

  • If SEV-SNP is not detected in the guest, verify that the host SEV-SNP configuration is correct and that the VM was restarted after the configuration change.
  • To revert to the original configuration, restore from the backup: 
    # virsh undefine <vm_name>
# virsh define /tmp/<vm_name>-backup.xml