Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Readme #116

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
296 changes: 293 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,295 @@
# snphost
Management CLI for SEV-SNP host system administrators

Please consult `docs/snphost.1.adoc` for an overview of `snphost` and
descriptions of each `snphost` subcommand.
`snphost` is a Command Line Interface (CLI) utility designed for administrators managing AMD SEV-SNP enabled host systems. This tool facilitates interaction with the AMD SEV-SNP firmware device, enabling various operations such as certificate management and attestation processes.

- [Usage](#usage)
- [1. help](#1-help)
- [2. export](#2-export)
- [3. import](#3-import)
- [4. ok](#4-ok)
- [5. fetch](#5-fetch)
- [6. show](#6-show)
- [7. commit](#7-commit)
- [8. config](#8-config)
- [9. verify](#9-verify)
- [Building](#building)
- [Ubuntu Dependencies](#ubuntu-dependencies)
- [RHEL and Compatible Distributions Dependencies](#rhel-and-compatible-distributions-dependencies)
- [openSUSE and Compatible Distributions Dependencies](#opensuse-and-compatible-distributions-dependencies)
- [Reporting Bugs](#reporting-bugs)

## Usage

### 1. `help`

Every `snphost` command and subcommand comes with a `--help` option that provides a description of its usage.

**Usage:**

```bash
snphost --help
```

or for a specific subcommand:

```bash
snphost <subcommand> --help
```

### 2. `export`

Deserializes a GHCB formatted cert chain file into individual certificates. The user must specify the desired encoding format (`der` or `pem`) for the certificates, the file where the `GHCB` cert chain is stored in, and the target directory path where to store the deserialized certs. This command is useful for looking at the individual certs that will be used for an extended attestation.

**Usage:**

```bash
snphost export [der|pem] CERT-FILE DIR-PATH
```

**Example:**

```bash
snphost export pem ghcb-certs.bin ./certs
```

### 3. `import`

Converts a certificate chain into a GHCB formatted file for extended attestation. This formatted file can then be provided to QEMU to perform extended attestation on guests. Currently, only the `ASK`, `ASVK`, `ARK`, `VCEK`, and `VLEK` certificates are supported for serialization.

**Usage:**

```bash
snphost import DIR-PATH CERT-FILE
```

**Example:**

```bash
snphost import ./certs ghcb-certs.bin
```
### 4. `ok`

Verifies if the `snpost` service is operational.

**Usage:**

```sh
snphost ok
```

**Example:**

```
```
Comment on lines +80 to +83
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the example is the same as the usage, just delete the example then.

Suggested change
**Example:**
```
```


### 5. `fetch`

Command to request certificates from the KDS.

**Usage:**

```bash
snphost fetch <subcommand>
```

**Subcommands:**

#### 1. `ca`

Fetches the host system's Certificate Authority (CA) certificate chain and writes the encoded certificates to the specified directory. Users must specify the desired encoding format (`der` or `pem`).

**Usage:**

```bash
snphost fetch ca [der|pem] DIR-PATH
```

**Example:**

```bash
snphost fetch ca pem ./certs
```

#### 2. `vcek`

Fetches the host system's Versioned Chip Endorsement Key (VCEK) and writes the encoded certificate to the specified directory. Users must specify the desired encoding format (`der` or `pem`).

**Usage:**

```bash
snphost fetch vcek [der|pem] DIR-PATH
```

**Example:**

```bash
snphost fetch vcek pem ./certs
```

#### 3. `crl`
Fetches the latest Certificate Revocation List (CRL) from the configured source.

```sh
snphost fetch crl
```

**Example:**

```bash
snphost fetch crl
```

### 6. `show`
Displays various SNP-related information.

**Usage:**
```sh
snphost show <subcommands>
```

**Subcommands:**

#### 1. `guests`
Lists all active guests.

**Usage:**
```sh
snphost show guests
```

#### 2. `identifier`
Displays the SNP identifier.

**Usage:**
```sh
snphost show identifier
```

#### 3. `tcb`
Shows the current Trusted Computing Base (TCB) version.

**Usage:**
```sh
snphost show tcb
```

#### 4. `vcek-url`
Displays the URL for fetching the VCEK certificate.

**Usage:**
```sh
snphost show vcek-url
```

#### 5. `version`

Prints the current version of `snphost`.

**Usage:**
```sh
snphost show version
```
Comment on lines +150 to +191
Copy link
Member

@DGonzalezVillal DGonzalezVillal Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idk if we need to list every single show subcommand this way. Maybe bullets of every show subcommand would be more effective. This just seem bulky to me.


### 7. `commit`
Commits pending configuration changes.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Commits pending configuration changes.
This command commits the current firmware and SNP platform config versions to the PSP.
This can't be undone and will not allow rollbacks to older versions.

Very Important that you clear up that this will not allow rollbacks (meaning you won't be able to change the config to a version prior to what has been committed to the ASP.


**Usage:**
```sh
snphost commit
```

### 8. `config`
Manages `snphost` configuration.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Manages `snphost` configuration.
Subcommands to manage the host machine's configuration.


**Usage:**
```sh
snphost config <subcommand>
```

**Subcommands**

#### 1. `set`
Sets a configuration parameter.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Sets a configuration parameter.
Change the config of the SNP platform. The user can
provide the desired versions of the different TCB parameters they would like to modify.
The command will change the reported values by the PSP.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Look at the snphost.1.adoc explanation for more information. I think you could write out the workflow of changing the config (config set -> commit) and you could give a more detailed explanation there. This is a sensitive command to run, so the more information you can provide here the better.


**Usage:**
```sh
snphost config set BOOTLOADER TEE SNP-FW MICROCODE MASK-CHIP
```

**Example:**
```sh
snphost config set
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
snphost config set
snphost config set 0 0 0 0 0

The suggestion doesn't show actual values you'd use, but I'm trying to say you should provide a value for the config you are going to change.

Again, try to understand what the command is really doing to provide an accurate example of how you would use it. And I think your example should come with an explanation of what will it will do when you run it. You're not providing any new information that is not already listed in the adoc.

```

#### 2.`reset`
Resets a configuration parameter to its default value.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Resets a configuration parameter to its default value.
This command resets the SEV-SNP platform. This will clear all
persistent data managed by the platform and reset the platform configuration
to its last committed version.


**Usage:**
```sh
snphost config reset
```

**Example:**
```sh
snphost config reset
```
Comment on lines +232 to +235
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**Example:**
```sh
snphost config reset
```


### 9. `verify`

Reads the certificates in a directory and verifies the certificate chain, ensuring its integrity and authenticity. This command is essential for validating the trustworthiness of the certificates that can be then passed to complete attestation.

**Usage:**
```bash
snphost verify DIR-PATH
```

**Example:**
```bash
snphost verify ./certs
```

## Building

Some packages may need to be installed on the host system in order to build snpguest.

```bash
#Rust Installation
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"
```

### Ubuntu Dependencies

```bash
sudo apt install build-essential
```

### RHEL and its compatible distributions Dependencies

```bash
sudo dnf groupinstall "Development Tools" "Development Libraries"
```

### openSUSE and its compatible distributions Dependencies

```bash
sudo zypper in -t pattern "devel_basis"
```

After installing the necessary dependencies, clone the `snphost` repository and build the project:

```bash
git clone https://github.com/virtee/snphost.git
cargo build --release
cd snphost/target/release
```

The compiled binary will be located in the `target/release` directory.

## Reporting Bugs

If you encounter any issues or bugs while using `snphost`, please report them by opening an issue by clicking [here](https://github.com/virtee/snphost/issues). Provide a detailed description of the problem, including steps to reproduce the issue and any relevant system information. This will help the maintainers address the problem more effectively.

---

*Note: This README is structured similarly to the [snpguest README](https://github.com/virtee/snpguest/blob/main/README.md) to maintain consistency across related projects.*
Loading