Lesson 2.3 · 15 min read

AMD SEV-SNP and Arm CCA

Reverse map table integrity, VCEK-signed attestation reports, and Arm's Realm Management Extension.

AMD SEV-SNP

AMD Secure Encrypted Virtualization (SEV) encrypts each VM's memory with a key managed by the AMD Secure Processor, a dedicated security processor on the SoC. The original SEV protected confidentiality; SEV-ES added encryption of register state; SEV-SNP (Secure Nested Paging) adds memory integrity protection using a Reverse Map Table (RMP) that records which guest owns each physical page, so the hypervisor cannot remap, replay or alias guest memory undetected. SNP also introduces Virtual Machine Privilege Levels (VMPLs) for running a privileged component, such as a paravisor or vTPM, inside the guest.

Selected SEV-SNP attestation report fields
Report field	Meaning
`MEASUREMENT`	Launch digest of the initial guest memory (typically the virtual firmware), computed by the AMD Secure Processor
`REPORT_DATA`	64 bytes supplied by the guest when requesting the report: bind a public key or nonce here
`HOST_DATA`	32 bytes set by the host at launch, often used to carry a policy or config digest
`POLICY`	Guest policy bits, including whether debugging is allowed
`REPORTED_TCB`	Security version numbers of the bootloader, TEE firmware, SNP firmware and microcode

Reports are signed by the VCEK (Versioned Chip Endorsement Key), which is unique to the chip and to its TCB version, and chains to AMD's root keys (ARK and ASK). Cloud providers may instead use a VLEK (Versioned Loaded Endorsement Key) issued to them by AMD. A guest obtains a report through the SNP guest driver, for example via /dev/sev-guest on Linux.

bash

# Inside an SEV-SNP guest (Linux): confirm SNP is active
dmesg | grep -i sev
# Example output line (wording varies by kernel):
#   Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP

A quick sanity check. It does not replace remote attestation.

Arm Confidential Compute Architecture (CCA)

Arm CCA is part of the Armv9-A architecture. Its Realm Management Extension (RME) adds a new Realm world alongside the existing Normal, Secure and Root worlds. Physical memory is assigned to worlds using granule protection checks, so the Normal-world hypervisor cannot access Realm memory. A small, separately measured firmware component, the Realm Management Monitor (RMM), manages Realms on the hypervisor's behalf.

CCA attestation produces a token with two parts: a platform token describing the hardware and firmware state, and a Realm token carrying the Realm Initial Measurement (RIM) and Realm Extensible Measurements (REMs), plus a challenge value from the verifier. Both are CBOR/COSE encoded.

Confidential VM families side by side
	Intel TDX	AMD SEV-SNP	Arm CCA
Isolated unit	Trust domain (VM)	SNP guest (VM)	Realm (VM)
Trusted mediator	TDX module (SEAM)	AMD Secure Processor firmware	RMM in Realm world
Launch measurement	MRTD	MEASUREMENT	RIM
Runtime measurements	RTMR0-3	vTPM PCRs (if provided)	REM0-3
Caller-bound data	REPORTDATA (64 B)	REPORT_DATA (64 B)	Challenge in Realm token

Key takeaways

SEV-SNP adds integrity (RMP) to SEV's encryption; reports are signed by a VCEK or VLEK chaining to AMD roots.
Arm CCA adds a Realm world via RME; the RMM manages Realms and attestation splits into platform and Realm tokens.
All three CVM families expose a launch measurement, runtime measurements and a field for caller-bound data.

Official resources: AMD SEV developer page, AMD SEV-SNP white paper (PDF), Arm CCA.

End of module 2

Take the module 2 quiz to check your understanding.