[SEV-SNP] Launching a guest VM with identity block failed (INVALID_PARAM at SNP_LAUNCH_FINISH)

[kokintt]

Hello,

We followed the steps on https://github.com/AMDESE/AMDSEV/tree/sev-snp-devel , and launch a guest VM with specifying the identity block using the sev-host-identity, but it returns the error "Invalid parameter (INVALID_PARAM)" during SNP_LAUNCH_FINISH.

qemu-system-x86_64: sev_snp_launch_finish: SNP_LAUNCH_FINISH ret=-5 fw_error=22 'Invalid parameter'

In the SEV Secure Nested Paging Firmware ABI Specification, the status code INVALID_PARAM for SNP_LAUNCH_FINISH means "MBZ fields are not zero.", but it seems that all the MBZ fields is zero.

(Question) Do you know why this "Invalid parameter (INVALID_PARAM)" error happens, and how we can launch a guest VM with specifying the identity block?

(Reference Information) We have created identity block by using the sev-host-identity in https://github.com/AMDESE/sev-guest .

ubuntu@ubuntu:~/sev-guest$ ./sev-host-identity -b -d bf18a1fcc9218b74788dc46b88dd56cb3cc3e407a8175deb46d281fe6bcb6332bc5686ea941f84df9e2b4ffc134c4eef -a auth_info.64 -i id_block.64 -p 0xb0000 key.pem

ubuntu@ubuntu:~/sev-guest$ xxd id_block
00000000: bf18 a1fc c921 8b74 788d c46b 88dd 56cb  .....!.tx..k..V.
00000010: 3cc3 e407 a817 5deb 46d2 81fe 6bcb 6332  <.....].F...k.c2
00000020: bc56 86ea 941f 84df 9e2b 4ffc 134c 4eef  .V.......+O..LN.
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0100 0000 0000 0000 0000 0b00 0000 0000  ................

For creating the above identity block, we have used the values of the measurement and the policy from the attestation report obtained by launching the same guest VM without specifying the identity block.

Attestation report :

ubuntu@ubuntu:~/sev-guest$ sudo ./sev-guest-parse-report report.bin
Version: 2
Guest SVN: 0
Policy: 0xb0000
 - Debugging Allowed:       Yes
 - Migration Agent Allowed: No
 - SMT Allowed:             Yes
 - Min. ABI Major:          0
 - Min. ABI Minor:          0
Family ID:
    00000000000000000000000000000000
Image ID:
    00000000000000000000000000000000
VMPL: 0
Signature Algorithm: 1 (Invalid)
Platform Version: 0200000000000667
 - Boot Loader SVN:   2
 - TEE SVN:           0
 - SNP firmware SVN:  6
 - Microcode SVN:    67
Platform Info: 0x1
 - SMT Enabled: Yes
Author Key Enabled: Yes
Report Data:
    0000000000000000000000000000000000000000000000000000000000000000
    0000000000000000000000000000000000000000000000000000000000000000
Measurement:
    bf18a1fcc9218b74788dc46b88dd56cb3cc3e407a8175deb
    46d281fe6bcb6332bc5686ea941f84df9e2b4ffc134c4eef
:

[jlarrew]

Hi Koki,

Thanks for the detailed report! The attestation report contains Author Key Enabled: Yes, which indicates that the SNP guest is being launched by qemu with auth-key-enabled=true. However, the command used to create the auth_info block doesn't supply an authority key.

There are two ways to fix this:

1) Generate a second key to act as the authority key and pass it to sev-host-identity as the last parameter:

openssl genpkey -algorithm EC ec_paramgen_curve:P-384 -outform PEM -out author-key.pem
./sev-host-identity -b \
-d bf18a1fcc9218b74788dc46b88dd56cb3cc3e407a8175deb46d281fe6bcb6332bc5686ea941f84df9e2b4ffc134c4eef \
-a auth_info.64 \
-i id_block.64 \
-p 0xb0000 \
key.pem \
author-key.pem

2) If you don't want to use an authority key, start the SNP guest with the authority key disabled:

qemu-system-x86 -object sev-snp-guest,auth-key-enabled=false ...

Please let me know if this resolves your issue!

Sincerely, Jesse

[jlarrew]

UPDATE:

There appears to be a bug in the SNP firmware where launching a SNP guest with an ID key only always fails. (See Issue https://github.com/AMDESE/sev-guest/issues/13)

A workaround is to use option 1) above, i.e. generate a second key to act as the authority key and pass both keys into sev-host-identity.

Let me know if this resolves your issue. Thanks!

Sincerely, Jesse

[kokintt]

Dear Jesse-san,

Thank you very much for sharing the information about the workaround.

Our issue has been resolved by the option (1) - generating a second key to act as the authority key and pass both keys into sev-host-identity, and launching SNP guest by qemu with auth-key-enabled=true. Thank you very much!

If you have any information about when the bug in the SNP firmware will be fixed, please let us know.

Best Regards, Koki

[JustPlay]

openssl genpkey -algorithm EC ec_paramgen_curve:P-384 -outform PEM

openssl genpkey -algorithm EC ec_paramgen_curve:P-384 -outform PEM do not work on ubuntu-22.04 (openssl-3.0.2) and debian-10 (openssl-1.1.1n), both genpkey: Use -help for summary

@jlarrew

thanks

[JustPlay]

@jlarrew and another question, how to pass the IDB and id_auth_info into qemu cmdline? thanks

i know it, thanks;