virt-qemu-sev-validate(1) Virtualization Support virt-qemu-sev-validate(1) (NAME) virt-qemu-sev-validate - AMD SEV (SYNOPSIS) virt-qemu-sev-validate [OPTIONS] (DESCRIPTION) AMD SEV . SEV / SEV-ES . AMD SEV . . AMD SEV . . libvirt libvirt . --insecure . . (OPTIONS) -h, --help . -d, --debug . -q, --quiet (attestation). . --measurement BASE64-STRING (hypervisor) . base64 . --api-major VERSION (major) SEV . --api-minor VERSION (minor) SEV . --build-id ID (build ID) SEV . --policy POLiCY . . . -f PATH, --firmware=PATH . EDK2 AMD SEV . NVRAM NVRAM . -k PATH, --kernel=PATH . -r PATH, --initrd=PATH initrd . . -e STRING, --cmdline=STRING . . -n COUNT, --num-cpus=COUNT . SEV-ES . -0 PATH, --vmsa-cpu0=PATH VMSA . SEV-ES . . -1 PATH, --vmsa-cpu1=PATH VMSA . SEV-ES . . --tik PATH TIK . . --tk . --tek PATH TEK . . --tk . --tk PATH TEK/TIK . TEK TIK . --tik --tek . libvirt libvirt . -c, --connect URI (URI) libvirt. . --insecure . -o, --domain ID|NAME|UUID UUID . libvirt . (paused) . -i, --insecure . libvirt . . . -g, --ignore-config . XML . . --ignore-config . . --inject-secret ALIAS-OR-GUID:PATH . . ALIAS : o luks-key - LUKS. GUID 736869e5-84f0-4973-92ec-06879ce3da0b. GUID UUID . PATH GUID . : o PATH GUID . o NUL GUID PATH . GUID . --secret-header PATH base64 . libvirt . --secret-payload PATH base64 . libvirt . (EXAMPLES) . . . SEV : # virt-qemu-sev-validate \ --firmware OVMF.sev.fd \ --tk this-guest-tk.bin \ --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8swFrybR1fZ2ID \ --api-major 0 \ --api-minor 24 \ --build-id 13 \ --policy 3 SEV : # virt-qemu-sev-validate \ --firmware OVMF.sev.fd \ --kernel vmlinuz-5.11.12 \ --initrd initramfs-5.11.12 \ --cmdline "root=/dev/vda1" \ --tk this-guest-tk.bin \ --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8swFrybR1fZ2ID \ --api-major 0 \ --api-minor 24 \ --build-id 13 \ --policy 3 SEV-ES SMP : # virt-qemu-sev-validate \ --firmware OVMF.sev.fd \ --num-cpus 2 \ --vmsa-cpu0 vmsa0.bin \ --vmsa-cpu1 vmsa1.bin \ --tk this-guest-tk.bin \ --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8swFrybR1fZ2ID \ --api-major 0 \ --api-minor 24 \ --build-id 13 \ --policy 7 SEV-ES SMP VMSA : # virt-qemu-sev-validate \ --firmware OVMF.sev.fd \ --num-cpus 2 \ --cpu-family 23 \ --cpu-model 49 \ --cpu-stepping 0 \ --tk this-guest-tk.bin \ --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8swFrybR1fZ2ID \ --api-major 0 \ --api-minor 24 \ --build-id 13 \ --policy 7 SEV : # virt-qemu-sev-validate \ --firmware OVMF.sev.fd \ --tk this-guest-tk.bin \ --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8swFrybR1fZ2ID \ --api-major 0 \ --api-minor 24 \ --build-id 13 \ --policy 3 \ --inject-secret 736869e5-84f0-4973-92ec-06879ce3da0b:passwd.txt \ --secret-header secret-header.b64 \ --secret-payload secret-payload.b64 secret-header.b64 secret-payload.b64 . libvirt libvirt . . . SEV : # virt-qemu-sev-validate \ --connect qemu+ssh://root@some.remote.host/system \ --firmware OVMF.sev.fd \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV : # virt-qemu-sev-validate \ --connect qemu+ssh://root@some.remote.host/system \ --firmware OVMF.sev.fd \ --kernel vmlinuz-5.11.12 \ --initrd initramfs-5.11.12 \ --cmdline "root=/dev/vda1" \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV-ES SMP : # virt-qemu-sev-validate \ --connect qemu+ssh://root@some.remote.host/system \ --firmware OVMF.sev.fd \ --num-cpus 2 \ --vmsa-cpu0 vmsa0.bin \ --vmsa-cpu1 vmsa1.bin \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV-ES SMP VMSA : # virt-qemu-sev-validate \ --connect qemu+ssh://root@some.remote.host/system \ --firmware OVMF.sev.fd \ --cpu-family 23 \ --cpu-model 49 \ --cpu-stepping 0 \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV : # virt-qemu-sev-validate \ --connect qemu+ssh://root@some.remote.host/system \ --firmware OVMF.sev.fd \ --tk this-guest-tk.bin \ --domain fedora34x86_64 \ --inject-secret 736869e5-84f0-4973-92ec-06879ce3da0b:passwd.txt libvirt libvirt . . --insecure . libvirt TIK/TEK . SEV : # virt-qemu-sev-validate \ --insecure \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV : # virt-qemu-sev-validate \ --insecure \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV-ES SMP : # virt-qemu-sev-validate \ --insecure \ --vmsa-cpu0 vmsa0.bin \ --vmsa-cpu1 vmsa1.bin \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV-ES SMP VMSA : # virt-qemu-sev-validate \ --insecure \ --tk this-guest-tk.bin \ --domain fedora34x86_64 SEV : # virt-qemu-sev-validate \ --insecure \ --tk this-guest-tk.bin \ --domain fedora34x86_64 \ --inject-secret 736869e5-84f0-4973-92ec-06879ce3da0b:passwd.txt (COMMON MISTAKES CHECKLIST) : ERROR: Measurement does not match, VM is not trustworthy . : o DH (session blob) XML libvirt. base64 sevctl session . base64 . o (policy) . XML libvirt sevctl session . QEMU : sev_launch_start: LAUNCH_START ret=1 fw_error=11 'Bad measurement' o TIK/TEK. TIK/TEK DH . TIK/TEK DH XML libvirt . . TIK TEK . o . . . . o initrd cmdline . initrd cmdline . . o . kernelHashes XML libvirt initrd cmdline . . (NOT) . o . (nonce) . . o VMSA / CPU SKU . VMSA . CPU SKU ( / family, model, stepping) . VMSA SKU . CPU SKU . o . VMSA SEV-ES . vCPU . . libvirt . libvirt ( VM ) . XML . --insecure . . TIK TEK libvirt . . TIK/TEK DH . --debug / (hex dump) . --debug . . . (EXIT STATUS) 0 . : o 1 - . o 2 - . o 3 - . --insecure . . o 4 - . (DoS) . --ignore-config XML . 1 . o 5 - . o 6 - . . (AUTHORS) Daniel P. Berrange (BUGS) . : 1. 2. / . (COPYRIGHT) Copyright (C) 2022 by Red Hat, Inc. (LICENSE) virt-qemu-sev-validate LGPL 2.1 . . . (SEE ALSO) virsh(1), SEV launch security usage , virt-qemu-sev-validate(1)