SEV: Failed to query the attestation report length ret=-22 fw_err=0 ()

[Alexander Lindner]

Hello everyone,

I'm trying to attest my SEV VM, but it fails. I started the VM with this snippet:

  <launchSecurity type="sev">

    <cbitpos>47</cbitpos>

    <reducedPhysBits>1</reducedPhysBits>

    <policy>0x0003</policy>

  </launchSecurity>

When I try to utilize qmp, it fails with a generic message:

echo '{ "execute": "qmp_capabilities" }\n{"execute":"query-sev-attestation-report","arguments":{"mnonce":"ZBaOEOsVmenc5q34VJb9jw=="}}' | socat - tcp:192.168.123.1:4444 | tail -1 | jq
{
 "error": {
   "class": "GenericError",

   "desc": "SEV: Failed to query the attestation report length ret=-22 fw_err=0 ()"

 }
}

No syslog or similar logs are written. Can someone give me a hint what went wrong?

Some other information:

echo '{ "execute": "qmp_capabilities" }\n{ "execute": "query-sev" }' | socat - tcp:192.168.123.1:4444 | tail -1 | jq                                                                   
{
 "return": {
   "enabled": true,
   "api-minor": 22,
   "handle": 1,
   "state": "running",
   "api-major": 0,
   "build-id": 11,
   "policy": 3
 }
}

Inside the host:

dmesg | grep SEV

[    0.160174] AMD Secure Encrypted Virtualization (SEV) active

Regards
Alex