Re: Qeustion about how to use domsetlaunchsecstate command correctly.

On Fri, Oct 14, 2022 at 11:11:08AM +0800, 贺培轩 wrote: Just pass the --paused flag, eg $ virsh create --paused sev-guest.xml Note, that before injecting sectrets to the guest, you would want to perform an attestation to validate the boot measurement is what is expected. https://listman.redhat.com/archives/libvir-list/2022-October/234729.html The next release of libvirt is likley to include a script which handles the attestation and can inject a secret when it succeeds: https://gitlab.com/berrange/libvirt/-/blob/lgtm-vm/tools/virt-qemu-sev-va... See docs showing usage here: https://gitlab.com/berrange/libvirt/-/blob/lgtm-vm/docs/manpages/virt-qem... This script is hardcoded to inject a LUKS disk secret, as defined by the OVMF amdsev build flavour. I'm curious what kind of secret you are wanting to inject, and whether our tool needs extending to cope with other secrets besides the disk. For use with SEV, if you want to perform attestation prior to injecting a disk secret, then use of a stateless firmware (ie no NVRAM) is strongly recommended, otherwise the NVRAM can be used to undermine the integrity of the guest from a malicious host. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|