Hello,

I'm new to libvirt. I have tried to launch a sev vm with secret injection recently, and I found the command domsetlaunchsecstate is what I need. But I had some problem to make it work. Here is what I did to use this command.

1. run command: virsh create sev-guest.xml

2. create secret header file and secret file.

3. run command: virsh domsetlaunchsecstate sev-guest-1 --secrethdr <hdr-filename> --secret <secret-filename> .

But it will report this error: SEV: not in correct state.

I think it is because the vm is not in a paused state. So how can I launch a sev vm which is in a paused state? How should I revise my xml file?

The sev-guest.xml I use is as follows:

  <name>sev-guest-1</name>
  <uuid>d50a4205-40e0-4482-b0dc-f26bb4a1a9ff</uuid>
  <metadata>
    <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
      <libosinfo:os id="http://ubuntu.com/ubuntu/16.04"/>
    </libosinfo:libosinfo>
  </metadata>
  <memory>4194304</memory>
  <currentMemory>4194304</currentMemory>
  <memtune>
    <hard_limit>4563402</hard_limit>
  </memtune>
  <vcpu>32</vcpu>
  <cpu mode='custom' match='exact' check='partial'>
     <model fallback='forbid'>EPYC</model>
  </cpu>
  <os>
    <type arch="x86_64" machine="q35">hvm</type>
    <loader readonly="yes" type="pflash">/data01/OVMF.fd</loader>
    <nvram template="/data01/OVMF.fd">/var/lib/libvirt/qemu/nvram/sev-guest-1_VARS.fd</nvram>
    <boot dev="hd"/>
  </os>
  
  <features>
    <acpi/>
    <apic/>
  </features>
  <clock offset="utc">
    <timer name="rtc" tickpolicy="catchup"/>
    <timer name="pit" tickpolicy="delay"/>
    <timer name="hpet" present="no"/>
  </clock>
  <pm>
    <suspend-to-mem enabled="no"/>
    <suspend-to-disk enabled="no"/>
  </pm>
  <devices>
    <emulator>/usr/local/bin/qemu-system-x86_64</emulator>
    <disk type="file" device="disk">
      <driver name="qemu" type="qcow2"/>
      <source file="/data01/AMDSEV/sev-guest-1.qcow2"/>
      <target dev="sda" bus="scsi"/>
    </disk>
    <controller type="scsi" index="0" model="virtio-scsi">
      <driver iommu="on"/>
    </controller>
    <controller type="virtio-serial" index="0">
      <driver iommu="on"/>
    </controller>
    <controller type="usb" index="0" model="ich9-ehci1"/>
    <controller type="usb" index="0" model="ich9-uhci1">
      <master startport="0"/>
    </controller>
    <controller type="usb" index="0" model="ich9-uhci2">
      <master startport="2"/>
    </controller>
    <controller type="usb" index="0" model="ich9-uhci3">
      <master startport="4"/>
    </controller>
    <controller type='pci' index='1' model='pcie-root-port'>
      <model name='pcie-root-port'/>
      <target chassis='1' port='0x8'/>
      <alias name='pci.1'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
    </controller>
    <controller type='pci' index='2' model='pcie-root-port'>
      <model name='pcie-root-port'/>
      <target chassis='2' port='0x9'/>
      <alias name='pci.2'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
    </controller>
    <controller type='pci' index='3' model='pcie-root-port'>
      <model name='pcie-root-port'/>
      <target chassis='3' port='0xa'/>
      <alias name='pci.3'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
    </controller>
    <controller type='pci' index='4' model='pcie-root-port'>
      <model name='pcie-root-port'/>
      <target chassis='4' port='0xb'/>
      <alias name='pci.4'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
    </controller>
    <console type="pty"/>
    <input type="tablet" bus="usb"/>
    <graphics type="vnc" port="-1" listen="127.0.0.1"/>
    <video>
      <model type="vga"/>
      <address type='pci' slot='0x07'/>
    </video>
    <memballoon model="virtio">
      <driver iommu="on"/>
    </memballoon>
  </devices>
  <launchSecurity type="sev">
    <cbitpos>51</cbitpos>
    <reducedPhysBits>1</reducedPhysBits>
    <policy>0x05</policy>
    <dhCert>XXXXXXXXX</dhCert>
    <session>XXXXXXXXXXXXXXXXx</session>
  </launchSecurity>
</domain>

Thank you in advance,
Peixuan