How to use OVMF with AMDSEV and Secure Boot

[nandogmarques]

Hello, I was trying to use a VM with AMD SEV-SNP and Secure Boot for my research. For some reason the OVMF fails when I try to start the VM returning this error:

PlatformAddHobCB: Reserved [0xFEFFC000, 0xFF000000)
Reserved variable store memory: 0x7FDFC000; size: 528kb
error: kvm run failed Invalid argument
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=00000000 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 00000000 00000000
CS =0000 00000000 00000000 00000000
SS =0000 00000000 00000000 00000000
DS =0000 00000000 00000000 00000000
FS =0000 00000000 00000000 00000000
GS =0000 00000000 00000000 00000000
LDT=0000 00000000 00000000 00000000
TR =0000 00000000 00000000 00000000
GDT=     00000000 00000000
IDT=     00000000 00000000
CR0=80000033 CR2=00000000 CR3=00000000 CR4=00000668
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000100
Code=<??> ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

This was the ovmf build command

build -q --cmd-len=64436 -DDEBUG_ON_SERIAL_PORT=TRUE -DSECURE_BOOT_ENABLE=TRUE -n $(getconf _NPROCESSORS_ONLN) -t GCC5 -a X64 -p OvmfPkg/OvmfPkgX64.dsc

[jingyao-zhang]

Hi, GALSANTA,
Have you resolved?

[nandogmarques]

Hello, Jingyao Zhang.
I haven't tested it anymore. Our team decided to focus on other ways to ensure root security through the AMD SEV-SNP. We recently decided to get back to working on the secure boot topic, when I have news I'll post it here.

[jingyao-zhang]

Thanks, GALSANTA!