snphost config set leads to FirmwareError(KnownSevError(InvalidParam))

[tianyishan]

Hi
My snphost version is 0.6.1
My snphost ok had two failure cases.

sudo snphost ok
...
[ FAIL ]         - Alias check
....
[ FAIL ] - Comparing TCB values: The TCB versions did NOT match 

 Platform TCB version: TCB Version:
  Microcode:   213
  SNP:         24
  TEE:         0
  Boot Loader: 2
  FMC:         None 
 Reported TCB version: TCB Version:
  Microcode:   213
  SNP:         23
  TEE:         0
  Boot Loader: 2
  FMC:         None
ERROR: One or more tests in snphost ok reported a failure
Error: One or more tests in snphost ok reported a failure

I was trying to update the reported TCB version using snphost config set. However, I ran into the following issues.

sudo snphost config set 2 0 24 213 0
ERROR: Error setting a new snp config
Error: Error setting a new snp config
Caused by:
   FirmwareError(KnownSevError(InvalidParam))

I made sure that no guests are running right now.
What does FirmwareError(KnownSevError(InvalidParam)) mean?

Thank you.

[DGonzalezVillal]

Noted. I think the config command is having an error, we forgot to give it the TCB versioning update, so we need to get it fixed. I'll start working on that now.

On the other hand for your particular problem, have you attempted a system-reboot? What about a firmware update? Those two things might help you get the TCBs matching again. From seeing the alias check failing, I can tell your SEV fw could be updated.

[tianyishan]

Thank you for replying.

I tried rebooting, and I think my firmware is up to date.

sudo dmesg | grep SEV
[ 0.000000] SEV-SNP: RMP table physical range [0x0000000016000000 - 0x00000000568fffff]
[ 0.005656] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x0000000056800000]
[ 14.771709] ccp 0000:22:00.1: SEV firmware update successful
[ 18.056920] ccp 0000:22:00.1: SEV API:1.55 build:29
[ 18.056941] ccp 0000:22:00.1: SEV-SNP API:1.55 build:29
[ 18.067180] kvm_amd: SEV enabled (ASIDs 16 - 509)
[ 18.067182] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)
[ 18.067183] kvm_amd: SEV-SNP enabled (ASIDs 1 - 15)

https://www.amd.com/en/developer/sev.html

Based on the official link, I found the newest firmware to be 1.55.29, which aligns with my firmware version.

Do you mean a different firmware?
Is there any other way to match it?
Thank you!

[DGonzalezVillal]

That is the latest firmware correct. So I don't think that is necessarily the issue.

Did you try running config reset?

[DGonzalezVillal]

Hi @tianyishan,

There was an issue in how the library was parsing TCB values, which has now been addressed in this PR: virtee/sev#314.

We still need to update the tool to use the latest version of the library, but once that’s done, you should be able to update your config as expected.

The reset subcommand was also not working properly, so I submitted a PR to address that as well: #129.

Just a quick note: reset should be used to bring your reported_tcb back in line with your committed_tcb.

Also, config set will only work if the value you're trying to set is less than or equal to the CommittedTcb. Otherwise, the firmware will return an INVALID_PARAM error.

Let me know if you run into any other issues.

[tylerfanelli]

@tianyishan Can you confirm the issue was fixed by the change in the PR? If not, please re-open this issue.