Bug 1977580
| Summary: | [svvp] job "Hardware Security Testability Interface Test" failed on Win2022 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | menli <menli> |
| Component: | qemu-kvm | Assignee: | Marek Kedzierski <mkedzier> |
| qemu-kvm sub component: | General | QA Contact: | dehanmeng <demeng> |
| Status: | CLOSED WONTFIX | Docs Contact: | |
| Severity: | medium | ||
| Priority: | high | CC: | ailan, demeng, leidwang, lijin, mkedzier, qizhu, virt-maint, xiagao |
| Version: | unspecified | Keywords: | Triaged |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Windows | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-04-12 07:41:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1968315, 2057757 | ||
|
Description
menli@redhat.com
2021-06-30 06:33:55 UTC
Assigned to Meirav for initial triage per bz process and age of bug created or assigned to virt-maint without triage. Secure Boot should be enabled before starting the test.
However, even with Secure Boot enabled test doesn't pass.
The analysis:
HLK calls function GetHstiBlob. This function calls NtQuerySystemInformation in the following way:
NTSTATUS status = NtQuerySystemInformation(0xA6,
NULL,
0,
&hstiBlobSize);
NtQuerySystemInformation is called with with undocumented class 0xA6 which is described as
'SystemHardwareSecurityTestInterfaceResultsInformation'
NtQuerySystemInformation for 0xA6 class calls undocumented kernel function SeQueryHSTIResults, which
returns status 0xc0000004. It causes the test failure.
Interestingly, the call fails but hstiBlobSize is set correctly.
So test can be fixed by Microsoft in the following way:
ULONG hstiBlobSize = 0;
NTSTATUS status = NtQuerySystemInformation(0xA6,
NULL,
0,
&hstiBlobSize);
// Ignore the status (0xc0000004) and if hstiBlobSize is greater
// then zero execute NtQuerySystemInformation again to obtain
// the blob
if (hstiBlobSize != 0)
{
hstiBuffer = new BYTE[hstiBlobSize];
status = NtQuerySystemInformation(0xa6,
hstiBuffer,
hstiBlobSize,
NULL);
if (NT_SUCCESS(status))
{
printf("HSTI blob obtained! \n");
}
else
{
printf("HSTI blob not obtained, error [0x%x] \n", status);
}
<skipped the rest of the code>
There are, of course, other methods for fixing the test.
Setting Triaged flag and leaving on the backlog (assigned to virt-maint) as it appears some level of triage has been done. Unclear from Marek's comment whether a retest with Secure Boot enabled is desired Still hit this issue on the official ws2022 guest. guest version: windows server 2022 datacenter(10.0.20344 Build 20344) virtio-win-1.9.18-2.el8.iso Bulk update: Move RHEL-AV bugs to RHEL9. If necessary to resolve in RHEL8, then clone to the current RHEL8 release. Passed this case after running it with Marek's OVMF.fd files. Update result here as tracker. thanks Marek for your time and efforts. thanks all. |