Bug 2041755
| Summary: | Mark SEV launch secret area as reserved | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Gerd Hoffmann <kraxel> |
| Component: | edk2 | Assignee: | Paweł Poławski <ppolawsk> |
| Status: | CLOSED ERRATA | QA Contact: | zixchen |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | CentOS Stream | CC: | berrange, bstinson, coli, jinzhao, juzhang, jwboyer, kkiwi, kraxel, mrezanin, pbonzini, ppolawsk, redhat-bugzilla, virt-maint, xuwei, ymankad, zixchen |
| Target Milestone: | rc | Keywords: | RFE, Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | edk2-20220126gitbb1bba3d77-3.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-17 12:53:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2018388 | ||
| Bug Blocks: | 2041754, 2112307 | ||
Pawel, we need this patch added to the package. As discussed in our meeting, this goes logically after the rebase is done, so I'll assign it to you as something to complement the work after the rebase is done. Thanks Should this backport be performed on top of latest rebase? This way I can close this BZ as a part of rebase. Moving Severity to Medium, as I believe it reflects better the impacts of potentially not having it on RHEL 9.0.0 QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass. According to https://bugzilla.redhat.com/show_bug.cgi?id=1985468#c12, verify this issue with the same steps of Bug 2054661 - RFE: Support measured AMD SEV boot with kernel/initrd/cmdline in OVMF. # rpm -q --changelog edk2-ovmf-20220126gitbb1bba3d77-3.el9.noarch.rpm| grep -i "Mark SEV launch secret area as reserved" (Mark SEV launch secret area as reserved) Test with edk2-ovmf-20220126gitbb1bba3d77-3.el9.noarch, no issue found. Version: edk2-ovmf-20220126gitbb1bba3d77-3.el9.noarch qemu-kvm-6.2.0-9.el9.x86_64 Steps: 1.Install and boot a SEV-ES guest with kernel/initrd/cmdline: /usr/libexec/qemu-kvm \ -S \ -name 'avocado-vt-vm1' \ -sandbox off \ -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF.amdsev.fd,auto-read-only=on,discard=unmap \ -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \ -machine q35,memory-backend=mem-machine_mem,usb=off,dump-guest-core=off,pflash0=drive_ovmf_code,confidential-guest-support=lsec0 \ -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \ -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0 \ -nodefaults \ -device VGA,bus=pcie.0,addr=0x2 \ -device i6300esb,bus=pcie-pci-bridge-0,addr=0x1 \ -watchdog-action reset \ -m 4096 \ -overcommit mem-lock=off \ -object memory-backend-ram,size=4096M,id=mem-machine_mem \ -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2 \ -cpu EPYC-Rome-v2 \ -device intel-hda,bus=pcie-pci-bridge-0,addr=0x2 \ -device hda-duplex \ -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/monitor-qmpmonitor1-20220223-020517-TfyHVYuF,wait=off,id=qmp_id_qmpmonitor1 \ -mon chardev=qmp_id_qmpmonitor1,mode=control \ -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/monitor-catch_monitor-20220223-020517-TfyHVYuF,wait=off,id=qmp_id_catch_monitor \ -mon chardev=qmp_id_catch_monitor,mode=control \ -device pvpanic,ioport=0x505,id=idR8W21P \ -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/serial-serial0-20220223-020517-TfyHVYuF,wait=off,id=chardev_serial0 \ -device isa-serial,id=serial0,chardev=chardev_serial0 \ -object rng-random,filename=/dev/random,id=passthrough-NaKR2bm4 \ -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \ -device virtio-rng-pci,id=virtio-rng-pci-pzencDAW,rng=passthrough-NaKR2bm4,bus=pcie-root-port-1,addr=0x0 \ -chardev socket,id=seabioslog_id_20220223-020517-TfyHVYuF,path=/tmp/avocado_3rfztrjr/seabios-20220223-020517-TfyHVYuF,server=on,wait=off \ -device isa-debugcon,chardev=seabioslog_id_20220223-020517-TfyHVYuF,iobase=0x402 \ -device ich9-usb-ehci1,id=usb1,addr=0x1d.0x7,multifunction=on,bus=pcie.0 \ -device ich9-usb-uhci1,id=usb1.0,multifunction=on,masterbus=usb1.0,addr=0x1d.0x0,firstport=0,bus=pcie.0 \ -device ich9-usb-uhci2,id=usb1.1,multifunction=on,masterbus=usb1.0,addr=0x1d.0x2,firstport=2,bus=pcie.0 \ -device ich9-usb-uhci3,id=usb1.2,multifunction=on,masterbus=usb1.0,addr=0x1d.0x4,firstport=4,bus=pcie.0 \ -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \ -device qemu-xhci,id=usb2,bus=pcie-root-port-2,addr=0x0 \ -device usb-tablet,id=usb-tablet1,bus=usb2.0,port=1 \ -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \ -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-3,addr=0x0 \ -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \ -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \ -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \ -device pcie-root-port,id=pcie-root-port-4,port=0x4,addr=0x1.0x4,bus=pcie.0,chassis=5 \ -device virtio-net-pci,mac=9a:c7:44:50:9f:47,id=idNaFmKp,netdev=idkIZeZI,bus=pcie-root-port-4,addr=0x0 \ -netdev tap,id=idkIZeZI,vhost=on \ -blockdev node-name=file_cd1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/iso/linux/RHEL*-x86_64-dvd1.iso,cache.direct=on,cache.no-flush=off \ -blockdev node-name=drive_cd1,driver=raw,read-only=on,cache.direct=on,cache.no-flush=off,file=file_cd1 \ -device scsi-cd,id=cd1,drive=drive_cd1,write-cache=on \ -blockdev node-name=file_unattended,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64/ks.iso,cache.direct=on,cache.no-flush=off \ -blockdev node-name=drive_unattended,driver=raw,read-only=on,cache.direct=on,cache.no-flush=off,file=file_unattended \ -device scsi-cd,id=unattended,drive=drive_unattended,write-cache=on \ -kernel '/home/kvm_autotest_root/images/vmlinuz' \ -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg nicdelay=60 net.ifnames=0 biosdevname=0 console=ttyS0,115200' \ -initrd '/home/kvm_autotest_root/images/initrd.img' \ -vnc :0 \ -rtc base=utc,clock=host,driftfix=slew \ -boot menu=off,order=cdn,once=d,strict=off \ -no-shutdown \ -no-hpet \ -enable-kvm \ -monitor stdio \ -object sev-guest,id=lsec0,cbitpos=47,reduced-phys-bits=1,policy=7,kernel-hashes=on \ -device pcie-root-port,id=pcie-root-port-5,port=0x5,addr=0x1.0x5,bus=pcie.0,chassis=6 \ -device virtio-balloon-pci,id=balloon0,bus=pcie-root-port-5,addr=0x0 \ -device pcie-root-port,id=pcie_extra_root_port_0,multifunction=on,bus=pcie.0,addr=0x3,chassis=7 2. login in guest, check dmesg # dmesg| grep -i sev [ 0.232868] AMD Memory Encryption Features active: SEV SEV-ES Result: Guest boots successfully and sev-es enabled. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: edk2), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2415 |
backport needed: commit 079a58276b98dc97ca363e3bc8b35cc7baa56d76 Author: Dov Murik <dovmurik.com> Date: Tue Jan 4 15:16:40 2022 +0800 OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret area as reserved Mark the SEV launch secret MEMFD area as reserved, which will allow the guest OS to use it during the lifetime of the OS, without creating copies of the sensitive content.