https://gitlab.com/redhat/centos-stream/src/edk2/-/merge_requests/10

QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass.

Test with edk2-ovmf-20220126gitbb1bba3d77-3.el9.noarch, no issue found.

Version:
edk2-ovmf-20220126gitbb1bba3d77-3.el9.noarch
qemu-kvm-6.2.0-9.el9.x86_64

Steps:
1.Install and boot a SEV-ES guest with kernel/initrd/cmdline:
/usr/libexec/qemu-kvm \
    -S  \
    -name 'avocado-vt-vm1'  \
    -sandbox off  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF.amdsev.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -machine q35,memory-backend=mem-machine_mem,usb=off,dump-guest-core=off,pflash0=drive_ovmf_code,confidential-guest-support=lsec0 \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -device i6300esb,bus=pcie-pci-bridge-0,addr=0x1 \
    -watchdog-action reset \
    -m 4096 \
    -overcommit mem-lock=off \
    -object memory-backend-ram,size=4096M,id=mem-machine_mem  \
    -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
    -cpu EPYC-Rome-v2 \
    -device intel-hda,bus=pcie-pci-bridge-0,addr=0x2 \
    -device hda-duplex \
    -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/monitor-qmpmonitor1-20220223-020517-TfyHVYuF,wait=off,id=qmp_id_qmpmonitor1  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/monitor-catch_monitor-20220223-020517-TfyHVYuF,wait=off,id=qmp_id_catch_monitor  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=idR8W21P \
    -chardev socket,server=on,path=/tmp/avocado_3rfztrjr/serial-serial0-20220223-020517-TfyHVYuF,wait=off,id=chardev_serial0 \
    -device isa-serial,id=serial0,chardev=chardev_serial0 \
    -object rng-random,filename=/dev/random,id=passthrough-NaKR2bm4 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device virtio-rng-pci,id=virtio-rng-pci-pzencDAW,rng=passthrough-NaKR2bm4,bus=pcie-root-port-1,addr=0x0  \
    -chardev socket,id=seabioslog_id_20220223-020517-TfyHVYuF,path=/tmp/avocado_3rfztrjr/seabios-20220223-020517-TfyHVYuF,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20220223-020517-TfyHVYuF,iobase=0x402 \
    -device ich9-usb-ehci1,id=usb1,addr=0x1d.0x7,multifunction=on,bus=pcie.0 \
    -device ich9-usb-uhci1,id=usb1.0,multifunction=on,masterbus=usb1.0,addr=0x1d.0x0,firstport=0,bus=pcie.0 \
    -device ich9-usb-uhci2,id=usb1.1,multifunction=on,masterbus=usb1.0,addr=0x1d.0x2,firstport=2,bus=pcie.0 \
    -device ich9-usb-uhci3,id=usb1.2,multifunction=on,masterbus=usb1.0,addr=0x1d.0x4,firstport=4,bus=pcie.0 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device qemu-xhci,id=usb2,bus=pcie-root-port-2,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb2.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-3,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-4,port=0x4,addr=0x1.0x4,bus=pcie.0,chassis=5 \
    -device virtio-net-pci,mac=9a:c7:44:50:9f:47,id=idNaFmKp,netdev=idkIZeZI,bus=pcie-root-port-4,addr=0x0  \
    -netdev tap,id=idkIZeZI,vhost=on \
    -blockdev node-name=file_cd1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/iso/linux/RHEL*-x86_64-dvd1.iso,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_cd1,driver=raw,read-only=on,cache.direct=on,cache.no-flush=off,file=file_cd1 \
-device scsi-cd,id=cd1,drive=drive_cd1,write-cache=on \
    -blockdev node-name=file_unattended,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64/ks.iso,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_unattended,driver=raw,read-only=on,cache.direct=on,cache.no-flush=off,file=file_unattended \
    -device scsi-cd,id=unattended,drive=drive_unattended,write-cache=on  \
    -kernel '/home/kvm_autotest_root/images/vmlinuz'  \
    -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg nicdelay=60 net.ifnames=0 biosdevname=0 console=ttyS0,115200'  \
    -initrd '/home/kvm_autotest_root/images/initrd.img'  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=d,strict=off  \
    -no-shutdown \
    -no-hpet \
    -enable-kvm \
    -monitor stdio \
    -object sev-guest,id=lsec0,cbitpos=47,reduced-phys-bits=1,policy=7,kernel-hashes=on \
    -device pcie-root-port,id=pcie-root-port-5,port=0x5,addr=0x1.0x5,bus=pcie.0,chassis=6 \
    -device virtio-balloon-pci,id=balloon0,bus=pcie-root-port-5,addr=0x0 \
    -device pcie-root-port,id=pcie_extra_root_port_0,multifunction=on,bus=pcie.0,addr=0x3,chassis=7

2. login in guest, check dmesg
# dmesg| grep -i sev
[    0.232868] AMD Memory Encryption Features active: SEV SEV-ES


Result:
Guest boots successfully and sev-es enabled.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: edk2), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2415