This can be reproduced only with OVMF_CODE.cc.fd +++ This bug was initially created as a clone of Bug #2114858 +++ Description of problem: Attempting to boot a Linux guest using OVMF and the isa-debugcon results in the guest kernel panicking during boot up. This doesn't happen if the Fedora OVMF binaries are replaced with those from RHEL-9, or those from qemu.git master This doesn't happen if isa-debugcon is removed. NB, I've only tested this with -kernel boot, not guest BIOS boot, so not sure if that's a factor or not. Version-Release number of selected component (if applicable): qemu-system-x86-6.2.0-12.fc36.x86_64 edk2-ovmf-20220526git16779ede2d36-3.fc36.noarch How reproducible: Always Steps to Reproduce: $ git clone https://gitlab.com/berrange/tiny-vm-tools $ cd tiny-vm-tools $ ./make-tiny-image.py --run date date tiny-initrd.img Copy lib /lib/ld-musl-x86_64.so.1 -> /tmp/make-tiny-imagebcuv8i_b/lib/ld-musl-x86_64.so.1 Copy bin /usr/bin/date -> /tmp/make-tiny-imagebcuv8i_b/bin/date Copy lib /lib64/libc.so.6 -> /tmp/make-tiny-imagebcuv8i_b/lib64/libc.so.6 Copy lib /lib64/ld-linux-x86-64.so.2 -> /tmp/make-tiny-imagebcuv8i_b/lib64/ld-linux-x86-64.so.2 $ cp /usr/share/edk2/ovmf/OVMF_VARS.fd vars.fd $ qemu-system-x86_64 \ -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF_CODE.fd,auto-read-only=on,discard=unmap \ -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \ -blockdev node-name=file_ovmf_vars,driver=file,filename=vars.fd,auto-read-only=on,discard=unmap \ -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \ -machine pc,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \ -kernel /boot/vmlinuz-5.18.5-200.fc36.x86_64 \ -initrd tiny-initrd.img \ -m 8000 \ -display none \ -nodefaults \ -serial stdio \ -accel kvm \ -append 'console=ttyS0 quiet' -chardev file,path=firmware.log,id=seabios \ -device isa-debugcon,iobase=0x402,chardev=seabios Actual results: [ 0.068331] BUG: unable to handle page fault for address: 000000000080b000 [ 0.068776] #PF: supervisor read access in kernel mode [ 0.068776] #PF: error_code(0x0000) - not-present page [ 0.068776] PGD 1001e9063 P4D 1001e9063 PUD 1001ff063 PMD 100200063 PTE 0 [ 0.068776] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.068776] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.5-200.fc36.x86_64 #1 [ 0.068776] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 [ 0.068776] RIP: 0010:0xfffffffeff8c3615 [ 0.068776] Code: 89 44 24 20 e8 2c 96 00 00 eb 08 ba f8 0c 00 00 89 d8 ef 48 83 c4 38 89 d8 5b 5d c3 55 48 89 e5 57 48 89 cf 56 53 48 83 ec 38 <80> 3c 25 00 b0 80 00 02 75 5b 4c 89 c3 49 8d 34 10 48 39 f3 74 5c [ 0.068776] RSP: 0000:ffffffff94e03970 EFLAGS: 00010282 [ 0.068776] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402 [ 0.068776] RDX: 0000000000000060 RSI: ffffffff94e03c00 RDI: 0000000000000402 [ 0.068776] RBP: ffffffff94e039c0 R08: ffffffff94e03a00 R09: 0000000000000002 [ 0.068776] R10: 0000000000000002 R11: 0000000000000000 R12: ffffffff94e03e90 [ 0.068776] R13: ffffffff9420b1c0 R14: 0000000000000007 R15: 0000000000000000 [ 0.068776] FS: 0000000000000000(0000) GS:ffff9eb16be00000(0000) knlGS:0000000000000000 [ 0.068776] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.068776] CR2: 000000000080b000 CR3: 0000000100222000 CR4: 00000000000006b0 [ 0.068776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 0.068776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 0.068776] Call Trace: [ 0.068776] <TASK> [ 0.068776] ? post_alloc_hook+0xc8/0x150 [ 0.068776] ? post_alloc_hook+0xc8/0x150 [ 0.068776] ? get_page_from_freelist+0x55c/0x1520 [ 0.068776] ? get_page_from_freelist+0x55c/0x1520 [ 0.068776] ? __change_page_attr_set_clr+0xd65/0xf90 [ 0.068776] ? native_flush_tlb_global+0x79/0x90 [ 0.068776] ? __flush_tlb_all+0x30/0x40 [ 0.068776] ? kernel_map_pages_in_pgd+0xc2/0xce [ 0.068776] ? __efi_call+0x25/0x30 [ 0.068776] ? virt_efi_set_variable_nonblocking+0xa5/0x120 [ 0.068776] ? efi_delete_dummy_variable+0x5c/0x80 [ 0.068776] ? efi_enter_virtual_mode+0x416/0x435 [ 0.068776] ? start_kernel+0x8cc/0x955 [ 0.068776] ? load_ucode_bsp+0x3a/0x100 [ 0.068776] ? secondary_startup_64_no_verify+0xd5/0xdb [ 0.068776] </TASK> [ 0.068776] Modules linked in: [ 0.068776] CR2: 000000000080b000 [ 0.068776] ---[ end trace 0000000000000000 ]--- [ 0.068776] RIP: 0010:0xfffffffeff8c3615 [ 0.068776] Code: 89 44 24 20 e8 2c 96 00 00 eb 08 ba f8 0c 00 00 89 d8 ef 48 83 c4 38 89 d8 5b 5d c3 55 48 89 e5 57 48 89 cf 56 53 48 83 ec 38 <80> 3c 25 00 b0 80 00 02 75 5b 4c 89 c3 49 8d 34 10 48 39 f3 74 5c [ 0.068776] RSP: 0000:ffffffff94e03970 EFLAGS: 00010282 [ 0.068776] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402 [ 0.068776] RDX: 0000000000000060 RSI: ffffffff94e03c00 RDI: 0000000000000402 [ 0.068776] RBP: ffffffff94e039c0 R08: ffffffff94e03a00 R09: 0000000000000002 [ 0.068776] R10: 0000000000000002 R11: 0000000000000000 R12: ffffffff94e03e90 [ 0.068776] R13: ffffffff9420b1c0 R14: 0000000000000007 R15: 0000000000000000 [ 0.068776] FS: 0000000000000000(0000) GS:ffff9eb16be00000(0000) knlGS:0000000000000000 [ 0.068776] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.068776] CR2: 000000000080b000 CR3: 0000000100222000 CR4: 00000000000006b0 [ 0.068776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 0.068776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 0.068776] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.068776] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- qemu-system-x86_64: terminating on signal 2 Expected results: Wed Aug 3 11:55:46 UTC 2022 [ 0.418779] reboot: Power down Additional info: --- Additional comment from Gerd Hoffmann on 2022-08-17 10:36:44 UTC --- Bisected. The winner is "OvmfPkg: enable DEBUG_VERBOSE (RHEL only)" (aka patch12 in spec file). The faulting address is 80b000 aka PcdOvmfWorkAreaBase. So given this needs isa-debugcon to trigger I suspect the following is happening: (1) linux kernel does a efi runtime call. (2) ovmf wants log a debug message (enabled by the patch above). (3) debugcon driver calls into iolib to send the characters. (4) iolib checks WorkArea to figure whenever it can just use io instructions or must call some tdx/sev helper function for io. (5) WorkArea has no runtime mapping -> BOOM. --- Additional comment from Gerd Hoffmann on 2022-08-17 11:07:52 UTC --- https://edk2.groups.io/g/devel/topic/ccprobelib_not_working_for/93078060
This can be only reproduced with OVMF_CODE.cc.fd and isa-debugcon in guest installation, but not hit this issue with OVMF.amdsev.fd and OVMF_CODE.secboot.fd. Version: edk2-ovmf-20220826gitba0e0e4c6a-2.el9.noarch kernel-5.14.0-200.el9.x86_64 qemu-kvm-7.1.0-5.el9.x86_64 Steps: /usr/libexec/qemu-kvm \ -S \ -name 'avocado-vt-vm1' \ -sandbox on \ -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF_CODE.cc.fd,auto-read-only=on,discard=unmap \ -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \ -blockdev node-name=file_ovmf_vars,driver=file,filename=/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel-64-virtio-scsi_qcow2_filesystem_VARS.fd,auto-read-only=on,discard=unmap \ -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \ -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \ -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \ -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0 \ -nodefaults \ -device VGA,bus=pcie.0,addr=0x2 \ -m 86016 \ -object '{"qom-type": "memory-backend-ram", "size": 90194313216, "id": "mem-machine_mem"}' \ -smp 48,maxcpus=48,cores=24,threads=1,dies=1,sockets=2 \ -cpu 'EPYC-Milan',+kvm_pv_unhalt \ -device pvpanic,ioport=0x505,id=idpeAyeF \ -chardev socket,wait=off,path=/var/tmp/avocado_7ubtbkdx/serial-serial0-20221128-232439-8mqszM3M,id=chardev_serial0,server=on \ -device isa-serial,id=serial0,chardev=chardev_serial0 \ -chardev socket,id=seabioslog_id_20221128-232439-8mqszM3M,path=/var/tmp/avocado_7ubtbkdx/seabios-20221128-232439-8mqszM3M,server=on,wait=off \ -device isa-debugcon,chardev=seabioslog_id_20221128-232439-8mqszM3M,iobase=0x402 \ -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \ -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \ -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \ -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \ -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}' \ -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel-64-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \ -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \ -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \ -device virtio-net-pci,mac=9a:43:0d:43:1a:43,id=idDIKLlz,netdev=idkXaye3,bus=pcie-root-port-3,addr=0x0 \ -netdev tap,id=idkXaye3,vhost=on,vhostfd=16,fd=9 \ -blockdev '{"node-name": "file_cd1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/iso/linux/RHEL-*-x86_64-dvd1.iso", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_cd1", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_cd1"}' \ -device '{"driver": "scsi-cd", "id": "cd1", "drive": "drive_cd1", "write-cache": "on"}' \ -blockdev '{"node-name": "file_unattended", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/ks.iso", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_unattended", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_unattended"}' \ -device '{"driver": "scsi-cd", "id": "unattended", "drive": "drive_unattended", "write-cache": "on"}' \ -kernel '/home/kvm_autotest_root/images/rhel9-64/vmlinuz' \ -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg net.ifnames=0 console=ttyS0,115200' \ -initrd '/home/kvm_autotest_root/images/rhel9-64/initrd.img' \ -vnc :0 \ -rtc base=utc,clock=host,driftfix=slew \ -boot menu=off,order=cdn,once=d,strict=off \ -no-shutdown \ -chardev socket,id=char_vtpm_avocado-vt-vm1_tpm0,path=/root/avocado/data/avocado-vt/swtpm/avocado-vt-vm1_tpm0_swtpm.sock \ -tpmdev emulator,chardev=char_vtpm_avocado-vt-vm1_tpm0,id=emulator_vtpm_avocado-vt-vm1_tpm0 \ -device tpm-crb,id=tpm-crb_vtpm_avocado-vt-vm1_tpm0,tpmdev=emulator_vtpm_avocado-vt-vm1_tpm0 \ -enable-kvm \ Result: Kernel crash [ 0.172206] #PF: supervisor read access in kernel mode [ 0.172269] #PF: error_code(0x0000) - not-present page [ 0.172269] PGD 1001d6063 P4D 1001d6063 PUD 1001f7063 PMD 100200063 PTE 800fffffff7f4060 [ 0.172269] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 0.172269] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.14.0-201.el9.x86_64 #1 [ 0.172269] Hardware name: Red Hat KVM/RHEL, BIOS 0.0.0 02/06/2015 [ 0.172269] RIP: 0010:0xfffffffeff4c3596 [ 0.172269] Code: d6 00 00 01 3c e9 0f 94 05 37 d6 00 00 8a 05 31 d6 00 00 48 83 c4 48 c3 8a 05 26 d6 00 00 c3 41 54 49 89 cc 56 53 48 83 ec 30 <80> 3c 25 00 b0 80 00 02 75 63 4c 89 c3 49 8d 34 10 48 39 f3 74 64 [ 0.172269] RSP: 0000:ffffffffade039d0 EFLAGS: 00010282 [ 0.172269] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402 [ 0.172269] RDX: 0000000000000060 RSI: ffffffffade03c50 RDI: 0000000000000001 [ 0.172269] RBP: ffffffffade03ed0 R08: ffffffffade03a50 R09: 0000000000000000 [ 0.172269] R10: fffffffeff4ccbbe R11: 0000000000000002 R12: 0000000000000402 [ 0.172269] R13: ffffffffade03cb0 R14: 0000000000000007 R15: 0000000000000000 [ 0.172269] FS: 0000000000000000(0000) GS:ffff8ad86b200000(0000) knlGS:0000000000000000 [ 0.172269] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.172269] CR2: 000000000080b000 CR3: 00000001001d4002 CR4: 00000000000606b0 [ 0.172269] Call Trace: [ 0.172269] <TASK> [ 0.172269] ? rmqueue_bulk+0x33d/0x980 [ 0.172269] ? rmqueue+0x440/0xd80 [ 0.172269] ? rmqueue+0x440/0xd80 [ 0.172269] ? rmqueue+0x440/0xd80 [ 0.172269] ? _raw_spin_unlock+0xc/0x30 [ 0.172269] ? __change_page_attr_set_clr+0x5a/0xb0 [ 0.172269] ? __flush_tlb_all+0x18/0x30 [ 0.172269] ? kernel_map_pages_in_pgd+0xd5/0xf9 [ 0.172269] ? __efi_call+0x25/0x30 [ 0.172269] ? virt_efi_set_variable_nonblocking.part.0+0x8b/0xf0 [ 0.172269] ? efi_delete_dummy_variable+0x5c/0x80 [ 0.172269] ? __efi_enter_virtual_mode+0x1c1/0x1e8 [ 0.172269] ? efi_enter_virtual_mode+0x110/0x11b [ 0.172269] ? start_kernel+0x426/0x4c0 [ 0.172269] ? secondary_startup_64_no_verify+0xd6/0xdb [ 0.172269] </TASK> [ 0.172269] Modules linked in: [ 0.172269] CR2: 000000000080b000 [ 0.172269] ---[ end trace bef6c92b0eb0d797 ]--- [ 0.172269] RIP: 0010:0xfffffffeff4c3596 [ 0.172269] Code: d6 00 00 01 3c e9 0f 94 05 37 d6 00 00 8a 05 31 d6 00 00 48 83 c4 48 c3 8a 05 26 d6 00 00 c3 41 54 49 89 cc 56 53 48 83 ec 30 <80> 3c 25 00 b0 80 00 02 75 63 4c 89 c3 49 8d 34 10 48 39 f3 74 64 [ 0.172269] RSP: 0000:ffffffffade039d0 EFLAGS: 00010282 [ 0.172269] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402 [ 0.172269] RDX: 0000000000000060 RSI: ffffffffade03c50 RDI: 0000000000000001 [ 0.172269] RBP: ffffffffade03ed0 R08: ffffffffade03a50 R09: 0000000000000000 [ 0.172269] R10: fffffffeff4ccbbe R11: 0000000000000002 R12: 0000000000000402 [ 0.172269] R13: ffffffffade03cb0 R14: 0000000000000007 R15: 0000000000000000 [ 0.172269] FS: 0000000000000000(0000) GS:ffff8ad86b200000(0000) knlGS:0000000000000000 [ 0.172269] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.172269] CR2: 000000000080b000 CR3: 00000001001d4002 CR4: 00000000000606b0 [ 0.172269] Kernel panic - not syncing: Fatal exception [ 0.172269] ---[ end Kernel panic - not syncing: Fatal exception ]---
fixed upstream, rebase to 2022-11 should bring us the fix, please retest once we have test builds.
https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=1685612
(In reply to Gerd Hoffmann from comment #3) > fixed upstream, rebase to 2022-11 should bring us the fix, please retest > once we have test builds. Can you re-test latest rhel-9.2 version?
Verified with edk2-ovmf-20221207gitfff6d81270b5-7.el9.noarch no issue found Version: edk2-ovmf-20221207gitfff6d81270b5-7.el9.noarch qemu-kvm-7.2.0-10.el9.x86_64 kernel-5.14.0-283.el9.x86_64 Steps: 1. Install a sev-es guest with OVMF_CODE.cc.fd and isa-debugcon /usr/libexec/qemu-kvm \ -S \ -name 'avocado-vt-vm1' \ -sandbox on \ -object {"qom-type":"sev-guest","id":"lsec0","cbitpos":51,"reduced-phys-bits":1,"policy":3} -blockdev '{"node-name": "file_ovmf_code", "driver": "file", "filename": "/usr/share/edk2/ovmf/OVMF_CODE.cc.fd", "auto-read-only": true, "discard": "unmap"}' \ -blockdev '{"node-name": "drive_ovmf_code", "driver": "raw", "read-only": true, "file": "file_ovmf_code"}' \ -blockdev '{"node-name": "file_ovmf_vars", "driver": "file", "filename": "/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel920-64-virtio-scsi_qcow2_filesystem_VARS.fd", "auto-read-only": true, "discard": "unmap"}' \ -blockdev '{"node-name": "drive_ovmf_vars", "driver": "raw", "read-only": false, "file": "file_ovmf_vars"}' \ -machine q35,memory-backend=mem-machine_mem,confidential-guest-support=lsec0,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \ -device '{"id": "pcie-root-port-0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x1", "chassis": 1}' \ -device '{"id": "pcie-pci-bridge-0", "driver": "pcie-pci-bridge", "addr": "0x0", "bus": "pcie-root-port-0"}' \ -nodefaults \ -device '{"driver": "VGA", "bus": "pcie.0", "addr": "0x2"}' \ -m 30720 \ -object '{"size": 32212254720, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}' \ -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2 \ -cpu 'EPYC-Milan',+kvm_pv_unhalt \ -chardev socket,path=/var/tmp/avocado_hu8qri_u/monitor-qmpmonitor1-20230302-040448-YDhfGYL9,server=on,wait=off,id=qmp_id_qmpmonitor1 \ -mon chardev=qmp_id_qmpmonitor1,mode=control \ -chardev socket,path=/var/tmp/avocado_hu8qri_u/monitor-catch_monitor-20230302-040448-YDhfGYL9,server=on,wait=off,id=qmp_id_catch_monitor \ -mon chardev=qmp_id_catch_monitor,mode=control \ -device '{"ioport": 1285, "driver": "pvpanic", "id": "id7YjUxf"}' \ -chardev socket,path=/var/tmp/avocado_hu8qri_u/serial-serial0-20230302-040448-YDhfGYL9,server=on,wait=off,id=chardev_serial0 \ -device '{"id": "serial0", "driver": "isa-serial", "chardev": "chardev_serial0"}' \ -chardev socket,id=seabioslog_id_20230302-040448-YDhfGYL9,path=/var/tmp/avocado_hu8qri_u/seabios-20230302-040448-YDhfGYL9,server=on,wait=off \ -device isa-debugcon,chardev=seabioslog_id_20230302-040448-YDhfGYL9,iobase=0x402 \ -device '{"id": "pcie-root-port-1", "port": 1, "driver": "pcie-root-port", "addr": "0x1.0x1", "bus": "pcie.0", "chassis": 2}' \ -device '{"driver": "qemu-xhci", "id": "usb1", "bus": "pcie-root-port-1", "addr": "0x0"}' \ -device '{"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}' \ -device '{"id": "pcie-root-port-2", "port": 2, "driver": "pcie-root-port", "addr": "0x1.0x2", "bus": "pcie.0", "chassis": 3}' \ -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}' \ -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel920-64-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \ -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \ -device '{"id": "pcie-root-port-3", "port": 3, "driver": "pcie-root-port", "addr": "0x1.0x3", "bus": "pcie.0", "chassis": 4}' \ -device '{"driver": "virtio-net-pci", "mac": "9a:15:db:cf:1c:32", "id": "idflg8Rb", "netdev": "idw1Nppf", "bus": "pcie-root-port-3", "addr": "0x0"}' \ -netdev tap,id=idw1Nppf,vhost=on,vhostfd=16,fd=12 \ -blockdev '{"node-name": "file_cd1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/iso/linux/RHEL-9.2.0-20230220.9-x86_64-dvd1.iso", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_cd1", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_cd1"}' \ -device '{"driver": "scsi-cd", "id": "cd1", "drive": "drive_cd1", "write-cache": "on"}' \ -blockdev '{"node-name": "file_unattended", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel920-64/ks.iso", "cache": {"direct": true, "no-flush": false}}' \ -blockdev '{"node-name": "drive_unattended", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_unattended"}' \ -device '{"driver": "scsi-cd", "id": "unattended", "drive": "drive_unattended", "write-cache": "on"}' \ -kernel '/home/kvm_autotest_root/images/rhel920-64/vmlinuz' \ -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg net.ifnames=0 console=ttyS0,115200' \ -initrd '/home/kvm_autotest_root/images/rhel920-64/initrd.img' \ -vnc :0 \ -rtc base=utc,clock=host,driftfix=slew \ -boot menu=off,order=cdn,once=d,strict=off \ -no-shutdown \ -chardev socket,id=char_vtpm_avocado-vt-vm1_tpm0,path=/root/avocado/data/avocado-vt/swtpm/avocado-vt-vm1_tpm0_swtpm.sock \ -tpmdev emulator,chardev=char_vtpm_avocado-vt-vm1_tpm0,id=emulator_vtpm_avocado-vt-vm1_tpm0 \ -device '{"id": "tpm-crb_vtpm_avocado-vt-vm1_tpm0", "tpmdev": "emulator_vtpm_avocado-vt-vm1_tpm0", "driver": "tpm-crb"}' \ -enable-kvm \ Result: Install and boot guest, no issue found.