Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2149251

Summary: Guest OS kernel crashes when isa-debugcon is enabled wIth OVMF_CODE.cc.fd
Product: Red Hat Enterprise Linux 9 Reporter: zixchen
Component: edk2Assignee: Gerd Hoffmann <kraxel>
Status: CLOSED CURRENTRELEASE QA Contact: zixchen
Severity: medium Docs Contact:
Priority: medium    
Version: 9.2CC: berrange, crobinso, jinzhao, kraxel, pbonzini, philmd, vgoyal, virt-maint, virt-maint, xuwei, zhguo
Target Milestone: rcKeywords: TestOnly, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: edk2-ovmf-20221207gitfff6d81270b5-7.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2114858 Environment:
Last Closed: 2023-11-27 02:16:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2114858    
Bug Blocks:    

Description zixchen 2022-11-29 10:35:30 UTC 
This can be reproduced only with OVMF_CODE.cc.fd

+++ This bug was initially created as a clone of Bug #2114858 +++

Description of problem:

Attempting to boot a Linux guest using OVMF and the isa-debugcon results in the guest kernel panicking during boot up.

This doesn't happen if the Fedora OVMF binaries are replaced with those from RHEL-9, or those from qemu.git master

This doesn't happen if isa-debugcon is removed.

NB, I've only tested this with -kernel boot, not guest BIOS boot, so not sure if that's a factor or not.


Version-Release number of selected component (if applicable):
qemu-system-x86-6.2.0-12.fc36.x86_64
edk2-ovmf-20220526git16779ede2d36-3.fc36.noarch


How reproducible:
Always

Steps to Reproduce:
 $ git clone https://gitlab.com/berrange/tiny-vm-tools
 $ cd tiny-vm-tools
 $ ./make-tiny-image.py --run date date
 tiny-initrd.img
 Copy lib /lib/ld-musl-x86_64.so.1 -> /tmp/make-tiny-imagebcuv8i_b/lib/ld-musl-x86_64.so.1
 Copy bin /usr/bin/date -> /tmp/make-tiny-imagebcuv8i_b/bin/date
 Copy lib /lib64/libc.so.6 -> /tmp/make-tiny-imagebcuv8i_b/lib64/libc.so.6
 Copy lib /lib64/ld-linux-x86-64.so.2 -> /tmp/make-tiny-imagebcuv8i_b/lib64/ld-linux-x86-64.so.2

 $ cp /usr/share/edk2/ovmf/OVMF_VARS.fd vars.fd

 $ qemu-system-x86_64 \
   -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF_CODE.fd,auto-read-only=on,discard=unmap \
   -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
   -blockdev node-name=file_ovmf_vars,driver=file,filename=vars.fd,auto-read-only=on,discard=unmap \
   -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars  \
   -machine pc,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
   -kernel /boot/vmlinuz-5.18.5-200.fc36.x86_64 \
   -initrd tiny-initrd.img \
   -m 8000 \
   -display none \
   -nodefaults \
   -serial stdio \
   -accel kvm \
   -append 'console=ttyS0 quiet'
   -chardev file,path=firmware.log,id=seabios \
   -device isa-debugcon,iobase=0x402,chardev=seabios 


Actual results:
[    0.068331] BUG: unable to handle page fault for address: 000000000080b000
[    0.068776] #PF: supervisor read access in kernel mode
[    0.068776] #PF: error_code(0x0000) - not-present page
[    0.068776] PGD 1001e9063 P4D 1001e9063 PUD 1001ff063 PMD 100200063 PTE 0
[    0.068776] Oops: 0000 [#1] PREEMPT SMP PTI
[    0.068776] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.5-200.fc36.x86_64 #1
[    0.068776] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
[    0.068776] RIP: 0010:0xfffffffeff8c3615
[    0.068776] Code: 89 44 24 20 e8 2c 96 00 00 eb 08 ba f8 0c 00 00 89 d8 ef 48 83 c4 38 89 d8 5b 5d c3 55 48 89 e5 57 48 89 cf 56 53 48 83 ec 38 <80> 3c 25 00 b0 80 00 02 75 5b 4c 89 c3 49 8d 34 10 48 39 f3 74 5c
[    0.068776] RSP: 0000:ffffffff94e03970 EFLAGS: 00010282
[    0.068776] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402
[    0.068776] RDX: 0000000000000060 RSI: ffffffff94e03c00 RDI: 0000000000000402
[    0.068776] RBP: ffffffff94e039c0 R08: ffffffff94e03a00 R09: 0000000000000002
[    0.068776] R10: 0000000000000002 R11: 0000000000000000 R12: ffffffff94e03e90
[    0.068776] R13: ffffffff9420b1c0 R14: 0000000000000007 R15: 0000000000000000
[    0.068776] FS:  0000000000000000(0000) GS:ffff9eb16be00000(0000) knlGS:0000000000000000
[    0.068776] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.068776] CR2: 000000000080b000 CR3: 0000000100222000 CR4: 00000000000006b0
[    0.068776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    0.068776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    0.068776] Call Trace:
[    0.068776]  <TASK>
[    0.068776]  ? post_alloc_hook+0xc8/0x150
[    0.068776]  ? post_alloc_hook+0xc8/0x150
[    0.068776]  ? get_page_from_freelist+0x55c/0x1520
[    0.068776]  ? get_page_from_freelist+0x55c/0x1520
[    0.068776]  ? __change_page_attr_set_clr+0xd65/0xf90
[    0.068776]  ? native_flush_tlb_global+0x79/0x90
[    0.068776]  ? __flush_tlb_all+0x30/0x40
[    0.068776]  ? kernel_map_pages_in_pgd+0xc2/0xce
[    0.068776]  ? __efi_call+0x25/0x30
[    0.068776]  ? virt_efi_set_variable_nonblocking+0xa5/0x120
[    0.068776]  ? efi_delete_dummy_variable+0x5c/0x80
[    0.068776]  ? efi_enter_virtual_mode+0x416/0x435
[    0.068776]  ? start_kernel+0x8cc/0x955
[    0.068776]  ? load_ucode_bsp+0x3a/0x100
[    0.068776]  ? secondary_startup_64_no_verify+0xd5/0xdb
[    0.068776]  </TASK>
[    0.068776] Modules linked in:
[    0.068776] CR2: 000000000080b000
[    0.068776] ---[ end trace 0000000000000000 ]---
[    0.068776] RIP: 0010:0xfffffffeff8c3615
[    0.068776] Code: 89 44 24 20 e8 2c 96 00 00 eb 08 ba f8 0c 00 00 89 d8 ef 48 83 c4 38 89 d8 5b 5d c3 55 48 89 e5 57 48 89 cf 56 53 48 83 ec 38 <80> 3c 25 00 b0 80 00 02 75 5b 4c 89 c3 49 8d 34 10 48 39 f3 74 5c
[    0.068776] RSP: 0000:ffffffff94e03970 EFLAGS: 00010282
[    0.068776] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402
[    0.068776] RDX: 0000000000000060 RSI: ffffffff94e03c00 RDI: 0000000000000402
[    0.068776] RBP: ffffffff94e039c0 R08: ffffffff94e03a00 R09: 0000000000000002
[    0.068776] R10: 0000000000000002 R11: 0000000000000000 R12: ffffffff94e03e90
[    0.068776] R13: ffffffff9420b1c0 R14: 0000000000000007 R15: 0000000000000000
[    0.068776] FS:  0000000000000000(0000) GS:ffff9eb16be00000(0000) knlGS:0000000000000000
[    0.068776] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.068776] CR2: 000000000080b000 CR3: 0000000100222000 CR4: 00000000000006b0
[    0.068776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    0.068776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    0.068776] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.068776] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
qemu-system-x86_64: terminating on signal 2


Expected results:
Wed Aug  3 11:55:46 UTC 2022
[    0.418779] reboot: Power down


Additional info:

--- Additional comment from Gerd Hoffmann on 2022-08-17 10:36:44 UTC ---

Bisected.  The winner is "OvmfPkg: enable DEBUG_VERBOSE (RHEL only)" (aka patch12 in spec file).

The faulting address is 80b000 aka PcdOvmfWorkAreaBase.

So given this needs isa-debugcon to trigger I suspect the following is happening:

(1) linux kernel does a efi runtime call.
(2) ovmf wants log a debug message (enabled by the patch above).
(3) debugcon driver calls into iolib to send the characters.
(4) iolib checks WorkArea to figure whenever it can just use
    io instructions or must call some tdx/sev helper function for io.
(5) WorkArea has no runtime mapping -> BOOM.

--- Additional comment from Gerd Hoffmann on 2022-08-17 11:07:52 UTC ---

https://edk2.groups.io/g/devel/topic/ccprobelib_not_working_for/93078060
Comment 1 zixchen 2022-11-29 10:52:42 UTC 
This can be only reproduced with OVMF_CODE.cc.fd and isa-debugcon in guest installation, but not hit this issue with OVMF.amdsev.fd and OVMF_CODE.secboot.fd.

Version:
edk2-ovmf-20220826gitba0e0e4c6a-2.el9.noarch
kernel-5.14.0-200.el9.x86_64
qemu-kvm-7.1.0-5.el9.x86_64

Steps:
/usr/libexec/qemu-kvm \
    -S  \    
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/edk2/ovmf/OVMF_CODE.cc.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -blockdev node-name=file_ovmf_vars,driver=file,filename=/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel-64-virtio-scsi_qcow2_filesystem_VARS.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \
    -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 86016 \
    -object '{"qom-type": "memory-backend-ram", "size": 90194313216, "id": "mem-machine_mem"}'  \
    -smp 48,maxcpus=48,cores=24,threads=1,dies=1,sockets=2  \
    -cpu 'EPYC-Milan',+kvm_pv_unhalt \
    -device pvpanic,ioport=0x505,id=idpeAyeF \
    -chardev socket,wait=off,path=/var/tmp/avocado_7ubtbkdx/serial-serial0-20221128-232439-8mqszM3M,id=chardev_serial0,server=on \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20221128-232439-8mqszM3M,path=/var/tmp/avocado_7ubtbkdx/seabios-20221128-232439-8mqszM3M,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20221128-232439-8mqszM3M,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}' \
    -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel-64-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \
    -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \
    -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \ 
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:43:0d:43:1a:43,id=idDIKLlz,netdev=idkXaye3,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=idkXaye3,vhost=on,vhostfd=16,fd=9 \
    -blockdev '{"node-name": "file_cd1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/iso/linux/RHEL-*-x86_64-dvd1.iso", "cache": {"direct": true, "no-flush": false}}' \
    -blockdev '{"node-name": "drive_cd1", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_cd1"}' \
    -device '{"driver": "scsi-cd", "id": "cd1", "drive": "drive_cd1", "write-cache": "on"}' \ 
    -blockdev '{"node-name": "file_unattended", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/ks.iso", "cache": {"direct": true, "no-flush": false}}' \
    -blockdev '{"node-name": "drive_unattended", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_unattended"}' \
    -device '{"driver": "scsi-cd", "id": "unattended", "drive": "drive_unattended", "write-cache": "on"}'  \
    -kernel '/home/kvm_autotest_root/images/rhel9-64/vmlinuz'  \
    -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg net.ifnames=0 console=ttyS0,115200'  \
    -initrd '/home/kvm_autotest_root/images/rhel9-64/initrd.img'  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=d,strict=off  \
    -no-shutdown \
    -chardev socket,id=char_vtpm_avocado-vt-vm1_tpm0,path=/root/avocado/data/avocado-vt/swtpm/avocado-vt-vm1_tpm0_swtpm.sock \
    -tpmdev emulator,chardev=char_vtpm_avocado-vt-vm1_tpm0,id=emulator_vtpm_avocado-vt-vm1_tpm0 \
    -device tpm-crb,id=tpm-crb_vtpm_avocado-vt-vm1_tpm0,tpmdev=emulator_vtpm_avocado-vt-vm1_tpm0 \
    -enable-kvm \

Result:
Kernel crash
[    0.172206] #PF: supervisor read access in kernel mode 
[    0.172269] #PF: error_code(0x0000) - not-present page
[    0.172269] PGD 1001d6063 P4D 1001d6063 PUD 1001f7063 PMD 100200063 PTE 800fffffff7f4060
[    0.172269] Oops: 0000 [#1] PREEMPT SMP NOPTI
[    0.172269] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.14.0-201.el9.x86_64 #1
[    0.172269] Hardware name: Red Hat KVM/RHEL, BIOS 0.0.0 02/06/2015
[    0.172269] RIP: 0010:0xfffffffeff4c3596
[    0.172269] Code: d6 00 00 01 3c e9 0f 94 05 37 d6 00 00 8a 05 31 d6 00 00 48 83 c4 48 c3 8a 05 26 d6 00 00 c3 41 54 49 89 cc 56 53 48 83 ec 30 <80> 3c 25 00 b0 80 00 02 75 63 4c 89 c3 49 8d 34 10 48 39 f3 74 64   
[    0.172269] RSP: 0000:ffffffffade039d0 EFLAGS: 00010282
[    0.172269] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402
[    0.172269] RDX: 0000000000000060 RSI: ffffffffade03c50 RDI: 0000000000000001
[    0.172269] RBP: ffffffffade03ed0 R08: ffffffffade03a50 R09: 0000000000000000
[    0.172269] R10: fffffffeff4ccbbe R11: 0000000000000002 R12: 0000000000000402
[    0.172269] R13: ffffffffade03cb0 R14: 0000000000000007 R15: 0000000000000000
[    0.172269] FS:  0000000000000000(0000) GS:ffff8ad86b200000(0000) knlGS:0000000000000000
[    0.172269] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.172269] CR2: 000000000080b000 CR3: 00000001001d4002 CR4: 00000000000606b0
[    0.172269] Call Trace:
[    0.172269]  <TASK>
[    0.172269]  ? rmqueue_bulk+0x33d/0x980
[    0.172269]  ? rmqueue+0x440/0xd80
[    0.172269]  ? rmqueue+0x440/0xd80
[    0.172269]  ? rmqueue+0x440/0xd80
[    0.172269]  ? _raw_spin_unlock+0xc/0x30
[    0.172269]  ? __change_page_attr_set_clr+0x5a/0xb0
[    0.172269]  ? __flush_tlb_all+0x18/0x30
[    0.172269]  ? kernel_map_pages_in_pgd+0xd5/0xf9
[    0.172269]  ? __efi_call+0x25/0x30
[    0.172269]  ? virt_efi_set_variable_nonblocking.part.0+0x8b/0xf0
[    0.172269]  ? efi_delete_dummy_variable+0x5c/0x80
[    0.172269]  ? __efi_enter_virtual_mode+0x1c1/0x1e8
[    0.172269]  ? efi_enter_virtual_mode+0x110/0x11b
[    0.172269]  ? start_kernel+0x426/0x4c0
[    0.172269]  ? secondary_startup_64_no_verify+0xd6/0xdb
[    0.172269]  </TASK>
[    0.172269] Modules linked in:
[    0.172269] CR2: 000000000080b000
[    0.172269] ---[ end trace bef6c92b0eb0d797 ]---
[    0.172269] RIP: 0010:0xfffffffeff4c3596
[    0.172269] Code: d6 00 00 01 3c e9 0f 94 05 37 d6 00 00 8a 05 31 d6 00 00 48 83 c4 48 c3 8a 05 26 d6 00 00 c3 41 54 49 89 cc 56 53 48 83 ec 30 <80> 3c 25 00 b0 80 00 02 75 63 4c 89 c3 49 8d 34 10 48 39 f3 74 64
[    0.172269] RSP: 0000:ffffffffade039d0 EFLAGS: 00010282
[    0.172269] RAX: 0000000000000060 RBX: 0000000000000000 RCX: 0000000000000402
[    0.172269] RDX: 0000000000000060 RSI: ffffffffade03c50 RDI: 0000000000000001
[    0.172269] RBP: ffffffffade03ed0 R08: ffffffffade03a50 R09: 0000000000000000
[    0.172269] R10: fffffffeff4ccbbe R11: 0000000000000002 R12: 0000000000000402
[    0.172269] R13: ffffffffade03cb0 R14: 0000000000000007 R15: 0000000000000000
[    0.172269] FS:  0000000000000000(0000) GS:ffff8ad86b200000(0000) knlGS:0000000000000000
[    0.172269] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.172269] CR2: 000000000080b000 CR3: 00000001001d4002 CR4: 00000000000606b0
[    0.172269] Kernel panic - not syncing: Fatal exception
[    0.172269] ---[ end Kernel panic - not syncing: Fatal exception ]---
Comment 3 Gerd Hoffmann 2022-12-01 09:09:27 UTC 
fixed upstream, rebase to 2022-11 should bring us the fix, please retest once we have test builds.
Comment 4 Gerd Hoffmann 2022-12-13 12:14:00 UTC 
https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=1685612
Comment 5 Gerd Hoffmann 2023-02-28 14:04:10 UTC 
(In reply to Gerd Hoffmann from comment #3)
> fixed upstream, rebase to 2022-11 should bring us the fix, please retest
> once we have test builds.

Can you re-test latest rhel-9.2 version?
Comment 6 zixchen 2023-03-02 09:26:00 UTC 
Verified with edk2-ovmf-20221207gitfff6d81270b5-7.el9.noarch no issue found

Version:
edk2-ovmf-20221207gitfff6d81270b5-7.el9.noarch
qemu-kvm-7.2.0-10.el9.x86_64
kernel-5.14.0-283.el9.x86_64


Steps:
1. Install a sev-es guest with OVMF_CODE.cc.fd and isa-debugcon
/usr/libexec/qemu-kvm \
     -S  \
     -name 'avocado-vt-vm1'  \
     -sandbox on  \
     -object {"qom-type":"sev-guest","id":"lsec0","cbitpos":51,"reduced-phys-bits":1,"policy":3}
     -blockdev '{"node-name": "file_ovmf_code", "driver": "file", "filename": "/usr/share/edk2/ovmf/OVMF_CODE.cc.fd", "auto-read-only": true, "discard": "unmap"}' \
     -blockdev '{"node-name": "drive_ovmf_code", "driver": "raw", "read-only": true, "file": "file_ovmf_code"}' \
     -blockdev '{"node-name": "file_ovmf_vars", "driver": "file", "filename": "/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel920-64-virtio-scsi_qcow2_filesystem_VARS.fd", "auto-read-only": true, "discard": "unmap"}' \
     -blockdev '{"node-name": "drive_ovmf_vars", "driver": "raw", "read-only": false, "file": "file_ovmf_vars"}' \
     -machine q35,memory-backend=mem-machine_mem,confidential-guest-support=lsec0,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
     -device '{"id": "pcie-root-port-0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x1", "chassis": 1}' \
     -device '{"id": "pcie-pci-bridge-0", "driver": "pcie-pci-bridge", "addr": "0x0", "bus": "pcie-root-port-0"}'  \
     -nodefaults \
     -device '{"driver": "VGA", "bus": "pcie.0", "addr": "0x2"}' \
     -m 30720 \
     -object '{"size": 32212254720, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}'  \
     -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
     -cpu 'EPYC-Milan',+kvm_pv_unhalt \
     -chardev socket,path=/var/tmp/avocado_hu8qri_u/monitor-qmpmonitor1-20230302-040448-YDhfGYL9,server=on,wait=off,id=qmp_id_qmpmonitor1  \
     -mon chardev=qmp_id_qmpmonitor1,mode=control \
     -chardev socket,path=/var/tmp/avocado_hu8qri_u/monitor-catch_monitor-20230302-040448-YDhfGYL9,server=on,wait=off,id=qmp_id_catch_monitor  \
     -mon chardev=qmp_id_catch_monitor,mode=control \
     -device '{"ioport": 1285, "driver": "pvpanic", "id": "id7YjUxf"}' \
     -chardev socket,path=/var/tmp/avocado_hu8qri_u/serial-serial0-20230302-040448-YDhfGYL9,server=on,wait=off,id=chardev_serial0 \
     -device '{"id": "serial0", "driver": "isa-serial", "chardev": "chardev_serial0"}'  \
     -chardev socket,id=seabioslog_id_20230302-040448-YDhfGYL9,path=/var/tmp/avocado_hu8qri_u/seabios-20230302-040448-YDhfGYL9,server=on,wait=off \
     -device isa-debugcon,chardev=seabioslog_id_20230302-040448-YDhfGYL9,iobase=0x402 \
     -device '{"id": "pcie-root-port-1", "port": 1, "driver": "pcie-root-port", "addr": "0x1.0x1", "bus": "pcie.0", "chassis": 2}' \
     -device '{"driver": "qemu-xhci", "id": "usb1", "bus": "pcie-root-port-1", "addr": "0x0"}' \
     -device '{"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}' \
     -device '{"id": "pcie-root-port-2", "port": 2, "driver": "pcie-root-port", "addr": "0x1.0x2", "bus": "pcie.0", "chassis": 3}' \
     -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}' \
     -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel920-64-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \
     -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \
     -device '{"id": "pcie-root-port-3", "port": 3, "driver": "pcie-root-port", "addr": "0x1.0x3", "bus": "pcie.0", "chassis": 4}' \
     -device '{"driver": "virtio-net-pci", "mac": "9a:15:db:cf:1c:32", "id": "idflg8Rb", "netdev": "idw1Nppf", "bus": "pcie-root-port-3", "addr": "0x0"}'  \
     -netdev tap,id=idw1Nppf,vhost=on,vhostfd=16,fd=12 \
     -blockdev '{"node-name": "file_cd1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/iso/linux/RHEL-9.2.0-20230220.9-x86_64-dvd1.iso", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_cd1", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_cd1"}' \
     -device '{"driver": "scsi-cd", "id": "cd1", "drive": "drive_cd1", "write-cache": "on"}' \
     -blockdev '{"node-name": "file_unattended", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel920-64/ks.iso", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_unattended", "driver": "raw", "read-only": true, "cache": {"direct": true, "no-flush": false}, "file": "file_unattended"}' \
-device '{"driver": "scsi-cd", "id": "unattended", "drive": "drive_unattended", "write-cache": "on"}'  \
     -kernel '/home/kvm_autotest_root/images/rhel920-64/vmlinuz'  \
     -append 'inst.sshd inst.repo=cdrom inst.ks=cdrom:/ks.cfg net.ifnames=0 console=ttyS0,115200'  \
     -initrd '/home/kvm_autotest_root/images/rhel920-64/initrd.img'  \
     -vnc :0  \
     -rtc base=utc,clock=host,driftfix=slew  \
     -boot menu=off,order=cdn,once=d,strict=off  \
     -no-shutdown \
     -chardev socket,id=char_vtpm_avocado-vt-vm1_tpm0,path=/root/avocado/data/avocado-vt/swtpm/avocado-vt-vm1_tpm0_swtpm.sock \
     -tpmdev emulator,chardev=char_vtpm_avocado-vt-vm1_tpm0,id=emulator_vtpm_avocado-vt-vm1_tpm0 \
     -device '{"id": "tpm-crb_vtpm_avocado-vt-vm1_tpm0", "tpmdev": "emulator_vtpm_avocado-vt-vm1_tpm0", "driver": "tpm-crb"}' \
     -enable-kvm \

Result:
Install and boot guest, no issue found.