Boot failed when using AmdSevX64 OVMF #257
Comments
You need to add kernel-hashes=on to your sev-snp-guest object. I'm not sure if that will solve your issue, but it could be related. @fitzthum, is this case allowed? AmdSev pkg running but kernel-hashes not specified on the qemu command line? |
|
It seems like @choehojun wants to extend the measurement to cover more components, but they don't seem to have injected the kernel hash given the message @tlendacky points out. Probably an extra flag must be provided to the hypervisor. AFAIK booting with AMDSEV but without the kernel hashes should work. It should revert to OVMF's default boot flow. I'm not sure what it's getting caught up on here. It might be a good idea to test that the snp-latest scripts are building this in a way that works and that no changes have crept in and broken this. Ofc this wouldn't measure anything so I don't think it's what @choehojun wants to do. |
|
@tlendacky However, the problem was not solved. Boot was failed because of same issue. |
|
@fitzthum |
|
I launched guest VM with this command: |
|
I'm seeing this same issue. I've tried building various versions of
All the above have the same error that you're seeing: I'm using a very similar QEMU command, but without disk encryption or networking: sudo ~/AMDSEV/usr/local/bin/qemu-system-x86_64 \
-enable-kvm \
-cpu EPYC-v4 \
-machine q35 -smp 32,maxcpus=32 \
-m 4096M,slots=5,maxmem=12288M \
-no-reboot \
-bios ~/edk2/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd \
-drive file=./cvm.raw,if=none,id=disk0,format=raw \
-device virtio-scsi-pci,id=scsi0,disable-legacy=on,iommu_platform=true \
-device scsi-hd,drive=disk0 -machine memory-encryption=sev0,vmport=off \
-object memory-backend-memfd,id=ram1,size=4096M,share=true,prealloc=false \
-machine memory-backend=ram1 -object sev-snp-guest,id=sev0,policy=0x30000,cbitpos=51,reduced-phys-bits=5,kernel-hashes=on \
-kernel ./cvm.vmlinuz \
-append "console=ttyS0 earlyprintk=serial root=/dev/sda2" \
-initrd ./cvm.initrd \
-nographic -monitor pty -monitor unix:monitor,server,nowaitMy process for building OVMF is as follows: git clone https://github.com/tianocore/edk2 && cd edk2
git checkout edk2-stable202411
git rm -rf UnitTestFrameworkPkg
touch OvmfPkg/AmdSev/Grub/grub.efi
git submodule update --init --recursive
make -C BaseTools
. ./edksetup.sh --reconfig
nice build -q --cmd-len=64436 -DDEBUG_ON_SERIAL_PORT=TRUE -n 32 -t GCC5 -a X64 -p OvmfPkg/AmdSev/AmdSevX64.dsc
ls -lah Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd |
|
One of the differences between the OvmfPkgX64 and AmdSev happens at the failure: OvmfPkgX64:
AmdSev:
And it appears that attempting to map this range is failing. @kraxel, any idea why a PCI option ROM would be present in the AmdSev package but not the OvmfX64Pkg? |
|
I noticed AmdSev was using the CcProbeLib NULL library. When I added the same CcProbeLib definitions as are in OvmfPkgX64.dsc, I was able to successfully boot with AmdSev. Can @choehojun and/or @natesales test this patch: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello,
I built an OVMF file using the default package
OvmfPkg/OvmfPkgX64.dscand successfully launched a guest VM with SEV-SNP enabled. (I built host/guest kernel and qemu using shell scripts atsnp-latestbranch) However, I noticed that this OVMF file does not have anSNP_KERNEL_HASHESsection, so its launch-time measurement only provide integrity for the boot loader and do not cover the kernel or initrd. Therefore, I tried to switch the build package toOvmfPkg/AmdSev/AmdSevX64.dscso that the launch-time measurement would also include the hashes of the kernel and initrd images. Unfortunately, I was unable to boot the guest VM using the OVMF file built this way.I tried to analyze the cause of this problem but was unsuccessful, so I'm sharing the log here and submitting an issue in order to find out what’s going wrong.
Below is the part of VM launch log using QEMU:
The text was updated successfully, but these errors were encountered: