* Error when launching SEV-ES guest with OvmfPkg/AmdSev build
@ 2021-10-13 9:35 Dov Murik
2021-10-13 19:41 ` Brijesh Singh
0 siblings, 1 reply; 3+ messages in thread
From: Dov Murik @ 2021-10-13 9:35 UTC (permalink / raw)
To: edk2-devel-groups-io
Cc: Dov Murik, Tobin Feldman-Fitzthum, James Bottomley, Brijesh Singh,
Min Xu, Jiewen Yao, Tom Lendacky, Gerd Hoffmann
Hello,
I encountered the following problem when trying to launch SEV-ES
(policy=0x5) guests with the OvmfPkg/AmdSev/AmdSevX64 package build:
$ sudo /home/dmurik/git/qemu/build/qemu-system-x86_64 -enable-kvm
-machine q35 -smp 1 -m 2G -machine confidential-guest-support=sev0
-object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x5
-drive
if=pflash,format=raw,unit=0,file=/home/dmurik/git/edk2/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd,readonly=on
-nographic -global isa-debugcon.iobase=0x402 -debugcon file:ovmf-1.log
-monitor pty
char device redirected to /dev/pts/6 (label compat_monitor0)
error: kvm run failed Invalid argument
EAX=0000000a EBX=0000006f ECX=00000000 EDX=00000000
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 00000000 00000000
CS =0000 00000000 00000000 00000000
SS =0000 00000000 00000000 00000000
DS =0000 00000000 00000000 00000000
FS =0000 00000000 00000000 00000000
GS =0000 00000000 00000000 00000000
LDT=0000 00000000 00000000 00000000
TR =0000 00000000 00000000 00000000
GDT= 00000000 00000000
IDT= 00000000 00000000
CR0=c0000033 CR2=00000000 CR3=00000000 CR4=00000660
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000100
Code=?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? <??> ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ??
ovmf-1.log is empty (even though OVMF is compiled with debug flags).
Plain SEV (no -ES) guests work OK.
The error is "kvm run failed Invalid argument", so I first tried
switching kernels, but 5.11.0, 5.13.0, and 5.14.0 all gave the same result.
Then I tried an older OVMF release (edk2-stable202108) -- and it worked
OK. So I started a git bisect session and found this first bad commit:
commit ab77b6031b03733c28fa5f477d802fd67b3f3ee0
Author: Brijesh Singh <brijesh.singh@amd.com>
Date: Tue Aug 17 21:46:50 2021 +0800
OvmfPkg/ResetVector: update SEV support to use new work area format
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3429
Update the SEV support to switch to using the newer work area format.
I wonder if any change in this series should have also touched files in
OvmfPkg/AmdSev and missed them.
Any other ideas on how to debug this are welcome.
Let me know if this should be reported/discussed somewhere else.
Thanks,
-Dov
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Error when launching SEV-ES guest with OvmfPkg/AmdSev build
2021-10-13 9:35 Error when launching SEV-ES guest with OvmfPkg/AmdSev build Dov Murik
@ 2021-10-13 19:41 ` Brijesh Singh
2021-10-13 19:47 ` Dov Murik
0 siblings, 1 reply; 3+ messages in thread
From: Brijesh Singh @ 2021-10-13 19:41 UTC (permalink / raw)
To: Dov Murik, edk2-devel-groups-io
Cc: brijesh.singh, Tobin Feldman-Fitzthum, James Bottomley, Min Xu,
Jiewen Yao, Tom Lendacky, Gerd Hoffmann
Hi Dov,
On 10/13/21 2:35 AM, Dov Murik wrote:
> Hello,
>
> I encountered the following problem when trying to launch SEV-ES
> (policy=0x5) guests with the OvmfPkg/AmdSev/AmdSevX64 package build:
>
>
> $ sudo /home/dmurik/git/qemu/build/qemu-system-x86_64 -enable-kvm
> -machine q35 -smp 1 -m 2G -machine confidential-guest-support=sev0
> -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x5
> -drive
> if=pflash,format=raw,unit=0,file=/home/dmurik/git/edk2/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd,readonly=on
> -nographic -global isa-debugcon.iobase=0x402 -debugcon file:ovmf-1.log
> -monitor pty
>
> char device redirected to /dev/pts/6 (label compat_monitor0)
> error: kvm run failed Invalid argument
> EAX=0000000a EBX=0000006f ECX=00000000 EDX=00000000
> ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
> EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
> ES =0000 00000000 00000000 00000000
> CS =0000 00000000 00000000 00000000
> SS =0000 00000000 00000000 00000000
> DS =0000 00000000 00000000 00000000
> FS =0000 00000000 00000000 00000000
> GS =0000 00000000 00000000 00000000
> LDT=0000 00000000 00000000 00000000
> TR =0000 00000000 00000000 00000000
> GDT= 00000000 00000000
> IDT= 00000000 00000000
> CR0=c0000033 CR2=00000000 CR3=00000000 CR4=00000660
> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
> DR3=0000000000000000
> DR6=00000000ffff0ff0 DR7=0000000000000400
> EFER=0000000000000100
> Code=?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? <??> ??
> ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
> ?? ?? ?? ??
>
>
> ovmf-1.log is empty (even though OVMF is compiled with debug flags).
>
>
> Plain SEV (no -ES) guests work OK.
>
>
> The error is "kvm run failed Invalid argument", so I first tried
> switching kernels, but 5.11.0, 5.13.0, and 5.14.0 all gave the same result.
>
> Then I tried an older OVMF release (edk2-stable202108) -- and it worked
> OK. So I started a git bisect session and found this first bad commit:
>
>
> commit ab77b6031b03733c28fa5f477d802fd67b3f3ee0
> Author: Brijesh Singh <brijesh.singh@amd.com>
> Date: Tue Aug 17 21:46:50 2021 +0800
>
> OvmfPkg/ResetVector: update SEV support to use new work area format
>
> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3429&data=04%7C01%7Cbrijesh.singh%40amd.com%7C161014bce6d140ebb89408d98e2cce3a%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637697145350831431%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=26MCaioHLlTtw81C%2F3Mpf8kOG2LpQXFmvt3FvH%2FnjNk%3D&reserved=0
>
> Update the SEV support to switch to using the newer work area format.
>
>
> I wonder if any change in this series should have also touched files in
> OvmfPkg/AmdSev and missed them.
This is most likely because the patch repurposed the EsWorkArea to a
generic workarea but the AmdSevX64.fdf is still pointing the EsWorkArea
to be the start of the page. After we repurposed the EsWorkArea it got
assigned to a different value. See the OvmfPkgX64.fdf. I am having
trouble building the AmdSev package. I am getting this error
grub-mkimage: error: cannot open
`/usr/lib/grub/x86_64-efi/sevsecret.mod': No such file or directory.
Do you know what I am missing ? It seems like we have some dependency
with the grub but I cannot seem to find out what I need to do to get
those resolved. Any hint ?
> Any other ideas on how to debug this are welcome.
>
> Let me know if this should be reported/discussed somewhere else.
>
>
> Thanks,
> -Dov
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Error when launching SEV-ES guest with OvmfPkg/AmdSev build
2021-10-13 19:41 ` Brijesh Singh
@ 2021-10-13 19:47 ` Dov Murik
0 siblings, 0 replies; 3+ messages in thread
From: Dov Murik @ 2021-10-13 19:47 UTC (permalink / raw)
To: Brijesh Singh, edk2-devel-groups-io
Cc: Tobin Feldman-Fitzthum, James Bottomley, Min Xu, Jiewen Yao,
Tom Lendacky, Gerd Hoffmann, Dov Murik
Thanks Brijesh for looking into this.
On 13/10/2021 22:41, Brijesh Singh wrote:
> Hi Dov,
>
> On 10/13/21 2:35 AM, Dov Murik wrote:
>> Hello,
>>
>> I encountered the following problem when trying to launch SEV-ES
>> (policy=0x5) guests with the OvmfPkg/AmdSev/AmdSevX64 package build:
>>
>>
>> $ sudo /home/dmurik/git/qemu/build/qemu-system-x86_64 -enable-kvm
>> -machine q35 -smp 1 -m 2G -machine confidential-guest-support=sev0
>> -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x5
>> -drive
>> if=pflash,format=raw,unit=0,file=/home/dmurik/git/edk2/Build/AmdSev/DEBUG_GCC5/FV/OVMF.fd,readonly=on
>> -nographic -global isa-debugcon.iobase=0x402 -debugcon file:ovmf-1.log
>> -monitor pty
>>
>> char device redirected to /dev/pts/6 (label compat_monitor0)
>> error: kvm run failed Invalid argument
>> EAX=0000000a EBX=0000006f ECX=00000000 EDX=00000000
>> ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
>> EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
>> ES =0000 00000000 00000000 00000000
>> CS =0000 00000000 00000000 00000000
>> SS =0000 00000000 00000000 00000000
>> DS =0000 00000000 00000000 00000000
>> FS =0000 00000000 00000000 00000000
>> GS =0000 00000000 00000000 00000000
>> LDT=0000 00000000 00000000 00000000
>> TR =0000 00000000 00000000 00000000
>> GDT= 00000000 00000000
>> IDT= 00000000 00000000
>> CR0=c0000033 CR2=00000000 CR3=00000000 CR4=00000660
>> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
>> DR3=0000000000000000
>> DR6=00000000ffff0ff0 DR7=0000000000000400
>> EFER=0000000000000100
>> Code=?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? <??> ??
>> ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
>> ?? ?? ?? ??
>>
>>
>> ovmf-1.log is empty (even though OVMF is compiled with debug flags).
>>
>>
>> Plain SEV (no -ES) guests work OK.
>>
>>
>> The error is "kvm run failed Invalid argument", so I first tried
>> switching kernels, but 5.11.0, 5.13.0, and 5.14.0 all gave the same result.
>>
>> Then I tried an older OVMF release (edk2-stable202108) -- and it worked
>> OK. So I started a git bisect session and found this first bad commit:
>>
>>
>> commit ab77b6031b03733c28fa5f477d802fd67b3f3ee0
>> Author: Brijesh Singh <brijesh.singh@amd.com>
>> Date: Tue Aug 17 21:46:50 2021 +0800
>>
>> OvmfPkg/ResetVector: update SEV support to use new work area format
>>
>> BZ: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D3429&data=04%7C01%7Cbrijesh.singh%40amd.com%7C161014bce6d140ebb89408d98e2cce3a%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637697145350831431%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=26MCaioHLlTtw81C%2F3Mpf8kOG2LpQXFmvt3FvH%2FnjNk%3D&reserved=0
>>
>> Update the SEV support to switch to using the newer work area format.
>>
>>
>> I wonder if any change in this series should have also touched files in
>> OvmfPkg/AmdSev and missed them.
>
> This is most likely because the patch repurposed the EsWorkArea to a
> generic workarea but the AmdSevX64.fdf is still pointing the EsWorkArea
> to be the start of the page. After we repurposed the EsWorkArea it got
> assigned to a different value. See the OvmfPkgX64.fdf. I am having
> trouble building the AmdSev package. I am getting this error
>
> grub-mkimage: error: cannot open
> `/usr/lib/grub/x86_64-efi/sevsecret.mod': No such file or directory.
>
> Do you know what I am missing ? It seems like we have some dependency
> with the grub but I cannot seem to find out what I need to do to get
> those resolved. Any hint ?
>
A simple way to skip the grub embedding is to run
touch OvmfPkg/AmdSev/Grub/grub.efi
before running the build.
This will cause grub.sh to use the already existing (empty) grub.efi as
the embedded grub module; which is fine for now because I can't even
reach a single log line in OVMF.
-Dov
>> Any other ideas on how to debug this are welcome.
>>
>> Let me know if this should be reported/discussed somewhere else.
>>
>>
>> Thanks,
>> -Dov
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-13 19:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-13 9:35 Error when launching SEV-ES guest with OvmfPkg/AmdSev build Dov Murik
2021-10-13 19:41 ` Brijesh Singh
2021-10-13 19:47 ` Dov Murik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox