https://bugzilla.suse.com/show_bug.cgi?id=1192126 Dominique Leuenberger changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dleuenberger@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 Lubos Kocman changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High CC| |lubos.kocman@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c2 --- Comment #2 from Fabian Vogt --- (In reply to Fabian Vogt from comment #1)

Apparently the crash is due to a rdmsr instruction raising a fault when reading MSR 0xC0010131 (SEV status), which is not available on the host. This is caused by the MemEncryptSevEsIsEnabled function called from the TpmMmioSevDecryptPei module.

The reason it thinks that SEV is available is that PcdPteMemoryEncryptionAddressOrMask is a non-zero value, probably overwritten by Linux at some point. In qemu-ovmf-x86_64-202105-3.4.noarch, it is at address 0x80b010 and doing "set *(long*)0x80b010 = 0" fixes the reset loop.

According to dmesg, the e820 table marks 0x80b010 as usable. That's where my knowledge of EFI and OVMF stops, so I'll stop debugging here. It appears like either PcdPteMemoryEncryptionAddressOrMask is the wrong type of variable (wrong section?) or the region not correctly marked as reserved. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c5 --- Comment #5 from Fabian Vogt --- Any news here? Currently all openQA workers are stuck on the old OVMF from 15.2. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 Santiago Zarate changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.suse.com/s | |how_bug.cgi?id=1193820 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c8 --- Comment #8 from Joey Lee --- Created attachment 854688 --> https://bugzilla.suse.com/attachment.cgi?id=854688&action=edit 0001-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch This is a workaround patch for this issue. I will apply it to openSUSE factory. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 Jose Lausuch changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jalausuch@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c11 --- Comment #11 from Joey Lee --- (In reply to Joey Lee from comment #9)

This issue can not be reproduced on edk2-stable202111 because the this patchset:

80e67af9afcac3b OvmfPkg: introduce a common work area ab77b6031b03733 OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b270c47 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm

I will try to backport those patches.

Too many changes since edk2-stable202008 for SEV, so backporting the above patches must also backported many patches of SEV. So I choice to apply the workaround patch on comment#8 for Leap 15.3. The PcdSevEsWorkArea will always be reserved as an ACPI_NVS region as this: [ 0.000000] efi: mem06: [ACPI Mem NVS| | | | | | | | | | |WB|WT|WC|UC] range=[0x000000000080b000-0x000000000080bfff] (0MB) The size is 4K. For openSUSE TW, I will update it to edk2-stable202111 which included the above patches. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c13 --- Comment #13 from Joey Lee --- (In reply to Joey Lee from comment #12)

Created attachment 854707 [details] 0001-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch

Updated workaround patch. At least checking the existence of PcdSevEsWorkAreaBase before reserve SEV-ES work area.

I have applied this patch on edk2-stable202108 for SLE15-SP3 and built in my home branch: https://build.opensuse.org/project/monitor/home:joeyli:branches:SUSE:SLE-15-... It can be used for testing. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 Joey Lee changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.suse.com/s | |how_bug.cgi?id=1187245 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c18 --- Comment #18 from Joey Lee --- (In reply to Joey Lee from comment #16)

Created attachment 854756 [details] ovmf-bsc1192126-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch

Updated workaround patch. Always reserved the SEV-ES work area as a ACPI NVS region.

Workaround patch be pushed to SLE15-SP3/ovmf and wait to be merged. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c21 --- Comment #21 from Swamp Workflow Management --- SUSE-RU-2022:0009-1: An update that has one recommended fix can now be installed. Category: recommended (important) Bug References: 1192126 CVE References: JIRA References: Sources used: SUSE MicroOS 5.1 (src): ovmf-202008-10.11.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): ovmf-202008-10.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c23 Joey Lee changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #23 from Joey Lee --- The openSUSE_TW/ovmf be updated to edk2-stable202111 version and it also be pushed to 15-SP4. Set this issue to fixed. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1192126 https://bugzilla.suse.com/show_bug.cgi?id=1192126#c26 Marius Kittler changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED CC| |marius.kittler@suse.com --- Comment #26 from Marius Kittler --- It looks like the new version works, see https://progress.opensuse.org/issues/104607#note-5. -- You are receiving this mail because: You are on the CC list for the bug.