Public bug reported:
ISO install with a SNP capable kernel in SNP mode may fail due to
outdated user space tooling like mdadm creating md devices during
install time. Then the guest receives a #VC exit which can’t be resolved
because that range has never been validated, and it should never be
since its not guest memory. The kernel community has taken this into
account and remediated the issue, but distros may still have outdated
tooling that does not consider this issue.
The kernel commits that fixes this for kernel accesses to legacy ROM is
0f4a1e80989a x86/sev: Skip ROM range scans and validation for SEV-SNP
guests - Fixes: 9704c07bf9f7 ("Validate ROM memory before accessing when
SEV-SNP is active")
We know that installs work fine using qcow2 for all distros, but
installs to raw image fail.
By examining the ISO kernel version if it supports SNP, and the mdadm
version in mdadm package whether it faills back to legacy ROM scan for
IMSM signature it can be determined if the distro will fail install when
executed as SNP guest.
Command Line
- Boot into a console character prompt install, in order to get into
installer shell and execute the user space install utility that causes
the hang. Some paths require adjustments to your environment.
cdrom=/path/xxx.iso
# must use a RAW image to reproduce it works with qcow2
img= test-image.raw
ovmf=/home/amd/ovmf-2-24-2025
/home/amd/hugetlb-qemu/build/qemu-system-x86_64 \
-enable-kvm \
-cpu
EPYC-v4,enforce,svm=off,pku=off,svme-addr-chk=off,kvm-pv-eoi=on,l3-cache=on \
-smp 4,sockets=4,cores=1,threads=1 \
-m 32G \
-machine
q35,confidential-guest-support=sev0,memory-backend=ram0,kernel_irqchip=split \
-object
memory-backend-file,id=ram0,mem-path=/tmp/snp-guest-ram,share=true,size=32G \
-bios $ovmf/Build/OvmfX64/DEBUG_GCC5/FV/OVMF.fd \
-device
pcie-root-port,id=pci.1,bus=pcie.0,chassis=1,port=16,addr=0x2,multifunction=on \
-device pcie-root-port,id=pci.2,bus=pcie.0,chassis=2,port=17,addr=0x2.0x1 \
-device
virtio-scsi-pci,id=scsi0,iommu_platform=on,bus=pci.2,addr=0x0,max_sectors=2048 \
-drive id=hd0,file=$img,format=raw,if=none,cache=none \
-device scsi-hd,drive=hd0,bus=scsi0.0,scsi-id=0,lun=0,bootindex=2 \
-drive id=cd0,file=$cdrom,media=cdrom,readonly=on,if=none \
-device ide-cd,drive=cd0,bus=ide.0,bootindex=1 \
-boot menu=off,strict=on \
-netdev user,id=net0,hostfwd=tcp::2222-:22 \
-device virtio-net-pci,netdev=net0,iommu_platform=on,bus=pci.1,addr=0x0 \
-object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,policy=0x30000 \
-display none \
-chardev stdio,id=serial1,signal=off \
-device isa-serial,chardev=serial1,index=1,iobase=0x2f8,irq=3 \
-monitor none \
-debugcon file:ovmf-debug.log \
-global isa-debugcon.iobase=0x402 \
-msg timestamp=on
Steps to Reproduce
LIVE-ISO-BOOT = please replace this with your distro syntax for live
ISO boot.
After bootup:
1. type 'e' for edit mode
2. use arrows to get to the end of linux entry and add
everything after the ~~~
linux /boot/vmlinuz boot=LIVE-IS-BOOT --- console=ttyS1,115200n8
earlyprintk=serial,ttyS1,115200 ignore_loglevel loglevel=8
3.Type ^x
After the installer comes up
- Type 'F1' - select the shell
Now you can run commands like ps, .., and 'mdadm'
Test
# mdadm --examine --metadata=imsm /dev/sr0
If it hangs then mdadm is outdated and preventing install from SNP guest
Assertion Error Message
You should see #VC handler complaining
Wrong/unhandled opcode bytes: 0xb70f, exit_code: 0x404, rIP:
0x633ea46bc6cd (rIP will vary)
Strace like
timeout 30 strace -tt -T -s 128 -yy -o /tmp/mdadm-26-sr0.strace mdadm --examine
--metadata=imsm /dev/sr0
tail -80 /tmp/mdadm-26-sr0.strace
Should result in a lot of SIGBUS errors
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165925
Title:
guest ISOs in SNP mode installation on raw images can fail
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165925/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
