** Description changed:
[Impact]
Since edk2 2025.11-3ubuntu7.2 (LP: #2160129), 60-edk2-x86_64-amdsev.json
maps OVMF.amdsev.fd with "device": "memory". On Resolute, a UEFI guest that
relies on libvirt firmware autoselection, with Secure Boot disabled and no
per-VM nvram, now selects that descriptor on a non-SEV Intel host. libvirt
uses it as a rom loader, virt-aa-helper rejects the path, and the domain
fails to start with a misleading AppArmor error:
- error: Failed to start domain 'lp-repro-efi'
- error: internal error: cannot load AppArmor profile
'libvirt-eb9cc8c8-f1f5-427c-9408-1645f8032f08'
+ error: Failed to start domain 'lp-repro-efi'
+ error: internal error: cannot load AppArmor profile
'libvirt-eb9cc8c8-f1f5-427c-9408-1645f8032f08'
libvirtd log:
- internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr
- /usr/lib/libvirt/virt-aa-helper -c -u
libvirt-eb9cc8c8-f1f5-427c-9408-1645f8032f08)
- unexpected exit status 1: virt-aa-helper: error:
/usr/share/ovmf/OVMF.amdsev.fd
- virt-aa-helper: error: skipped restricted file
- virt-aa-helper: error: invalid VM definition
+ internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr
+ /usr/lib/libvirt/virt-aa-helper -c -u
libvirt-eb9cc8c8-f1f5-427c-9408-1645f8032f08)
+ unexpected exit status 1: virt-aa-helper: error:
/usr/share/ovmf/OVMF.amdsev.fd
+ virt-aa-helper: error: skipped restricted file
+ virt-aa-helper: error: invalid VM definition
The guest requests no confidential-computing features. Our production
guests with the same firmware request (UEFI, secure-boot disabled, no
nvram) started normally before 7.2; failures began with the 7.2 upgrade.
Still reproduces with edk2 2025.11-3ubuntu7.3 and libvirt
12.0.0-1ubuntu5.5 (current resolute-updates).
[Test Plan]
- On a non-SEV x86_64 host with the 7.2 descriptor installed:
+ The fix has 2 folds for 2 packages: edk2 and libvirt
- 1. Define the attached repro.xml (os firmware='efi', secure-boot
- disabled, no nvram element, no disk):
- virsh define repro.xml
- 2. virsh dumpxml lp-repro-efi | grep loader
- -> <loader type='rom'
format='raw'>/usr/share/ovmf/OVMF.amdsev.fd</loader>
- 3. virsh start lp-repro-efi
- -> internal error: cannot load AppArmor profile
+ Install libvirt
+ $ apt install -y libvirt-daemon-system libvirt-clients
- Expected: the guest starts, as such guests did before 7.2.
+ Create vm.xml domain definition:
+ $ cat vm.xml
+ <domain type="qemu">
+ <name>lp-repro-efi</name>
+ <memory unit="MiB">512</memory>
+ <vcpu>1</vcpu>
+ <os firmware="efi">
+ <type arch="x86_64" machine="q35">hvm</type>
+ <firmware>
+ <feature enabled="no" name="secure-boot"/>
+ </firmware>
+ </os>
+ <features>
+ <acpi/>
+ </features>
+ <devices/>
+ </domain>
- [Workaround]
+ $ virsh define vm.xml
+ $ virsh domxml-to-native qemu-argv --domain lp-repro-efi
- Mask the descriptor using the qemu firmware-descriptor override
- directory, then redefine affected domains:
+ The output is the generated qemu command and should contain in the faulty
system:
+ ...
+ -bios /usr/share/ovmf/OVMF.amdsev.fd
+ ...
- sudo ln -s /dev/null /etc/qemu/firmware/60-edk2-x86_64-amdsev.json
+ Try to start the VM:
+ $ virsh start lp-repro-efi
+ error: Failed to start domain 'lp-repro-efi'
+ error: internal error: cannot load AppArmor profile
'libvirt-00a88774-3b55-4284-a292-666687f18ac3'
- [Notes]
+ With EDK2 and libvirt with proposed fixes:
- Possible fixes:
- - virt-aa-helper allows read access to memory-mapped (stateless) loaders, or
- - autoselection does not pick SEV/TDX builds for guests that request no
- launch security.
+ $ virsh domxml-to-native qemu-argv --domain lp-repro-efi
+ ...-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE_4M.fd",..
- 60-edk2-x86_64-inteltdx.json is also mapped "device": "memory"
- (OVMF.inteltdx.ms.fd) and may hit the same path for secure-boot guests
- without nvram; not tested.
+ Try to start the VM will no longer cause a apparmor issue:
+ $ virsh start lp-repro-efi
- Versions:
- Ubuntu 26.04.1 LTS
- ovmf 2025.11-3ubuntu7.3
- ovmf-amdsev 2025.11-3ubuntu7.3
- qemu-system-x86 1:10.2.1+ds-1ubuntu3.2
- libvirt-daemon-system 12.0.0-1ubuntu5.5
- apparmor 5.0.2-0ubuntu1~26.04.1
+ [Where problems could occur]
- Related: LP: #2160129 (the SRU that changed the mapping; verified on an
- AMD SEV-SNP host, where the memory mapping is intended).
+ The change affects only AppArmor permissions generated for ROM loaders.
+ These loaders are read-only, so granting them readonly access preserves the
+ existing restriction on writable access to protected firmware paths. Other
+ loader types and their readonly settings are unchanged.
+
+ [Other Info]
** Changed in: libvirt-hwe (Ubuntu Stonking)
Status: Invalid => Fix Released
** Changed in: libvirt (Ubuntu Stonking)
Status: Invalid => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169887
Title:
UEFI guests without nvram fail to start after edk2 2025.11-3ubuntu7.2:
autoselect picks memory-mapped amdsev firmware, virt-aa-helper rejects
it
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2169887/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
