Skip to content

Commit

Permalink
domain: Disable secure boot feature
Browse files Browse the repository at this point in the history
During debugging of OKD bundle test on github runner, found out that
`AMD EPYC 7763 64-Core Processor` which runner uses for VM environment
doesn't support secure boot and vm creation failed with following error.

With this PR we are explictly disable the secure boot as feature when `uefi` is
enabled.

```
EFI stub: UEFI Secure Boot is enabled.
KVM: entry failed, hardware error 0xffffffff
EAX=00000000 EBX=be203d38 ECX=00000000 EDX=000000b2
ESI=ff98a000 EDI=00000058 EBP=0000000c ESP=be203ca8
EIP=00008000 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=1 HLT=0
ES =0000 00000000 ffffffff 00809300
CS =be00 7ffbe000 ffffffff 00809300
SS =0000 00000000 ffffffff 00809300
DS =0000 00000000 ffffffff 00809300
FS =0000 00000000 ffffffff 00809300
GS =0000 00000000 ffffffff 00809300
LDT=0000 00000000 00000000 00000000
TR =0040 00003000 00004087 00008b00
GDT=     00001000 0000007f
IDT=     00000000 00000000
CR0=00050032 CR2=f3401000 CR3=0025c002 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=qemu-system-x86_64: ../../hw/core/cpu-sysemu.c:77: cpu_asidx_from_attrs: Assertion `ret < cpu->num_ases && ret >= 0' failed.
2024-07-23 12:13:58.568+0000: shutting down, reason=crashed
```

also
dockur/windows#231 (comment)
suggest that it can also happen with old intel hardware and I tried to
disable the `tdp_mmu` on this AMD hardware but that didn't fix it.

commands to used to disable `tdp_mmu`
```
$ sudo modprobe -r kvm_amd
$ sudo modprobe -r kvm
$ sudo modprobe kvm tdp_mmu=0
$ sudo modprobe  kvm
$ sudo modprobe kvm_amd
$ sudo cat /sys/module/kvm/parameters/tdp_mmu
N
```
  • Loading branch information
praveenkumar committed Jul 25, 2024
1 parent 894e1d0 commit d8e6e93
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 0 deletions.
8 changes: 8 additions & 0 deletions pkg/libvirt/domain.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,14 @@ func domainXML(d *Driver, machineType string) (string, error) {
},
OS: &libvirtxml.DomainOS{
Firmware: "efi",
FirmwareInfo: &libvirtxml.DomainOSFirmwareInfo{
Features: []libvirtxml.DomainOSFirmwareFeature{
{
Name: "secure-boot",
Enabled: "no",
},
},
},
Type: &libvirtxml.DomainOSType{
Type: "hvm",
},
Expand Down
3 changes: 3 additions & 0 deletions pkg/libvirt/domain_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ func TestTemplating(t *testing.T) {
<vcpu>4</vcpu>
<os firmware="efi">
<type machine="q35">hvm</type>
<firmware>
<feature enabled="no" name="secure-boot"></feature>
</firmware>
<boot dev="hd"></boot>
<bootmenu enable="no"></bootmenu>
</os>
Expand Down

0 comments on commit d8e6e93

Please sign in to comment.