Bug#989040: linux-image-5.10.0-6-amd64: Missing CONFIG_AMD_MEM_ENCRYPT in kernel config makes SEV booting impossible

From	Louis Bouchard <lbouchard@scaleway.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#989040: linux-image-5.10.0-6-amd64: Missing CONFIG_AMD_MEM_ENCRYPT in kernel config makes SEV booting impossible
Date	2021-05-24 16:30 +0200
Message-ID	<CijKF-1XQ-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Package: src:linux
Version: 5.10.28-1
Severity: important

Dear Kernel team,

As previously reported in bug #959069 
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959069) for kernel 
5.5.0-2, the config parameter CONFIG_AMD_MEM_ENCRYPT is missing and, 
hence, booting an Debian Buster image in a SEV enabled VM is impossible.

No log may be provided as GRUB2 simply returns to the menu upon trying 
to boot the kernel.

Compilation of the kernel currently present in the testing pocket with 
this option enabled allows the kernel to boot normally.

Please include this kernel parameter so Debian Buster may be booted out 
of the box in a SEV enabled VM.

Kind regards,

...Louis Bouchard

-- Package-specific info:
** Version:
Linux version 5.10.0-6-amd64 (debian-kernel@lists.debian.org) (gcc-10 
(Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 
2.35.2) #1 SMP Debian 5.10.28-1 (2021-04-09)

** Command line:
BOOT_IMAGE=/boot/vmlinuz-5.10.0-6-amd64 
root=UUID=2a32edc5-aef2-4dcc-93ee-9cd605341279 ro console=tty0 
console=ttyS0,115200 earlyprintk=ttyS0,115200 scsi_mod.use_blk_mq=Y

** Not tainted

** Kernel log:
[    1.157475] virtio_net virtio0 enp0s1: renamed from eth0
[    1.160360] ahci 0000:00:1f.2: version 3.0
[    1.161125] ahci 0000:00:1f.2: AHCI 0001.0000 32 slots 6 ports 1.5 
Gbps 0x3f impl SATA mode
[    1.162382] ahci 0000:00:1f.2: flags: 64bit ncq only
[    1.164175] scsi host1: ahci
[    1.164778] scsi host2: ahci
[    1.165438] scsi host3: ahci
[    1.166113] scsi host4: ahci
[    1.166971] scsi host5: ahci
[    1.167592] scsi host6: ahci
[    1.168067] ata1: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000100 irq 31
[    1.169210] ata2: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000180 irq 31
[    1.170158] ata3: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000200 irq 31
[    1.170983] ata4: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000280 irq 31
[    1.171765] ata5: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000300 irq 31
[    1.172612] ata6: SATA max UDMA/133 abar m4096@0x90000000 port 
0x90000380 irq 31
[    1.180922] sd 0:0:0:0: Power-on or device reset occurred
[    1.182051] sd 0:0:0:0: [sda] 19531250 512-byte logical blocks: (10.0 
GB/9.31 GiB)
[    1.182860] sd 0:0:0:0: [sda] 4096-byte physical blocks
[    1.183439] sd 0:0:0:0: [sda] Write Protect is off
[    1.183945] sd 0:0:0:0: [sda] Mode Sense: 63 00 00 08
[    1.183988] sd 0:0:0:0: [sda] Write cache: enabled, read cache: 
enabled, doesn't support DPO or FUA
[    1.185019] sd 0:0:0:0: [sda] Optimal transfer size 4194304 bytes
[    1.217913]  sda: sda1 sda14 sda15
[    1.219876] sd 0:0:0:0: [sda] Attached SCSI disk
[    1.485700] ata2: SATA link down (SStatus 0 SControl 300)
[    1.487349] ata3: SATA link down (SStatus 0 SControl 300)
[    1.488903] ata5: SATA link down (SStatus 0 SControl 300)
[    1.490509] ata6: SATA link down (SStatus 0 SControl 300)
[    1.492179] ata4: SATA link down (SStatus 0 SControl 300)
[    1.493897] ata1: SATA link down (SStatus 0 SControl 300)
[    1.671112] EXT4-fs (sda1): mounted filesystem with ordered data 
mode. Opts: (null)
[    1.760312] Not activating Mandatory Access Control as 
/sbin/tomoyo-init does not exist.
[    1.966827] systemd[1]: Inserted module 'autofs4'
[    2.018048] systemd[1]: systemd 241 running in system mode. (+PAM 
+AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP 
+GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN 
-PCRE2 default-hierarchy=hybrid)
[    2.023560] systemd[1]: Detected virtualization kvm.
[    2.024855] systemd[1]: Detected architecture x86-64.
[    2.044339] systemd[1]: Set hostname to <buster>.
[    2.324858] systemd[1]: Reached target Remote File Systems.
[    2.327595] systemd[1]: Started Forward Password Requests to Wall 
Directory Watch.
[    2.331404] systemd[1]: Reached target System Time Synchronized.
[    2.334587] systemd[1]: Listening on udev Kernel Socket.
[    2.337157] systemd[1]: Listening on Journal Socket (/dev/log).
[    2.340047] systemd[1]: Created slice system-getty.slice.
[    2.396217] EXT4-fs (sda1): re-mounted. Opts: discard,errors=remount-ro
[    2.407729] EXT4-fs (sda1): resizing filesystem from 2408634 to 
2408634 blocks
[    2.434805] systemd-journald[459]: Received request to flush runtime 
journal from PID 1
[    2.562550] input: Power Button as 
/devices/LNXSYSTM:00/LNXPWRBN:00/input/input4
[    2.571579] pstore: Using crash dump compression: deflate
[    2.572711] pstore: Registered efi as persistent store backend
[    2.575821] iTCO_vendor_support: vendor-support=0
[    2.581114] sd 0:0:0:0: Attached scsi generic sg0 type 0
[    2.581344] ACPI: Power Button [PWRF]
[    2.587588] iTCO_wdt: Intel TCO WatchDog Timer Driver v1.11
[    2.588563] iTCO_wdt: Found a ICH9 TCO device (Version=2, TCOBASE=0x0660)
[    2.590081] iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)
[    2.673312] cryptd: max_cpu_qlen set to 1000
[    2.693446] AVX2 version of gcm_enc/dec engaged.
[    2.694017] AES CTR mode by8 optimization enabled
[    2.756485] audit: type=1400 audit(1621865258.312:2): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="nvidia_modprobe" pid=649 comm="apparmor_parser"
[    2.761170] audit: type=1400 audit(1621865258.312:3): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="nvidia_modprobe//kmod" pid=649 comm="apparmor_parser"
[    2.764402] audit: type=1400 audit(1621865258.312:4): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="/usr/bin/man" pid=651 comm="apparmor_parser"
[    2.765859] audit: type=1400 audit(1621865258.312:5): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="man_filter" pid=651 comm="apparmor_parser"
[    2.767260] audit: type=1400 audit(1621865258.312:6): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="man_groff" pid=651 comm="apparmor_parser"
[    2.768634] audit: type=1400 audit(1621865258.320:7): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="/usr/sbin/chronyd" pid=648 comm="apparmor_parser"
[    2.770171] audit: type=1400 audit(1621865258.324:8): 
apparmor="STATUS" operation="profile_load" profile="unconfined" 
name="/usr/sbin/tcpdump" pid=650 comm="apparmor_parser"
[    3.100486] kvm: Nested Virtualization enabled
[    3.101081] SVM: kvm: Nested Paging enabled
[    3.107514] Huh? What family is it: 0x19?!
[    3.235120] Huh? What family is it: 0x19?!
[    3.416476] Huh? What family is it: 0x19?!
[    3.505039] Huh? What family is it: 0x19?!
[    3.593569] Huh? What family is it: 0x19?!
[    3.726588] Huh? What family is it: 0x19?!
[    3.795710] Huh? What family is it: 0x19?!
[    3.856692] Huh? What family is it: 0x19?!
[    3.954905] Huh? What family is it: 0x19?!
[    4.018895] Huh? What family is it: 0x19?!
[    4.116992] Huh? What family is it: 0x19?!
[    4.189389] Huh? What family is it: 0x19?!
[    4.275866] Huh? What family is it: 0x19?!
[    4.357935] Huh? What family is it: 0x19?!
[    4.470680] Huh? What family is it: 0x19?!
[    4.635505] Huh? What family is it: 0x19?!
[    4.687180] Huh? What family is it: 0x19?!
[    4.766865] Huh? What family is it: 0x19?!
[    4.865686] Huh? What family is it: 0x19?!
[    4.958866] Huh? What family is it: 0x19?!
[    5.027576] Huh? What family is it: 0x19?!
[    5.070738] Huh? What family is it: 0x19?!
[    5.171539] Huh? What family is it: 0x19?!
[    5.275379] Huh? What family is it: 0x19?!
[    5.375461] Huh? What family is it: 0x19?!
[    5.478819] Huh? What family is it: 0x19?!
[    5.572316] Huh? What family is it: 0x19?!
[    5.650784] Huh? What family is it: 0x19?!
[    5.714844] Huh? What family is it: 0x19?!
[    5.766747] Huh? What family is it: 0x19?!
[    5.799251] Huh? What family is it: 0x19?!
[    5.839227] Huh? What family is it: 0x19?!

** Model information
sys_vendor: Scaleway
product_name: SCW-ENT1-L
product_version: pc-q35-3.0
chassis_vendor: QEMU
chassis_version: pc-q35-3.0
bios_vendor: EFI Development Kit II / OVMF
bios_version: 0.0.0

** Loaded modules:
kvm_amd
ccp
rng_core
kvm
irqbypass
crc32_pclmul
ghash_clmulni_intel
aesni_intel
libaes
nls_ascii
crypto_simd
nls_cp437
cryptd
vfat
glue_helper
fat
iTCO_wdt
intel_pmc_bxt
sg
joydev
evdev
iTCO_vendor_support
serio_raw
watchdog
efi_pstore
qemu_fw_cfg
button
efivarfs
ip_tables
x_tables
autofs4
ext4
crc16
mbcache
jbd2
crc32c_generic
sd_mod
t10_pi
crc_t10dif
crct10dif_generic
ahci
libahci
libata
virtio_net
net_failover
virtio_scsi
failover
crct10dif_pclmul
psmouse
scsi_mod
crct10dif_common
virtio_pci
crc32c_intel
virtio_ring
i2c_i801
lpc_ich
i2c_smbus
virtio

** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation 82G33/G31/P35/P31 Express 
DRAM Controller [8086:29c0]
	Subsystem: Red Hat, Inc QEMU Virtual Machine [1af4:1100]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0

00:01.0 Ethernet controller [0200]: Red Hat, Inc Virtio network device 
[1af4:1000]
	Subsystem: Red Hat, Inc Virtio network device [1af4:0001]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 21
	Region 0: I/O ports at 60a0 [size=32]
	Region 1: Memory at 90002000 (32-bit, non-prefetchable) [size=4K]
	Region 4: Memory at 2800000000 (64-bit, prefetchable) [size=16K]
	Expansion ROM at 90080000 [disabled] [size=512K]
	Capabilities: <access denied>
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci

00:02.0 SCSI storage controller [0100]: Red Hat, Inc Virtio SCSI [1af4:1004]
	Subsystem: Red Hat, Inc Virtio SCSI [1af4:0008]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 22
	Region 0: I/O ports at 6040 [size=64]
	Region 1: Memory at 90001000 (32-bit, non-prefetchable) [size=4K]
	Region 4: Memory at 2800004000 (64-bit, prefetchable) [size=16K]
	Capabilities: <access denied>
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci

00:1f.0 ISA bridge [0601]: Intel Corporation 82801IB (ICH9) LPC 
Interface Controller [8086:2918] (rev 02)
	Subsystem: Red Hat, Inc QEMU Virtual Machine [1af4:1100]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Kernel driver in use: lpc_ich
	Kernel modules: lpc_ich

00:1f.2 SATA controller [0106]: Intel Corporation 82801IR/IO/IH 
(ICH9R/DO/DH) 6 port SATA Controller [AHCI mode] [8086:2922] (rev 02) 
(prog-if 01 [AHCI 1.0])
	Subsystem: Red Hat, Inc QEMU Virtual Machine [1af4:1100]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 31
	Region 4: I/O ports at 6080 [size=32]
	Region 5: Memory at 90000000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: ahci
	Kernel modules: ahci

00:1f.3 SMBus [0c05]: Intel Corporation 82801I (ICH9 Family) SMBus 
Controller [8086:2930] (rev 02)
	Subsystem: Red Hat, Inc QEMU Virtual Machine [1af4:1100]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- 
Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- 
<MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 16
	Region 4: I/O ports at 6000 [size=64]
	Kernel driver in use: i801_smbus
	Kernel modules: i2c_i801


** USB devices:
not available


-- System Information:
Debian Release: 10.9
   APT prefers testing
   APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-6-amd64 (SMP w/32 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 
(charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages linux-image-5.10.0-6-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.133+deb10u1
ii  kmod                                    26-1
ii  linux-base                              4.6

Versions of packages linux-image-5.10.0-6-amd64 recommends:
ii  apparmor             2.13.2-10
ii  firmware-linux-free  20200122-1

Versions of packages linux-image-5.10.0-6-amd64 suggests:
pn  debian-kernel-handbook               <none>
pn  grub-pc | grub-efi-amd64 | extlinux  <none>
pn  linux-doc-5.10                       <none>

Versions of packages linux-image-5.10.0-6-amd64 is related to:
pn  firmware-amd-graphics     <none>
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
pn  firmware-iwlwifi          <none>
pn  firmware-libertas         <none>
pn  firmware-linux-nonfree    <none>
pn  firmware-misc-nonfree     <none>
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#989040: linux-image-5.10.0-6-amd64: Missing CONFIG_AMD_MEM_ENCRYPT in kernel config makes SEV booting impossible Louis Bouchard <lbouchard@scaleway.com> - 2021-05-24 16:30 +0200
  Bug#989040: marked as done (linux-image-5.10.0-6-amd64: Missing  CONFIG_AMD_MEM_ENCRYPT in kernel config makes SEV booting impossible) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-08-10 09:10 +0200
  Bug#989040: marked as done (linux-image-5.10.0-6-amd64: Missing  CONFIG_AMD_MEM_ENCRYPT in kernel config makes SEV booting impossible) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-08-10 09:10 +0200

csiph-web